Enrich Findings

Once a finding has been correlated into a single, de-duplicated record, ETM lets you layer additional context on top of it, business risk factors, attacker technique mapping, and supporting evidence so the finding carries more than just what the scanner reported.

Navigate to: Configuration > Custom Attributes or Risk Management > Findings

Custom Attributes

Write your own formulas against normalized asset and finding attributes to calculate a custom score or category for a finding — for example, weighting QDS by whether the asset is internet-facing. Custom Attributes become searchable tokens and dashboard widget inputs once defined.

MITRE ATT&CK Mapping

ETM maps vulnerabilities and misconfigurations to MITRE ATT&CK tactics and techniques, adding real-world attacker context to a finding. You can view this mapping as a matrix, group findings by tactic, technique, or sub-technique, and drill into a technique to see the assets and findings behind it.

Supporting Evidence

You can attach files or links to a finding as supporting evidence — for example, proof of a compensating control — to document why a finding was closed or accepted, and keep an audit trail alongside the finding itself.

Lifecycle Actions

For findings sourced from Generic CSV import, you can close vulnerabilities or misconfigurations directly from the UI instead of waiting on the next connector sync or file upload — another way a finding's record can be enriched with a manually confirmed status.

Enrichment is what feeds prioritization: the more risk context a finding carries — custom attributes, MITRE mapping, exploit and evidence data — the better ETM can help you rank it.

Related Topics

• Correlate findings
• View Findings Using Custom Attributes
• MITRE ATT&CK Matrix in ETM
• Prioritization Using MITRE ATT&CK Matrix
• View Findings with MITRE Tactics and Techniques Using the Group By Field
• Support for Attaching Evidence to Findings
• Manage Lifecycle State of Important Vulnerabilities
• Investigate findings