Risk review

Risks shows flagged workspace events for investigation. It is an assessment workflow, not a command approval queue. Owners, administrators, and security managers can mark records reviewed or reopen them. Auditors can inspect activity read-only.

Work through open findings

1. Open Risks → Open in the intended workspace.
2. Inspect the finding summary, severity, agent, and timestamp.
3. Locate related activity and local evidence when needed.
4. Determine what was proposed, what was observed, and which effects remain unverified.
5. Choose Mark reviewed after completing your assessment.

Each finding shows who reported it: the member and device for agent and browser findings, or the app for App monitoring findings. Search matches names, emails and apps. Each finding's sheet has Open full report, a full page for that one finding that also works on a phone. The Filters button opens severity, agent or product, app and period filters; they apply to every finding, not only the page loaded, and live in the URL so a filtered view can be shared. The list shows the latest 200 matching records, not an unlimited incident history. A low count can reflect filters, retention, or delivery gaps rather than a complete absence of risk.

Respond to an app finding

A finding from an app is a web request, so the sheet offers Ignore and Block address instead of the command rules used for agent findings. Block address pauses the sender's IP in the app that saw it (or every app) for 15 minutes to 7 days. Apps using the SDK answer it with a 429 within 5 minutes, and beam monitor --deny-file lists it for your web server. When the time is up the address is let back in automatically. Blocking needs workspace-write access (owners and administrators). Behind a shared proxy or office network one address can be many people, and private, loopback and allowlisted addresses are never blocked. The block appears under App monitoring → Paused and can be lifted there.

Assess severity in context

Severity describes a heuristic match. It does not establish malicious intent or successful execution. For example, a command mentioned in documentation can resemble an instruction to execute that command. Read the surrounding artifact and the agent's actual action before drawing a conclusion.

Record supporting evidence in your team's incident workflow when more detail is needed. Beam's review toggle is not a complete case-management record and does not itself remediate a device.

Reopen a reviewed finding

Open Reviewed, locate the event, and choose Reopen if new evidence warrants another look. Both review and reopening are recorded in the administrative audit log. Read-only users see the status without a mutation control.

Marking reviewed does not remove the underlying event, disable the detection rule, change policy, or acknowledge that a risky command was safe to run.

Correlate local and shared views

Studio also has a local reviewed marker. Connected review updates are forwarded best-effort; network failures can leave views out of sync. Verify the record in the system relevant to your team's workflow instead of assuming immediate propagation.

For an incident, preserve a redacted local export and the original supporting evidence before local retention or offboarding removes it. Use Audit log to verify who changed the administrative review state.