Cases
A case is the record of a finding that needs attention. It is opened by a rule when its condition is met. A case holds the evidence (the materials and hosts involved), a state, a history, and the deliveries made to each channel. One finding produces one case, however many times the rule re-checks it.
The page is reached from Notifications > Cases in the left navigation menu.
Your Queue
Four tiles at the top summarise what changed. Clicking a tile filters the list to those cases.
Critical, nobody has looked: Critical cases still in the Notified state.
Reopened in the last 24 hours: Cases that had been resolved and came back.
Waivers lapsing within 7 days: Waived cases whose waiver ends within a week; they will notify again.
Held — the host was not re-scanned: Cases the engine cannot close because the host has not reported recently.
The Case List
Case: The case number,
NTF-followed by a number. Click it to open the case.What / where: The rule that opened it, and the kind of material.
-
Severity: Set by the rule's author, not derived from the finding, so two cases from one rule share a severity.
State: Where the case is in its life — see Case States.
Materials and Hosts: How many of each the case covers.
-
Verdict: The worst risk level among the case's materials — Critical, High, Low or Safe. A dash means the rule does not assess risk; it does not mean Safe.
Last seen: When the finding was last observed.
Deliveries: The channels the case was sent to, with how many messages each received.
Search by case number, label or host. Use Filters for more, and the state chips below it to choose which states are shown:
Needs attention: Notified, Acknowledged and Held. This is the default.
Quieted: Baselined, Snoozed and Waived.
Cleared: Resolved.
-
Only changed: Keeps only cases that got worse — more materials, or a worse verdict — on the page you are viewing.
Group by arranges the current page by Rule, Severity or Age (last 24 hours, 1–7 days, 7–30 days, over 30 days), or Flat for none. When grouped by rule, each group offers Acknowledge all.
Tick rows to act on several cases at once: Acknowledge, Snooze… or Waive…. Closing is one case at a time.
Case States
Notified: Raised and delivered, and nobody has handled it yet.
-
Acknowledged: Someone has seen it. Repeat notifications stop unless the finding gets materially worse.
Snoozed: Quiet until a chosen date, then it returns by itself.
Waived: Accepted risk until a chosen date, with a recorded justification.
-
Held: The finding has stopped appearing, but the engine cannot prove it was fixed — the host has not reported within the evidence window, or no scan covers it. Re-scan the host to settle it.
-
Baselined: An existing finding recorded silently on a rule's first run, so that switching a rule on does not flood anyone with years of history.
Resolved: The finding is gone, and a later scan confirmed it.
Working a Case
Click a case number to open it:
The side panel summarises the case — severity, state, verdict, rule, counts, first detected, last seen, and why it opened — and carries the actions:
Acknowledge: Mark it seen, with an optional note.
Snooze: Quiet it until a future date, with an optional reason.
-
Waive: Accept the risk until a date at most a year away, with a justification of at least ten characters. Waiving a Critical case needs an administrator.
-
Close: Close the case with a reason. If the finding is still present, the rule will open a new case the next time it runs.
The main column holds:
Since you last looked: What changed since the last notification.
Scope: What the case covers, and the hosts involved.
-
Evidence: The materials themselves. Show removed materials adds the ones that have since left the case, and Export CSV downloads the list.
-
Deliveries: Each message sent, its state (Pending, Sending, Sent or Dead), and the last error. Retry re-queues a delivery that failed for good. Shown to administrators.
-
History: Every transition, newest first — when it was detected, each notification sent, reminders, and repeats that were deliberately suppressed (with the reason, such as once_per_case, unchanged).