Skip to main content

​
Search

Open Search in the desktop sidebar or mobile navigation, or visit Search. Your role needs the existing engagement-detail read permission. User and Subscriber both inherit that permission; results still depend on your current organization and engagement assignments or team membership. Read-only engagement access permits searching. Organization Notes Library title/body results additionally require the existing Edit Engagement permission, checked from your fresh role in the same search snapshot. Operator and Organization Owner can receive these library results even without visible engagements. User and Subscriber retain their engagement-reader results without library content. Read-only membership does not block library reads. Enter up to 200 characters in Keyword, choose any filters, then select Search. Matching is case-insensitive literal substring matching: percent signs, underscores, backslashes, quotes, and Unicode are text, not wildcard syntax. An empty keyword searches all authorized current content. The displayed count and results belong to the submitted search. Editing the controls does not change them until you submit again. Use submitted filters restores those submitted controls. Search and filter changes start at the first page; Previous and Next retain the submitted filters. The default page contains 20 results. Clear removes the keyword, filters, and page selection. If navigation fails, the controls remain available to retry. Once the current submitted results arrive, delayed older replies do not remove their count, filters, links, or pagination, and do not replace text you are still typing. Account and organization identity comes from the authenticated dashboard layout. Changing that identity clears the prior account’s results and draft; a delayed prior-account reply cannot restore them. If layout identity is unavailable, search controls and content stay hidden until you refresh your session.

​
Filters

Select multiple values within a filter to match any of them. Different filters and the keyword must all match. Missing metadata stays missing. Content without an author, date, severity, or supported host association is excluded only when that corresponding filter is selected. Clearing the filter includes it again. An unavailable selected value stays visible so you can remove it. Filter options and counts use the same authorized, matching content as the results.

​
Searchable content

  • Findings: current title, description, recommendations, remediation, impact, evidence, and reproduction steps.
  • References: nonblank finding references, labelled separately. Their date, author, severity, and host associations inherit the parent finding’s metadata.
  • Notes: supporting notes, active engagement/host/service note pages, active person notes, and retained evidence originals and corrections, including promoted evidence. Authorized Notes Library results search saved title and body for root notes or notes with a complete active folder path to the organization root. Archived notes or ancestors, missing/foreign parents, and cyclic ancestry are excluded.
  • Assets: stored host technical and ownership text, addresses, and service fields.
  • Reports: current report title, description, and content. Text retained in the current report remains searchable even if its original finding changed.
Results show an escaped plain-text snippet of up to 240 characters and open the existing finding, report, engagement, or Notes Library workspace. Library results are labelled Organization Notes Library and link to /dashboard/notes, where you select the saved note; the link does not preselect a note. Library creation time and creator are stored facts, including creators who later became inactive or transferred organization. Library results have no engagement, client, severity or asset metadata; selecting those absent filters excludes them, and no null client option is offered. Existing destination access checks still apply. Applicable archived/deleted content, credentials, attachment bytes, report revision history, published report snapshots, and separate Commands/Playbooks libraries are excluded. Malformed search values or invalid UTC dates return controlled feedback. An unavailable search returns a retry message without exposing database details.