Finding Detection History

See every time a finding has been confirmed, in one place.

When the same vulnerability shows up in more than one test, Cobalt links those findings together. Detection History shows that timeline on the individual finding page, so you can see when an issue first appeared, the severity, and the current state of the finding.

Why it matters

• Know if it is new or recurring. An issue seen once is a different problem from one found in four tests over two years.
• Prioritize with context. A repeat detection can mean a fix did not hold or a risk has been open longer than expected.
• Skip the digging. You no longer need to search past reports to find out whether you have seen a finding before.
• Check fixes over time. If a finding was fixed and the issue is detected again later, the history shows it.

Where to find the Detection History

Open an individual finding. If the finding is linked to earlier detections, a Detection History section appears on the finding page in the lower right hand corner. 

The section title shows the total number of detections, for example Detection History (4). The finding you are viewing is marked with a blue dot. All other entries have a grey dot.

How it works

What each entry shows

• Finding ID, linked to that finding
• The date the finding moved to Pending Fix
• Severity
• Current state

Entries are sorted newest first.

Which findings are included

Detection History lists confirmed detections only: findings in Pending Fix, Ready for Retest, Fixed, Accepted Risk, or Carried Over. Findings in Draft, Triaging, Duplicate, Declined, Out of Scope, or Not Applicable are not listed.

Long histories

The first five entries are shown by default. If there are more, select View More to see the rest, then View Less to collapse the list. If the finding you are viewing is further down the timeline, the list opens expanded.

Detections you cannot open

If an earlier detection belongs to a finding you do not have access to, you see its date and a lock next to the finding ID. The state and all other details are hidden, and the ID is not a link. Hover over the lock for an explanation.

Carried Over findings

The Carried Over section is still on the finding page and is not replaced by Detection History at this point. The two will often overlap, because a carried over finding is also a linked detection, so the same earlier finding can appear in both. If a finding has carried over history but no Detection History, you see only the Carried Over section. See Carried Over Findings.

Some earlier detections may not be shown

The oldest entry in every Detection History shows this message: “Some earlier detections may not be shown.”

Cobalt links detections automatically, so the timeline reflects the detections Cobalt could confirm, not necessarily the first time the issue occurred.

Sometimes an earlier detection really is missing. For example, a similar finding was created manually and nothing connected it to the others. If you think that happened, see Report a missing or incorrect detection below.

Report a missing or incorrect detection

If a detection looks missing, or one is listed that does not belong, contact your Customer Success Manager or support@cobalt.io. 

FAQ

Does Detection History change my findings?

No. It is a read-only view. It does not change severity, state, or remediation.

Why does my finding not show Detection History?

It has no earlier confirmed detections linked to it, so there is no history to show.

Does it include findings from before this feature launched?

Yes. Cobalt looks at previous findings to build their history, relying heavily on findings that were carried over to a more recent test.

Can a finding show history that is not related?

Rarely. Matching is automated, so an earlier detection can occasionally be attached to the wrong history. Use the contact path above to report it.

Is Detection History in my exported report?

No. It is not included in individual finding PDF exports or full pentest report exports.

Who can see it?

All users can see the Detection History module when at least two findings are linked together. A net new finding has no Detection History module.