Working with findings
A finding is one issue on one asset. It keeps the same identifier — FND- followed by a hex string — for its entire life.
The findings list
Columns: severity, ID, title, asset, status, assignee, priority score, first seen and last observed.
Priority and severity are different. Severity is how bad the issue class is; priority is how urgently you should deal with this instance, factoring in exploitability, internet exposure, asset importance and age. Sort by priority when deciding what to do next. See How scores are calculated.
Filter by search text, status, severity, organization, asset and assignee — filters combine with AND. Sort by severity, priority, first seen, last observed or status.
Statuses and allowed transitions
| From | Can move to |
|---|---|
| Open | Acknowledged, In Progress, False Positive, Closed |
| Acknowledged | In Progress, Closed, False Positive |
| In Progress | Closed, Risk Accepted, False Positive |
| Closed | Open |
| Risk Accepted | Open |
| False Positive | Open |
Anything not in this table is rejected.
Two consequences worth knowing:
- Risk Accepted is only reachable from In Progress. You cannot accept a risk straight from Open — someone has to pick the finding up first. This is deliberate: risk acceptance should follow investigation, not replace it.
- Risk Accepted and False Positive cannot go directly to Closed. Reopen them first.
Moving to Closed or False Positive records a closure timestamp and reason; reopening clears both. Every change is written to an append-only event log with the actor and reason.
The detail panel
Click a finding to see its description and remediation guidance, the affected asset, first and last seen timestamps, occurrences (each time a scan observed it), assignments, and the full event timeline.
Assigning work
Assign a finding to a colleague with an optional due date. Assignees with the Remediator role see only their assigned findings and those findings' assets — nothing else in the workspace.
Select up to 100 findings at a time for bulk status changes or bulk assignment.
Rescanning
Findings found by a scan have a Rescan button. It re-runs only the relevant checks against that asset.
Perimeter polls for the result and tells you one of three things: the rescan is still running; the issue is still present; or the signal is gone — in which case it offers a Close case action.
Findings imported from an external source cannot be rescanned. Their state comes from the next import.
Automatic closure
You don't have to close everything by hand. When a full scan runs and a previously-seen finding is no longer observed, Perimeter closes it and records why:
- Not observed in scan — a full scan no longer saw it.
- Remediated or not observed — a targeted rescan no longer saw it.
- No longer present in source — it disappeared from an external import.
Findings are never deleted. A closed finding that reappears is reopened against the same record, so the history of a recurring problem stays in one place.
SLA
Each finding gets a deadline based on severity. Defaults are 72 hours for critical, 7 days for high, 30 days for medium and 90 days for low. Informational findings use the low target.
Your dashboard has an SLA At Risk card. Administrators can set custom per-organization targets.