Security events and findings
Events, detections, findings, ingest tokens and the ingest dead-letter queue.
List detections
List detections
List fixtures
List fixtures
Detection detail
Detection detail
Tune detection
Tune detection
Test detection
Evaluate the rule IN MEMORY - over a labelled synthetic fixture, or over this tenant's recent real events. The ONLY thing persisted is
List events
List events
Export events
≤ 50 000 rows, same filters as the list. Needs `export_evidence` AND tenant policy export.allow_evidence_export. Cells are masked
Event facets
Counts over the last 7 days (real events only), each facet capped at 50 values.
Event detail
Event detail
List findings
List findings
Finding detail
Finding detail
Accept finding risk
Accept the risk of a vulnerability / configuration finding for a limited time. Admin only (`accept_risk`). `expires_at` must be in the future and at most
Assign finding
Assign a finding to a person of THIS workspace whose role can see Security (`view_security`); `null` unassigns. Ledger `security.finding.assigned`.
Finding feedback
Analyst feedback feeds the rule's false_positive_rate. It never changes the finding's status or the rule by itself.
Finding to incident
Create an incident from this finding, or - with `incident_id` - link it to an existing one. Human action only.
List finding notes
List finding notes
Add finding note
A standalone analyst note on a finding (it changes nothing else). The ledger entry `security.finding.note` records the note id and length, not the text; the
Plan finding remediation
Record who fixes a finding and by when (owner of the same workspace whose role can see Security, due date not in the past, optional plan text). A person's
Rescan finding
Re-read the current inventory and re-run what produced the finding: a vulnerability finding is re-matched against the advisory data, a configuration
Set finding status
Resolution policy (docs/security/SECURITY_FINDINGS_AND_RISK.md): runtime findings keep the manual lifecycle, but `resolved` and `false_positive`
List tokens
List tokens
Create an ingest token
Create an `obt_` token for the [Ingest API](/docs/api/ingest/bairav-ingest-api). Requires the `manage_observability` permission.
Revoke token
Revoke token
List dead letters
Security-ingest events that validated but could not be stored (a processing failure, not a validation reject).
Replay dead letter route
Replay dead letter route
List investigations
What people are working on right now, from three existing tables (nothing is stored for it): findings in status `investigating`; incidents that are open
Overview
Everything on the Security landing page, from real tables. No number here is hard-coded; a count of zero is a real zero because
List sources
List sources
Triage activity
What PEOPLE did, newest first, merged from finding status changes (audit ledger), finding feedback, incident transitions, incident