How do I view and resolve findings?

A finding is the record of what the scanner concluded about one object: the verdict, the signals that produced it, the site and account it belongs to, and what action was taken. Findings are kept for 180 days by default.

From the command line

shelltrap findings list
shelltrap findings show <id>
shelltrap findings resolve <id>

Add --json before the command to get the API response unchanged, which is what you want in a script:

shelltrap --json findings list

From the CyberPanel plugin

The findings page offers filters, paging, a detail view and the signal list. Administrators see every site; resellers and customers see their own sites and objects only, and that boundary is enforced by the broker, not by the user interface.

Reading a finding

The detail view shows which engine produced the hit and, for rule-based hits, the rule's author, source and licence where the rule provides them. For heuristic findings it lists the individual signals and their scores — PHP obfuscation markers such as eval, base64_decode, gzinflate, str_rot13, chr chains, long hex strings, variable function calls and entropy; PHP inside an upload directory; .htaccess and .user.ini tricks such as AddHandler, AddType and auto_prepend_file; symlinks pointing out of the home directory; world-writable and setuid files.

This is the point of the design: you can see what the scanner reasoned about instead of taking a score on faith.

What "resolve" does and does not do

Resolving a finding closes it as handled. It does not delete the audit record, it does not restore a quarantined file, and it does not stop the same file being found again if it is still there and still matches. If the file is genuinely fine, you want an ignore rule or a false-positive report instead — see the two articles on those.

Typical order of work

1. shelltrap findings show <id> — read the signals and the path.
2. Decide: real compromise, or a false positive?
3. Real: clean up the account, then shelltrap quarantine list to confirm what was moved.
4. False positive: report it to us so the rule can be corrected for everyone, and add an ignore rule locally if you need immediate quiet.
5. shelltrap findings resolve <id>.

The audit trail

shelltrap audit tail

Every action — quarantine, restore, policy change, ignore rule, feed activation, licence state change — lands in a hash-chained audit log, kept for a year by default. In the plugin, audit is visible to administrators only.