listFindings
List and filter Mallory findings, returning lean summaries as {items,total,offset,limit}. Each item includes: title, status, severity, confidence, the owning definition's slug/title/category, asset type and identifier, resolution_reason, the thread_uuid of the investigation that produced it, and timestamps; the detail object adds body / summary / remediation / evidence, any linked external tickets, and entities — the threat actors, vulnerabilities and stories this finding resolved to, which is the pivot back into Mallory's intel graph. Returns every status by default — pass status=open (or status__in=open,fixed) to narrow. Sort by created_at, updated_at, status, title, severity, or asset_identifier; severity sorts INFO < LOW < MEDIUM < HIGH < CRITICAL, so desc puts Critical first. Notable fieldFilters: status, severity, definition_slug, definition_category, asset_type, asset_identifier, title, resolution_reason (also resolution_reason__isnull=true for closed findings with no reason recorded), thread_uuid to scope to one investigation. Enum values are case-sensitive and each field has its own set: severity is UPPERCASE (CRITICAL, HIGH, MEDIUM, LOW, INFO); status is lowercase and has exactly three values (open, fixed, dismissed); resolution_reason is lowercase and separate from status (false_positive, accepted_risk, not_applicable, duplicate, fixed_externally, other); definition_category is lowercase-hyphenated (e.g. public-exposure). Send values, not enum member names. definition_category is the exception: equality and membership ONLY (bare, __in, __not_in) — the __contains/__ilike/__neq the other fields accept are dropped on it, and you get the unfiltered list back. asset_type is a free-text column in provider.service.object form (e.g. aws.s3.bucket, not s3), so a partial value matches nothing unless you use asset_type__ilike. Field operators append to a field name with __: a bare field name is exact match, and the string/enum fields (status, severity, title, definition_slug, asset_type, asset_identifier, resolution_reason) also take __neq, __in, __not_in, __contains, __not_contains, __ilike. This endpoint has NO __like. Timestamps are created_at / updated_at with __gte and __lt ONLY, a half-open range — __gt, __lte and a bare created_at are not parameters at all. An operator this endpoint does not define is dropped silently rather than rejected, so guessing one returns a WIDER result set that looks filtered. Pass an item's identifier to getFinding for the full detail object.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Field to sort by (see this tool's sort fields). | |
| limit | No | Max items to return (1-100, default 25). | |
| order | No | Sort order (default: desc). | |
| filter | No | Full-text search over the finding's title, asset identifier, body, summary, remediation and asset details. Supports web-search query syntax, and AND-combines with the other filters. | |
| offset | No | Items to skip, for pagination. | |
| fieldFilters | No | Advanced structured filters as a map of query-param name -> value. Use a bare field for exact match, or a field__operator key for ranges/sets. Field operators append to a field name with `__`: a bare field name is exact match, and the string/enum fields (status, severity, title, definition_slug, asset_type, asset_identifier, resolution_reason) also take __neq, __in, __not_in, __contains, __not_contains, __ilike. This endpoint has NO __like. Timestamps are created_at / updated_at with __gte and __lt ONLY, a half-open range — __gt, __lte and a bare created_at are not parameters at all. An operator this endpoint does not define is dropped silently rather than rejected, so guessing one returns a WIDER result set that looks filtered. |