Findings, HTTP Records, and OAST
Triage happens in Workbench. A finding is useful when the evidence that supports it is still attached.
Findings
Open Findings to filter by severity, status, module, and project. Each row is a review object.
When you open a finding, confirm:
- The project and authorized target
- The identity or session in use
- Why the module raised it
- Which HTTP Record or OAST callback supports it
Do not escalate a finding that has no reviewed evidence. Do not treat a SAST file/line/snippet candidate as a confirmed runtime exploit until that review is done.
HTTP Records
HTTP Records hold the captured request and response for the same project. Use them to answer what was sent, what came back, which parameter, header, or route mattered, and whether the behavior is still reproducible in the authorized environment.
Sensitive values may be redacted. The review sequence still has to be visible.
OAST callbacks
OAST records out-of-band interactions on the same trail. Review them in the same project as the finding.
If the callback cannot be tied to the authorized assessment, do not treat it as a confirmed finding. Dashboard Recent OAST callbacks is a shortcut into this list, not a second product.
Evidence drift
Workbench can signal evidence drift when the stored record no longer matches the current finding context. When that happens:
- Open the finding
- Open the related HTTP Record or OAST callback
- Re-validate against the authorized target
- Update the finding status only after review
Evidence drift is a review signal. It is not a restore feature.
Related
Need a workflow that is not documented here? Email contact@eresussec.com.