Findings
Findings provide your analysts with pre-triaged alerts, evidence, the ability to investigate quickly and to respond even faster.
The lifecycle
We run every finding through a series of automated steps. Gathering evidence, auto-triaging and defining threads that analysts can pull on to quickly remediate threats.
What's in a finding
Triage
Orient your analysts before they even start
Icite dispatches agents to summarize what the detection found, add evidence from your data, and — critically — state what wasn't assessed. Your analysts review a case file, not a query result.
"The three Conditional Access policies that target 'All users' are not enforcing — one is disabled and two are report-only…"
Members & classifications
Improve fidelity of findings and detections
Each finding lists its members — the identities implicated — with recurrence and first/last seen. Classification is one click, and every verdict feeds detection tuning. False positives make the system smarter, not just quieter.
False positive
True positive
Benign
Members
Member
Recurrence
First seen
Last seen
Classify
Emily Chen
Open
May 5th, 03:03:03
May 6th, 03:03:03
Emily Chen
Open
May 5th, 03:03:03
May 6th, 03:03:03
Emily Grace
Open
May 5th, 03:03:03
May 6th, 03:03:03
Randall Savage
Lapsed
May 3rd , 08:22:11
May 3rd , 08:22:11
Recommendations
The next three moves, ranked and specific.
Clear, actionable suggestions for analysts like: revoke the 247 external Drive shares, transfer ownership of the Customer Master List, remove the Salesforce export permission. Named resources, named identities, real blast-radius numbers.
Recommendations
01
Revoke external Drive shares
Revoke the 247 external shares on files owned by Emily Grace. These shares persist after termination and grant ongoing access to customer data unless manually expired.
02
Transfer ownership of the Customer Master List
Reassign ownership of the Customer Master List shared drive to her manager. Emily currently holds sole ownership, and no DLP rule is configured to flag further bulk exports from this drive.
03
Remove Salesforce export permission
Remove the "Export Reports" permission from Emily Grace's Salesforce profile. She triggered a 4 GB report export yesterday and retains the ability to repeat it until termination.
03
Revoke GitHub write to billing-service
Downgrade Emily Grace's access on billing-service from write to read-only. She recently pulled ‘customer_export.py’ from this repo, and write access lets her push or rewrite history before departure.
Investigations
Get the evidence you need, fast.
Start an investigation right from the finding. "Who else accessed that drive?" becomes an inquiry against the same correlated data — no pivot to the SIEM, no query language, no losing the thread. List out actual events, see configuration change diffs and add them right to the finding.
Measure what matters
Evidence based investigations right from the finding increases analysts confidence to respond.
Verified remediation —"fixed" is checked against subsequent detection runs, and lapses reopen the conversation.
Crush triage time with agent-written overviews the minute a finding is created. Analysts start with context not queries.
Feedback loop to detections — false-positive rates fall because classifications feed detection tune capabilities.
