Reviewing findings

Findings are the customer-facing intelligence items ThreatHarvest surfaces for review. Use Findings to triage what matters, open details, and update status.

Filters and URL params

Findings supports:

• Status Filter — Pending, Review, Resolved, or All
• Relevance Filter — Relevant, Informational, or All
• Search — search findings by text

Filters are reflected in the URL (for example status and relevant query params), so you can bookmark or share a filtered view. Overview cards often deep-link here with filters already set.

Findings table

Select rows with the checkbox column when you want a bulk update.

ThreatHarvest Priority (TH-P)

ThreatHarvest Priority (TH-P) is a standardized threat prioritization scoring system designed to help identify, evaluate, and act on critical Cyber Threat Intelligence (CTI) signals. It produces a single score on a 0–10 scale, giving every finding in your queue one consistent basis for triage ordering.

TH-P is a relative prioritization aid within ThreatHarvest — not an absolute measure of risk. Exact numeric weights and the full calculation formula are not published; use the dimensions below to understand what the score reflects.

Core evaluation dimensions

TH-P is a 0–10 priority score adjusted by contextual signals where available:

• Severity — the baseline technical impact of the finding.
• Target Relevance — how directly the finding concerns a monitored keyphrase.
• Exploit Maturity — findings with confirmed exploitation may be weighted above theoretical ones.
• Evidence Confidence — largely based on source trust when material and quantifiable.
• Environmental Signals — findings involving inherently sensitive exposure.

Informational findings

Findings assessed as not relevant to a monitored keyphrase are surfaced separately as Informational only. Use the Relevance Filter (Relevant, Informational, or All) to focus the queue.

Overview also charts findings by TH-P band (Critical / High / Low). See Overview dashboard → TH-P distribution for the band cutoffs shown in the product.

Detail panel

Open a finding row for detail, status, and Explain Finding.

Explain Finding / AI Guidance

In the detail panel, under AI Guidance, choose Explain Finding. Guidance includes two sections:

• Quick Summary — a plain-language overview of the finding: what was observed, why it may matter, and how it relates to the monitored attribute (for example whether exposure depends on whether you actually run the affected software or service).
• Remediation Guidance — practical next steps framed generically: confirm whether the affected component applies to your environment; patch, rebuild, or harden if it does; limit exposure until fixed; verify afterward; or document that you are not exposed if it does not apply.

Bulk update

Select one or more rows, then use Update Selected to change status in bulk. Clear Selected clears the selection.

Status values

Findings use three statuses in the product UI. You can change status from the table or the detail panel:

• Pending — Awaiting review or has not yet been actioned
• Review — An optional state you can select to identify findings that require follow-up
• Resolved — A finding that has been actioned and can be closed