Skip to main content
Open the dashboard supplied for your deployment. Select the Firewall and time window, then open Findings. Use Monitoring to review traffic volume alongside findings.

​
Inspect the event

Open a finding and record its finding ID, request ID, timestamp, hook, and tool name. Review the available conversation and captured evidence to understand the input, proposed action, and preceding events. Read the prediction, applicable governance decision, and effective mode together. A finding can describe a would-block event observed in Shadow or Warn. Confirm actual execution behavior in your application when investigating impact. Captured evidence can be partial or unavailable. Check the evidence availability notice before drawing conclusions about what the model saw. Handle payloads as untrusted content and keep sensitive excerpts within your authorized review workflow.

​
Report a false positive

Use Support in your dashboard and select the affected Firewall. Include the finding ID, request ID, timestamp, expected legitimate behavior, and a short explanation of why the action was authorized. Share a sanitized reproduction when possible. Keep API keys, credentials, and unrelated private content out of the report. Silmaril can arrange access to additional evidence when needed. Feedback gives the team evidence to investigate and evaluate improvements. Confirm any enforcement change separately before relying on it.

​
Investigate with an MCP client

Use Firewall MCP to summarize traffic and findings, build an investigation packet, and retrieve authorized detail. Start with aggregates and narrow to the evidence the review needs. For missing events or connection failures, see troubleshooting.