From 8d82b52ab66ff8bcbb3537d979611b844d796095 Mon Sep 17 00:00:00 2001 From: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Date: Thu, 29 Oct 2026 01:47:47 -0600 Subject: [PATCH 1/5] docs(dedupe): describe reverting the grouping after consolidation Explain that moving a tool back to the parser's grouping after consolidate_folded_findings splits the folded findings on the next reimport, with their locations moving back, and when a duplicate is left alone. Co-Authored-By: Claude Opus 5.5 --- .../finding_deduplication/PRO__deduplication_tuning.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md index e10592c3a97..7ff9990d964 100644 --- a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md +++ b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md @@ -110,6 +110,8 @@ python manage.py consolidate_folded_findings --product --apply The newest finding of each group survives, and the others' locations move onto it, keeping the test that reported each one. The others become its duplicates. +Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a location that consolidation folded away, the duplicate that held it becomes an active finding again, and its locations move back from the surviving finding with their status history. It comes back unverified, because consolidation cleared that. A duplicate is left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted. + To use a grouping only for some Assets, put them in a [dedupe pool](/triage_findings/finding_deduplication/pro__dedupe_pools/) and pick that pool under **Applies To**. Assets outside the pool keep the instance default. ## Same Tool Deduplication From 495fbd998d7993221b44e8b9b48fcfa2dc85cdeb Mon Sep 17 00:00:00 2001 From: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Date: Thu, 29 Oct 2026 10:38:27 -0600 Subject: [PATCH 2/5] docs(dedupe): scope the revert paragraph to findings consolidation folded away Say that every location type moves back, that the reopened finding gets a note naming the finding it was folded into, and that a finding marked as a duplicate by hand stays a duplicate. Co-Authored-By: Claude Opus 5.5 --- .../finding_deduplication/PRO__deduplication_tuning.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md index 7ff9990d964..a025555f36b 100644 --- a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md +++ b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md @@ -110,7 +110,7 @@ python manage.py consolidate_folded_findings --product --apply The newest finding of each group survives, and the others' locations move onto it, keeping the test that reported each one. The others become its duplicates. -Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a location that consolidation folded away, the duplicate that held it becomes an active finding again, and its locations move back from the surviving finding with their status history. It comes back unverified, because consolidation cleared that. A duplicate is left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted. +Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a location that consolidation folded away, the duplicate that held it becomes an active finding again, and its locations (files, URLs or any other kind) move back from the surviving finding with their status history. A note on it names the finding it had been folded into. It comes back unverified, because consolidation cleared that. Only findings consolidation folded away come back: a finding you marked as a duplicate yourself stays a duplicate. A folded-away finding is also left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted. To use a grouping only for some Assets, put them in a [dedupe pool](/triage_findings/finding_deduplication/pro__dedupe_pools/) and pick that pool under **Applies To**. Assets outside the pool keep the instance default. From 4957be3351195d32bc3f9dd04ffc4ef25c7d8b2b Mon Sep 17 00:00:00 2001 From: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Date: Thu, 29 Oct 2026 11:53:33 -0600 Subject: [PATCH 3/5] docs(dedupe): say a hand-marked duplicate on the same line or URL stays one Co-Authored-By: Claude Opus 5.5 --- .../finding_deduplication/PRO__deduplication_tuning.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md index a025555f36b..73f409b0604 100644 --- a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md +++ b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md @@ -110,7 +110,7 @@ python manage.py consolidate_folded_findings --product --apply The newest finding of each group survives, and the others' locations move onto it, keeping the test that reported each one. The others become its duplicates. -Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a location that consolidation folded away, the duplicate that held it becomes an active finding again, and its locations (files, URLs or any other kind) move back from the surviving finding with their status history. A note on it names the finding it had been folded into. It comes back unverified, because consolidation cleared that. Only findings consolidation folded away come back: a finding you marked as a duplicate yourself stays a duplicate. A folded-away finding is also left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted. +Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a location that consolidation folded away, the duplicate that held it becomes an active finding again, and its locations (files, URLs or any other kind) move back from the surviving finding with their status history. A note on it names the finding it had been folded into. It comes back unverified, because consolidation cleared that. Only findings consolidation folded away come back: a finding you marked as a duplicate yourself stays a duplicate, even when it is on the same line or URL as the finding you marked it against. A folded-away finding is also left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted. To use a grouping only for some Assets, put them in a [dedupe pool](/triage_findings/finding_deduplication/pro__dedupe_pools/) and pick that pool under **Applies To**. Assets outside the pool keep the instance default. From 69899c5c16f75903f1d117d5ddbf702414886526 Mon Sep 17 00:00:00 2001 From: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Date: Thu, 29 Oct 2026 13:29:42 -0600 Subject: [PATCH 4/5] docs(dedupe): describe consolidation records and the unfold command Co-Authored-By: Claude Opus 5.5 --- .../PRO__deduplication_tuning.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md index 73f409b0604..4399993d84f 100644 --- a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md +++ b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md @@ -110,7 +110,16 @@ python manage.py consolidate_folded_findings --product --apply The newest finding of each group survives, and the others' locations move onto it, keeping the test that reported each one. The others become its duplicates. -Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a location that consolidation folded away, the duplicate that held it becomes an active finding again, and its locations (files, URLs or any other kind) move back from the surviving finding with their status history. A note on it names the finding it had been folded into. It comes back unverified, because consolidation cleared that. Only findings consolidation folded away come back: a finding you marked as a duplicate yourself stays a duplicate, even when it is on the same line or URL as the finding you marked it against. A folded-away finding is also left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted. +Consolidation records each finding it folds: the finding it went onto, the locations that moved, and what marking it a duplicate cleared. Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a finding that consolidation folded away, that finding becomes active again, its locations (files, URLs or any other kind) move back from the surviving finding with their status history, it is verified again if it was before, and a note on it names the finding it had been folded into. Only findings with a consolidation record come back: a finding you marked as a duplicate yourself stays a duplicate. A folded-away finding is also left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted. + +Consolidations run on an earlier release have no record, so a reimport leaves their folded findings closed. To reopen them, run `unfold_consolidated_findings` for the Assets concerned. It lists each finding it would reopen, and each one it leaves alone, with its reasons, and changes nothing until you pass `--apply` (with `--user`, the account the notes are written as): + +```bash +python manage.py unfold_consolidated_findings --product +python manage.py unfold_consolidated_findings --product --apply --user +``` + +It recognizes these findings by their file and line, so it only handles findings with a code location. A finding on the same line as the finding it duplicates is listed and left alone, because a person marking one finding on that line a duplicate of another leaves the same traces. Findings without a file are only counted, because nothing on them says which locations they held. Reopen any of these yourself if they should be open. Use `--pool ` instead of `--product` to cover every Asset in a dedupe pool. To use a grouping only for some Assets, put them in a [dedupe pool](/triage_findings/finding_deduplication/pro__dedupe_pools/) and pick that pool under **Applies To**. Assets outside the pool keep the instance default. From 169406a6f2c31e4c98cd021c4650e01f0d41714a Mon Sep 17 00:00:00 2001 From: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Date: Thu, 29 Oct 2026 14:07:34 -0600 Subject: [PATCH 5/5] docs(dedupe): say what the unfold command counts and which rows it replaces Co-Authored-By: Claude Opus 5.5 --- .../finding_deduplication/PRO__deduplication_tuning.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md index 4399993d84f..6c3398d2465 100644 --- a/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md +++ b/docs/content/triage_findings/finding_deduplication/PRO__deduplication_tuning.md @@ -112,14 +112,14 @@ The newest finding of each group survives, and the others' locations move onto i Consolidation records each finding it folds: the finding it went onto, the locations that moved, and what marking it a duplicate cleared. Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a finding that consolidation folded away, that finding becomes active again, its locations (files, URLs or any other kind) move back from the surviving finding with their status history, it is verified again if it was before, and a note on it names the finding it had been folded into. Only findings with a consolidation record come back: a finding you marked as a duplicate yourself stays a duplicate. A folded-away finding is also left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted. -Consolidations run on an earlier release have no record, so a reimport leaves their folded findings closed. To reopen them, run `unfold_consolidated_findings` for the Assets concerned. It lists each finding it would reopen, and each one it leaves alone, with its reasons, and changes nothing until you pass `--apply` (with `--user`, the account the notes are written as): +Consolidations run on an earlier release have no record, so a reimport leaves their folded findings closed. To reopen them, run `unfold_consolidated_findings` for the Assets concerned. It lists each finding it would reopen with its reasons, counts the ones it leaves alone (`--verbose` lists those too), and changes nothing until you pass `--apply` (with `--user`, the account the notes are written as): ```bash python manage.py unfold_consolidated_findings --product python manage.py unfold_consolidated_findings --product --apply --user ``` -It recognizes these findings by their file and line, so it only handles findings with a code location. A finding on the same line as the finding it duplicates is listed and left alone, because a person marking one finding on that line a duplicate of another leaves the same traces. Findings without a file are only counted, because nothing on them says which locations they held. Reopen any of these yourself if they should be open. Use `--pool ` instead of `--product` to cover every Asset in a dedupe pool. +It recognizes these findings by their file and line, so it only handles findings with a code location. A finding on the same line as the finding it duplicates is left alone, because a person marking one finding on that line a duplicate of another leaves the same traces. If a reimport on an earlier release already gave a folded-away finding a new location row of its own, that newer row is removed when the finding is reopened, so its original row, with its history, comes back to it from the surviving finding; the note on the finding names each row removed. Findings without a file are only counted, because nothing on them says which locations they held. Reopen any of these yourself if they should be open. Use `--pool ` instead of `--product` to cover every Asset in a dedupe pool. To use a grouping only for some Assets, put them in a [dedupe pool](/triage_findings/finding_deduplication/pro__dedupe_pools/) and pick that pool under **Applies To**. Assets outside the pool keep the instance default.