Skip to content

Resolution wizard

Open findings offer Guided Resolve: DXDT drafts a step-by-step resolution plan from the finding's own evidence, verifies each step against your live environment as you work, and finishes by re-running the original detection to prove the issue is actually gone. DXDT never executes a fix — you run the commands; DXDT plans, verifies, and keeps the record.

The flow

  1. Plan. Click Guided Resolve on a finding. DXDT reads the finding's evidence and drafts a plan (up to 8 steps) for the whole duplicate cluster — plans are shared, so two teammates opening the same issue see the same plan and each other's progress.
  2. Work the steps. Each step carries instructions with evidence citations and up to two commands:
    • a fix command — labeled "run this yourself; DXDT never executes it", with a copy button;
    • a verification command — read-only, executed by DXDT only when you click Verify, with a "Done when: …" expectation.
  3. Verify. Clicking Verify runs the read-only check server-side (it passes through the same read-only gate as every DXDT check) and judges the output against the step's expectation. If a cloud API hasn't caught up with your change yet, the wizard says so and retries shortly — cloud APIs can lag a real fix by a few minutes.
  4. Confirm or skip. Steps that can't be checked automatically show "How to confirm" guidance and a Mark done button. Any non-final step can be skipped with a reason (recorded in the audit trail) — skipping unblocks the flow without pretending the step was done.
  5. Final check. The last step is always platform-controlled: once every other step is verified, confirmed, or skipped, Run final check re-runs the original detection against your environment.
    • Issue gone → the entire cluster is marked resolved with the evidence on record, estimated savings are realized into your value metrics, and a learning is written to institutional memory.
    • Issue still present → the wizard says so honestly, shows the run summary, and offers to regenerate the plan.

If the finding's evidence changes while a plan is open (a re-scan saw something new), the wizard flags the plan as stale and offers a refresh.

Destructive commands

If a fix command looks destructive (delete / destroy / terminate and similar), the wizard withholds the copy button behind an explicit acknowledgment — a reminder to check backups, dependent systems, and change windows first. This is a prompt, not a guarantee: the check is a keyword heuristic, so always read a command before running it in production.

The record

Every wizard action is auditable:

  • Step verifications, manual confirmations, and skips (with reasons) are appended to the finding's audit trail and the organization's immutable audit log.
  • Resolutions carry the detection re-run's evidence and the resolver — visible later in the Pulse Resolved tab.

API surface (session or read_write token):

Endpoint Purpose
POST /api/pulse/findings/{id}/resolution-plan Get-or-create the cluster's plan
GET /api/pulse/plans/{id} Plan status, steps, verification state
POST /api/pulse/plans/{id}/steps/{seq}/verify Run a step's read-only check
POST /api/pulse/plans/{id}/steps/{seq}/confirm Mark a step done manually
POST /api/pulse/plans/{id}/steps/{seq}/skip Skip with a recorded reason
POST /api/pulse/plans/{id}/finalize Run the final detection re-run

Troubleshooting

Symptom What it means
"Plan generation failed" / taking longer than expected Generation hit an error or exceeded ~2 minutes — Try again regenerates from the same evidence.
"Change not visible yet" The read-only check ran but the cloud API hasn't reflected your fix; the wizard auto-retries, or click Verify again in a few minutes.
"The check ran but judging its output failed" The verification executed but couldn't be judged — click Verify to retry; nothing was marked.
"The final step cannot be skipped" By design — the detection re-run is the proof of resolution and is never skippable.
"A short reason is required" Skips require a brief reason (it goes in the audit trail).
Final check reports the issue still present The detection genuinely still fires. Re-check the steps (something may have been skipped that mattered) or Regenerate for a fresh plan against current evidence.
Copy button disabled on a command The destructive-command acknowledgment hasn't been given yet — read the warning and confirm.