> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started: Security Analyst

> Onboarding guide for Security Analysts managing finding triage, risk prioritization, and remediation tracking.

As a **Security Analyst**, you operate Snapsec daily to investigate vulnerabilities, evaluate exploitability, eliminate false positives, and coordinate remediation across engineering teams.

***

## 1. The Daily Triage Workflow

```mermaid theme={null}
flowchart TD
    A["New Findings Detected"] --> B["Review TrueRisk™ Score"]
    B --> C{"Exploitable & Valid?"}
    C -->|No / False Positive| D["Apply Suppression Rule"]
    C -->|Blocked by Business Impact| E["Raise Remediation Blocker"]
    C -->|Yes| F["Assign Team & Create Jira Ticket"]
    F --> G["Monitor SLA Timeline"]
    G --> H["Verify Fix via One-Click Retest"]
```

***

## 2. Prioritizing by TrueRisk™

Rather than relying purely on CVSS base scores, analyze the contextual factors provided by Snapsec:

* **Asset Exposure**: Is the affected asset exposed to the public internet (ASM) or isolated in an internal subnet?
* **Asset Criticality**: Is this classified as a Production Tier-1 service handling PII/PCI data?
* **Exploit Status**: Is there an active public exploit (CISA KEV, Metasploit, Exploit-DB) or high EPSS probability?

***

## 3. Managing Remediation Blockers

When an engineering team cannot patch immediately due to upstream dependencies or production freeze:

1. Open the finding and select **Raise Blocker**.
2. Specify the blocker category (e.g., `Awaiting Vendor Patch`, `Scheduled Maintenance Window`, `Architectural Redesign`).
3. Set an expiration date. If approved by the Security Administrator, the SLA pause is recorded in the audit log.

***

## 4. Generating Executive & Compliance Reports

1. Navigate to **Platform > Reports**.
2. Select report templates: **Executive Summary**, **OWASP Top 10 Compliance**, or **Remediation SLA Audit**.
3. Export as branded PDF or CSV for executive presentations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.