Blumira Findings

Blumira Findings

Overview

Findings are Blumira's primary security detection unit — they represent threats, suspicious activity, or policy violations detected across your environment. This skill covers the full finding lifecycle from discovery through resolution.

Anti-triggers

• Any client account other than your own org — every tool here is an /org/* call scoped to the credential's own organization. With MSP credentials these return 403 or an empty set; use blumira-msp and its blumira_msp_findings_* equivalents.
• Choosing between Valid / Not Applicable / False Positive — the resolve call is here, but the disposition semantics and their effect on detection tuning are blumira-resolutions.
• A detection from another security product — "finding", "alert", and "detection" are shared vocabulary. Use huntress-incidents, sentinelone-alerts, blackpoint-incident-response, or cipp-alerts depending on which platform raised it.
• Containing or remediating the threat — Blumira has no isolate, kill, or block action; resolving a finding is a bookkeeping change only. Response happens in the EDR or firewall.

Key Concepts

Finding Statuses

Status Code	Label	Description
10	Open	New, unreviewed finding
20	In Progress	Under investigation
30	Resolved	Closed with a resolution

Finding Severity

Findings have severity levels (e.g., LOW, MEDIUM, HIGH, CRITICAL) that indicate the potential impact. Always triage CRITICAL and HIGH findings first.

Resolution Types

When resolving a finding, you must specify a resolution type:

Resolution Code	Label	Use When
10	Valid	Confirmed real threat, action was taken
20	Not Applicable	Finding doesn't apply to this environment
30	False Positive	Detection was incorrect

API Patterns

List Findings

blumira_findings_list
  status.eq=10          # Open findings only
  severity.in=HIGH,CRITICAL
  order_by=-created     # Most recent first
  page_size=25