Triage & Risk Acceptance — Shieldome Docs

The triage queue

Every new finding lands in the triage queue — findings that have not yet been reviewed. The queue is accessible from the Findings tab in the top navigation. Findings are sorted by severity by default (Critical first). Use the queue to work through findings systematically and ensure nothing is missed.

💡

Press g anywhere in the app (or click Search in the nav) to open the global search and find findings across all scans instantly.

Marking findings

Each finding supports three dispositions:

Disposition	When to use	Effect
Open	Default — needs attention	Stays in triage queue; counts toward risk score
False Positive	Finding is incorrect — the vulnerability doesn't exist	Removed from queue; excluded from risk score; suppressed in future scans
Accepted Risk	Vulnerability is real but the risk is accepted	Removed from queue; still shown in compliance view; tracked in MTTR

To change a disposition, click the finding to open its detail panel, then click the Mark as False Positive or Accept Risk button. Add a note in the comment field to document the reasoning.

Bulk triage

For efficiency, use bulk selection to triage multiple findings at once:

Check the checkbox at the left of each finding row to select it
Use the checkbox in the table header to select all visible findings
Click Bulk Accept or Bulk False Positive in the action bar that appears
Add an optional batch note that applies to all selected findings

ℹ️

Bulk actions apply only to the currently filtered view. Use filters first to narrow to a specific category or severity before bulk-selecting.

Notes and comments

Every finding has a free-text notes field. Use it to record:

Why a finding was marked false positive (e.g., WAF rule already blocks this)
Ticket or issue tracker references (e.g., "JIRA-1234")
Risk acceptance rationale for audit trails
Assigned owner and expected remediation date

Notes are included in PDF exports and in the GET /api/scan/{id} JSON response as finding.notes.

MTTR tracking

Shieldome tracks Mean Time to Remediate automatically. For each finding, the system records:

Field	Description
`first_seen`	Timestamp of the scan where the finding first appeared
`last_seen`	Timestamp of the most recent scan where the finding was still present
`resolved_at`	Timestamp of the scan where the finding no longer appeared (auto-set)
`mttr_days`	Days between `first_seen` and `resolved_at`

The MTTR dashboard (Findings → MTTR tab) shows average remediation time broken down by severity and category. Use this to identify which finding types take longest to fix and prioritize process improvements.

Saved filters

Filter combinations (severity, category, disposition, tag, date range) are automatically persisted in localStorage so your view is restored on next visit. To reset all filters, click Clear filters at the top of the findings list.

Risk acceptance hygiene

Risk acceptance is a formal decision, not a way to clear the queue. Good practices:

Always add a note explaining why the risk is acceptable
Set a review date — revisit accepted risks on a defined schedule
Never accept Critical findings without documented approval from a security lead
Re-evaluate accepted risks after major architecture changes or new threat intelligence