Findings allow you to view and investigate notable events in your organization's Active Directory and Entra ID, including:

• Active Directory Tier Zero and Entra ID Privileged object activity, including the identification of unprotected Tier Zero objects.
• Hygiene indicators detected by Assessments.
• Detected TTP and Detected Anomaly Indicators collected by Audit.

NOTE: Hygiene indicators identified by Assessments show that certain objects may be vulnerable to adversary attacks. Detected indicators suggest that an action occurred which could potentially be an adversary attack. Detected TTPs (tactics, techniques, and procedures) are indicators found through search-based detection, while Detected Anomalies are indicators identified through statistical analysis.

To view Findings:

• From the left navigation menu, choose Security | Findings.

The Findings list displays the following information for each finding:

• Finding name
• Severity level

  NOTE: Security Guardian calculates severity levels by a range of values (for example, the lower the value, the higher severity). If you sort by this column, you can see the Findings in order of most to least severe.

  	Critical	Generally reserved for Hygiene and Detected Indicators that are changes to Tier Zero and Privileged object security, have significant potential impact to the Active Directory or Entra ID environment, and are not part of the default Active Directory or Entra ID configuration.
  	High	Generally reserved for: Hygiene and Detected Indicators that are of high concern but impact single objects. the discovery of new Tier Zero domain objects and Privileged tenant objects. changes to Tier Zero and Privileged objects that occur more often through normal business operations or are part of the default Active Directory or Entra ID configuration.
  	Medium	Generally reserved for the discovery of: Tier Zero user, computer, group, and Group Policy objects. Privileged user, role, group, and service principal objects.

• Type (Tier Zero, Hygiene, Detected TTP, or Detected Anomaly)
• Workload (Active Directory or Entra ID)
• Last Detected date and time. (This field displays the signed-in user's local date and time.)

• Status (Active or Inactive)

NOTE: If you click the Filter button, you can filter displayed results by one or more of the following criteria: Finding Severity Type Status (Active Findings display by default. You can choose to display either Active or Inactive Findings in the list, but not both.)

From the Findings list you can dismiss one or more Findings and view Finding history.