Process Management is the calendar view of your remediation work. Instead of reading status columns, you see a month grid where every day shows what actually happened to your vulnerabilities: what was detected, what was assigned to someone, what was started, and what was finished. Click any day and you get the timeline for that date, event by event, with the exact time each one was recorded.
The problem
Vulnerability trackers are good at telling you what is open right now. They are bad at telling you what happened last Tuesday. When a manager asks why a critical finding sat untouched for eleven days, or when an auditor asks you to show the sequence of handling for a specific finding, the honest answer in most teams is a spreadsheet rebuilt by hand from ticket exports and memory.
The underlying data usually exists, every task has a created date, an assignment date, a start date and a completion date, but nothing reads those four columns across every task and lays them out on a timeline. So teams reconstruct their own history manually, one export at a time, and the reconstruction is only as accurate as the person doing it at 6pm on a Friday.
How it works
- It joins findings and tasks in one pass
Opening the page loads your vulnerabilities, your tasks (up to 1,000 in a single request) and your dashboard statistics in parallel, then matches each task to its vulnerability by ID. Findings that have a task inherit that task’s timestamps; completed tasks whose vulnerability record has been archived are still carried through, so finished work does not vanish from history when the underlying finding is cleaned up.
- It turns timestamps into events
Each record is decomposed into up to four events, detection, assignment, start, completion, one for every timestamp that is actually present. Nothing is invented: if a task was never started, no start event appears. Dates are parsed in several formats, and each event is placed on the calendar day it belongs to in your local time.
- It renders a month you can move through
The grid shows one cell per day, with today highlighted, weekends shaded, a count badge when a day has activity, and up to three colour-coded event chips per cell. A selector lets you move back through the last twelve months. Clicking an event chip opens that finding inline; clicking anywhere else in the cell opens the full day.
- The day page gives you the day’s sequence
Each day has its own address, /process-management/day/2026-09-22, so a specific date can be bookmarked or pasted into a ticket. The day page offers a vertical timeline or a card grid, filters by event type, event source and status, and summary counts for detections, assignments, starts and completions on that date. Repeated records from the same source are collapsed within fifteen-minute windows, per finding and per event type, with the descriptions merged into the surviving event, and every event carries a visible source label so you can tell a task record from a derived one.
- Every event leads somewhere
Opening an event shows the finding name, risk, target IP, port, status and assignee, with user IDs resolved to the person’s name, and then hands you a button straight into the task detail or the vulnerability detail.
What you can do
Review any of the last twelve months as a calendar of detection, assignment, start and completion events.
Open a single date and read its events in chronological order, with the recorded time on each one.
Filter a day by event type, by the source system the event came from, or by finding status.
Switch a day between a timeline layout and a card grid.
See live counts of findings in progress, of completed tasks counted as resolved, and of the total under management.
Browse the in-progress list and the full historical list, sorted newest first, with the assignee shown by name.
Open a finding in place, read its comment thread and add a comment without leaving the page.
Follow a combined feed of the latest comments across findings and agents, each linking back to its subject.
See your team roster with role badges alongside the workload.
Jump from any event into the underlying task or vulnerability record.
Who it is for
Use the day pages to reconstruct exactly what happened during an incident window.
Use the month view to spot the pattern everyone feels but nobody can prove: findings that pile up on Mondays, assignments that never turn into starts, weeks where detection outran completion.
Get a defensible answer to “how fast do we actually move” that is built from recorded timestamps rather than estimates.
Get a date-addressable record of handling to point at during an audit, instead of a screenshot of a status board.
Why it matters
The gap between detection and assignment is where remediation programmes quietly fail, and it is invisible on a status board.
A finding that is open today looks identical whether it arrived this morning or five weeks ago.
Laying the four workflow timestamps on a calendar makes that gap visible on sight, which means it becomes something you can manage rather than something you discover during a breach review.
It also removes the manual assembly work behind every “what happened on…” question. The event history is already in your database; this module reads it, joins it, groups the repeats and puts it on a page.
And because you install and run the platform on your own infrastructure, that history, every finding, every assignee, every comment, stays in your own database.
Works with
- Task Management, creates the tasks whose timestamps become calendar events
- Team Workflow, coordinates assignment across teams and roles
- Vulnerability Lifecycle, the state machine behind each finding on the calendar
- AI Daily Summary, an AI written summary of the current day’s activity, reachable from this page when AI features are enabled
Frequently asked questions
Do I have to log events for the calendar to fill up?
No. Events are derived from timestamps your tasks and findings already carry: created, assigned, started, completed. There is no separate journal to maintain, and no event can appear unless its timestamp exists in the database.
Does every user see the same calendar?
Not entirely. Task visibility is scoped by role: administrators and managers see all tasks, while other users see only the tasks they created or that are assigned to them, so the assignment, start and completion events on an analyst’s calendar reflect their own workload. Detection events are drawn from the vulnerability list, which standard roles see in full, so those remain organisation-wide. External pentester accounts are the exception and see only the findings they entered themselves.
What happens if the same action is recorded twice?
The day view groups events into fifteen-minute buckets per finding and event type, and where the same source produced the record twice it keeps one event and merges the second description into it. Records that arrive from different sources, for example the task API and the derived workflow entries, are kept separately and labelled with their source, so you can filter by source or read the label to see which system logged what.
Can I link someone directly to a specific day?
Yes. Each day has its own URL containing the date, so you can paste it into a ticket, an incident report or an email and the recipient lands on that exact timeline.
Process Management ships as part of the SITEY platform, which you install and run on your own infrastructure, so its data stays in your own database. Optional AI features can be pointed at an external model provider or at a model endpoint you host yourself, and that choice stays with you. See pricing for the full platform, or start with the day view on your own history and find out how long your findings really wait.