Table View

The Findings Table is an alternate view on the Attack Paths page. Use it to review many findings at once, compare finding state across environments and zones, and triage high-volume result sets faster. Each row in the table represents a single finding. The table displays the following columns:

​

Use cases

Use the Findings Table to focus an investigation on a set of findings:

• Triage findings at scale: Review a dense list of Attack Path findings and sort by severity, date, status, or contextual columns.
• Focus an investigation: Filter by severity, platform, environment, zone, and status to move from a broad result set to a smaller set that matches your investigation goal.
• Compare scope across environments or zones: Select multiple environments or zones and review the matching findings together.
• Review finding state and recency: Use Status, First Seen, and Last Seen to understand whether findings are open, accepted, remediated, deprecated, or orphaned, and when BloodHound Enterprise last updated them.
• Preserve table context: Use the page URL to return to or share the same view, filters, and sort order.

​

Prerequisites

Before you can use the Findings Table, you must have the following:

• BloodHound Enterprise with the Findings Table beta feature enabled on the Early Access Features page.
• Access to the environments you want to analyze.
  If Environment Targeted Access Control (ETAC) is enabled on your tenant, it can limit which findings and environments appear for your account. Two users can see different rows for the same filters depending on their access.

​

Filter findings

Use filters to narrow the result set: The filters support multi-select. Selecting All for a filter removes that filter from the query. Clearing every value in a filter returns no rows until you select a value or return to All.

​

Sort findings

You can sort by each table column and resize column width. Sorting reorders the full result set for the current filters. For example:

• Sort by First Seen to distinguish newer findings from findings that have persisted across analysis runs.
• Sort by Last Seen to review the most recently updated findings for the current filters.

​

Finding status lifecycle

A finding moves through a lifecycle as BloodHound Enterprise detects it, as you act on it, and as your environment changes. The Status column reflects where a finding is in that lifecycle. The diagram separates active findings from system-archived outcomes.

​

Status definitions

The following table describes the stored value and meaning of each finding status, and whether the status marks a finding as archived.

​

User-driven transitions

You control the transition between Open and Accepted:

• Open to Accepted: Accept the finding and set an acceptance duration. BloodHound records an acceptance expiration for the finding. For steps, see Risk Acceptance.
• Accepted to Open: Remove the acceptance manually, or wait for the acceptance period to expire. In both cases, the finding returns to Open.

​

System-driven transitions

BloodHound sets the archived statuses automatically during analysis. You cannot set these statuses manually:

• Remediated: A subsequent analysis run no longer detects the Attack Path or vulnerable principal. Use this status to confirm that a risk was actually removed.
• Orphaned: The environment associated with the finding (such as an Active Directory domain or Azure tenant) is archived or removed and is no longer collected.
• Deprecated: The finding type is removed from (or deprecated in) the current schema, for example when an OpenGraph extension no longer defines it.