Findings

Overview

A Finding is a record of a policy violation against an auth asset. Every time a scan runs and a policy’s rule matches an asset, OrgGuard creates or updates a Finding. Findings are how you see what needs attention, who’s responsible, and what’s been done about it.

Findings have a lifecycle: Open → Acknowledged → Resolved (or Suppressed). OrgGuard auto-resolves a finding when the underlying issue goes away (e.g. a certificate is renewed before expiry). You can also manually update status, assign findings to users, and add resolution notes.

Who this page is for

Anyone who responds to governance alerts — security admins, platform owners, integration engineers. Policy authors should read Policies instead.

The Findings experience is two screens:

• Findings Overview (Dashboard) — severity and status metrics at a glance
• Findings List — the filterable, paginated table of every finding

Status changes and ownership edits happen on the individual Finding’s record page (click a row).

---

What you’ll see

Findings Overview (Dashboard)

Header: Findings Overview title, last-updated timestamp, Refresh button.

Main content:

• By Severity metrics — five tiles: Total Active, Critical, High, Medium, Low. “Active” means in Open or Acknowledged status — resolved and suppressed findings are excluded.
• By Status metrics — counts for each lifecycle state.
• By Finding Type — breakdown by finding type. The type list is data-driven and includes Expiring Soon, Expired, Missing Owner, Unknown Expiry, plus Inactive Owner and Consecutive Failures from Scheduled Job Health Monitoring. (Drift is a defined-but-unused finding type — no evaluator produces it in Pro 1.0, so it never appears in the breakdown.)

If no findings exist, an empty state appears — this is good news.

Findings List

Header: Security Findings title, last-updated timestamp, Refresh button. Auto-refreshes every 5 minutes.

Filter row:

• Status — checkbox group for Open / Acknowledged / Resolved / Suppressed. Default: Open + Acknowledged.
• Severity — checkbox group for Critical / High / Medium / Low. Default: all.
• Clear Filters — appears when Severity filter is non-default; resets to the initial view.

Data table — 9 columns:

Column	Notes
Finding Type	Data-driven: Expiring Soon, Expired, Missing Owner, Unknown Expiry, plus Inactive Owner and Consecutive Failures (Scheduled Job Health). Drift is a defined-but-unused type — no evaluator produces it in Pro 1.0
Severity	Color-coded: Critical/High = red, Medium = amber
Risk	Risk score (0–100) for the finding, color-bucketed by band
Status	Color-coded: Open = red, Acknowledged = amber, Resolved = green, Suppressed = gray
Asset	Name of the asset the finding is against
Asset Type	Certificate, Connected App, etc.
Assigned To	User the finding is assigned to, or “Unassigned”
Due Date	Color-coded: overdue / within 7 days = red, within 14 days = amber
First Detected	When the finding was first created

Click any row to open its Finding record page, where status and ownership are edited.

Pagination: 25 rows per page with Previous / Next and a “Showing X–Y of Z” label.

---

Common tasks

Task: Triage new findings after a scan

Who can do this: OrgGuard User. Prerequisites: A scan has just completed.

1. Open the Findings tab.
2. Leave the Status filter on its default (Open + Acknowledged).
3. Sort by Severity (click the column header) to see Critical findings first.
4. For each finding, click the row to open its record page.
5. Review the asset, finding type, and details; decide the next action (acknowledge, assign, resolve, or suppress).

Task: Export to CSV

Who can do this: OrgGuard User (read access to Finding__c). Prerequisites: At least one row in the current filter view.

1. Apply Status filters or search to narrow the list to the rows you want in the export.
2. Click Export CSV in the header.
3. Your browser downloads a file named orgguard-findings-YYYY-MM-DD.csv (UTF-8 encoded, comma-delimited).
4. Expected result: the CSV contains every row matching your current filters with one header row plus one data row per finding (asset, type, severity, status, due date, assignee, dates, details, resolution notes).

Caution

The button is disabled when no rows match the current filters. Hover over the button to see why; typical reason is filters too narrow. Clear or relax filters and try again.

Note

Exports are capped at 10,000 rows per call. For large remediation backlogs, narrow by Status or Severity to chunk the export.

Task: Acknowledge a finding

Use this when you’ve seen the alert and are working on a fix but it isn’t done yet. Acknowledgment stops the finding from being re-notified during the dedupe window. Acknowledgment is in-app only — there is no email acknowledge link.

Who can do this: OrgGuard User.

The fastest path is the one-click Acknowledge button on a certificate’s Findings tab:

1. Open the Inventory tab and click the certificate’s row to open its record page.
2. Open the Findings tab and locate the open finding.
3. Click Acknowledge on the finding.
4. Expected result: the finding moves to Acknowledged status; the Status cell turns amber and no repeat notifications fire until the dedupe window expires (see the policy’s Deduplication Window setting — default 24h).

You can also acknowledge from the finding’s record page:

1. Open the finding’s record page (click a row in the list).
2. Edit the record:
   • Set Status = Acknowledged.
   • Optional: fill in Assigned To if you know who’s responsible.
3. Click Save.

Task: Assign a finding to a user

1. Open the finding’s record page.
2. Edit Assigned To → search for and pick a Salesforce user.
3. Click Save.
4. Expected result: the Assigned To column on the list shows the user’s name.

Caution

Assignment does not automatically send a notification to the assignee. Notifications come from policies, based on the asset’s assigned Owner. Use assignment for tracking ownership in reports.

Task: Resolve a finding manually

Use when you’ve fixed the underlying issue but OrgGuard hasn’t detected it yet (next scan hasn’t run).

1. Open the finding’s record page.
2. Edit:
   • Status = Resolved.
   • Resolution Notes — describe what was done (e.g. “Certificate renewed 2026-04-10, Days_To_Expiry reset to 365.”).
3. Click Save.
4. Expected result: Status turns green. The finding is excluded from the Active metrics.

Task: Suppress a finding

Use when the finding is a known false positive or accepted risk. Suppressed findings don’t auto-resolve and are excluded from Active metrics and notifications.

1. Open the finding’s record page.
2. Edit:
   • Status = Suppressed.
   • Resolution Notes — document why suppression is intentional.
3. Click Save.
4. Expected result: Status turns gray. The finding stays suppressed permanently unless you change it back.

Task: Re-open a closed finding

If a Resolved or Suppressed finding needs attention again:

1. Open the record page.
2. Change Status back to Open (or Acknowledged).
3. Click Save.

The finding re-enters Active metrics and can re-trigger notifications on the next policy evaluation (respecting the dedupe window).

Task: Review only the things that need attention right now

1. On the Findings List, set filters:
   • Status: only Open
   • Severity: only Critical and High
2. Sort by Due Date (ascending) to see the most overdue at the top.
3. Work top-down. Repeat weekly.

---

Lifecycle reference

   ┌──────────┐         ┌──────────────┐
   │   Open   │────────▶│ Acknowledged │
   └─────┬────┘         └───────┬──────┘
         │                      │
         │                      │
         ▼                      ▼
   ┌──────────┐         ┌──────────────┐
   │ Resolved │         │  Suppressed  │
   └──────────┘         └──────────────┘

Status	What it means	How to get here
Open	New or re-opened violation. Needs attention.	Created automatically by policy evaluation; or manually re-opened.
Acknowledged	Owner is aware, remediation in progress.	Manual status change.
Resolved	Issue fixed. Excluded from active metrics.	Auto (underlying condition no longer matches) or manual.
Suppressed	Intentional ignore — known false positive or accepted risk.	Manual only.

Auto-resolution happens when a scan re-evaluates an asset and the policy no longer matches — e.g. a certificate’s expiration date jumps from 10 days out to 365 days out (renewal detected). OrgGuard flips matching open findings to Resolved automatically.

---

Troubleshooting

Symptom	Likely cause	Fix
Expected finding didn’t appear	Policy that should create it is disabled, or no scan has run since policy was enabled	Enable the policy (see Policies); trigger a scan from Scan Management.
Finding keeps generating new notifications	Dedupe window too short, or status still Open	Acknowledge the finding; raise the policy’s Deduplication Window (see Policies → Edit → Step 4).
Can’t edit a finding’s status	User lacks edit access to Finding__c	Assign OrgGuard User or OrgGuard Admin permission set (see Permission Sets).
Finding re-opened after a scan even though I suppressed it	Suppression is sticky — scans don’t reopen Suppressed findings	Verify Last Modified By on the record; a user changed it, not the scan.
Dashboard shows 0 Total Active but the list shows findings	The list is showing Resolved or Suppressed findings (non-default filter)	Clear filters or set Status back to Open + Acknowledged.
”Unassigned” in Assigned To	No user assigned to this finding	Open the record and set Assigned To.

---

FAQ

What’s the difference between Resolved and Suppressed? Resolved means the underlying issue is fixed — the certificate was renewed, the owner was assigned, etc. Suppressed means the issue still technically exists but you’ve decided not to act on it (known false positive, accepted risk). Always add Resolution Notes when suppressing so future reviewers understand why.

Why did OrgGuard auto-resolve my finding? Because the next scan re-evaluated the asset and the policy no longer matches — typically because the certificate was renewed, the owner was assigned, or the asset was set to Deprecated. The Resolved finding is preserved for audit.

Can I bulk-update findings? Not from the OrgGuard Findings List component (checkboxes are hidden for safety). For bulk edits, open the standard Findings object tab, use a list view with inline edit, or use Data Loader / standard Salesforce bulk tools.

Will assignees get an email when I assign them? Not automatically from OrgGuard’s logic. Notifications are triggered by policy evaluation and routed to the asset’s assigned Owner and the admin group email. To notify an assignee, create a Salesforce workflow rule / flow on Finding__c → Assigned_To__c change.

Can I delete a finding I created by mistake? No. Findings are protected audit records — deletion is blocked even for Admins. OrgGuard enforces this at the platform level regardless of permission set or profile. To hide a finding you no longer need to act on, set its Status to Suppressed and add a Resolution Note explaining why. Suppressed findings stay visible for audit. By default findings are not auto-purged (the retention setting for findings defaults to Keep, 0 days). An admin can opt into automatic purging by configuring a retention age — see Data Retention.

What does “Drift” finding type mean? A Drift finding would represent a previously-discovered asset that has changed in a material way between scans (e.g. a scope change on a Connected App). Drift is a defined-but-unused finding type — it exists in the picklist, but no evaluator produces it in Pro 1.0, so you’ll never see a Drift finding today. Documentation will be expanded when a Drift evaluator ships.

---

Related

• Policies — rules that create findings
• Notifications — delivery and dedupe for finding alerts
• Asset Inventory — the assets findings are raised against
• Scan Management — when findings are evaluated
• Data Retention — how long resolved/suppressed findings are kept
• Permission Sets — who can read and edit findings