Finding Article Overview

The platform provides multiple ways for you to add your own data to findings, including custom attributes and notes. You can also apply finding articles to findings if you need to provide more structured or more visual examples for other users. For example, you can write an article that provides configuration or patching steps with screenshots and attach additional documentation. You can create and apply finding articles from the Host Findings or Application Findings pages.

If you work as an analyst, you can write finding articles to provide more threat context. You can mark a finding article as a “proof of exploitation” (PoE) and apply it to one or more findings. The platform also allows you to prioritize the PoE by spotlighting it within the platform. You have the option to create a PoE that changes the VRR score of any associated finding to a 10.0 and alters the assignment of asset and organizational RS³ scores.

You can view the finding articles associated with a finding under the Finding Articles and References section of the Finding Details. This section gives you access to the finding article history and the full article.

To view the full article and its attachments, click View the Article. The platform opens a popup containing the full text and the attachments.

To perform any action on a finding article, you must have the appropriate privileges. “Read” privileges allow you to view the full text of an article and to download the attachments. “Modify” privileges enable creating finding articles, modifying them, deleting them, and applying them to findings. To see the full list of privileges, visit the Roles page within the platform.

An article can have one of two classifications: Unrestricted or Restricted. One set of privileges exists for each classification level. However, the Restricted privileges enable you to perform the same actions on both unrestricted and restricted articles.

Authors may want to mark articles as restricted if they contain sensitive information. For example, you may want to make a PoE or a list of asset identifiers available only to other users who can read restricted articles.

You must first have the correct privileges to create or update a finding article. Roles that grant these privileges include Vulnerability Manager, Security Analyst, Finding Article Owner, and Restricted Finding Article Owner.

Go to either the Host Findings page or the Application Findings page. Locate the Finding Articles menu.

To create an article, open up the Finding Articles menu and select CREATE. If you select one or more findings first, you will automatically apply your new article to those findings.

On the first step, you must

When you complete the first step, the platform creates a finding article with an empty body. The finding article will also become visible in the Finding Articles list.

In the next step, you will provide the body of the finding article. The markdown editor offers both a split-pane markdown editor with a preview and a full-size WYSIWYG editor.

To the right of the editor, you can upload attachments. Once you have uploaded an attachment, you can add it to the finding article by clicking on the file name or the link icon. Images show up directly within the editor. For other types of files, the editor will insert them as links.

Regardless of whether you insert attachment links directly into the article, users can still access any attachments from the full article view accessible from the Finding Details.

Note that the platform validates attachment links before it lets you submit. It may show an error message if the article contains

You can open up an article for editing from the Finding Articles menu or from the full finding article view.

To apply an article to a finding, first select the findings. Then open the Finding Articles menu and search for the article.

Check the box next to the article. Then select Apply. Your update will become visible in a few moments.

To remove a finding article from a finding, first select the findings. Then open the Finding Articles menu and search for the article.

Uncheck the box next to each finding article that you want to remove from these findings. Then select Apply.

If the finding article is informational, the article will show up in the Finding Articles and References section of the Finding Details.

If the finding article is a PoE, the PoE will show up in the Threats section of the Finding Details as well as the Finding Articles and References section. On the system dashboards, counts of weaponized findings will include findings associated with PoEs.

If a PoE has RS³ Impact, then the following occur:

The platform enables you to quickly locate any open findings that have a PoE with RS³ Impact. For example, the Ivanti RS³ widget on the Executive Dashboard shows warning indicators when the overall RS³ average includes one or more impacted assets. You can click the text Findings with proof of exploitation… to go directly to the open findings with the PoE.

The Groups, Hosts, and Applications list view shows similar warnings. On these pages, a warning indicator will appear in the RS³ column. The detail pane will provide more information and let you quickly navigate to the open findings with the PoE.

To reverse the effects of a PoE with RS³ Impact, you can either

Assume in these examples that you apply a PoE to open finding A on client A and on open finding B on client B. The visible outcomes can differ depending on the original RS³ score, the criticality of the impacted asset, and the number of assets included in the calculation.

On Client A, the overall RS³ score shows more change because the PoE with RS³ Impact limits how high the score can go: a max score of 549.