/findings

name: "Blumira Findings"
description: >
  The Blumira finding lifecycle: status and severity codes, resolution types, list
  filtering, enriched detail retrieval, assignment, and comment threads.
when_to_use: >-
  When triaging, investigating, assigning, commenting on, or resolving Blumira
  security detections. Use when: blumira finding,
  blumira alert, blumira detection, security finding, triage finding, resolve finding, or finding
  status.

Blumira Findings

Overview

Findings are Blumira's primary security detection unit — they represent threats, suspicious activity, or policy violations detected across your environment. This skill covers the full finding lifecycle from discovery through resolution.

Anti-triggers

• **Any client account other than your own org** — every tool here is

an `/org/*` call scoped to the credential's own organization. With MSP credentials these return 403 or an empty set; use `blumira-msp` and its `blumira_msp_findings_*` equivalents.

• **Choosing between Valid / Not Applicable / False Positive** — the

resolve *call* is here, but the disposition semantics and their effect on detection tuning are `blumira-resolutions`.

• **A detection from another security product** — "finding", "alert",

and "detection" are shared vocabulary. Use `huntress-incidents`, `sentinelone-alerts`, `blackpoint-incident-response`, or `cipp-alerts` depending on which platform raised it.

• **Containing or remediating the threat** — Blumira has no isolate,

kill, or block action; resolving a finding is a bookkeeping change only. Response happens in the EDR or firewall.

Key Concepts

Finding Statuses

| Status Code | Label | Description | |-------------|-------|-------------| | 10 | Open | New, unreviewed finding | | 20 | In Progress | Under investigation | | 30 | Resolved | Closed with a resolution |

Finding Severity

Findings have severity levels (e.g., LOW, MEDIUM, HIGH, CRITICAL) that indicate the potential impact. Always triage CRITICAL and HIGH findings first.

Resolution Types

When resolving a finding, you must specify a resolution type:

| Resolution Code | Label | Use When | |----------------|-------|----------| | 10 | Valid | Confirmed real threat, action was taken | | 20 | Not Applicable | Finding doesn't apply to this environment | | 30 | False Positive | Detection was incorrect |

API Patterns

List Findings

blumira_findings_list
  status.eq=10          # Open findings only
  severity.in=HIGH,CRITICAL
  order_by=-created     # Most recent first
  page_size=25

Get Finding Details

blumira_findings_get
  finding_id=<UUID>

blumira_findings_details
  finding_id=<UUID>

The `details` endpoint returns enriched data including related context, evidence, and recommended actions.

Resolve a Finding

blumira_findings_resolve
  finding_id=<UUID>
  resolution_type=10    # Valid
  notes="Confirmed brute force attempt. Blocked source IP in firewall."

Assign a Finding

blumira_findings_assign
  finding_id=<UUID>
  user_id=<UUID>

List Comments

blumira_findings_comments_list
  finding_id=<UUID>

Add a Comment

blumira_findings_comments_add
  finding_id=<UUID>
  comment="Investigating source IP. Checking firewall logs for correlation."

Common Workflows

Triage Open Findings

1. `blumira_findings_list` with `status.eq=10` and `order_by=-severity` 2. Review CRITICAL and HIGH findings first 3. For each finding, use `blumira_findings_details` to get context 4. Assign to an analyst with `blumira_findings_assign` 5. Add investigation notes with `blumira_findings_comments_add`

Investigate a Finding

1. `blumira_findings_get` to retrieve the finding 2. `blumira_findings_details` for enriched context and evidence 3. `blumira_findings_comments_list` to review prior investigation notes 4. Add findings with `blumira_findings_comments_add` 5. Resolve when investigation is complete

Resolve Multiple Findings

1. `blumira_findings_list` with filters matching the batch (e.g., same detection rule) 2. Review a representative sample to confirm the resolution applies 3. Resolve each with `blumira_findings_resolve` and appropriate resolution type 4. Document the rationale in the notes field

Filter by Date Range

blumira_findings_list
  created.gt=2025-01-01
  created.lt=2025-02-01
  status.eq=10

Error Handling

Finding Not Found

**Cause:** Invalid finding ID or finding not accessible in current org scope **Solution:** Verify the finding ID. If using MSP credentials, use `blumira_msp_findings_get` instead.

Cannot Resolve — Missing Resolution Type

**Cause:** Resolution type not provided or invalid **Solution:** Provide a valid resolution type: 10 (Valid), 20 (Not Applicable), or 30 (False Positive).

Cannot Assign — Invalid User

**Cause:** User ID doesn't exist or isn't a member of the organization **Solution:** Use `blumira_users_list` to get valid user IDs.

Best Practices

• Always triage by severity: CRITICAL → HIGH → MEDIUM → LOW
• Add comments before resolving to document the investigation trail
• Use resolution types accurately — false positive tracking improves detection tuning
• Filter by date range when reviewing historical findings to avoid overwhelming results
• Assign findings to specific analysts for accountability

Related Skills

• [API Patterns](../api-patterns/SKILL.md) — Filtering and pagination
• [Resolutions](../resolutions/SKILL.md) — Resolution types in depth
• [Users](../users/SKILL.md) — Finding user IDs for assignment
• [MSP](../msp/SKILL.md) — Cross-account finding management