Findings and proof

A finding is a normalised, deduplicated result. It is the pivot every connector produces into and every consumer reads from. A finding carries:

• severity - critical, high, medium, low, info.
• category - what kind of issue it is.
• confidence - how sure the pipeline is.
• status - its triage state.
• a dedup_key - what makes two sightings the same finding.

Occurrences

An occurrence is one sighting of a finding in one run. The findings row is the canonical, merged record; occurrences are its history.

Proof

Proof is the evidence that a finding is real. It comes in three strengths:

• proven - a reproducible exploit was executed.
• evidence - supporting evidence short of a full reproduction.
• reproducer - the steps to reproduce.

The rule that follows from the proof-driven principle: no HIGH or CRITICAL exploitation finding is reportable unproven. Deterministic detections (SCA, secrets, misconfiguration, licences) are delivered as-is, because the detection is itself the proof.

Noise and suppression

• Noise is candidates filtered out before they ever become findings, counted separately so nothing is hidden silently.
• Suppression is your triage decision to mute a finding, rule, endpoint or category, recorded with a verdict.