> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate the findings you already have

> Connect your scanners, and let the Blue team agent prove or disprove each new alert in production. Then you work only on the issues that an attacker can use.

Your scanners send more alerts than your team can examine. Many of these alerts are not exploitable in your environment. The Blue team agent tries to exploit each new alert from your tools on your live authorized target. Blue starts when the alert arrives, or on a schedule that you select. Each attempt gives a proof of exploitation or a "not exploitable" result with a reason.

## Connect your security tools

Blue works on findings from the security tools that you connect:

| Category | Tools |
| - | - |
| Cloud and code security | Wiz, Snyk, Aikido, Socket, Upwind, Corridor |
| Bug bounty | HackerOne, Bugcrowd |
| Compliance | Drata |

For the full list, see the [integrations catalog](https://docs.tolmo.com/integrations/catalog.md). To add a tool, see [Connect an integration](https://docs.tolmo.com/integrations/connect.md). For a different tool, import its Markdown security report with the [findings commands](https://docs.tolmo.com/cli/commands/findings.md).

## Choose which findings Blue tests

Blue runs on the findings that match your triggers. For example, one trigger tests each new critical finding when it arrives. A second trigger tests high-severity Wiz findings one time each day. For all trigger options and testing hours, see [Add Blue triggers](https://docs.tolmo.com/pentesting/production-changes.md#add-blue-triggers-for-new-third-party-findings).

Blue starts when you connect a findings integration. Blue tests only targets in your [authorized domains](https://docs.tolmo.com/pentesting/scope.md). To test one finding immediately, [retest it](https://docs.tolmo.com/pentesting/retest.md).

## Blue verdicts

For each finding, Blue gives one of these verdicts:

| Verdict | What it means | Exploitability |
| - | - | - |
| **Exploited** | Blue proved the issue on your live authorized target. Blue keeps the exploit as evidence. | **Validated exploit** |
| **Not exploitable** | Blue disproved the mechanism, or a control stopped the attack, or no external path exists. | **Not exploitable**, or **Defence in depth** if the internet cannot reach the target |
| **Inconclusive** | Blue had a target but did not get a clear result. This verdict does not count against the finding. | No change |
| **Error** | Blue could not try the exploit. The reason shows what was missing, such as a target URL, credentials, or an authorized domain. | No change, or **No permitted domain** |

When Blue proves a finding, the finding gets the same evidence and fix prompt as a finding from the Red team agent. See [Understand a finding](https://docs.tolmo.com/pentesting/findings.md).

> [!NOTE]
>
> Blue does not change the finding in the source tool. Tolmo keeps the Blue verdict and your triage decisions. A later scan from the source tool can still update the provider status.

## See which alerts were real

The **Validated exploits** view shows all validated exploits from all sources. Filter the view by source. Then you can see which scanner alerts an attacker can use.

## Next steps

> [card] [Triage at scale](https://docs.tolmo.com/pentesting/triage.md)
>
> Filter, group, and triage findings from all sources.

> [card] [Agents overview](https://docs.tolmo.com/agents/overview.md)
>
> How Red, Blue, and Green work together.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.