View findings
Select Findings from the left navigation menu to view all policy violations detected across your monitored domains. Select the Portfolio dropdown to filter findings by portfolio. Summary cards at the top of the page show:
Total Findings: The total count of active findings across your account.
High: The count of high-severity findings.
Medium: The count of medium-severity findings.
Low: The count of low-severity findings.
The findings table includes the following columns:
Finding: The name of the policy violation. Select to open the Finding details panel.
Policy: The policy that surfaced the finding.
Principle: The security principle the policy belongs to.
Domain: The domain the finding was detected on. Select to open the domain’s detail view.
Portfolio: The portfolio the domain is assigned to.
Ticket: The linked ticket, if one has been created.
Status: The current state of the finding.
Severity: The severity of the finding (Critical, High, Medium, or Low). See Investigate and remediate findings for severity definitions.
Posture impact: The number of posture score points deducted by this finding.
Last observed: The date and time the finding was last detected. Relative to the most recent scan of the domain or portfolio the domain belongs to.
Select a finding in the Finding column to open the Finding details panel. The panel shows the finding's details and raw evidence across 2 tabs: Details and Evidence. For policy-specific context, see Policy guidance.
The Details tab shows the following fields:
Domain: The domain the finding was detected for.
Record Name: The DNS record name associated with the finding.
Record Type: The DNS record type (for example, TXT).
Policy: The policy that surfaced the finding.
Principle: The security principle the policy belongs to.
Severity: The severity badge for the finding.
Posture impact: The number of posture score points deducted by this finding.
Confidence: The confidence level of the finding result.
Below the fields, an evidence table shows the Record Name, Record Type, Record Value, and Details for the specific DNS signal that triggered the finding. The tab also includes the following sections:
Why it matters: A plain-language explanation of the security impact of the finding.
Recommendations: Actionable steps to address the finding. See Remediate a finding to act on these steps.
The Evidence tab displays the raw signal data collected during the scan as a JSON payload. Copy copies the raw signal data to the clipboard.