Findings
A finding is a non-compliant resource detected by a policy. Kostavo tracks findings over time so you can see trends, spot recurring issues, and know when problems resolve themselves.
Finding States
| State | Meaning |
|---|---|
| Open | The resource is currently non-compliant. Stays open as long as the policy keeps detecting it. |
| Resolved | The resource is no longer flagged. Kostavo auto-resolves findings after they go undetected for a configurable number of consecutive runs (default: 2). |
| Suppressed | You've chosen to ignore this finding; it won't trigger actions or notifications. |
If a resolved finding reappears in a later run, it automatically re-opens.
Suppress vs Exception
Two mechanisms exist for "this resource is intentionally like this", and they behave differently:
| Suppress | Exception | |
|---|---|---|
| Where | The Suppress toggle on a finding's detail | The policy's exception list in the profile editor |
| Effect | The finding stays recorded but stops triggering actions and notifications | The policy skips the resource entirely; no finding is created at all |
| Scope | One finding on one resource | One resource for one policy, across all workspaces using the profile |
| Best for | Temporary or case-by-case decisions, reversible any time | Permanent, structural exemptions (streaming ingest, 24/7 serving) |
Rule of thumb: suppress when you are deciding about this occurrence; add an exception when the resource should never be evaluated by that policy. A findings list full of suppressed rows is a sign those should have been exceptions.
This is the canonical explanation; guides link back here rather than re-explaining it.
What a Finding Shows
Each finding includes:
- Resource: name, type (cluster, warehouse, job, etc.), and link to Databricks
- Issue: what's wrong with the resource
- Severity: inherited from the policy configuration
- Action taken: NOTIFIED, FIXED, REMOVED, FAILED, or SKIPPED
- First seen / Last seen: when it was first and most recently detected
- Occurrences: how many times it's been flagged
Deduplication
If the same resource is flagged in consecutive runs, Kostavo tracks it as one finding, not a new one each time. This prevents duplicate notifications and keeps your counts accurate.
Execution History
Every scan run produces an execution record showing:
- Which policies ran and how long they took
- How many findings each policy produced
- What actions were taken
You can filter execution history by workspace, profile, or status.
Cooldown
The check_cooldown_hours setting prevents repeated actions on the same resource within a time window. After an action is taken, the finding enters cooldown: the policy still runs and records findings, but actions are skipped.
Related
- Guide: Triage findings is the day-to-day workflow built on this lifecycle
- Guide: Set up Slack and Teams notifications controls how findings reach you
- Reference: Action modes explains what happens when a finding triggers an action