Findings go where your team already looks. Alerts go where they already talk. Everything is available over the API.
Findings become tickets with owner, heat and evidence attached. Closing the ticket triggers a retest.
finding.verified → ticket · ticket closed → retest
finding.verifiedfinding.routedretest.passedHot findings and retest results post to the channel you choose, with the evidence a click away.
finding.verified → channel · retest.passed → channel
finding.verifiedfinding.fixedretest.passedVerified findings and surface changes stream as events, ready for your playbooks.
finding.* and surface.changed → event stream
finding.verifiedfinding.routedfinding.fixedsurface.changedoperation.startedRead-only connections enrich discovery with what is actually deployed.
read-only inventory → Sight
Single sign-on for access, and identity context for discovery.
SSO → access · directory → Sight
Gate releases on open hot findings, and trigger retests from your pipeline.
pipeline → retest · open hot findings → gate
finding.fixedretest.passedA critical finding verified at 03:00 pages the person on call, with the evidence in the alert.
finding.verified (critical) → page
finding.verifiedEverything in the platform, available to your own tooling.
every event → your endpoint
finding.verifiedfinding.routedfinding.fixedsurface.changedoperation.startedretest.passedA rule reads like a sentence: when a finding is verified, if it is hot and belongs to Platform, create the ticket, tell the channel and retest when the ticket closes. You write the rules once. The platform runs them on every finding, and logs every action it takes.
Every verified finding arrives in Resolve with an owner, a heat-ranked priority and a fix plan Saluki writes for it: what to change, where, and how to confirm it. Run remediation entirely in the platform, connect the tools you already use, or do both. Close the ticket in Jira and Saluki retests. Mark it fixed in Saluki and the ticket closes. The finding keeps one timeline either way.
Every verified finding leaves the platform as an event and lands in the tool that owns the next step. When that tool closes the ticket, the platform hears it, retests the finding and only then calls it fixed, in Saluki and in the ticket.
Every event, on the wire.
Six event types cover the loop end to end. Subscribe a webhook, or pull anything in the platform over the API.
finding.verifiedPursuit reproduced a finding and an operator cleared it.finding.routedA ticket was raised and an owner assigned.finding.fixedA retest passed and the finding closed.surface.changedSight found, lost or re-classified an asset.operation.startedA red team operation, campaign or retest batch began.retest.passedA retest ran from a clean session and the path no longer works.{"event": "finding.verified","heat": 91,"severity": "critical","title": "Admin panel reachable from the internet","asset": "vpn-02.brackwell.example","owner": "Platform team","evidence": "https://app.saluki.example/f/PR-0917"}