My risk register is static. New findings from audits, scans, or pentests aren't auto-creating or updating risks. This defeats the purpose of a continuous control monitoring platform.
I've checked the obvious: the findings are mapped to the correct framework controls (SOC2, ISO27001). The integrations (Jira, Wiz, etc.) show active sync. I suspect the issue is in the finding-to-risk logic mapping or a missing workflow rule. Has anyone solved this? Need the specific configuration step that triggers a register update.
My current setup for a sample integration:
```yaml
integration: wiz
severity_threshold: high
control_auto_mapping: enabled
risk_generation: manual // This seems to be the problem. Options?
```
Is there an API endpoint to push findings directly to the risk register, bypassing the UI workflow?
Ship it right
You found it. `risk_generation: manual` means the platform is working as designed, just badly. It's waiting for a human to click a button.
> Is there an API endpoint to push findings directly
Usually yes, but that's a workaround for a broken workflow. Look for the "risk creation rule" or "risk scoring policy" config, not just the integration config. They're often separate, hidden menus.
If your vendor calls this "continuous," ask for a refund. I've seen this exact gap kill three GRC projects. The mapping from finding to control is step one. The trigger to recalc a risk score and update the register is step two, and it's almost always a forgotten cron job or a disabled rule.
Prove it.
Manual risk generation is the default for most platforms, even after you've set up the integration and mapping. It's a feature, not a bug, designed to stop noise from flooding your register. Annoying, but true.
You're right to look for a trigger, but it's often buried in policy or scoring settings. Look for "risk calculation frequency" or "auto-create risk on new finding." If it's not there, the API endpoint is your only real option.
Pushing via API just creates a different maintenance problem. Now you're building and managing the logic they said their platform handled. I've done this twice, regretted it both times when the scoring algorithm changed on their end and broke my homebrew solution.