Findings

Findings is the one list of everything Vibgrate found that may need action. It is included in every plan. It holds drift, known vulnerabilities, and runtimes that are past end of life. Findings come from your latest scans.

What you'll see

• Severity — Critical, High, Medium, Low, or Info.
• Finding — a short title, and its type: Drift, Vulnerability, or End of life.
• Repository or package — where the finding is. For a vulnerability, this includes the package and version.
• Status — Open, Fix in progress, Dismissed, or Closed. A dismissed finding also shows why, and the date it opens again if you set one. An assigned finding shows who it is with: you, or someone else.
• First seen — when Vibgrate first found it. It shows "Not recorded" when the date is not known.
• Actions — what you can do with the finding.

The most severe findings come first.

How to use it

Use the status, type, and severity buttons, or the search box, to narrow the list. The list opens on Open findings. Choose To me to see only the findings assigned to you. The filters are part of the page address, so you can bookmark a filtered view or share it. Select a drift or end-of-life finding to open its repository, where the same list is limited to that repository.

On Overview, the Open findings card shows the most severe open findings you can access and links here with the same filters. Developer and tech lead views also show an Assigned to you card.

Dismiss, close, reopen, and assign

• Dismiss — choose a reason and write a note of at least 10 characters that says why. Your team sees the note in the history. You can set a date when the finding opens again. A dismissal can last one year at most. If the reason is "Risk accepted" and you set no date, the finding opens again after 90 days.
• Close — mark a finding as done.
• Reopen — move a dismissed or closed finding back to Open.
• Assign to me, Assign to…, and Unassign — take a finding, give it to a colleague, or give it up. The list of colleagues shows only people who can see the repository, and you can search it by name or email.
• Request a fix (Business plan and higher) — create a remediation task for the finding and mark the finding Fix in progress. Asking again returns the same task. Closing the task does not close the finding. The finding closes when a later scan no longer reports it, or when someone closes it.

Each change is saved in the history, with who made it and when. A change applies to that finding on that repository only.

Good to know

• Findings from scans made before this release may not name a repository. They cannot be changed, and their row says so.
• You need permission to change findings, and you can change only findings in repositories your access covers. If a change is not saved, the page tells you why.
• The list shows the most severe findings first and can be cut short for a very large estate. The page says so when that happens. Narrow the filters to find the rest.
• You see only the repositories and applications your access covers.