# Posture

> See which detections are active, what data they need, review findings and manage suppressions in Vigilbase OS.

Source: https://docs.vigilbase.com/os/posture

**Posture** shows what Vigilbase can detect with the data you have, and what it found. Open it from the sidebar or press `g` then `p`. You need the `detections.read` permission.

The page has four tabs: **Detection catalogue**, **Findings**, **Suppressions** and **Processing health**.

## Detection catalogue

The summary at the top shows how many detections are active, and how many more could start without connecting anything new. Detections are grouped by status:

| Status | Meaning |
|---|---|
| **Active** | Receiving all the data it needs. |
| **Active, with gaps** | Running, but a source is partly failing, delayed or not yet confirmed complete, so findings may be missed or late. |
| **Active, learning** | Learning what normal looks like before it raises findings. |
| **Needs data** | Turned on, but nothing connected provides the data it needs. |
| **Failing** | Evaluations are failing, so it may miss events until this is fixed. |
| **Disabled** | Turned off for this organisation. |

A detection that needs data raises no findings, so no findings from it is not evidence that you are safe.

**Do these next** lists the steps that would start the most detections, such as **Turn on**, **Finish setup**, **Reconnect**, **Check licence** or connecting a provider. **Data your detections need** shows each data area, its status, sources and which detections use it.

### Turn a detection on or off

Use the **On** or **Off** switch on a detection. You need the `detections.manage` permission. A detection marked **Shadow mode** is being evaluated before activation, and its findings are marked **Shadow**.

### Configure a detection

Open **Configuration** on a detection to edit its settings as JSON. The server validates it against the detection's schema, records the change in the audit log and reassesses coverage. Choose **Save configuration**. You need the `detections.manage` permission.

## Findings

Filter findings by **Detection**, **Status** and **Severity**. Each finding shows the entities and evidence events involved.

- **Open case** opens the investigation for the finding.
- **Change status** updates the finding's status. You need the `findings.manage` permission.
- **Suppress** creates a suppression for similar findings. You need the `detections.manage` permission.

### Suppress similar findings

:::steps
1. **Choose Suppress on a finding.**
2. **Choose the Scope.** Suppress findings for these entities, or for this exact finding fingerprint only.
3. **Choose when it Expires after:** 1, 7, 30 or 90 days.
4. **Choose Create suppression.**
:::

Suppressions always expire and are audited. They affect only new matching findings; existing findings and their evidence stay available.

## Suppressions

This tab lists every suppression as **Active suppression**, **Expires within 24 hours** or **Expired**. Choose **End suppression** to end one early; new matching observations become eligible for detection again.

## Processing health

This tab shows recorded processing faults and late arrivals for the last seven days. Failed evaluations are isolated, and missed evidence is reassessed after recovery. Review the detection catalogue separately for missing or delayed feeds.