Explain a Security Finding

Tasks

Use the security overview to choose a finding, inspect its recorded context, and request an advisory explanation when more interpretation would help.

Before you start

Contextual explanations require a verified account binding. Viewers can read context; a current active administrator must consent to paid generation. Configure an internal provider and enable AI Analyst under Settings → AI Features. OIDC-only sessions without an immutable account binding are currently unsupported. See AI Analyst for the feature boundary and admin MCP tools for the equivalent API workflow.

Review and explain a finding

1. Choose the scope. Open Home and select a time window. Review activity trends, recorded gateway outcomes, and the exposure cards. An unavailable metric or incomplete attribution is an evidence gap, not zero exposure.

2. Inspect a finding. Open a ranked Home finding or go to Security → Activity → Correlated findings, which lists open incidents; open one to see its findings, then select a finding to read its recorded evidence. A finding's drawer opens with a verdict: for a call a policy blocked, it says the control worked and nothing was sent, shows how many times the same user hit the same rule in the previous 48 hours, and offers Notify user (administrators; an in-app notice with the catalog's advice, never evidence) and Open the session. Other findings get the same layout, led by the Judge's verdict when there is one, then severity. Choose All findings for individual events. To get an interpretation of a whole incident, see Summarize an incident. For one workload, open Inventory → Workloads and its Security tab or drawer preview. Review its recorded evidence and request correlation before deciding what action is warranted. Below the verdict, the recorded evidence marks the text that triggered a content safety detector and lists it under Why this was flagged; select an entry to jump to the highlight. Injection and jailbreak entries show the matched text, while secrets and PII show a masked placeholder. See Evidence highlights. Administrators can then assign the incident, acknowledge it, or resolve it with a disposition and a note; see Incident triage.

3. Ask Analyst. On Home or in the Workload Security preview, select the contextual Analyst control beside the finding. Correlated findings has no per-finding control. In the Workload Security preview, reveal the icon by hovering or moving keyboard focus to the finding; it stays visible on narrow or touch screens. That action retains the preview's exact recorded workload, cluster, and frozen last-24-hours window. This explicit action gathers authorized recorded context, requests analysis when available, and reports the result. Administrator sessions can include bounded retained redacted prompts, responses and transaction excerpts. If the browser does not know your role, it first verifies current server authorization, then gathers retained content before asking the provider. This remains one explicit action; an answer that fails validation is retried once automatically, so it can make two provider calls. Review Recorded content and omissions for partial coverage and delta captures. A provider call may incur cost.

4. Review the advisory. Read the lead interpretation and suggested next action, then compare them with recorded facts. Open a citation to inspect the original finding’s current evidence, with the same highlights, without losing your report. The explanation does not execute recommendations or change controls.

5. Check the result. Review the cited explanation and the attempt receipt. Call count, token usage, and estimated cost appear when available; missing usage or pricing appears as Unknown. Aggregate usage is under Settings → AI Features → Usage and cost.

Reopening a recent report revalidates authorization and recorded context before showing the cached analysis without another model call. If recorded context or provider configuration changes, select Analyze latest to request another analysis. If a stage fails, retry that stage explicitly; generation failures preserve gathered facts. When Gathering evidence fails, the drawer states the reason, such as an unreadable evidence source, a retained capture that could not be retrieved, or a timeout. If only retained content failed, Analyze recorded metadata only runs the analysis without it. While the Analyst is open it replaces the incident drawer, which returns when you close it. Closing the drawer cancels the browser request, but a provider call that already started may still incur cost.

Summarize an incident

1. Open the incident. Go to Security → Activity → Correlated findings and select an incident. The drawer lists the incident's findings. Findings and their evidence have no Analyst button.
2. Select Summarize incident. This is the one opt-in action. It gathers the incident's recorded metadata and makes one provider call, which may incur cost. If the model's answer fails validation, AIControls retries once with a stricter prompt and costs both attempts. A manual Try again or Analyze latest makes another call. The Analyst uses the time range, subject, source and search filters that produced the incident's findings.
3. Read the recommendation. The summary leads with a recommendation (close as benign, escalate or contain), a confidence (low, medium or high) and the findings it rests on. Confidence is never high when the summary read only some of the findings or coverage is partial.
4. Read the answers. Below it are what happened, the blast radius, whether a control worked, and the next step. When the incident has more than eight findings, the summary covers the newest eight and says so.
5. Check the citations. Each answer cites findings and audit events from the incident. Select a citation to open that finding's current evidence; closing it returns you to the summary with no new provider call.
6. Act on it, or not. Administrators can select Resolve as benign with this note, which opens the summary's reasoning as a note you can edit before it is recorded (the summary reads recorded metadata only, so confirm the activity was expected first), or Escalate, which assigns the incident to you and acknowledges it. Both are the ordinary incident triage actions, with the same audit trail. Nothing runs until you select it. Viewers see these buttons disabled with the reason. Copy summary copies plain text for a ticket or chat.

If the answer is rejected after the automatic retry, the drawer keeps the recorded facts, the findings read and the control outcomes, and states the reason in words, for example "it cited a finding outside this incident" or "it gave fewer than three observations". It also shows the model, attempts and estimated cost. Try again is a separate, paid request.

The summary uses metadata only and does not send prompts or responses. If recorded context or provider configuration changes while the drawer is open, select Analyze latest to request another summary. Other failures, such as a provider error or timeout, are retried only when you select a retry action.

Analyze a security window

1. Select the window. On Home's Security dashboard, select a range of up to 31 days. For a supported user or agent, open its Identity Security view to keep the exact recorded identity and displayed window.
2. Check attribution coverage. Inventory Identity Security supports recorded machine keys, cluster-qualified Kubernetes identities and observer developer-owner keys. Legacy display-only identities, ordinary human identities without recorded owner binding and governed clients show scope unavailable. Cluster-qualified findings cover recorded attribution and detector subjects; they do not establish every sequence executed by that identity. Review the source coverage notice before treating the count as a complete history.
3. Read the briefing first. Select Security briefing. It shows what needs attention, what is probably noise, what changed and whether controls held, computed without a model. See Security briefing.
4. Ask Analyst. At the bottom of the briefing, select Ask Analyst about this window. It is optional and uses the configured model. It gathers full-window counts, an equal preceding window and up to eight representative findings, then requests a single advisory analysis when authorized. Window analysis uses metadata only; it does not send captured prompts or responses.
5. Check the citations. A summary citation shows gathered counts and coverage for both periods. A representative citation opens that finding's recorded evidence in the selected scope. Missing retention or attribution remains an explicit limitation; samples do not establish which identity caused most activity.

Counts represent retained source groups, not unique attacks or gateway requests. Gateway requests and recorded enforcement outcomes are counted separately. No prior records does not prove zero prior activity. Other scopes and finding facets are not supported by this window action; they are rejected rather than silently removed. See window Analyst MCP tools to use the same flow outside the UI.