> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Triage at scale

> Triage findings from Tolmo's agents and all connected scanners in one list: saved views, filters, tickets for many findings, status history, attachments, and secret detections.

**Findings** shows all findings in one list. The list contains findings from Tolmo's agents, findings from your connected scanners, and issues that your team reported. To read a single finding, see [Understand a finding](https://docs.tolmo.com/pentesting/findings.md).

## Start from a saved view

The list opens on **Validated exploits**. This view shows the findings that an agent proved in production. Four views are available:

| View | What it shows |
| - | - |
| **Validated exploits** | Validated exploits with all remediation statuses. |
| **High and critical opened** | High and critical findings with the **Open** status. |
| **Closed** | Findings with the **Closed** status. |
| **Backlog** | Open findings that wait for exploitation or triage. |

## Filter and search

You can add filters to a view. You can remove each filter separately.

| Filter | Values |
| - | - |
| Severity | Critical, High, Medium, Low, or Info |
| Status | The [triage status](https://docs.tolmo.com/pentesting/findings.md#triage-status) |
| Exploitability | Validated exploit, Not exploitable, Not validated, or Resolved |
| Source | Tolmo, or a connected tool such as Wiz |
| Search | Titles, external IDs, rules, and resource keys |

For a more complex filter, write an **Advanced** query expression, such as `origin:wiz severity:critical`. The URL keeps the filter. Thus, you can send a filtered view to a teammate.

## Act on many findings at once

Select more than one finding. Then you can [create tickets](https://docs.tolmo.com/pentesting/fix.md#create-tickets) for all of them in Linear or Fibery. You can also [export them as a PDF report](https://docs.tolmo.com/pentesting/fix.md#export-a-pentest-report).

## Keep the record

Each finding keeps a status history. The history shows each status change, the person who made it, and the justification. The chronology of a finding shows when an agent detected it, exploited it, and retested it. It also shows when someone closed it. Your team can also attach evidence files to a finding, such as a review PDF.

## Report an issue yourself

You can add an issue that you found yourself or that a customer told you about. Use **Report a finding**. Give the issue a title, a description, and a location. Also give your estimate of its severity. Tolmo grades the issue during triage.

## Duplicates

Sometimes two scanners report the same issue. Tolmo then marks one finding as **Duplicate** and links it to the other finding. Work on the original finding. You can see the duplicate with its own filter.

## Secret detections

Detected secrets are not in the findings list. An example of a detected secret is an API key in a repository commit. To read detected secrets, use the API endpoint [List secret findings](https://docs.tolmo.com/api-reference/secrets/list-secret-findings.md). Each detection contains these items:

* Its resource, rule, and severity.
* The times when Tolmo observed it.
* Its triage verdict, if a verdict exists.

## Work from the CLI or API

The CLI and the API give you access to the same findings:

```bash theme={null}
tolmo findings list --status open --severity critical
tolmo findings get <finding-id>
tolmo findings history <finding-id>
```

See the [findings command reference](https://docs.tolmo.com/cli/commands/findings.md) and the [API reference](https://docs.tolmo.com/api-reference/introduction.md).

## Next steps

> [card] [Fix a finding](https://docs.tolmo.com/pentesting/fix.md)
>
> Copy the fix prompt, link the pull request, or create a ticket.

> [card] [Query findings with SQL](https://docs.tolmo.com/knowledge-graph/sql-cypher.md)
>
> Ask the questions that filters cannot answer.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.