Finding schema

Fields

id

Stable, opaque identifier.

check_id

The engine check that produced this finding.

asset_id

The affected asset.

severity

Final score, 0–10.

state

open, acknowledged, in_progress, closed, suppressed.

evidence_refs

Pointers into the evidence layer.

Lifecycle states

1. open — detected, awaiting triage.
2. acknowledged — someone owns it.
3. in_progress — a remediation is underway.
4. closed — a fresh check confirmed it is gone.
5. suppressed — explicitly ignored with a recorded reason.