> ## Documentation Index
> Fetch the complete documentation index at: https://silmaril.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Review findings

> Connect a Firewall finding to its event, decision, and application behavior.

Open the dashboard supplied for your deployment. Select the Firewall and time window, then open **Findings**. Use **Monitoring** to review traffic volume alongside findings.

## Inspect the event

Open a finding and record its finding ID, request ID, timestamp, hook, and tool name. Review the available conversation and captured evidence to understand the input, proposed action, and preceding events.

Read the prediction, applicable governance decision, and effective mode together. A finding can describe a would-block event observed in Shadow or Warn. Confirm actual execution behavior in your application when investigating impact.

Captured evidence can be partial or unavailable. Check the evidence availability notice before drawing conclusions about what the model saw. Handle payloads as untrusted content and keep sensitive excerpts within your authorized review workflow.

## Report a false positive

Use **Support** in your dashboard and select the affected Firewall. Include the finding ID, request ID, timestamp, expected legitimate behavior, and a short explanation of why the action was authorized.

Share a sanitized reproduction when possible. Keep API keys, credentials, and unrelated private content out of the report. Silmaril can arrange access to additional evidence when needed.

Feedback gives the team evidence to investigate and evaluate improvements. Confirm any enforcement change separately before relying on it.

## Investigate with an MCP client

Use [Firewall MCP](https://silmaril.dev/docs/integrations/firewall-mcp.md) to summarize traffic and findings, build an investigation packet, and retrieve authorized detail. Start with aggregates and narrow to the evidence the review needs.

For missing events or connection failures, see [troubleshooting](https://silmaril.dev/docs/operate/troubleshooting.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.