The Findings List Comes First
September 10, 2026 · InfraScout Team
The Insights page used to open on analytics. Severity counters, category bars, a status panel, a trend chart and a top-hosts list — all above the findings themselves, which meant the page opened on aggregate color while the rows you actually work through sat below the fold.
Triage does not start with a chart. It starts with a list.
The list leads
The findings list now takes the full width of the page and opens directly on the rows. Every aggregation moves into a narrow rail beside it, and on a narrow screen the rail stacks underneath — the list still comes first.
Nothing was removed. Every counter, bar and chart row is still there, and every one of them is still a filter toggle. They have simply stopped being the first thing the page asks you to read. The numbers exist to steer the list.
Two of them changed in the move. Category bars now scale against the largest category rather than against the total, because scaled by total a realistic spread leaves every bar a stub. And the charts became plain bars, which follow a theme switch instantly and make the page noticeably lighter to open.
Filters split by how often you use them
The list card has three zones now, divided by how often a triage pass reaches for each.
The toolbar carries the constants: search, severity, status, Export, Clear, and the row count. Everything else — category, namespace, creator, playbook, hostname, and the My Insights toggle — moved behind a Filters button with a badge counting how many are active. Those are the filters you set once and leave, and folding them away gives the toolbar back to the ones you touch every few seconds. The badge is what keeps it honest: nothing is ever narrowing your list invisibly.
Clear deliberately stayed in the toolbar rather than moving into the panel with the rest. A Clear you can only reach by opening something is unreachable exactly when you most want it — staring at an over-filtered empty list.
Rows say what the finding is
A finding carries a stable identifier like windows_firewall_all_profiles_disabled. The row used to show you that string and a one-line summary beside it, and you decoded the identifier to work out what you were looking at.
Rows now lead with the name in plain language, with a severity-colored left edge. The raw identifier is still on the detail view for anything that needs the exact string.
Two columns came off to pay for that width. The severity badge was saying the same thing as the row edge and the icon color — three times over. The summary gave up its column and moved to the row's hover text, one gesture away rather than permanently occupying space the name uses better.
The detail view reads as a document
Opening a finding used to give you a flat stack of five identical cards. It now opens on a severity-led header — what it is, how bad, which host, when — over a body that reads as one document divided into Remediation, Evidence, and Affected Resources, with a triage rail beside it for status, assignee, effort and related findings.
Remediation steps render as a sequence you work down, with a copy button on anything meant to be run.
They are deliberately not tick boxes. An insight carries an assignee and a status, so remediation is shared work — and progress that lived only in your own browser would show you three of four steps done and a colleague none of them, on the same finding.
Ask InfraScout lets you choose first
Ask InfraScout hands a finding to a chat conversation with its context attached. It used to create that conversation the instant you clicked — always on the tenant's default model, with no opportunity to pick a playbook or scope the tools.
It now attaches the context and stops on the ordinary Start a Conversation form, where those three pickers already live. You choose, then send your first message, and the conversation is created then.
The form names the attached context rather than previewing it. The context is built from the live finding at the moment the conversation actually starts, so showing you a copy beforehand risks showing you something the model never received.
One correction that came with it: the button is admin-only, because the action behind it always was. It used to appear for every role and fail with an error.
Reference: Insights.
Questions or feedback? Reach us at info@infrascout.cloud.