Findings

Findings is where individual security-control results live: filter and bulk-triage the list, then open one to see its full history, evidence, and lifecycle — status, ownership, exceptions and disputes.

What’s on the page

The list page has a filter form (severity, status, check id — all deep-linkable, so you can bookmark or share a filtered view) and a table: severity, finding title and check id, asset, region, status, last seen, and recurrences. Pagination is cursor-based, and your filters carry over to the next page.

If your role can triage, the table gains a selection checkbox, an owner column, a due-date column, and a toolbar for bulk actions once you’ve selected at least one row.

Opening a finding shows severity and status pills (plus “Disputed” or “Removed target” where they apply), a fact grid (asset, region, first/last seen, recurrences, pillar), a triage card, a governance card for exceptions and disputes (only rendered when there’s something to show), why the finding matters, how to fix it, and the evidence CloudCerta collected at scan time.

What you can do

The interface hides controls you can’t use, but every action is re-checked by the API regardless of what the screen shows.

Triage (change status, assign, set a due date, comment): Owner, Admin or Engineer. Others get a read-only view of the same information.
File a dispute: Owner, Admin or Engineer.
Accept risk, suppress, mark not applicable, or decide a dispute: Owner or Admin only.

Status can’t be set freely from the dropdown: from Open you can move to In progress or Resolved; from In progress to Open or Resolved; from Resolved back to Open. Resolving always requires a short resolution note. Stale, Not applicable, Accepted risk and Suppressed are reached only through the exception flow, not the status dropdown, and an exception can only be opened from Open or In progress. Accepted-risk and Suppression exceptions require an expiry date; a reason is always required.

Bulk actions cover status changes to Open/In progress, assigning an owner, and setting a due date for everyone selected; Owner/Admin can additionally suppress the selection (reason and expiry required). Resolving isn’t offered as a bulk action, because it requires a resolution note per finding. Each row in a bulk action reports its own result — applied, conflicted, not found, or not a legal transition — never a single pass/fail for the whole batch.

How to read it

Recurrences isn’t a detection counter. It only increases when a finding that was Resolved, Stale or Not applicable comes back on a later scan — a finding that stays Open scan after scan keeps a recurrence count of 1, because it never left.
Every change carries the version you last loaded. If someone else changed the same finding first, you’ll see a message asking you to refresh rather than silently overwriting their change.
Confirming a dispute suppresses the finding for a long default horizon (currently ten years) — it’s a real suppression exception, not a quiet status flip.
If a finding’s owner is removed from your team, the finding shows “Owner removed” rather than pointing at someone who no longer has access.
Evidence distinguishes “not configured” (AWS reported the setting is genuinely absent) from “couldn’t read it” (a permission or rate-limit problem) — the two are never shown the same way, because a permission gap is not a finding about your configuration.
If the check behind a finding has since been retired from the check pack, the detail page says so directly rather than showing broken or missing guidance.

Before your first scan

With no findings and no filters applied: “No findings yet. Connect a target and run a scan — findings appear once a scan completes.” If filters are applied and nothing matches, the message is different — it tells you to clear your filters rather than implying there’s nothing to find at all.