Vulnerabilities: read the evidence and triage findings

The Vulnerabilities tab helps you decide what to fix first. Start from the evidence, weigh the context and record your decision: RECON applies it again in later scans of the same domains.

Goal

By the end of this guide you can read a finding (severity, CVSS, CISA KEV, EPSS, evidence quality) and classify it as False positive, Resolved / fixed or Accepted risk, with a reason that stays on record.

Prerequisites

• A completed external scan, for example the one for meccanicaadda.it.
• Access to the scan: you can classify findings on your own scans and on scans shared with you.

Chapters

How to read a finding

• Risk Assessment sums up the picture, with the count per severity next to it: Critical High Medium Low. These set the order of your analysis; they do not prove every finding applies.
• The Risk Score runs from 0 to 10 and combines CVSS severity, CISA KEV status, EPSS probability, public exploits and asset exposure.
• The red banner at the top tells you how many vulnerabilities are in the CISA KEV (Known Exploited Vulnerabilities) catalog: attackers are already exploiting them.
• The vulnerability detail shows the CVSS score with its attack vector (for example network, low complexity, no privileges required), the evidence status and the exploitation badges.
• The evidence status tells you how solid the finding is: Confirmed, Probable, Unverified or Not applicable. Unverified means the version has not been confirmed: check it on the server itself.
• EPSS (the FIRST model) estimates the probability that the vulnerability is exploited in the next 30 days. It is not the probability that your company gets breached.
• Further down you find Description and Timeline; View in NVD opens the official CVE record.

Steps

1. Open the Vulnerabilities tab

   Open the latest meccanicaadda.it scan and select the Vulnerabilities tab. To find a specific finding, type its ID in the search box (Search CVE ID or description...) and click the row to open the detail.

2. Check before you classify

   Compare the finding with reality: do the detected technology and version really match the vulnerable product? A finding about AngularJS, for example, does not apply to a site running a recent version of Angular. Close the detail and clear the search.

3. Open the classification panel

   Click the icon at the end of the row (Mark as false positive). The Set finding status panel opens and asks How are you classifying it?.

4. Choose the classification

   • False positive: the finding does not apply (for example a backported fix or a wrong version match).
   • Resolved / fixed: the issue was real but has already been fixed. The classification records a check; it does not install anything on the server.
   • Accepted risk: the issue is real and unfixed, but the business decides to accept it, for example for a site being decommissioned. Accepting is not fixing.

5. Add the reason and confirm

   Fill in Reason (optional) with a reason someone else can verify: who checked, what and when. If the finding affects several hosts, choose under What are you dismissing? whether it applies to This host only or to all affected hosts. Confirm with Dismiss everywhere (or Dismiss on followed by the host).

Result

• The row stays in the list, struck through, with the decision label: False positive, Resolved or Accepted risk.
• The classified finding leaves the risk score and is counted separately. The reason stays recorded with the decision.
• Use the severity filter (for example Low) to find the findings you want to review quickly, then go back to All Severities.

Troubleshooting

• I need to undo a decision: click the restore arrow at the end of the row (Unmark false positive). The finding is open again and the decision stops carrying over to later scans.
• The decision does not show up in another scan: decisions apply only to the same set of domains. A scan with a different set (for example with one extra domain) does not inherit them.
• I see fewer findings than expected: check the Finding evidence filter. Open findings shows only the findings to act on; All recorded evidence also shows unverified and not applicable ones.

Related articles