Posture

See which detections are active, what data they need, review findings and manage suppressions in Vigilbase OS.

Posture shows what Vigilbase can detect with the data you have, and what it found. Open it from the sidebar or press g then p. You need the detections.read permission.

The page has four tabs: Detection catalogue, Findings, Suppressions and Processing health.

Detection catalogue

The summary at the top shows how many detections are active, and how many more could start without connecting anything new. Detections are grouped by status:

Status	Meaning
Active	Receiving all the data it needs.
Active, with gaps	Running, but a source is partly failing, delayed or not yet confirmed complete, so findings may be missed or late.
Active, learning	Learning what normal looks like before it raises findings.
Needs data	Turned on, but nothing connected provides the data it needs.
Failing	Evaluations are failing, so it may miss events until this is fixed.
Disabled	Turned off for this organisation.

A detection that needs data raises no findings, so no findings from it is not evidence that you are safe.

Do these next lists the steps that would start the most detections, such as Turn on, Finish setup, Reconnect, Check licence or connecting a provider. Data your detections need shows each data area, its status, sources and which detections use it.

Turn a detection on or off

Use the On or Off switch on a detection. You need the detections.manage permission. A detection marked Shadow mode is being evaluated before activation, and its findings are marked Shadow.

Configure a detection

Open Configuration on a detection to edit its settings as JSON. The server validates it against the detection's schema, records the change in the audit log and reassesses coverage. Choose Save configuration. You need the detections.manage permission.

Findings

Filter findings by Detection, Status and Severity. Each finding shows the entities and evidence events involved.

Open case opens the investigation for the finding.
Change status updates the finding's status. You need the findings.manage permission.
Suppress creates a suppression for similar findings. You need the detections.manage permission.

Suppress similar findings

Choose Suppress on a finding.
Choose the Scope. Suppress findings for these entities, or for this exact finding fingerprint only.
Choose when it Expires after: 1, 7, 30 or 90 days.
Choose Create suppression.

Suppressions always expire and are audited. They affect only new matching findings; existing findings and their evidence stay available.

Suppressions

This tab lists every suppression as Active suppression, Expires within 24 hours or Expired. Choose End suppression to end one early; new matching observations become eligible for detection again.

Processing health

This tab shows recorded processing faults and late arrivals for the last seven days. Failed evaluations are isolated, and missed evidence is reassessed after recovery. Review the detection catalogue separately for missing or delayed feeds.