Skip to main content

Discovery findings

Findings are the actionable output of discovery. Every scan produces zero or more findings per endpoint: weak ciphers, deprecated TLS, expiring certificates, self-signed, PQC vulnerabilities. Each has a severity, a suggested remediation, and a status you can advance (open → acknowledged / suppressed / resolved).

Finding types​

TypeSeverityMeaning
expiring_soonHigh (<30 d), Critical (<7 d)Certificate's not_after is close.
expiredCriticalPast not_after.
weak_cipherHighHandshake negotiated a cipher suite on the weak-cipher blocklist (RC4, 3DES, export).
weak_cipher_acceptedHighCipher enumeration found the endpoint accepts a weak suite even if it prefers a stronger one — a downgrade-capable client can still negotiate it. Endpoint-scoped (host:port:SNI).
deprecated_tlsHigh (TLS 1.0/1.1), Medium (TLS 1.2 with weak kex)TLS version below the configured minimum.
weak_keyHighRSA key smaller than 2048 bits. RSA-2048 is not flagged.
self_signedMediumCert's issuer CN equals its subject CN.
untrusted_chainMediumIssuer not in the default trust store; could be an internal CA.
pqc_vulnerableMediumKey algorithm classed as vulnerable by the PQC analysis (RSA < 2048).
sni_required_endpointMedium (0 certs), Info (some found)An IP:port rejects SNI-less handshakes — certs are only reachable with a server name. A visible blind spot; consider an AXFR source.
ingress_default_certLowThe IP:port serves a placeholder/fake default certificate (ingress/LB) for unknown SNI.
sni_hidden_certsInfoMultiple distinct certs are served on one IP:port by SNI (explains why endpoint count exceeds IP count).
missing_sctLowLeaf cert has no embedded SCTs — browser may warn.
short_validityInformationalValidity under 30 days remaining at observation time.
name_mismatchHighEndpoint hostname not covered by any SAN.
chain_integrityMediumIntermediate in the presented chain is incomplete or broken.

Severity levels​

  • Critical — act now; service may already be broken.
  • High — act this week; active security concern.
  • Medium — backlog.
  • Low — advisory.
  • Informational — tracked for awareness; no score impact.

Finding lifecycle​

  1. Open — freshly generated by a scan.

  2. Acknowledged — operator has seen it; working on remediation. Adds a changed by + note field.

  3. Resolved — closed as fixed, two ways. The platform resolves a finding on its own when the underlying issue is no longer detected by a scan (resolved auto), or an operator marks it Resolved manually. Either way, if the issue is re-detected later the finding reopens automatically (history preserved, with a note saying which closure regressed). CT-log findings are never auto-resolved (certificates never leave a CT log) — close them with Resolve, Acknowledge or Suppress; for CT findings a manual resolve is effectively permanent.

    :::note Debounced auto-resolution A few findings rest on a best-effort probe that can briefly read "clear" on a single slow or lossy scan — legacy-TLS support (supports_tls10 / supports_tls11) and blast radius. To stop these from flickering open→resolved→open across scans, the platform waits until the issue has stayed undetected for about a day before auto-resolving them. A genuinely fixed endpoint still clears on its own within that window; only a transient one-scan blip is held back. All other finding types auto-resolve on the next clean scan as before. :::

  4. Suppressed — operator accepts the risk; the finding won't reappear on subsequent scans for this cert + type.

Working with findings​

  1. Discovery → Findings.
  2. Default view: open findings sorted by severity DESC.
  3. Filters: severity, type, discovered cert, endpoint, source, status.
  4. Click a row for the full context — the cert, the endpoint(s), the suggested remediation.
  5. Update status from the detail panel. Add a note; it is audit-logged.

Summary widget​

The Discovery overview page summarises findings:

  • Counts by severity (open only).
  • Top 5 finding types by volume.
  • Trend line — new findings per day over 30 days.

Sparkline helps spot sudden spikes — e.g. a misconfigured firmware rollout that enables a weak cipher fleet-wide.

Remediation hints​

Every finding ships with a remediation blob:

  • expiring_soon / expired → adopt the cert into management and enable auto-renew, or ask the owning team to rotate.
  • weak_cipher / deprecated_tls → reconfigure the endpoint's TLS policy; link to the target's vendor docs.
  • self_signed → replace with a CA-signed cert unless intentional.
  • pqc_vulnerable → roll to ECDSA P-256/P-384 or RSA-3072+ until post-quantum is ready.

Remediation text is static — you can't customise it per-org, but the status/note fields absorb org-specific guidance.

Notifications​

Findings can route through the notification system:

  • discovery.new_cert / discovery.cert_changed — inventory changes that typically carry new findings.
  • discovery.cert_expiring — expiry-window alert for a discovered certificate.
  • discovery.scan.completed — scan run finished, with aggregate new-finding counts.

Troubleshooting​

Finding I resolved keeps reopening​

The underlying issue isn't actually fixed. Re-check the endpoint; or if the scanner is wrong, use Suppress instead of Resolve until the scanner is corrected.

False-positive on untrusted_chain​

You use an internal CA the scanner doesn't trust. Either add the CA to the backend's system trust store, or mark the finding suppressed with a note explaining the policy.

See also​