Findings dashboard

What it is

A continuously-updated feed of every AI-verified finding the engine has confirmed across your workspace. Default sort is “newest first × severity-weighted”, so the row you should look at is the first one.

What it produces

Per finding:

• Severity (critical / high / medium / low / info)
• Kind (sqli, default-credentials, auth-bypass, ssrf, etc.)
• Service / host / target identifiers
• The exploit-run ID for the cinematic replay
• Triage state (admin-only: pending, confirmed, rejected)
• KEV / CVE badges when the finding came from CVE validation

What to use it for

• Daily triage queue for the security team
• Filtering by company for MSSP reporting
• Filtering by agent for internal-surface review
• Generating per-target reports for handoff

Why it matters

Most security tools generate “findings” by version-string matching without proving anything, and bury the real ones in noise. The findings dashboard only lists outcomes the AI engine confirmed with a working PoC (or that a deterministic check like default- logins matched). Every row is real.

Why it’s valuable

• Every row is real. No “potentially vulnerable” entries: only validated chains and deterministic matches.
• Filterable by every axis. Severity, kind, company, agent, internal/external, age (all token-grammar-driven).
• Linked to a replay. Every row has a “View replay” button that opens the full step-by-step cinematic.
• Admin triage. Triagers can mark a finding rejected (with a rationale); operators see clean state by default.

How to use it

• Click Findings in the left nav.
• Default view is “everything not rejected, sorted by severity × age.”
• Search:

  severity:critical kev:true     # critical KEVs only
  agent:prod-bastion             # findings on one agent's surface
  kind:sqli company:Acme         # SQLi for one company
  internal:true compromised:true # internal services we've proved
  

For Slack: /umbra findings critical (severity word) or /umbra findings kind:sqli internal:true (token grammar).