Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,17 @@ python manage.py consolidate_folded_findings --product <asset id> --apply

The newest finding of each group survives, and the others' locations move onto it, keeping the test that reported each one. The others become its duplicates.

Consolidation records each finding it folds: the finding it went onto, the locations that moved, and what marking it a duplicate cleared. Moving the tool back to **As the parser groups them** after consolidating does not split anything when you save it, because what the parser makes of a report is only known at the next import. The split happens on the next reimport instead. When it reports a finding that consolidation folded away, that finding becomes active again, its locations (files, URLs or any other kind) move back from the surviving finding with their status history, it is verified again if it was before, and a note on it names the finding it had been folded into. Only findings with a consolidation record come back: a finding you marked as a duplicate yourself stays a duplicate. A folded-away finding is also left alone when the surviving finding is no longer active, for example because it was marked a false positive or risk accepted.

Consolidations run on an earlier release have no record, so a reimport leaves their folded findings closed. To reopen them, run `unfold_consolidated_findings` for the Assets concerned. It lists each finding it would reopen with its reasons, counts the ones it leaves alone (`--verbose` lists those too), and changes nothing until you pass `--apply` (with `--user`, the account the notes are written as):

```bash
python manage.py unfold_consolidated_findings --product <asset id>
python manage.py unfold_consolidated_findings --product <asset id> --apply --user <username>
```

It recognizes these findings by their file and line, so it only handles findings with a code location. A finding on the same line as the finding it duplicates is left alone, because a person marking one finding on that line a duplicate of another leaves the same traces. If a reimport on an earlier release already gave a folded-away finding a new location row of its own, that newer row is removed when the finding is reopened, so its original row, with its history, comes back to it from the surviving finding; the note on the finding names each row removed. Findings without a file are only counted, because nothing on them says which locations they held. Reopen any of these yourself if they should be open. Use `--pool <pool id>` instead of `--product` to cover every Asset in a dedupe pool.

To use a grouping only for some Assets, put them in a [dedupe pool](/triage_findings/finding_deduplication/pro__dedupe_pools/) and pick that pool under **Applies To**. Assets outside the pool keep the instance default.

## Same Tool Deduplication
Expand Down
Loading