Findings

Findings are groups of significant exposures with the same root cause.

You can promote one or more vulnerabilities from a finding into a runZero issue for tracking and remediation, and optionally push the issue to Jira as an external ticket.

Findings are created through three sources:

1. Query-based: These findings are identified through specific queries defined within the system (see list below).

2. Nuclei-generated: These findings result from scans where default credentials and vulnerability checks are enabled, leveraging Nuclei templates (see templates).

3. KEV (Known Exploited Vulnerabilities): These findings are triggered when a discovered vulnerability is present on the CISA Known Exploited Vulnerabilities (KEV) catalog or VulnCheck KEV.