Triaging from the terminal

cf triage is how a decision about a finding gets written down. Reading a finding and moving on leaves no record. Saying that it is not real, or that it is real and you are living with it, does.

cf triage a1f3c2 false-positive --note "the path is behind an internal-only gateway"
cf triage 9b02de accepted-risk --note "scheduled for the Q4 rewrite"
cf triage a1f3c2 open

The three decisions

Spell them however reads naturally: dismiss means the same as false-positive, accept the same as accepted-risk, and reopen the same as open. Anything else is refused with invalid_triage_status rather than guessed at.

The note is the point

--note takes any text and stores it with the decision. Six months on, the useful record is not that someone dismissed a finding, it is why. A dismissal with no reason is a decision nobody can review later, including you.

Every triage decision is recorded in the audit log with who made it and when, so cf audit --category finding is where you go to read them back.

Short ids

The ids cf reproduced prints are short on purpose, and cf triage accepts any prefix long enough to be unambiguous. If two findings in the scan share it, the command says so rather than picking one.

What the next scan does with it

Findings are tracked across scans by a fingerprint built from the rule, the location, and the enclosing function, and your decision travels with the fingerprint. That is what stops a dismissed finding coming back every time somebody runs a formatter. A finding with no fingerprint cannot carry a decision forward and is refused with finding_not_triageable rather than accepting one that would be lost.

Who can do it

Anyone in the organization. Triage is the one consequential action a member holds, because the person reading the finding is usually the person who knows whether it is real. See Organizations.