Findings and remediation
Prioritize CVEs, assign owners, record exceptions, and close findings using verification.
Findings track assessment results independently from detections and incidents. A finding remains actionable until verification, an approved risk decision, or a documented false-positive review resolves it.
At Assessments → Findings, filter by asset owner, severity, exposure, CVE, exploit context, and state. Technical severity and asset risk serve different purposes: severity describes the weakness; risk prioritizes it in the current environment.
Triage and assign
Open Finding → Review. Confirm the affected package, service, version basis, credential coverage, and detector evidence. Select Assign owner, choose a due date, and record a remediation plan. Related observations can be grouped, but distinct affected assets keep their own verification state.
States are open, in_progress, pending_verification, resolved, accepted_risk, or false_positive. Accepting risk requires the designated risk-approval grant, a reason, owner, and expiry. False-positive decisions require supporting evidence; neither decision deletes the original observation.
Remediate and verify
Apply the vendor-supported patch or configuration change through the system's deployment workflow. Guard's guidance does not automatically patch production software. For temporary protection, link a scoped WAF rule or access restriction to the finding and record why it reduces exposure; mitigation is distinct from removing the vulnerable component.
At Finding → Verify, choose the approved scope and matching check profile. The finding enters pending_verification. It becomes resolved only when the affected check completes with sufficient coverage and no longer detects the condition. A failed or unauthenticated verification preserves the unresolved state. A recurring detection reopens the finding and records its new observation.
Reports and external tickets
At Finding → Integrations, link an external task by provider ID. Closing that ticket cannot substitute for a verification scan. An expired risk acceptance returns to review and remains visible in reports. Scan suppression uses a separately scoped exception; it must not manufacture a resolved result.