Turn on finding types
C1 comes with a catalog of built-in finding types, grouped by category. Most are opt-in — you choose which conditions matter to your organization — but a handful are on by default, so C1 starts surfacing them without any setup.The finding types on by default are the ones built on unambiguous evidence: a decoy was touched, a credential is confirmed public, a connector’s anomaly detection is confirmed off, or a non-human identity has no owner. Finding types that instead rely on inference over synced data are off by default, so you can look at the results before turning them loose.You can turn any finding type on or off at any time from the settings menu — the gear icon at the top of the Findings page. See the finding catalog reference below for which finding types are on by default.
1
From any tab in Findings, click the settings (gear) icon at the top right of the page.
2
In Findings settings, toggle on the finding types you want C1 to detect. Each type shows a short description of what it looks for.
3
Click Save changes.
Turning off a finding type stops C1 from creating new findings of that type. Findings of that type that are already open stay open — nothing re-checks them, so they won’t resolve automatically.
Finding catalog reference
The following finding types are available today. Types marked On by default start detecting immediately; everything else needs to be turned on from the settings menu.Work with a finding
Click a finding from the Overview or All findings tab to open its detail view, which includes:- Evidence — why C1 flagged this finding, including any confidence score.
- Activity — an audit trail of everything that’s happened to the finding, including when it was created, when routing rules evaluated against it, and any evidence updates.
- Accept risk — formally acknowledge the finding as a known risk. Requires a justification and an expiration date. The finding reopens automatically when the acceptance period ends.
- Suppress — permanently hide the finding from the default view and exclude it from posture scores. Requires a reason.
- Snooze — temporarily hide the finding. Requires a duration (1, 7, 30, or 90 days, or a custom date) and a reason. The finding automatically returns to open status when the snooze period ends.
- Remediate — resolve and close the finding. This action only appears for finding types that support it. Its label also varies by finding type — for example, a service account misclassification finding offers Confirm human and Mark as service instead of a generic remediate button.
Act on multiple findings at once
From All findings, select multiple findings with the checkbox column, or use Select all N in filter to apply an action to every finding matching your current filters. Choose Snooze, Suppress, Accept risk, or Reopen from the bulk action menu. Because these four actions apply to different finding states, the menu shows how many of your selected findings each one can actually change (for example, “Reopen — 3 of 12”), and the confirmation dialog restates that split before you commit. Only eligible findings are changed. Bulk actions require the same permission as changing a single finding’s state, so read-only users don’t see the selection controls.Transformation rules
Transformation rules reshape a finding’s data — for example, escalating its severity or adding annotations — before a routing rule acts on it. Use them to make sure the findings that matter most are marked that way consistently. Your routing rules can then act on severity or annotations directly, instead of re-deriving that context from scratch. Go to Findings > Transformation rules to create or manage rules of this type. Each rule has:- A match condition — narrow the rule to a specific app, finding type, or a CEL expression referencing
finding.severity,finding.state,finding.risk_score, orfinding.annotations. Leave everything unset to match every finding. - One or more transforms — set severity, add annotations, or remove annotations.
finding.app_id == "<app-id>" that sets severity to Critical. A routing rule can then match on that Critical severity and escalate automatically.
You can create as many transformation rules as you need. Every rule whose condition matches a finding is applied, in ascending order by the rule’s Order value — later rules override earlier ones where they conflict.
Routing rules
Routing rules turn triage into automation. Instead of someone opening every finding to decide what happens next, a routing rule matches on a condition and immediately suppresses, snoozes, accepts, remediates, or dispatches it. No manual review is required unless nothing matches. Go to Findings > Routing rules to create or manage them. Each rule has:- A match condition — the same app, finding type, or CEL expression matching used by transformation rules.
- An action — No action, Suppress, Snooze, or Accept risk. Remediate is also available for finding types that support it.
- Dispatchers (optional) — fire a webhook, invoke a function, or trigger an automation every time the rule matches.
finding.severity == FINDING_SEVERITY_LOW and action Suppress. Escalate anything Critical with a rule matching finding.severity == FINDING_SEVERITY_CRITICAL that triggers an automation to notify your team or open a ticket.
Unlike transformation rules, routing rules stop at the first match. C1 evaluates rules in ascending order by Order and applies only the first one that matches.
Order rules effectively
Transformation rules and routing rules order in opposite directions, and mixing up the two is the most common way a rule set stops working as expected.- Transformation rules apply cumulatively — every matching rule runs, and later rules override earlier ones. Put your general, default-setting rules early and your specific overrides later.
- Routing rules stop at the first match — only one rule ever runs. Put your specific, narrow rules early and your general, catch-all rules last. A broad rule placed too early will catch findings a later, more specific rule was meant to handle.
- Test a routing rule’s match condition with the No action action first, which matches the finding without changing its state. Confirm it’s catching the right findings before wiring up Suppress, Snooze, or a dispatcher.
- Leave gaps between Order values (10, 20, 30 instead of 1, 2, 3) so you can insert a new rule later without renumbering the rest.
- If you want a default outcome for anything your specific rules don’t catch, add a broad rule with no match condition (Match all) at the end of your routing rules.
Example: catch and escalate decoy credential use
This walkthrough combines a finding type, a transformation rule, and a routing rule to automatically flag and escalate decoy credential use. It’s a strong signal of compromise that shouldn’t wait for someone to notice it in the findings list. See Decoys for how to plant a decoy credential.1
Navigate to Findings, click the settings menu (gear icon) in the upper right corner of the page, and turn on Decoy credential used.
2
Save your changes.
3
Go to Transformation rules > Create rule.
4
Set Finding type to Decoy credential used, and leave App and the expression unset to match every app.
5
Add a Set severity transform and set it to Critical.
6
Save the transformation rule.
7
Go to Routing rules > Create rule.
8
Set Finding type to Decoy credential used.
9
Set Action to No action, so the finding stays open for review.
10
Add a Trigger automation dispatcher to notify your security team immediately.
11
Set this rule’s Order so it runs before any broad catch-all routing rules. A general rule like “suppress low severity findings” could otherwise match first and prevent this one from running.