Findings, carry-forward and dismissals

What a finding shows

Severity as a word (High, Medium, Low; the CVSS number stays on the card), where it was found (the host and the check), the title, why it matters, the next action (for a KEV entry, CISA's deadline and the published fix as numbered steps), an evidence list, and two actions: Mark as done and Ask NHM.

In the app, Simple view says what the finding means in plain words and folds the technical rows behind "Show the technical detail"; Advanced keeps the CVSS rail, the source line and the evidence. Switch under Account, Settings, Appearance, App detail. Simple hides no finding.

Carry-forward

A scheduled scan runs fewer tools than a deep scan. Without carry-forward, the morning after a deep scan a domain could read "0 high", not because anything was fixed but because the tool that found it did not run again. Findings therefore persist until a scan that ran the same check either re-finds them or does not; each is labelled with the date it was last checked.

Marking done

"Mark as done" asks why:

All four reasons are dismissals and behave the same way; the reason is kept for the record (Fixed means you dealt with it, False positive means the scanner was wrong). Marking a finding Fixed does not ask the next scan to re-check it: if the problem is still there, the finding stays hidden until you restore it, so only choose Fixed once you have confirmed the fix. A dismissal is keyed to what the result is (its stable key from the scan result), not its row id, so it survives re-scans. It applies to one domain when a domain is given, and to the whole account when none is. Dismissals cover three kinds: a scan finding, a software inventory reading, and a KEV/CVE alert.

• Web: the finding's Mark as done (under Fixes or on a domain's Overview tab). Dismissed software readings are restored under Software, Scan readings; dismissed advisories from Manage advisories on an application's page.
• iOS: Monitoring, Software, Advisories, hosts and network targets, Watchlist, Dismissed to see and restore.
• API/MCP: GET/POST /api/vuln-scan/dismissals (?kind=finding|component|alert), DELETE /api/vuln-scan/dismissals/:id; tools list_vuln_dismissals, dismiss_vuln_finding (kind, target_key, reason, optional domain_id, label, note), restore_vuln_dismissal.

Restoring

Undoing a dismissal makes the finding, reading or alert report again on the next read. Nothing is deleted by a dismissal; the record and the reason stay in the account for audit.

Where this comes from (Advanced view)

Under the list: how many domains were compared, how many products are on the watchlist, how many open services were seen, and when the last deep scan ran. Anything nothing has measured shows a dash.

Common questions

A finding disappeared without me touching it. A scan that ran the same check did not find it again, so it is treated as fixed. A lighter scan cannot clear it (see carry-forward above); the last-checked date says which scan looked.

Can I dismiss for the whole account? Omit the domain when dismissing. A scan finding's key includes the host it was found on, so even an account-wide dismissal of a finding only matches that host.