From eb2e1167ffad589df703b0fd0b6c666f807d5ef9 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 23 Jul 2026 12:47:51 -0700 Subject: [PATCH 01/21] Draft IA reframe: split end-user guides into own tab, promote MCP servers, group AI agent governance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rough pass at a new admin-guide structure to make room for the upcoming Shadow AI Discovery, Agentic Vault, Agent Runtime Governance, and Agentic Security & Intelligence features alongside the existing AI access management, enterprise-managed authorization, and cloud infrastructure access sections. Splits end-user guides into their own top-level tab and promotes MCP server setup guides out of a nested subgroup. Not for merge yet — several referenced pages don't exist. Co-Authored-By: Claude Sonnet 5 --- docs.json | 319 +++++++++++++++++++++++++++++------------------------- 1 file changed, 171 insertions(+), 148 deletions(-) diff --git a/docs.json b/docs.json index dd748137..f33e6f72 100644 --- a/docs.json +++ b/docs.json @@ -72,18 +72,8 @@ "tab": "Home" }, { - "icon": "book", + "icon": "compass", "pages": [ - { - "group": "Welcome", - "pages": [ - "product/intro", - "product/release-notes", - "product/how-to/qs-set-up-c1", - "product/admin/ai-assistant", - "product/glossary" - ] - }, { "group": "End-user guides", "pages": [ @@ -95,19 +85,159 @@ "product/how-to/ai-tools", "product/how-to/connect-mcp-client" ] - }, + } + ], + "tab": "Using C1" + }, + { + "icon": "gear", + "pages": [ { - "group": "AI access management", - "tag": "NEW", + "group": "Overview", "pages": [ - "product/admin/aiam-overview", + "product/intro", + "product/how-to/qs-set-up-c1", + "product/release-notes", + "product/admin/ai-assistant", "product/admin/c1-mcp", - "product/admin/enable-ai-access-management", - "product/admin/mcp-servers", + "product/glossary" + ] + }, + { + "group": "Workforce & app access", + "pages": [ + { + "group": "Applications", + "pages": [ + "product/admin/applications", + { + "group": "Configure apps", + "pages": [ + "product/admin/managing-accounts", + "product/admin/managing-resources", + "product/admin/managing-entitlements", + "product/admin/relationships" + ] + }, + { + "group": "Provisioning", + "pages": [ + "product/admin/provisioning", + "product/admin/account-provisioning" + ] + }, + "product/admin/c1-for-c1", + "product/admin/shadow-apps" + ] + }, + { + "group": "Access requests", + "pages": [ + { + "group": "Get started with access requests", + "pages": [ + "product/how-to/qs-self-service-requests", + "product/how-to/qs-okta-app-requests", + "product/how-to/qs-onelogin-app-requests", + "product/how-to/qs-entra-app-requests", + "product/how-to/qs-aws-jit-identity-center", + "product/how-to/qs-gcp-jit", + "product/how-to/qs-on-call-access-control" + ] + }, + "product/admin/access-requests", + "product/admin/customize-requests", + "product/admin/entitlement-config-rules", + "product/admin/emergency" + ] + }, { - "group": "MCP server setup guides", + "group": "Access conflicts", "pages": [ - "product/admin//mcp-server/mcp-bridge", + "product/admin/access-conflicts" + ] + }, + { + "group": "Access profiles", + "pages": [ + "product/admin/profiles", + "product/admin/role-mining", + "product/admin/dynamic-access-control" + ] + }, + { + "group": "Campaigns", + "pages": [ + "product/how-to/qs-user-access-reviews", + "product/admin/campaigns", + "product/admin/campaign-scope-by-inheritance", + "product/admin/manage-campaigns" + ] + }, + { + "group": "Directory", + "pages": [ + "product/admin/directory", + "product/admin/attributes", + "product/admin/push-rules", + "product/admin/profile-types", + "product/admin/groups", + "product/admin/user-roles", + "product/admin/delegate" + ] + }, + { + "group": "Automations", + "pages": [ + "product/admin/automations", + "product/admin/automations-triggers-reference", + "product/admin/automations-steps-reference", + "product/admin/automation-actions", + "product/admin/automation-circuit-breaker", + "product/admin/automation-examples" + ] + }, + { + "group": "Functions", + "pages": [ + "product/admin/functions", + "product/admin/functions-create", + "product/admin/functions-automations", + "product/admin/functions-api", + "product/admin/functions-reference" + ] + } + ] + }, + { + "group": "AI agent governance", + "pages": [ + { + "group": "Discover", + "tag": "NEW", + "pages": [ + "product/admin/shadow-ai-discovery" + ] + }, + { + "group": "Manage agent access", + "tag": "NEW", + "pages": [ + "product/admin/aiam-overview", + "product/admin/enable-ai-access-management", + "product/admin/tools-and-toolsets", + "product/admin/tool-call-hooks", + "product/admin/agent-runtime-governance", + "product/admin/ai-clients", + "product/admin/audit-ai-tool-usage" + ] + }, + { + "group": "MCP servers", + "tag": "NEW", + "pages": [ + "product/admin/mcp-servers", + "product/admin/mcp-server/mcp-bridge", "product/admin/mcp-server/apollo", "product/admin/mcp-server/auth0", "product/admin/mcp-server/azure-devops", @@ -148,147 +278,50 @@ "product/admin/mcp-server/wiz" ] }, - "product/admin/tools-and-toolsets", - "product/admin/tool-call-hooks", - "product/admin/ai-clients", - "product/admin/audit-ai-tool-usage" - ] - }, - { - "group": "Enterprise-managed authorization", - "tag": "NEW", - "pages": [ - "product/admin/enterprise-managed-authorization/overview", - "product/admin/enterprise-managed-authorization/enable", - "product/admin/enterprise-managed-authorization/resource-servers", - "product/admin/enterprise-managed-authorization/scopes-and-profiles", - "product/admin/enterprise-managed-authorization/audit", - "product/admin/enterprise-managed-authorization/support-in-your-app" - ] - }, - { - "group": "Cloud infrastructure", - "tag": "NEW", - "pages": [ - "product/admin/cloud-infrastructure-access" - ] - }, - { - "group": "Campaigns", - "pages": [ - "product/how-to/qs-user-access-reviews", - "product/admin/campaigns", - "product/admin/campaign-scope-by-inheritance", - "product/admin/manage-campaigns" - ] - }, - { - "group": "Applications", - "pages": [ - "product/admin/applications", { - "group": "Configure apps", + "group": "Enterprise-managed authorization", + "tag": "NEW", "pages": [ - "product/admin/managing-accounts", - "product/admin/managing-resources", - "product/admin/managing-entitlements", - "product/admin/relationships" + "product/admin/enterprise-managed-authorization/overview", + "product/admin/enterprise-managed-authorization/enable", + "product/admin/enterprise-managed-authorization/resource-servers", + "product/admin/enterprise-managed-authorization/scopes-and-profiles", + "product/admin/enterprise-managed-authorization/audit", + "product/admin/enterprise-managed-authorization/support-in-your-app" ] }, { - "group": "Provisioning", + "group": "Agent credentials & vaulting", + "tag": "NEW", "pages": [ - "product/admin/provisioning", - "product/admin/account-provisioning" + "product/admin/agentic-vault", + "product/admin/vaults", + "product/admin/secret-sharing" ] - }, - "product/admin/c1-for-c1", - "product/admin/shadow-apps" - ] - }, - { - "group": "Access requests", - "pages": [ - { - "group": "Get started with access requests", - "pages": [ - "product/how-to/qs-self-service-requests", - "product/how-to/qs-okta-app-requests", - "product/how-to/qs-onelogin-app-requests", - "product/how-to/qs-entra-app-requests", - "product/how-to/qs-aws-jit-identity-center", - "product/how-to/qs-gcp-jit", - "product/how-to/qs-on-call-access-control" - ] - }, - "product/admin/access-requests", - "product/admin/customize-requests", - "product/admin/entitlement-config-rules", - "product/admin/emergency" - ] - }, - { - "group": "Access conflicts", - "pages": [ - "product/admin/access-conflicts" - ] - }, - { - "group": "Access profiles", - "pages": [ - "product/admin/profiles", - "product/admin/role-mining", - "product/admin/dynamic-access-control" - ] - }, - { - "group": "Automations", - "pages": [ - "product/admin/automations", - "product/admin/automations-triggers-reference", - "product/admin/automations-steps-reference", - "product/admin/automation-actions", - "product/admin/automation-circuit-breaker", - "product/admin/automation-examples" - ] - }, - { - "group": "Functions", - "pages": [ - "product/admin/functions", - "product/admin/functions-create", - "product/admin/functions-automations", - "product/admin/functions-api", - "product/admin/functions-reference" + } ] }, { - "group": "Access intelligence", + "group": "Risk & intelligence", "pages": [ "product/admin/query", "product/admin/inventory", - "product/admin/external-insights" + "product/admin/external-insights", + "product/admin/agentic-security-intelligence" ] }, { - "group": "Directory", + "group": "Cloud infrastructure access", + "tag": "NEW", "pages": [ - "product/admin/directory", - "product/admin/attributes", - "product/admin/push-rules", - "product/admin/profile-types", - "product/admin/groups", - "product/admin/user-roles", - "product/admin/delegate" + "product/admin/cloud-infrastructure-access" ] }, { - "group": "Platform", + "group": "Platform & administration", "pages": [ "product/admin/policies", "product/admin/object-annotations", - "product/admin/vaults", - "product/admin/secret-sharing", "product/admin/system-log", { "group": "Integrations", @@ -348,16 +381,6 @@ } ] }, - { - "group": "CEL expressions", - "pages": [ - "product/admin/expressions", - "product/admin/expressions-reference", - "product/admin/expressions-examples", - "product/admin/expressions-workflows", - "product/admin/expressions-troubleshooting" - ] - }, { "group": "C1 CLIs", "pages": [ @@ -382,7 +405,7 @@ ] } ], - "tab": "Products" + "tab": "Admin guide" }, { "icon": "code-merge", From 9b791bd285f42cce8132a9fba7a475b160c2c9a4 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 23 Jul 2026 12:55:56 -0700 Subject: [PATCH 02/21] Rename tabs to Use C1 / Administer C1, rename group to How-to guides Co-Authored-By: Claude Sonnet 5 --- docs.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs.json b/docs.json index f33e6f72..608ec19b 100644 --- a/docs.json +++ b/docs.json @@ -75,7 +75,7 @@ "icon": "compass", "pages": [ { - "group": "End-user guides", + "group": "How-to guides", "pages": [ "product/how-to/review-tasks", "product/how-to/create-requests", @@ -87,7 +87,7 @@ ] } ], - "tab": "Using C1" + "tab": "Use C1" }, { "icon": "gear", @@ -405,7 +405,7 @@ ] } ], - "tab": "Admin guide" + "tab": "Administer C1" }, { "icon": "code-merge", From 649667c3ad7a82e01aa4d5c656305b93c3b4171e Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 23 Jul 2026 13:00:01 -0700 Subject: [PATCH 03/21] Match connect-mcp-client title/sidebar to How-to guides naming convention Co-Authored-By: Claude Sonnet 5 --- product/how-to/connect-mcp-client.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/product/how-to/connect-mcp-client.mdx b/product/how-to/connect-mcp-client.mdx index 04c6c15b..f3b1440d 100644 --- a/product/how-to/connect-mcp-client.mdx +++ b/product/how-to/connect-mcp-client.mdx @@ -1,9 +1,9 @@ --- -title: Connect your MCP client to C1 +title: How to connect your MCP client description: Authenticate once to C1, then let your AI agent reach the MCP servers you're entitled to — with short-lived, scoped tokens instead of long-lived API keys. -og:title: Connect your MCP client to C1 - C1 docs +og:title: How to connect your MCP client - C1 docs og:description: Authenticate once to C1, then let your AI agent reach the MCP servers you're entitled to — with short-lived, scoped tokens instead of long-lived API keys. -sidebarTitle: Connect your MCP client +sidebarTitle: How to connect your MCP client --- {/* Editor Refresh: 2026-06-13 */} From adfce9dbcac9d51ddd7d63036bedae32f5624fa1 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Tue, 4 Aug 2026 11:29:12 -0700 Subject: [PATCH 04/21] docs: split landing page card into Use C1 and Administer C1 Adds a new card for the Use C1 tab and renames the Products card to Administer C1, matching the reframed IA in this draft. Co-Authored-By: Claude Sonnet 5 --- index.mdx | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/index.mdx b/index.mdx index 1859de6a..d2edb026 100644 --- a/index.mdx +++ b/index.mdx @@ -53,15 +53,37 @@ mode: "custom"
{/* Feature Card 1 */} +
e.currentTarget.style.borderColor = '#1e5f67'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}> +
+ + Use C1 + + +
+

+ Use C1 +

+

+ Request access, complete review tasks, and use AI tools and MCP clients as an end user of C1. +

+ + Learn more + + + + +
+ + {/* Feature Card 2 */}
e.currentTarget.style.borderColor = '#1e5f67'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}>
- Products + Administer C1

- Products + Administer C1

Automate security for all your human, non-human, and AI identities. Run access reviews, enable self-service access, and set up just-in-time access for key resources. @@ -74,7 +96,7 @@ mode: "custom"

- {/* Feature Card 2 */} + {/* Feature Card 3 */}
e.currentTarget.style.borderColor = '#c937ae'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}>
@@ -95,7 +117,7 @@ mode: "custom"
- {/* Feature Card 3 */} + {/* Feature Card 4 */}
e.currentTarget.style.borderColor = '#c937ae'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}>
@@ -116,7 +138,7 @@ mode: "custom"
- {/* Card 4 */} + {/* Feature Card 5 */}
e.currentTarget.style.borderColor = '#1e5f67'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}>
From 85fc52b0689bc669c6ba02948350cae1dd58f6a4 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Tue, 4 Aug 2026 11:35:36 -0700 Subject: [PATCH 05/21] docs: add task-first landing page for Using C1 section Adds an overview page for the Use C1 tab, organized around what readers are trying to do rather than a list of feature names, with a first-time quickstart, admin-side disambiguation, and an FAQ. Points the homepage's Use C1 card and the tab's Overview group at it. Co-Authored-By: Claude Sonnet 5 --- docs.json | 6 ++++ index.mdx | 2 +- product/how-to/intro.mdx | 77 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 product/how-to/intro.mdx diff --git a/docs.json b/docs.json index 608ec19b..f061d57d 100644 --- a/docs.json +++ b/docs.json @@ -74,6 +74,12 @@ { "icon": "compass", "pages": [ + { + "group": "Overview", + "pages": [ + "product/how-to/intro" + ] + }, { "group": "How-to guides", "pages": [ diff --git a/index.mdx b/index.mdx index d2edb026..6db515a2 100644 --- a/index.mdx +++ b/index.mdx @@ -66,7 +66,7 @@ mode: "custom"

Request access, complete review tasks, and use AI tools and MCP clients as an end user of C1.

- + Learn more diff --git a/product/how-to/intro.mdx b/product/how-to/intro.mdx new file mode 100644 index 00000000..661e8778 --- /dev/null +++ b/product/how-to/intro.mdx @@ -0,0 +1,77 @@ +--- +title: "Using C1" +og:title: "Using C1" +og:description: "Request access, complete review and approval tasks, and work with AI tools in C1." +description: "Request access, complete review and approval tasks, and work with AI tools in C1." +sidebarTitle: "Overview" +--- +{/* Editor Refresh: 2026-08-04 */} + +Most people land here because C1 sent them a notification: a request to approve, a review to complete, or a reminder to connect an AI tool. Find your task below, or work through the quickstart if this is your first time signing in. + + +Setting up C1 for your organization — policies, connectors, access profiles — instead of using it day to day? Go to [Administer C1](/product/intro). + + +## First time in C1? + +If a colleague or an automated notification sent you here, these three steps cover the whole path from sign-in to resolution. + + + + Go to your company's C1 URL (for example, `acme.conductor.one`) and sign in with your company's SSO credentials. + + + C1 notifies you by email, Slack, or Microsoft Teams when a request or task needs your attention. Open the link in that notification, or check the **Requests** or **Tasks** page in C1 directly. + + + Follow the prompts C1 shows you for that specific request or task — the steps differ depending on whether you're requesting access, approving a request, or completing a review. + + + +C1 tracks the status of your request or task and notifies you when it changes. + +## What are you trying to do? + + + + Ask for access to an application, group, role, or other resource. + + + Get access to governed AI tools and connect your AI client to C1. + + + Verify that your access, or access you're responsible for, is still appropriate. + + + Approve, provision, or revoke access assigned to you as a task. + + + Request operational actions like device provisioning through C1's Actions catalog. + + + +## What's new + + + + The latest features, enhancements, and resolved issues. Published weekly. + + + +## Frequently asked questions about using C1 + + + + A request is something you ask for, like access to an app. A review is something you're asked to do, like confirming that a colleague's access is still appropriate as part of a [user access review campaign](/product/how-to/review-tasks). Both can show up as tasks that need your attention. + + + C1 admins control which apps and permissions you can see and request, based on your department or role. See [How to request new access](/product/how-to/create-requests) for more on how this works. + + + Someone with the right permissions — an approver, an admin, or an automated policy — can grant or revoke access on your behalf. Check [How to complete access change tasks](/product/how-to/access-change-tasks) if you're the one responsible for making that change for someone else. + + + C1 notifies you by email, Slack, or Microsoft Teams. Confirm your notification preferences on the [notification settings page](/product/admin/notifications-user-settings). + + From bcec2b7db4ccaafc4095984c2df464f1ad062a7c Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Tue, 4 Aug 2026 11:47:03 -0700 Subject: [PATCH 06/21] docs: alternate landing page card colors, match tab icons Recolors Administer C1 pink and Developer teal so the 2x3 grid checkerboards, and swaps the Use C1 / Administer C1 card icons to the same compass/gear icons used for their nav tabs. Co-Authored-By: Claude Sonnet 5 --- index.mdx | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/index.mdx b/index.mdx index 6db515a2..05e2548a 100644 --- a/index.mdx +++ b/index.mdx @@ -57,7 +57,8 @@ mode: "custom"
Use C1 - + +

@@ -75,11 +76,12 @@ mode: "custom"

{/* Feature Card 2 */} -
e.currentTarget.style.borderColor = '#1e5f67'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}> -
- + {/* Feature Card 4 */} -
e.currentTarget.style.borderColor = '#c937ae'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}> -
- +
e.currentTarget.style.borderColor = '#1e5f67'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}> +
+
@@ -130,7 +132,7 @@ mode: "custom"

Work with our Go and TypeScript SDKs, Terraform provider, and Postman integration. Integrate with, manage, and extend the C1 platform programmatically.

- + Learn more From 104dd90864e73030c13c2b81af6442975a0daead Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Tue, 4 Aug 2026 11:52:50 -0700 Subject: [PATCH 07/21] docs: use Icon component instead of hand-drawn SVGs for card icons The hand-drawn compass/gear paths rendered broken in preview. Swap to Mintlify's Icon component with the same icon names used for the Use C1 / Administer C1 tabs. Co-Authored-By: Claude Sonnet 5 --- index.mdx | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/index.mdx b/index.mdx index 05e2548a..bb34570e 100644 --- a/index.mdx +++ b/index.mdx @@ -55,11 +55,7 @@ mode: "custom" {/* Feature Card 1 */}
e.currentTarget.style.borderColor = '#1e5f67'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}>
- - Use C1 - - - +

Use C1 @@ -78,11 +74,7 @@ mode: "custom" {/* Feature Card 2 */}
e.currentTarget.style.borderColor = '#c937ae'} onMouseLeave={(e) => e.currentTarget.style.borderColor = ''}>
- - Administer C1 - - - +

Administer C1 From f51dfa47abc3900fcdef0b367d3646350f38fbbb Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Tue, 4 Aug 2026 12:22:39 -0700 Subject: [PATCH 08/21] docs: revise Using C1 landing page per review notes - Fix gerund parallelism: "Administer C1" -> "Administering C1" in the audience-disambiguation Tip - Collapse the first-time-in-C1 Steps into a collapsed Accordion so it doesn't push task cards below the fold - Move "What are you trying to do?" up to follow the intro/Tip - Retitle the AI tools card to lead with the task, not MCP jargon - Retitle the approval card to avoid overloading "complete" - Trim the redundant FAQ heading - Tighten generic step copy to match the opening line's specificity - Switch card icons to the duotone variant Co-Authored-By: Claude Sonnet 5 --- product/how-to/intro.mdx | 59 +++++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 28 deletions(-) diff --git a/product/how-to/intro.mdx b/product/how-to/intro.mdx index 661e8778..9ba14ecd 100644 --- a/product/how-to/intro.mdx +++ b/product/how-to/intro.mdx @@ -7,59 +7,62 @@ sidebarTitle: "Overview" --- {/* Editor Refresh: 2026-08-04 */} -Most people land here because C1 sent them a notification: a request to approve, a review to complete, or a reminder to connect an AI tool. Find your task below, or work through the quickstart if this is your first time signing in. +Most people land here because C1 sent them a notification: a request to approve, a review to complete, or a reminder to connect an AI tool. Find your task below. -Setting up C1 for your organization — policies, connectors, access profiles — instead of using it day to day? Go to [Administer C1](/product/intro). +Setting up C1 for your organization — policies, connectors, access profiles — instead of using it day to day? Go to [Administering C1](/product/intro). -## First time in C1? - -If a colleague or an automated notification sent you here, these three steps cover the whole path from sign-in to resolution. - - - - Go to your company's C1 URL (for example, `acme.conductor.one`) and sign in with your company's SSO credentials. - - - C1 notifies you by email, Slack, or Microsoft Teams when a request or task needs your attention. Open the link in that notification, or check the **Requests** or **Tasks** page in C1 directly. - - - Follow the prompts C1 shows you for that specific request or task — the steps differ depending on whether you're requesting access, approving a request, or completing a review. - - - -C1 tracks the status of your request or task and notifies you when it changes. - ## What are you trying to do? - + Ask for access to an application, group, role, or other resource. - - Get access to governed AI tools and connect your AI client to C1. + + Get access to governed AI tools and connect your AI client or MCP server to C1. - + Verify that your access, or access you're responsible for, is still appropriate. - + Approve, provision, or revoke access assigned to you as a task. - + Request operational actions like device provisioning through C1's Actions catalog. +## First time in C1? + +If a colleague or an automated notification sent you here, this covers the whole path from sign-in to resolution. + + + + + + Go to your company's C1 URL (for example, `acme.conductor.one`) and sign in with your company's SSO credentials. + + + C1 notifies you by email, Slack, or Microsoft Teams when a request or task needs your attention. Open the link in that notification, or check the **Requests** or **Tasks** page in C1 directly. + + + Approve or deny a request, confirm a colleague's access during a review, or fill in the fields C1 asks for when you're requesting something yourself. + + + C1 tracks the status of your request or task and notifies you when it changes. + + + ## What's new - + The latest features, enhancements, and resolved issues. Published weekly. -## Frequently asked questions about using C1 +## Frequently asked questions From a72edcdeec5b5283923d2c9be947a6a2579d54fa Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Wed, 12 Aug 2026 15:18:36 -0700 Subject: [PATCH 09/21] add c1mcp nav section --- docs.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs.json b/docs.json index 94b90167..7f874260 100644 --- a/docs.json +++ b/docs.json @@ -105,10 +105,16 @@ "product/how-to/qs-set-up-c1", "product/release-notes", "product/admin/ai-assistant", - "product/admin/c1-mcp", "product/glossary" ] }, + { + "group": "C1 MCP", + "pages": [ + "product/admin/c1-mcp", + "product/admin/mcp-server/copilot-studio" + ] + }, { "group": "Workforce & app access", "pages": [ From 95fe831d69f9a62dec39dd2d23daf80e42d83db8 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Wed, 12 Aug 2026 15:46:09 -0700 Subject: [PATCH 10/21] remove future pages, add stubs for findings and decoys --- docs.json | 12 ++---------- product/admin/decoys.mdx | 6 ++++++ product/admin/findings.mdx | 6 ++++++ 3 files changed, 14 insertions(+), 10 deletions(-) create mode 100644 product/admin/decoys.mdx create mode 100644 product/admin/findings.mdx diff --git a/docs.json b/docs.json index 7f874260..ac0e3d37 100644 --- a/docs.json +++ b/docs.json @@ -224,13 +224,6 @@ { "group": "AI agent governance", "pages": [ - { - "group": "Discover", - "tag": "NEW", - "pages": [ - "product/admin/shadow-ai-discovery" - ] - }, { "group": "Manage agent access", "tag": "NEW", @@ -239,7 +232,6 @@ "product/admin/enable-ai-access-management", "product/admin/tools-and-toolsets", "product/admin/tool-call-hooks", - "product/admin/agent-runtime-governance", "product/admin/ai-clients", "product/admin/audit-ai-tool-usage" ] @@ -310,7 +302,6 @@ "group": "Agent credentials & vaulting", "tag": "NEW", "pages": [ - "product/admin/agentic-vault", "product/admin/vaults", "product/admin/secret-sharing" ] @@ -323,7 +314,8 @@ "product/admin/query", "product/admin/inventory", "product/admin/external-insights", - "product/admin/agentic-security-intelligence" + "product/admin/findings", + "product/admin/decoys" ] }, { diff --git a/product/admin/decoys.mdx b/product/admin/decoys.mdx new file mode 100644 index 00000000..1ec697e7 --- /dev/null +++ b/product/admin/decoys.mdx @@ -0,0 +1,6 @@ +--- +title: "Decoys" +description: "Content coming soon." +--- + +Content coming soon. diff --git a/product/admin/findings.mdx b/product/admin/findings.mdx new file mode 100644 index 00000000..9d3a1f68 --- /dev/null +++ b/product/admin/findings.mdx @@ -0,0 +1,6 @@ +--- +title: "Findings" +description: "Content coming soon." +--- + +Content coming soon. From 3ccf2157da0e510b117b1691db4503226b30d9fd Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Wed, 12 Aug 2026 15:53:02 -0700 Subject: [PATCH 11/21] update icon style on cards --- baton/bitrise.mdx | 2 +- baton/blackline.mdx | 2 +- baton/blueworks-live.mdx | 2 +- baton/canvas.mdx | 4 +-- baton/file-connectors.mdx | 4 +-- baton/fivetran.mdx | 2 +- baton/intro.mdx | 22 +++++++-------- baton/metabase.mdx | 2 +- baton/youtrack.mdx | 2 +- docs.json | 7 +---- product/admin/external-insights.mdx | 4 +-- product/admin/service-principals/overview.mdx | 4 +-- .../workload-federation.mdx | 12 ++++---- product/how-to/qs-on-call-access-control.mdx | 4 +-- product/how-to/qs-set-up-c1.mdx | 14 +++++----- product/intro.mdx | 28 +++++++++---------- 16 files changed, 55 insertions(+), 60 deletions(-) diff --git a/baton/bitrise.mdx b/baton/bitrise.mdx index 76f1b2d2..3355ce73 100644 --- a/baton/bitrise.mdx +++ b/baton/bitrise.mdx @@ -32,7 +32,7 @@ This connector requires the following scopes: - Workspace Role:Viewer - Project Role:Admin - + ## Configure the Bitrise connector diff --git a/baton/blackline.mdx b/baton/blackline.mdx index d52c0e94..e07fadb4 100644 --- a/baton/blackline.mdx +++ b/baton/blackline.mdx @@ -60,7 +60,7 @@ The connector uses the following endpoints: - Role Management API - `GET /v1/roles` - + ## Configure the Blackline connector diff --git a/baton/blueworks-live.mdx b/baton/blueworks-live.mdx index 93a7ae4e..b8d261b8 100644 --- a/baton/blueworks-live.mdx +++ b/baton/blueworks-live.mdx @@ -43,7 +43,7 @@ This connector requires the following scopes: - Artifact reporting - User management - + ## Configure the Blueworks Live connector diff --git a/baton/canvas.mdx b/baton/canvas.mdx index 5cc3e234..dde700f2 100644 --- a/baton/canvas.mdx +++ b/baton/canvas.mdx @@ -150,10 +150,10 @@ scoped to a single user only sees that user's own data. |API token|`BATON_API_TOKEN`|Yes|An admin-scoped Canvas access token. Stored as a secret. Sent as the bearer token on every Canvas API request.| - + Browse the full catalog of ConductorOne connectors and integrations. - + Learn more about identity governance and access management with C1. diff --git a/baton/file-connectors.mdx b/baton/file-connectors.mdx index 5280fcc0..68282273 100644 --- a/baton/file-connectors.mdx +++ b/baton/file-connectors.mdx @@ -46,11 +46,11 @@ C1 allows for custom configurations in your Excel or CSV file, as each file can You can use one of our templates as a starting point: - + Use this template if your data is organized by accounts or users. - + Use this template if your data is organized by entitlements or permissions. diff --git a/baton/fivetran.mdx b/baton/fivetran.mdx index 9a75ba95..84786a80 100644 --- a/baton/fivetran.mdx +++ b/baton/fivetran.mdx @@ -53,7 +53,7 @@ A service-level key with configurable scopes per resource type. Use this for lea 3. Click **Add System Key** and configure the required scopes. 4. Copy the generated **Key** and **Secret**. - + **Required system key scopes for sync only:** diff --git a/baton/intro.mdx b/baton/intro.mdx index e0ecd535..0e5b6e8d 100644 --- a/baton/intro.mdx +++ b/baton/intro.mdx @@ -29,47 +29,47 @@ And if you want to integrate without writing code, check out our configuration-d - + Integrate your Okta instance with C1. - + Integrate your Google Workspace instance with C1. - + Integrate your Microsoft Entra ID instance with C1. - + Integrate your AWS instance with C1. - + Integrate your GitHub instance with C1. - + Integrate your Google Cloud Platform instance with C1. - + Integrate your Slack instance with C1. - + Integrate your Snowflake instance with C1. - + Integrate your Oracle NetSuite instance with C1. - + Integrate your Atlassian Jira Cloud instance with C1. - + Integrate your Atlassian Bitbucket instance with C1. diff --git a/baton/metabase.mdx b/baton/metabase.mdx index 1c1e707a..f2bef1d1 100644 --- a/baton/metabase.mdx +++ b/baton/metabase.mdx @@ -110,7 +110,7 @@ This connector requires the following scopes: - Query builder and native - + ## Configure the Metabase connector diff --git a/baton/youtrack.mdx b/baton/youtrack.mdx index d4dc0d5f..acf498d6 100644 --- a/baton/youtrack.mdx +++ b/baton/youtrack.mdx @@ -38,7 +38,7 @@ This connector requires the following scopes: * YouTrack Administration - + ## Configure the YouTrack connector diff --git a/docs.json b/docs.json index ac0e3d37..5dd69063 100644 --- a/docs.json +++ b/docs.json @@ -74,15 +74,10 @@ { "icon": "compass", "pages": [ - { - "group": "Overview", - "pages": [ - "product/how-to/intro" - ] - }, { "group": "How-to guides", "pages": [ + "product/how-to/intro", "product/how-to/review-tasks", "product/how-to/create-requests", "product/how-to/request-actions", diff --git a/product/admin/external-insights.mdx b/product/admin/external-insights.mdx index ddc13820..afd47f33 100644 --- a/product/admin/external-insights.mdx +++ b/product/admin/external-insights.mdx @@ -178,10 +178,10 @@ Require a clean posture from both sources for sensitive access: ## Supported external insights sources - + Ingest Falcon identity risk scores and password risk (compromised or weak passwords) into C1. - + Ingest Wiz identity risk scores into C1. diff --git a/product/admin/service-principals/overview.mdx b/product/admin/service-principals/overview.mdx index e8361c8f..a3715ac4 100644 --- a/product/admin/service-principals/overview.mdx +++ b/product/admin/service-principals/overview.mdx @@ -73,10 +73,10 @@ Before creating service principals: ## Next steps - + Get from zero to a working API call in under 5 minutes. - + Set up secretless authentication from CI/CD platforms. diff --git a/product/admin/service-principals/workload-federation.mdx b/product/admin/service-principals/workload-federation.mdx index 2defaaa9..e21bb18e 100644 --- a/product/admin/service-principals/workload-federation.mdx +++ b/product/admin/service-principals/workload-federation.mdx @@ -62,22 +62,22 @@ claims.repository == "acme/infra" && claims.environment == "production" ## Supported platforms - + Use the conductorone/oidc-token-action for one-step setup. - + Use GitLab's built-in id_tokens with a curl exchange. - + Auto-detected from TFC_WORKLOAD_IDENTITY_TOKEN. - + Use IAM outbound identity federation from any AWS workload. - + Authenticate SPIFFE workloads via JWT-SVID, for example SPIRE. - + Any platform with OIDC support. diff --git a/product/how-to/qs-on-call-access-control.mdx b/product/how-to/qs-on-call-access-control.mdx index 81e24225..25e2a1f6 100644 --- a/product/how-to/qs-on-call-access-control.mdx +++ b/product/how-to/qs-on-call-access-control.mdx @@ -21,8 +21,8 @@ To complete this guide, you'll need: Start by following the docs to integrate your on-call platform with C1: - - + + diff --git a/product/how-to/qs-set-up-c1.mdx b/product/how-to/qs-set-up-c1.mdx index 287c55a3..3cef5180 100644 --- a/product/how-to/qs-set-up-c1.mdx +++ b/product/how-to/qs-set-up-c1.mdx @@ -43,13 +43,13 @@ Click **Sign up with [your SSO provider]**. Jump to the instructions for your SSO provider: - - - - - - - + + + + + + + ## Authenticate with Google diff --git a/product/intro.mdx b/product/intro.mdx index 4c913847..5c0b4ea6 100644 --- a/product/intro.mdx +++ b/product/intro.mdx @@ -21,7 +21,7 @@ C1 connects to your apps through [connectors](/baton/intro) and governs access w ## What’s new - + The latest new features, enhancements, and resolved issues. Published weekly. @@ -29,19 +29,19 @@ The latest new features, enhancements, and resolved issues. Published weekly. ## Popular resources - + Add C1 egress IPs and hostnames to your firewall and proxy allowlists. - + Run user access review (UAR) campaigns to systematically verify user access. - + Import access data from your custom, home-grown, or airgapped applications. - + Mirror your software's access data, including accounts, resources, and permissions. @@ -49,15 +49,15 @@ The latest new features, enhancements, and resolved issues. Published weekly. ## Getting started guides - + Enhance security by setting up just-in-time access to your organization's key Amazon Web Services resources. - + From planning and preparation to creating the campaign, managing reviewers, and final reporting. - + We'll create security policies and customized access profiles, set up auto-approval of low-risk access, and demonstrate end-user workflows. @@ -65,11 +65,11 @@ The latest new features, enhancements, and resolved issues. Published weekly. ## End-user resources - + Have you been assigned access reviews in C1? Here's what you need to know. - + Need access to a new app or permission? Start here. @@ -77,10 +77,10 @@ The latest new features, enhancements, and resolved issues. Published weekly. ## Other useful links - - - - + + + + From 1ab0b3f8abfb3839b9927cdb493e9a450b14a48f Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Wed, 12 Aug 2026 16:07:36 -0700 Subject: [PATCH 12/21] more edits --- product/intro.mdx | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/product/intro.mdx b/product/intro.mdx index 5c0b4ea6..985ed0ce 100644 --- a/product/intro.mdx +++ b/product/intro.mdx @@ -18,6 +18,10 @@ C1 is an identity security platform for governing access across your human, non- C1 connects to your apps through [connectors](/baton/intro) and governs access with [policies](/product/admin/policies) and [automations](/product/admin/automations). + +Looking to review access, request access, or use AI tools in C1? Go to [Using C1](/product/how-to/intro). + + ## What’s new @@ -62,18 +66,6 @@ The latest new features, enhancements, and resolved issues. Published weekly. -## End-user resources - - - - Have you been assigned access reviews in C1? Here's what you need to know. - - - - Need access to a new app or permission? Start here. - - - ## Other useful links From 8fb1e72534c4b76011d13c394c04684bcbc20391 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Wed, 12 Aug 2026 16:13:30 -0700 Subject: [PATCH 13/21] edits --- product/how-to/intro.mdx | 8 ++++---- product/intro.mdx | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/product/how-to/intro.mdx b/product/how-to/intro.mdx index 9ba14ecd..c67c8001 100644 --- a/product/how-to/intro.mdx +++ b/product/how-to/intro.mdx @@ -1,6 +1,6 @@ --- -title: "Using C1" -og:title: "Using C1" +title: "Welcome to C1" +og:title: "Welcome to C1" og:description: "Request access, complete review and approval tasks, and work with AI tools in C1." description: "Request access, complete review and approval tasks, and work with AI tools in C1." sidebarTitle: "Overview" @@ -10,7 +10,7 @@ sidebarTitle: "Overview" Most people land here because C1 sent them a notification: a request to approve, a review to complete, or a reminder to connect an AI tool. Find your task below. -Setting up C1 for your organization — policies, connectors, access profiles — instead of using it day to day? Go to [Administering C1](/product/intro). +Setting up C1 for your organization — policies, connectors, access profiles — instead of using it day to day? Go to [Administer C1](/product/intro). ## What are you trying to do? @@ -58,7 +58,7 @@ If a colleague or an automated notification sent you here, this covers the whole - The latest features, enhancements, and resolved issues. Published weekly. + The latest features, enhancements, and resolved issues. diff --git a/product/intro.mdx b/product/intro.mdx index 985ed0ce..8bd921f1 100644 --- a/product/intro.mdx +++ b/product/intro.mdx @@ -19,14 +19,14 @@ C1 is an identity security platform for governing access across your human, non- C1 connects to your apps through [connectors](/baton/intro) and governs access with [policies](/product/admin/policies) and [automations](/product/admin/automations). -Looking to review access, request access, or use AI tools in C1? Go to [Using C1](/product/how-to/intro). +Looking to review access, request access, or use AI tools in C1? Go to [Use C1](/product/how-to/intro). ## What’s new -The latest new features, enhancements, and resolved issues. Published weekly. +The latest new features, enhancements, and resolved issues. From 3d906e69cff38235d8edf92b018a703074d4dd91 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 13 Aug 2026 15:41:21 -0700 Subject: [PATCH 14/21] Draft Findings and Decoys docs Findings: enabling finding types, working a finding, transformation and routing rules, rule ordering guidance, and a worked example chaining a transformation rule with a routing rule. Decoys: planting, managing, and what happens when a decoy is used, including the audit-trail-survives-a-toggle nuance and the finding types it produces. Also documents the "... (more actions) menu" convention in the docs-writing skill. Co-Authored-By: Claude Sonnet 5 --- .claude/skills/docs-writing.md | 1 + product/admin/decoys.mdx | 83 +++++++++++++++++++- product/admin/findings.mdx | 135 ++++++++++++++++++++++++++++++++- 3 files changed, 215 insertions(+), 4 deletions(-) diff --git a/.claude/skills/docs-writing.md b/.claude/skills/docs-writing.md index 957dad9e..d08927ed 100644 --- a/.claude/skills/docs-writing.md +++ b/.claude/skills/docs-writing.md @@ -111,6 +111,7 @@ Sidebar grouping in `docs.json` is independent of folder structure. You can visu - **Optional sections**: Use `## Optional: Section name` for entire optional tasks or sections - **UI elements**: Bold formatting (**New profile**) - **Navigation paths**: **Admin** > **Access profiles** > **New profile** +- **Kebab/overflow menus**: Always write as the **...** (more actions) menu — e.g., "click the **...** (more actions) menu and select **Delete**." This is the established pattern across the docs; don't substitute "kebab menu," "more options," a middle-dot glyph (···), or a vertical ellipsis (⋮). - **Terminology**: Use product-specific terms consistently (access profile, entitlement, campaign) - **Clarity**: Be specific, cite sources, avoid vague claims - **Simplicity**: Keep examples practical, avoid excessive options diff --git a/product/admin/decoys.mdx b/product/admin/decoys.mdx index 1ec697e7..8b55c9ab 100644 --- a/product/admin/decoys.mdx +++ b/product/admin/decoys.mdx @@ -1,6 +1,85 @@ --- title: "Decoys" -description: "Content coming soon." +og:title: "Decoys" +og:description: "Plant tripwire credentials that look real but grant no access, and turn any attempt to use one into a Critical finding." +description: "Plant tripwire credentials that look real but grant no access, and turn any attempt to use one into a Critical finding." --- +{/* Editor Refresh: 2026-08-13 */} -Content coming soon. + +**Early access.** This feature is in early access, which means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Share feedback with the C1 Support team. + + +Plant a credential that looks real but grants no access. Any attempt to use it is a high-confidence signal that someone has stolen access. Decoys are tripwire credentials: plant them where an attacker would look — env files, CI variables, secret managers — and using one raises a [Critical finding](/product/admin/findings). + +Managing decoys requires the **Super Administrator** role in C1. Go to **Settings** > **Security** > **Decoys** to get started. + +## Plant a decoy + +C1 supports five decoy types, each shaped to sit alongside a different kind of real credential: + +| Decoy type | What it plants | +| :--- | :--- | +| Human user credential | Client ID + secret planted under an existing human user. | +| Service principal credential | Client ID + secret planted under an existing service principal. | +| Connector client credential | Client ID + secret shaped like a connector credential. C1 places it under your tenant's C1 app — there's no app or connector to choose. | +| Workload federation trust | A trust under an existing workload federation provider. Any signature-valid JWT matching its condition triggers a finding. | +| Access token | A long-lived API access token issued for an existing user. | + +Except for a connector client credential, which C1 places automatically, every decoy type plants under an existing object — a human user, a service principal, or a registered workload federation provider. Make sure that object already exists before you start. + + + +Go to **Decoys**. + + +Click **Add decoy**. + + +Choose a decoy type. + + +For a workload federation trust, also set a **Condition expression** — a CEL expression evaluated against the presented JWT's claims. For example: `claims.sub.startsWith("repo:acme/fake-infra:")`. + + +Set a **Display name** and, optionally, a **Description** to remind yourself where you planted it. + + +**Optional.** Add **Annotations** — key/value tags for filtering, reporting, and integrations, for example `team = platform` or `owner = alice`. Annotations carry over onto the finding a decoy produces, so a [routing rule](/product/admin/findings#routing-rules) can condition on them. + + +Click **Plant decoy**. + + + +C1 shows the decoy's credential material — a client ID and secret, an access token, or a workload federation trust ID, depending on the type — along with a fingerprint. + + +This is the only time C1 shows this credential material. Save it now — copy each value or download the `.env` file — before confirming you've saved it. If you lose it, rotate the decoy to get a new one. + + +Save the fingerprint alongside wherever you place the secret. It's how you'll recognize which planted copy fired when you see the resulting finding. + +## Manage a decoy + +Open a decoy from the list to edit its display name, description, or annotations, or to take one of the following actions from the **...** (more actions) menu: + +- **Disable** — stops the decoy from triggering findings without deleting it. Past findings stay in history, and you can re-enable it at any time. +- **Rotate** — mints a new secret for the decoy and invalidates the old one. C1 shows the new credential material once, the same as when you first planted it. +- **Delete** — removes the decoy from the list and stops it from triggering findings. Past findings stay in history. + +## What happens when a decoy is used + +Any attempt to authenticate with a planted decoy credential does two things at once: whoever presented it gets an ordinary authentication failure — there's no way to tell a decoy apart from a real bad credential — and C1 records the attempt. + +If the **Decoy credential used** [finding type](/product/admin/findings#turn-on-finding-types) is turned on, C1 raises a Critical finding the moment the decoy is used. Repeated use of the same decoy doesn't create duplicate findings — it's tracked as recurrences of the same finding, reopening it if it had been resolved. + + +Turning off the **Decoy credential used** finding type stops the finding from being created, but C1 still records every use to your audit log regardless. Quieting the finding doesn't cost you the trail. + + +The resulting finding includes an **Attempts** table with the forensic detail you need for incident response: timestamp, source IP, user agent, and endpoint for every attempt, plus the raw event detail behind each one. + +If a decoy's secret turns up published somewhere public — a paste site, a public repository — C1 raises a separate **Decoy publicly exposed** finding, with the scanner that found it, where it was found, and when. + +See [Findings](/product/admin/findings) for how to turn on these finding types and build rules around them. diff --git a/product/admin/findings.mdx b/product/admin/findings.mdx index 9d3a1f68..1056164e 100644 --- a/product/admin/findings.mdx +++ b/product/admin/findings.mdx @@ -1,6 +1,137 @@ --- title: "Findings" -description: "Content coming soon." +og:title: "Findings" +og:description: "Detect and act on the things you care about in your organization's access data, from unowned service accounts to exposed credentials." +description: "Detect and act on the things you care about in your organization's access data, from unowned service accounts to exposed credentials." --- +{/* Editor Refresh: 2026-08-13 */} -Content coming soon. + +**Early access.** This feature is in early access, which means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Share feedback with the C1 Support team. + + +Stop hunting for risk by hand. Point C1 at the conditions you care about — unowned service accounts, exposed credentials, misclassified identities, and more — and it surfaces them as findings the moment they occur, then use rules to triage, escalate, or resolve them automatically. C1 checks for the conditions you've turned on every time a connector syncs, and reports back when it detects a match. + +Go to **Identity security** > **Findings** to get started. + +## Turn on finding types + +C1 ships with a catalog of built-in finding types, grouped by category. None are required — you choose which conditions matter to your organization. + + +Findings don't appear until you turn on the finding types you want C1 to detect. There's no separate "create" or "new" control — everything starts from **Findings settings**. + + + + +From any tab in **Findings**, click the **settings** (gear) icon in the top right. + + +In **Findings settings**, toggle on the finding types you want C1 to detect. Each type shows a short description of what it looks for. + + +Click **Save changes**. + + + +C1 starts creating findings of the types you turned on the next time each connector syncs. + + +Turning off a finding type stops C1 from creating new findings of that type. Findings of that type that are already open stay open — nothing re-checks them, so they won't resolve automatically. + + +### Finding catalog reference + +The following finding types are available today, grouped by category: + +| Category | Finding type | Detects | +| :--- | :--- | :--- | +| Ownership | Unowned non-human identity | Non-human identities with no assigned owner. | +| Ownership | Unowned service account | Service accounts with no assigned owner. | +| Ownership | Deactivated owner | Accounts and resources whose owner has been deactivated. | +| Identity resolution | Similar username match | App accounts that look like they belong to a known identity. | +| Identity resolution | Service account misclassification | Accounts labeled human that behave like service accounts. | +| Credentials | Decoy credential used | A planted [decoy credential](/product/admin/decoys) was used to attempt access. | +| Credentials | Unused secret | Secrets that have gone unused past the inactivity threshold. | +| Credentials | Credential publicly exposed | Credentials found published outside your organization. | +| Credentials | Decoy publicly exposed | A planted [decoy credential](/product/admin/decoys) was found published publicly. | +| Configuration | Anomaly detection disabled | Connectors running with sync anomaly detection turned off. | + +## Work with a finding + +Click a finding from the **Overview** or **All findings** tab to open its detail view, which includes: + +- **Evidence** — why C1 flagged this finding, including any confidence score. +- **Activity** — an audit trail of everything that's happened to the finding, including when it was created, when routing rules evaluated against it, and any evidence updates. + +From the detail view, you can take one of the following actions on a finding: + +- **Accept risk** — formally acknowledge the finding as a known risk. Requires a justification and an expiration date; the finding reopens automatically when the acceptance period ends. +- **Suppress** — permanently hide the finding from the default view and exclude it from posture scores. Requires a reason. +- **Snooze** — temporarily hide the finding. Requires a duration (1, 7, 30, or 90 days, or a custom date) and a reason; the finding automatically returns to open status when the snooze period ends. +- **Remediate** — resolve and close the finding. This action only appears for finding types that support it, and its label varies by finding type — for example, a service account misclassification finding offers **Confirm human** and **Mark as service** instead of a generic remediate button. + + +You can only act on findings one at a time today. Bulk actions are coming soon. + + +## Transformation rules + +Transformation rules reshape a finding's data — for example, escalating its severity or adding annotations — before a routing rule acts on it. Use them to make sure the findings that matter most are marked that way consistently, so your routing rules can act on severity or annotations instead of re-deriving that context from scratch. + +Go to **Findings** > **Transformation rules** to create or manage them. Each rule has: + +- **A match condition** — narrow the rule to a specific app, finding type, or a [CEL expression](/product/admin/expressions) referencing `finding.severity`, `finding.state`, `finding.risk_score`, or `finding.annotations`. Leave everything unset to match every finding. +- **One or more transforms** — set severity, add annotations, or remove annotations. + +For example, to flag every finding on a sensitive app as more urgent, create a rule matching `finding.app_id == ""` that sets severity to Critical. A routing rule can then match on that Critical severity and escalate automatically. + +You can create as many transformation rules as you need. Every rule whose condition matches a finding is applied, in ascending order by the rule's **Order** value — later rules override earlier ones where they conflict. + +## Routing rules + +Routing rules turn triage into automation. Instead of someone opening every finding to decide what happens next, a routing rule matches on a condition and immediately suppresses, snoozes, accepts, remediates, or dispatches it — no manual review required unless nothing matches. + +Go to **Findings** > **Routing rules** to create or manage them. Each rule has: + +- **A match condition** — the same app, finding type, or CEL expression matching used by transformation rules. +- **An action** — No action, Suppress, Snooze, or Accept risk. Remediate is also available for finding types that support it. +- **Dispatchers (optional)** — fire a webhook, invoke a function, or trigger an automation every time the rule matches. + +For example, suppress low-severity noise automatically with a rule matching `finding.severity == FINDING_SEVERITY_LOW` and action Suppress. Escalate anything Critical with a rule matching `finding.severity == FINDING_SEVERITY_CRITICAL` that triggers an [automation](/product/admin/automations) to notify your team or open a ticket. + +Unlike transformation rules, routing rules stop at the first match: C1 evaluates rules in ascending order by **Order** and applies only the first one that matches. + +### Order rules effectively + +Transformation rules and routing rules order in opposite directions, and mixing up the two is the most common way a rule set stops working as expected. + +- **Transformation rules apply cumulatively** — every matching rule runs, and later rules override earlier ones. Put your general, default-setting rules early and your specific overrides later. +- **Routing rules stop at the first match** — only one rule ever runs. Put your specific, narrow rules early and your general, catch-all rules last. A broad rule placed too early will catch findings a later, more specific rule was meant to handle. + +A few other tips for keeping a rule set maintainable: + +- Test a routing rule's match condition with the **No action** action first, which matches the finding without changing its state. Confirm it's catching the right findings before wiring up Suppress, Snooze, or a dispatcher. +- Leave gaps between **Order** values (10, 20, 30 instead of 1, 2, 3) so you can insert a new rule later without renumbering the rest. +- If you want a default outcome for anything your specific rules don't catch, add a broad rule with no match condition (**Match all**) at the end of your routing rules. + +## Example: catch and escalate decoy credential use + +This walkthrough combines a finding type, a transformation rule, and a routing rule to automatically flag and escalate decoy credential use — a strong signal of compromise that shouldn't wait for someone to notice it in the findings list. See [Decoys](/product/admin/decoys) for how to plant a decoy credential. + + + +Turn on the finding type. In **Findings settings**, under **Credentials**, turn on **Decoy credential used** and save. + + +Create a transformation rule to guarantee severity. Go to **Transformation rules** > **Create rule**. Set **Finding type** to **Decoy credential used**, leave **App** and the expression unset to match every app, add a **Set severity** transform, and set it to **Critical**. Save the rule. + + +Create a routing rule to escalate automatically. Go to **Routing rules** > **Create rule**. Set **Finding type** to **Decoy credential used**, set **Action** to **No action** so the finding stays open for review, and add a **Trigger automation** dispatcher to notify your security team immediately. + + +Set this rule's **Order** so it runs before any broad catch-all routing rules — a general rule like "suppress low severity findings" could otherwise match first and prevent this one from running. + + + +From now on, every decoy credential finding is marked Critical and your security team is notified the moment it's created — no one has to find it in the findings list first. From 606129ecf26041b0caf1a198d5f7b9880dcf75b2 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 13 Aug 2026 15:44:39 -0700 Subject: [PATCH 15/21] Add release notes for Findings and Decoys Standalone early-access entries, JTBD-framed per house style, linking to the new docs pages drafted earlier in this branch. Co-Authored-By: Claude Sonnet 5 --- product/release-notes.mdx | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/product/release-notes.mdx b/product/release-notes.mdx index e818328a..dbfc6ddb 100644 --- a/product/release-notes.mdx +++ b/product/release-notes.mdx @@ -6,7 +6,27 @@ description: Here are the latest new features, enhancements, and resolved issues rss: true sidebarTitle: Release notes --- -{/* Editor Refresh: 2026-08-07 */} +{/* Editor Refresh: 2026-08-13 */} + + + +### Early access: Findings + +Catching an unowned service account, an exposed credential, or a misclassified identity has usually meant someone remembering to go looking for it. Findings does the looking for you: turn on the conditions you care about, and C1 checks for them on every connector sync. From there, transformation and routing rules let you triage, escalate, or resolve what it finds automatically instead of reviewing every finding by hand. + +See [Findings](/product/admin/findings) for details. Share feedback with the C1 Support team. + + + + + +### Early access: Decoys + +Stolen credentials usually only surface after they've already been used for real damage. Decoys get ahead of that: plant a tripwire credential that looks real but grants no access, and any attempt to use it raises a Critical finding — while whoever's using it sees an ordinary authentication failure, with nothing to tell them they tripped a wire. + +See [Decoys](/product/admin/decoys) for details. Share feedback with the C1 Support team. + + From 781ed976b59ac225fbca5b1eff09fb9c69a8c4b7 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 13 Aug 2026 15:44:59 -0700 Subject: [PATCH 16/21] Combine Findings and Decoys into one release note Co-Authored-By: Claude Sonnet 5 --- product/release-notes.mdx | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/product/release-notes.mdx b/product/release-notes.mdx index dbfc6ddb..4b03f615 100644 --- a/product/release-notes.mdx +++ b/product/release-notes.mdx @@ -8,23 +8,15 @@ sidebarTitle: Release notes --- {/* Editor Refresh: 2026-08-13 */} - + -### Early access: Findings +### Early access: Findings and Decoys Catching an unowned service account, an exposed credential, or a misclassified identity has usually meant someone remembering to go looking for it. Findings does the looking for you: turn on the conditions you care about, and C1 checks for them on every connector sync. From there, transformation and routing rules let you triage, escalate, or resolve what it finds automatically instead of reviewing every finding by hand. -See [Findings](/product/admin/findings) for details. Share feedback with the C1 Support team. - - - - - -### Early access: Decoys - Stolen credentials usually only surface after they've already been used for real damage. Decoys get ahead of that: plant a tripwire credential that looks real but grants no access, and any attempt to use it raises a Critical finding — while whoever's using it sees an ordinary authentication failure, with nothing to tell them they tripped a wire. -See [Decoys](/product/admin/decoys) for details. Share feedback with the C1 Support team. +See [Findings](/product/admin/findings) and [Decoys](/product/admin/decoys) for details. Share feedback with the C1 Support team. From 0952d4c5b1d5c3de30dcfcd84fa3c36fc3dded3d Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 13 Aug 2026 15:53:02 -0700 Subject: [PATCH 17/21] Break up long compound sentences for readability Split sentences held together by em dashes, colons, or comma chains into shorter standalone sentences across findings.mdx, decoys.mdx, and the release notes entry. Co-Authored-By: Claude Sonnet 5 --- product/admin/decoys.mdx | 22 +++++++++++----------- product/admin/findings.mdx | 24 ++++++++++++------------ product/release-notes.mdx | 4 ++-- 3 files changed, 25 insertions(+), 25 deletions(-) diff --git a/product/admin/decoys.mdx b/product/admin/decoys.mdx index 8b55c9ab..3d53f3cc 100644 --- a/product/admin/decoys.mdx +++ b/product/admin/decoys.mdx @@ -10,7 +10,7 @@ description: "Plant tripwire credentials that look real but grant no access, and **Early access.** This feature is in early access, which means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Share feedback with the C1 Support team. -Plant a credential that looks real but grants no access. Any attempt to use it is a high-confidence signal that someone has stolen access. Decoys are tripwire credentials: plant them where an attacker would look — env files, CI variables, secret managers — and using one raises a [Critical finding](/product/admin/findings). +Plant a credential that looks real but grants no access. Any attempt to use it is a high-confidence signal that someone has stolen access. Decoys are tripwire credentials. Plant them where an attacker would look — env files, CI variables, secret managers. Using one raises a [Critical finding](/product/admin/findings). Managing decoys requires the **Super Administrator** role in C1. Go to **Settings** > **Security** > **Decoys** to get started. @@ -26,7 +26,7 @@ C1 supports five decoy types, each shaped to sit alongside a different kind of r | Workload federation trust | A trust under an existing workload federation provider. Any signature-valid JWT matching its condition triggers a finding. | | Access token | A long-lived API access token issued for an existing user. | -Except for a connector client credential, which C1 places automatically, every decoy type plants under an existing object — a human user, a service principal, or a registered workload federation provider. Make sure that object already exists before you start. +Every decoy type except a connector client credential plants under an existing object — a human user, a service principal, or a registered workload federation provider. C1 places connector client credentials automatically, with nothing to choose. For every other type, make sure the object you need already exists before you start. @@ -45,17 +45,17 @@ For a workload federation trust, also set a **Condition expression** — a CEL e Set a **Display name** and, optionally, a **Description** to remind yourself where you planted it. -**Optional.** Add **Annotations** — key/value tags for filtering, reporting, and integrations, for example `team = platform` or `owner = alice`. Annotations carry over onto the finding a decoy produces, so a [routing rule](/product/admin/findings#routing-rules) can condition on them. +**Optional.** Add **Annotations** — key/value tags for filtering, reporting, and integrations, for example `team = platform` or `owner = alice`. Annotations carry over onto the finding a decoy produces. A [routing rule](/product/admin/findings#routing-rules) can then condition on them. Click **Plant decoy**. -C1 shows the decoy's credential material — a client ID and secret, an access token, or a workload federation trust ID, depending on the type — along with a fingerprint. +C1 shows the decoy's credential material — a client ID and secret, an access token, or a workload federation trust ID, depending on the type. It also shows a fingerprint. -This is the only time C1 shows this credential material. Save it now — copy each value or download the `.env` file — before confirming you've saved it. If you lose it, rotate the decoy to get a new one. +This is the only time C1 shows this credential material. Save it now: copy each value or download the `.env` file. You'll need to confirm you've saved it before this screen closes. If you lose it, rotate the decoy to get a new one. Save the fingerprint alongside wherever you place the secret. It's how you'll recognize which planted copy fired when you see the resulting finding. @@ -64,22 +64,22 @@ Save the fingerprint alongside wherever you place the secret. It's how you'll re Open a decoy from the list to edit its display name, description, or annotations, or to take one of the following actions from the **...** (more actions) menu: -- **Disable** — stops the decoy from triggering findings without deleting it. Past findings stay in history, and you can re-enable it at any time. +- **Disable** — stops the decoy from triggering findings without deleting it. Past findings stay in history. You can re-enable it at any time. - **Rotate** — mints a new secret for the decoy and invalidates the old one. C1 shows the new credential material once, the same as when you first planted it. - **Delete** — removes the decoy from the list and stops it from triggering findings. Past findings stay in history. ## What happens when a decoy is used -Any attempt to authenticate with a planted decoy credential does two things at once: whoever presented it gets an ordinary authentication failure — there's no way to tell a decoy apart from a real bad credential — and C1 records the attempt. +Any attempt to authenticate with a planted decoy credential triggers two things. Whoever presented it gets an ordinary authentication failure — there's no way to tell a decoy apart from a real bad credential. C1 also records the attempt. -If the **Decoy credential used** [finding type](/product/admin/findings#turn-on-finding-types) is turned on, C1 raises a Critical finding the moment the decoy is used. Repeated use of the same decoy doesn't create duplicate findings — it's tracked as recurrences of the same finding, reopening it if it had been resolved. +If the **Decoy credential used** [finding type](/product/admin/findings#turn-on-finding-types) is turned on, C1 raises a Critical finding the moment the decoy is used. Repeated use of the same decoy doesn't create duplicate findings — it's tracked as recurrences of the same finding. If the finding had been resolved, it reopens. -Turning off the **Decoy credential used** finding type stops the finding from being created, but C1 still records every use to your audit log regardless. Quieting the finding doesn't cost you the trail. +Turning off the **Decoy credential used** finding type stops the finding from being created. C1 still records every use to your audit log regardless. Quieting the finding doesn't cost you the trail. -The resulting finding includes an **Attempts** table with the forensic detail you need for incident response: timestamp, source IP, user agent, and endpoint for every attempt, plus the raw event detail behind each one. +The resulting finding includes an **Attempts** table with the forensic detail you need for incident response — timestamp, source IP, user agent, and endpoint for every attempt. Each row also includes the raw event detail behind it. -If a decoy's secret turns up published somewhere public — a paste site, a public repository — C1 raises a separate **Decoy publicly exposed** finding, with the scanner that found it, where it was found, and when. +If a decoy's secret turns up published somewhere public — a paste site, a public repository — C1 raises a separate **Decoy publicly exposed** finding. The finding includes the scanner that found it, where it was found, and when. See [Findings](/product/admin/findings) for how to turn on these finding types and build rules around them. diff --git a/product/admin/findings.mdx b/product/admin/findings.mdx index 1056164e..736dfb3f 100644 --- a/product/admin/findings.mdx +++ b/product/admin/findings.mdx @@ -10,7 +10,7 @@ description: "Detect and act on the things you care about in your organization's **Early access.** This feature is in early access, which means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Share feedback with the C1 Support team. -Stop hunting for risk by hand. Point C1 at the conditions you care about — unowned service accounts, exposed credentials, misclassified identities, and more — and it surfaces them as findings the moment they occur, then use rules to triage, escalate, or resolve them automatically. C1 checks for the conditions you've turned on every time a connector syncs, and reports back when it detects a match. +Stop hunting for risk by hand. Point C1 at the conditions you care about — unowned service accounts, exposed credentials, misclassified identities, and more. It surfaces them as findings the moment they occur, and rules let you triage, escalate, or resolve them automatically. C1 checks for these conditions every time a connector syncs. It reports back the moment it detects a match. Go to **Identity security** > **Findings** to get started. @@ -66,10 +66,10 @@ Click a finding from the **Overview** or **All findings** tab to open its detail From the detail view, you can take one of the following actions on a finding: -- **Accept risk** — formally acknowledge the finding as a known risk. Requires a justification and an expiration date; the finding reopens automatically when the acceptance period ends. +- **Accept risk** — formally acknowledge the finding as a known risk. Requires a justification and an expiration date. The finding reopens automatically when the acceptance period ends. - **Suppress** — permanently hide the finding from the default view and exclude it from posture scores. Requires a reason. -- **Snooze** — temporarily hide the finding. Requires a duration (1, 7, 30, or 90 days, or a custom date) and a reason; the finding automatically returns to open status when the snooze period ends. -- **Remediate** — resolve and close the finding. This action only appears for finding types that support it, and its label varies by finding type — for example, a service account misclassification finding offers **Confirm human** and **Mark as service** instead of a generic remediate button. +- **Snooze** — temporarily hide the finding. Requires a duration (1, 7, 30, or 90 days, or a custom date) and a reason. The finding automatically returns to open status when the snooze period ends. +- **Remediate** — resolve and close the finding. This action only appears for finding types that support it. Its label also varies by finding type — for example, a service account misclassification finding offers **Confirm human** and **Mark as service** instead of a generic remediate button. You can only act on findings one at a time today. Bulk actions are coming soon. @@ -77,7 +77,7 @@ You can only act on findings one at a time today. Bulk actions are coming soon. ## Transformation rules -Transformation rules reshape a finding's data — for example, escalating its severity or adding annotations — before a routing rule acts on it. Use them to make sure the findings that matter most are marked that way consistently, so your routing rules can act on severity or annotations instead of re-deriving that context from scratch. +Transformation rules reshape a finding's data — for example, escalating its severity or adding annotations — before a routing rule acts on it. Use them to make sure the findings that matter most are marked that way consistently. Your routing rules can then act on severity or annotations directly, instead of re-deriving that context from scratch. Go to **Findings** > **Transformation rules** to create or manage them. Each rule has: @@ -90,7 +90,7 @@ You can create as many transformation rules as you need. Every rule whose condit ## Routing rules -Routing rules turn triage into automation. Instead of someone opening every finding to decide what happens next, a routing rule matches on a condition and immediately suppresses, snoozes, accepts, remediates, or dispatches it — no manual review required unless nothing matches. +Routing rules turn triage into automation. Instead of someone opening every finding to decide what happens next, a routing rule matches on a condition and immediately suppresses, snoozes, accepts, remediates, or dispatches it. No manual review is required unless nothing matches. Go to **Findings** > **Routing rules** to create or manage them. Each rule has: @@ -100,7 +100,7 @@ Go to **Findings** > **Routing rules** to create or manage them. Each rule has: For example, suppress low-severity noise automatically with a rule matching `finding.severity == FINDING_SEVERITY_LOW` and action Suppress. Escalate anything Critical with a rule matching `finding.severity == FINDING_SEVERITY_CRITICAL` that triggers an [automation](/product/admin/automations) to notify your team or open a ticket. -Unlike transformation rules, routing rules stop at the first match: C1 evaluates rules in ascending order by **Order** and applies only the first one that matches. +Unlike transformation rules, routing rules stop at the first match. C1 evaluates rules in ascending order by **Order** and applies only the first one that matches. ### Order rules effectively @@ -117,21 +117,21 @@ A few other tips for keeping a rule set maintainable: ## Example: catch and escalate decoy credential use -This walkthrough combines a finding type, a transformation rule, and a routing rule to automatically flag and escalate decoy credential use — a strong signal of compromise that shouldn't wait for someone to notice it in the findings list. See [Decoys](/product/admin/decoys) for how to plant a decoy credential. +This walkthrough combines a finding type, a transformation rule, and a routing rule to automatically flag and escalate decoy credential use. It's a strong signal of compromise that shouldn't wait for someone to notice it in the findings list. See [Decoys](/product/admin/decoys) for how to plant a decoy credential. Turn on the finding type. In **Findings settings**, under **Credentials**, turn on **Decoy credential used** and save. -Create a transformation rule to guarantee severity. Go to **Transformation rules** > **Create rule**. Set **Finding type** to **Decoy credential used**, leave **App** and the expression unset to match every app, add a **Set severity** transform, and set it to **Critical**. Save the rule. +Create a transformation rule to guarantee severity. Go to **Transformation rules** > **Create rule**. Set **Finding type** to **Decoy credential used**, and leave **App** and the expression unset to match every app. Add a **Set severity** transform and set it to **Critical**. Save the rule. -Create a routing rule to escalate automatically. Go to **Routing rules** > **Create rule**. Set **Finding type** to **Decoy credential used**, set **Action** to **No action** so the finding stays open for review, and add a **Trigger automation** dispatcher to notify your security team immediately. +Create a routing rule to escalate automatically. Go to **Routing rules** > **Create rule**. Set **Finding type** to **Decoy credential used**. Set **Action** to **No action**, so the finding stays open for review. Add a **Trigger automation** dispatcher to notify your security team immediately. -Set this rule's **Order** so it runs before any broad catch-all routing rules — a general rule like "suppress low severity findings" could otherwise match first and prevent this one from running. +Set this rule's **Order** so it runs before any broad catch-all routing rules. A general rule like "suppress low severity findings" could otherwise match first and prevent this one from running. -From now on, every decoy credential finding is marked Critical and your security team is notified the moment it's created — no one has to find it in the findings list first. +From now on, every decoy credential finding is marked Critical, and your security team is notified the moment it's created. No one has to find it in the findings list first. diff --git a/product/release-notes.mdx b/product/release-notes.mdx index 4b03f615..7bf05ce9 100644 --- a/product/release-notes.mdx +++ b/product/release-notes.mdx @@ -12,9 +12,9 @@ sidebarTitle: Release notes ### Early access: Findings and Decoys -Catching an unowned service account, an exposed credential, or a misclassified identity has usually meant someone remembering to go looking for it. Findings does the looking for you: turn on the conditions you care about, and C1 checks for them on every connector sync. From there, transformation and routing rules let you triage, escalate, or resolve what it finds automatically instead of reviewing every finding by hand. +Catching an unowned service account, an exposed credential, or a misclassified identity has usually meant someone remembering to go looking for it. Findings does the looking for you. Turn on the conditions you care about, and C1 checks for them on every connector sync. From there, transformation and routing rules let you triage, escalate, or resolve what it finds automatically instead of reviewing every finding by hand. -Stolen credentials usually only surface after they've already been used for real damage. Decoys get ahead of that: plant a tripwire credential that looks real but grants no access, and any attempt to use it raises a Critical finding — while whoever's using it sees an ordinary authentication failure, with nothing to tell them they tripped a wire. +Stolen credentials usually only surface after they've already been used for real damage. Decoys get ahead of that. Plant a tripwire credential that looks real but grants no access — any attempt to use it raises a Critical finding. Whoever's using it just sees an ordinary authentication failure, with nothing to tell them they tripped a wire. See [Findings](/product/admin/findings) and [Decoys](/product/admin/decoys) for details. Share feedback with the C1 Support team. From bf610146a3ec53166dfce9411563ee29265e2137 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 13 Aug 2026 15:55:14 -0700 Subject: [PATCH 18/21] Split crammed procedure steps into one action each The decoy-credential walkthrough and the decoy-planting steps each had multiple actions (navigate, set fields, save) bundled into single steps. Broken out into individual steps per the docs style guide's one-action-per-step rule. Co-Authored-By: Claude Sonnet 5 --- product/admin/decoys.mdx | 5 ++++- product/admin/findings.mdx | 27 ++++++++++++++++++++++++--- 2 files changed, 28 insertions(+), 4 deletions(-) diff --git a/product/admin/decoys.mdx b/product/admin/decoys.mdx index 3d53f3cc..fe60073e 100644 --- a/product/admin/decoys.mdx +++ b/product/admin/decoys.mdx @@ -42,7 +42,10 @@ Choose a decoy type. For a workload federation trust, also set a **Condition expression** — a CEL expression evaluated against the presented JWT's claims. For example: `claims.sub.startsWith("repo:acme/fake-infra:")`. -Set a **Display name** and, optionally, a **Description** to remind yourself where you planted it. +Set a **Display name**. + + +**Optional.** Set a **Description** to remind yourself where you planted it. **Optional.** Add **Annotations** — key/value tags for filtering, reporting, and integrations, for example `team = platform` or `owner = alice`. Annotations carry over onto the finding a decoy produces. A [routing rule](/product/admin/findings#routing-rules) can then condition on them. diff --git a/product/admin/findings.mdx b/product/admin/findings.mdx index 736dfb3f..b382e584 100644 --- a/product/admin/findings.mdx +++ b/product/admin/findings.mdx @@ -121,13 +121,34 @@ This walkthrough combines a finding type, a transformation rule, and a routing r -Turn on the finding type. In **Findings settings**, under **Credentials**, turn on **Decoy credential used** and save. +In **Findings settings**, under **Credentials**, turn on **Decoy credential used**. -Create a transformation rule to guarantee severity. Go to **Transformation rules** > **Create rule**. Set **Finding type** to **Decoy credential used**, and leave **App** and the expression unset to match every app. Add a **Set severity** transform and set it to **Critical**. Save the rule. +Save your changes. -Create a routing rule to escalate automatically. Go to **Routing rules** > **Create rule**. Set **Finding type** to **Decoy credential used**. Set **Action** to **No action**, so the finding stays open for review. Add a **Trigger automation** dispatcher to notify your security team immediately. +Go to **Transformation rules** > **Create rule**. + + +Set **Finding type** to **Decoy credential used**, and leave **App** and the expression unset to match every app. + + +Add a **Set severity** transform and set it to **Critical**. + + +Save the transformation rule. + + +Go to **Routing rules** > **Create rule**. + + +Set **Finding type** to **Decoy credential used**. + + +Set **Action** to **No action**, so the finding stays open for review. + + +Add a **Trigger automation** dispatcher to notify your security team immediately. Set this rule's **Order** so it runs before any broad catch-all routing rules. A general rule like "suppress low severity findings" could otherwise match first and prevent this one from running. From 13bdf71756139975f3422e589c6d408d8acceebd Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Fri, 14 Aug 2026 13:28:17 -0700 Subject: [PATCH 19/21] Add bulk actions and expiring-credential finding to Findings docs Both ship alongside the Findings/Decoys early-access launch. --- product/admin/findings.mdx | 9 ++++++--- product/release-notes.mdx | 4 ++++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/product/admin/findings.mdx b/product/admin/findings.mdx index b382e584..dd9626e7 100644 --- a/product/admin/findings.mdx +++ b/product/admin/findings.mdx @@ -55,6 +55,7 @@ The following finding types are available today, grouped by category: | Credentials | Unused secret | Secrets that have gone unused past the inactivity threshold. | | Credentials | Credential publicly exposed | Credentials found published outside your organization. | | Credentials | Decoy publicly exposed | A planted [decoy credential](/product/admin/decoys) was found published publicly. | +| Credentials | Expiring credential | ConductorOne's own service principal credentials that are within 30 days of expiring, or have already expired. | | Configuration | Anomaly detection disabled | Connectors running with sync anomaly detection turned off. | ## Work with a finding @@ -71,9 +72,11 @@ From the detail view, you can take one of the following actions on a finding: - **Snooze** — temporarily hide the finding. Requires a duration (1, 7, 30, or 90 days, or a custom date) and a reason. The finding automatically returns to open status when the snooze period ends. - **Remediate** — resolve and close the finding. This action only appears for finding types that support it. Its label also varies by finding type — for example, a service account misclassification finding offers **Confirm human** and **Mark as service** instead of a generic remediate button. - -You can only act on findings one at a time today. Bulk actions are coming soon. - +### Act on multiple findings at once + +From **All findings**, select multiple findings with the checkbox column, or use **Select all N in filter** to apply an action to every finding matching your current filters — including filters that couldn't previously be bulk-acted on, like finding type, owner, app resource, and connector. Choose **Snooze**, **Suppress**, **Accept risk**, or **Reopen** from the bulk action menu. + +Because these four actions apply to different finding states, the menu shows how many of your selected findings each one can actually change (for example, "Reopen — 3 of 12"), and the confirmation dialog restates that split before you commit. Only eligible findings are changed. Bulk actions require the same permission as changing a single finding's state, so read-only users don't see the selection controls. ## Transformation rules diff --git a/product/release-notes.mdx b/product/release-notes.mdx index 7bf05ce9..f22458e7 100644 --- a/product/release-notes.mdx +++ b/product/release-notes.mdx @@ -16,6 +16,10 @@ Catching an unowned service account, an exposed credential, or a misclassified i Stolen credentials usually only surface after they've already been used for real damage. Decoys get ahead of that. Plant a tripwire credential that looks real but grants no access — any attempt to use it raises a Critical finding. Whoever's using it just sees an ordinary authentication failure, with nothing to tell them they tripped a wire. +C1 now watches its own service principal credentials too: a new **Expiring credential** finding fires when one is within 30 days of expiring, or has already expired, so you can rotate it before it breaks any automation that depends on it. + +You can also act on findings in bulk. Select multiple findings in **All findings** — or use **Select all in filter** to grab everything matching your current filters — and snooze, suppress, accept risk on, or reopen them in one action instead of opening each one individually. + See [Findings](/product/admin/findings) and [Decoys](/product/admin/decoys) for details. Share feedback with the C1 Support team. From f21fd0fe2cff5a76130a585ff0e481d250a7981e Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Fri, 14 Aug 2026 13:28:38 -0700 Subject: [PATCH 20/21] Keep release note high-level, drop itemized mentions Detail lives in the linked Findings doc instead. --- product/release-notes.mdx | 4 ---- 1 file changed, 4 deletions(-) diff --git a/product/release-notes.mdx b/product/release-notes.mdx index f22458e7..7bf05ce9 100644 --- a/product/release-notes.mdx +++ b/product/release-notes.mdx @@ -16,10 +16,6 @@ Catching an unowned service account, an exposed credential, or a misclassified i Stolen credentials usually only surface after they've already been used for real damage. Decoys get ahead of that. Plant a tripwire credential that looks real but grants no access — any attempt to use it raises a Critical finding. Whoever's using it just sees an ordinary authentication failure, with nothing to tell them they tripped a wire. -C1 now watches its own service principal credentials too: a new **Expiring credential** finding fires when one is within 30 days of expiring, or has already expired, so you can rotate it before it breaks any automation that depends on it. - -You can also act on findings in bulk. Select multiple findings in **All findings** — or use **Select all in filter** to grab everything matching your current filters — and snooze, suppress, accept risk on, or reopen them in one action instead of opening each one individually. - See [Findings](/product/admin/findings) and [Decoys](/product/admin/decoys) for details. Share feedback with the C1 Support team. From 2dfd56ba7e8a578672b97a3058bd6fc5a65b4d48 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Fri, 14 Aug 2026 13:33:54 -0700 Subject: [PATCH 21/21] Mention NHI dashboard findings integration in release note --- product/release-notes.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/product/release-notes.mdx b/product/release-notes.mdx index 7bf05ce9..3e717add 100644 --- a/product/release-notes.mdx +++ b/product/release-notes.mdx @@ -16,6 +16,8 @@ Catching an unowned service account, an exposed credential, or a misclassified i Stolen credentials usually only surface after they've already been used for real damage. Decoys get ahead of that. Plant a tripwire credential that looks real but grants no access — any attempt to use it raises a Critical finding. Whoever's using it just sees an ordinary authentication failure, with nothing to tell them they tripped a wire. +Findings also show up on the Identities & NHI dashboard — every inventory table can filter to just the identities with open findings. + See [Findings](/product/admin/findings) and [Decoys](/product/admin/decoys) for details. Share feedback with the C1 Support team.