Home Triage findings Deduplication Knowledge Check Knowledge Check (Pro) Twenty-five questions about what Deduplication is for in DefectDojo Pro: how it differs from reimport matching, how it matches Findings across tools and across Assets in a Dedupe Pool, and which Finding data it compares.
Pick an answer to see whether it’s right and why. Your first pick is the one that counts toward your score, but you can then pick the other options to see where each one would point you. Each explanation links to the page that covers it. Nothing is recorded: your answers stay in your browser and disappear when you leave the page.
1. What is deduplication for?A.
Deleting every Finding that a later scan reports again
B.
Recognizing that a newly created Finding is the same vulnerability as an existing one, and marking it a duplicate so your team works on one active original
C.
Merging two matching Findings into a single record that combines their notes and fields
D.
Stopping a scanner from reporting the same issue twice Deduplication compares each new Finding with existing Findings in scope. A match is marked as a duplicate of the oldest Finding, so all the work on that vulnerability happens on one original.
Read more Where to look instead: Duplicates are kept by default. Deleting them is a separate, optional setting with a limit you choose.
Delete Deduplicate Findings →
Where to look instead: A duplicate stays its own Finding. It’s linked to its original rather than merged into it.
How duplicates are displayed and linked →
Where to look instead: DefectDojo doesn’t scan. Deduplication works on the Findings a parser creates from the tool’s report.
What happens to a Finding on import →
2. What is the difference between reimport deduplication and deduplication?A.
Nothing. They are the same check, run twice to be safe
B.
Reimport deduplication compares across the whole Asset, while deduplication only looks inside one Test
C.
Reimport deduplication compares the incoming report with the Findings in one Test, and a match is never created at all. Deduplication then compares the Findings that were created with the rest of their scope and marks matches as duplicates
D.
Reimport deduplication only runs for API uploads, and deduplication only for uploads through the UI Reimport matching happens first, inside one Test, and matched results never become Findings. Whatever is created then goes through Same Tool and Cross Tool deduplication, which marks duplicates instead of discarding them.
Read more Where to look instead: They are separate checks with separate formulas. Each tool has its own Reimport, Same Tool and Cross Tool settings.
Matching Configuration →
Where to look instead: It’s the other way round. A reimport only ever matches inside its own Test.
Reimport Deduplication →
Where to look instead: Both run for both kinds of upload. What differs is what each one compares against.
Reimport →
3. By default, which set of Findings are used for comparison during deduplication?A.
Every Finding in the DefectDojo instance
B.
Only the Findings in the same Test
C.
Findings in the same Organization
D.
Findings anywhere in the same Asset Deduplication is scoped to the Asset by default. Findings in different Assets aren’t compared unless you use a Dedupe Pool or one of the global algorithms.
Read more Where to look instead: Instance-wide matching comes only from the global algorithms, which are off by default and gated behind feature flags.
Global Component Deduplication →
Where to look instead: That’s how reimport matching works, not deduplication.
Reimport Deduplication →
Where to look instead: An Organization isn’t a deduplication scope. To make Findings in several Assets meet, group those Assets in a Dedupe Pool, which can even span Organizations.
Dedupe Pools →
4. What is a Dedupe Pool?A.
A queue of Findings that are waiting for deduplication to run
B.
A named group of Assets whose Findings deduplicate against each other
C.
A matching algorithm that compares Findings by component name and version
D.
A group of security tools whose Findings deduplicate against each other A pool widens deduplication beyond one Asset to a group you choose. It suits services that share a base image, or a monorepo split into one Asset per component.
Read more Where to look instead: Deduplication runs in the background after import. You can choose whether an import waits for it.
Background processing →
Where to look instead: That’s Global Component, an algorithm that matches across every Asset in the instance.
Global Component Deduplication →
Where to look instead: Matching Findings from different tools is Cross Tool deduplication, configured per tool.
Cross Tool Deduplication →
5. What does cross-tool deduplication do?A.
Copies Findings from one tool’s Test into another tool’s Test
B.
Converts one tool’s report format into another tool’s format
C.
Matches incoming results against existing Findings each time you reimport into a Test
D.
Marks a Finding from one tool as a duplicate of a Finding from a different tool when both describe the same issue For example, two dependency scanners that both flag the same CVE in the same package can resolve to one original. The original’s
Found by field then lists every tool that reported it.
Read more Where to look instead: Nothing is copied. Each tool’s Findings stay in their own Test, and duplicates link to an original.
How duplicates are displayed and linked →
Where to look instead: To bring in a format DefectDojo doesn’t support, map it with the Universal Parser.
Universal Parser →
Where to look instead: That’s reimport matching, which only compares within a single Test and a single tool.
Reimport Deduplication →
6. You import the same scan into Test 1, and later into a new Test 2 in the same Asset. Deduplication is on. What happens to the vulnerability reported in both?A.
Test 2’s Finding is marked as a duplicate of Test 1’s, set to inactive and unverified, and linked to it
B.
Test 2 replaces Test 1, and Test 1’s Findings are removed
C.
Test 1’s Finding becomes the duplicate, because Test 2 has the newer data
D.
Nothing. Deduplication only compares Findings inside one Test The new Finding gets the Duplicate status and points to the original. Duplicates are inactive, so the team has one active Finding to remediate.
Read more Where to look instead: Import always creates a new Test. To keep sending a recurring scan into one Test, use Reimport.
Using Reimport for continual Tests →
Where to look instead: The earliest-created Finding is always the original. An established original is never demoted.
Which Finding becomes the original →
Where to look instead: Deduplication compares across the whole Asset by default.
Deduplication scope →
7. During a reimport, an incoming result doesn’t match any Finding already in the Test. What happens to it?A.
It’s discarded, because reimport only keeps results that match
B.
It becomes a new Finding in the Test, and then goes through normal deduplication against the rest of its scope
C.
It’s attached as a duplicate of the closest Finding in the Test
D.
The reimport stops and asks you to create a new Test Only matched results are discarded. An unmatched result becomes a new Finding, and that Finding is subject to Same Tool and Cross Tool deduplication like any other.
Read more Where to look instead: It’s the other way round. Matched results are the ones that never become Findings.
Reimport Deduplication →
Where to look instead: Reimport doesn’t create duplicates inside its Test. Duplicates come from deduplication, which runs afterwards.
Reimport in action →
Where to look instead: Reimport handles new results itself by creating Findings for them.
Reimport →
8. A tool’s Reimport formula hashes Title, CWE, Severity, Description and Line Number. Its Same Tool formula hashes the same fields without Line Number. A vulnerability’s line number changes, and you reimport into the same Test. What happens?A.
Reimport matches the existing Finding and leaves it untouched
B.
Reimport discards the incoming result as a match
C.
Same Tool deduplication can’t run, because the two formulas disagree
D.
Reimport creates a new Finding because the line number differs, and Same Tool deduplication then marks it as a duplicate The two formulas run one after the other. Reimport sees a different line number and creates a Finding, then Same Tool deduplication ignores line number and marks it as a duplicate.
Read more Where to look instead: That needs a Reimport formula that tolerates the move. Track Findings as Locations Change keeps one Finding in place when its line shifts.
Location Drift Matching →
Where to look instead: Reimport only discards results that match, and the line number stopped this one matching.
Reimport Deduplication →
Where to look instead: Each matching kind has its own formula, and they’re meant to differ when that suits the tool.
Matching Configuration →
9. Why should a tool’s Reimport formula be changed with particular care?A.
Reimport discards matched results before they are recorded, so a formula that matches too broadly can lose real Findings
B.
A Reimport change also rewrites the tool’s Same Tool formula
C.
A Reimport formula can only be changed once per tool
D.
Changing it deletes the Tests already reimported with the old formula A deduplication mistake leaves an inactive duplicate you can still find. A reimport match is never created at all, so an over-broad formula can drop Findings you needed.
Read more Where to look instead: Same Tool, Cross Tool and Reimport each have their own column in Matching Configuration.
Matching Configuration →
Where to look instead: You can change it whenever you like. Each change goes through a review step first.
Changing a tool's matching →
Where to look instead: Nothing is deleted. A field change re-hashes the tool’s Findings in the background.
Running deduplication retroactively →
10. Two Engagements in one Asset scan different repositories, and each should keep its own Findings instead of deduplicating against the other. What do you turn on?A.
A Dedupe Pool containing both Engagements
B.
Delete Deduplicate Findings in System SettingsC.
Isolate Deduplication From Other Engagements on the EngagementD.
Close Old Findings on each importWith isolation on, an Engagement’s Findings only deduplicate against Findings in the same Engagement. If either of two Engagements has it enabled, their Findings are never compared.
Read more Where to look instead: Pools group Assets, not Engagements, and they widen the scope rather than narrowing it.
Dedupe Pools →
Where to look instead: That limits how many duplicates are kept. It doesn’t change which Findings are compared.
Delete Deduplicate Findings →
Where to look instead: That closes Findings missing from a new report. It has nothing to do with deduplication scope.
Reimport and closing fixed Findings →
11. The original Finding for a vulnerability was mitigated. The same vulnerability turns up again in a new Test. What does deduplication do with the new Finding?A.
Marks it as a duplicate of the mitigated original, so it’s inactive too
B.
Leaves it active as its own original, so the returning vulnerability isn’t hidden
C.
Reopens the mitigated original and discards the new Finding
D.
Rejects the import until the original is reopened by hand DefectDojo doesn’t attach an active Finding to a closed original, so a vulnerability that comes back stays visible.
Read more Where to look instead: Doing that would hide a vulnerability that’s back, so deduplication doesn’t link to a closed original.
How duplicates are displayed and linked →
Where to look instead: Reopening a closed Finding is what a reimport into the same Test does, unless you set Do Not Reactivate .
Reopen Findings →
Where to look instead: Deduplication never blocks an import. It only decides how new Findings are linked.
What happens to a Finding on import →
12. Why can’t the Unique ID From Tool algorithm match a Finding from one tool with a Finding from another?A.
It ignores endpoints, and cross-tool matching needs them
B.
Cross-tool matching only works inside a single Test
C.
It can, as long as both tools import into the same Asset
D.
One tool’s identifiers mean nothing to another, so cross-tool matches always come from the hash code Unique ID From Tool is the most stable choice within one tool, but it never crosses tools. Cross-tool matching relies on both tools producing the same hash code.
Read more Where to look instead: It does ignore endpoints, but that isn’t why. The identifier only means something to the tool that issued it.
How endpoints are assessed per algorithm →
Where to look instead: Cross-tool matching compares Findings across the Asset, or the Asset’s Dedupe Pool.
Cross Tool Deduplication →
Where to look instead: Being in the same Asset doesn’t help. Two tools never share identifiers.
Same-tool and cross-tool deduplication →
13. You’re turning on Cross Tool matching for two SCA tools. Which hash field setup is most likely to make their Findings match?A.
Title and Description on both tools
B.
Vulnerability IDs, component name and component version, selected identically on both tools
C.
A different field list on each tool, tuned to that tool’s report format
D.
No hash fields, so that every Finding is compared Pick fields whose values don’t depend on the vendor, and select the same fields on every participating tool. Titles and descriptions rarely match, because each vendor writes its own.
Read more Where to look instead: Each vendor words titles and descriptions differently, so these rarely line up across tools.
Same-tool and cross-tool deduplication →
Where to look instead: Every tool enabled for cross-tool deduplication must have the same fields selected, or the hash codes can’t match.
Deduplication best practices →
Where to look instead: The editor won’t save Cross Tool Hash Code with no fields, because the hash is built from those fields alone.
Cross Tool Deduplication →
14. Two tools have identical Cross Tool settings, but their Findings never deduplicate. One tool imports into Asset A and the other into Asset B. What’s the most likely reason?A.
Cross Tool deduplication is scoped to the Asset, or to the Asset’s Dedupe Pool, and these Assets share neither
B.
Cross Tool matching only works with the Unique ID From Tool algorithm
C.
Both tools need to import into the same Test
D.
Cross Tool deduplication only runs during reimport Matching hash fields aren’t enough on their own. The Findings must also be in the same scope, so keep cross-tool sources in one Asset, or pool the Assets for Cross Tool matching.
Read more Where to look instead: Cross Tool uses Hash Code, because tools don’t share unique IDs.
The deduplication algorithms →
Where to look instead: A Test holds one tool’s report. Cross-tool matching compares across the Asset.
Deduplication scope →
Where to look instead: Cross Tool deduplication runs on new Findings after every import and reimport.
What happens to a Finding on import →
15. What does adding Assets to a Dedupe Pool change?A.
The algorithm and hash fields that the pool’s Assets use
B.
Nothing until each Asset’s Findings are re-imported
C.
Which Findings are eligible to be compared, while how they’re compared still comes from Matching Configuration
D.
It moves the pooled Assets’ Findings into a single Asset A pool changes which Findings can meet, not how two Findings are compared. Every member uses the instance’s Matching Configuration for its tools.
Read more Where to look instead: Matching Configuration is instance-wide, pooled Assets included. Per-pool overrides aren’t available yet.
Matching Configuration →
Where to look instead: New imports pick up the pool straight away. For Findings already in DefectDojo, use Apply to Existing Findings .
Applying a pool to existing Findings →
Where to look instead: Pooled Assets stay separate. Only the deduplication links cross between them.
Dedupe Pools →
16. Which matching kinds can an Asset join a Dedupe Pool for?A.
Same Tool, Cross Tool and Reimport
B.
Only Same Tool
C.
Same Tool and Cross Tool, with any number of pools per kind
D.
Same Tool and Cross Tool, with at most one pool per kind An Asset can share Same Tool matching with one group and Cross Tool matching with another. There’s no Reimport kind, because a reimport only matches inside its own Test. The Findings a reimport creates are still deduplicated across the pool.
Read more Where to look instead: There’s deliberately no Reimport kind. Pooling couldn’t widen a match that stays inside one Test.
Membership is per matching kind →
Where to look instead: Cross Tool matching can be pooled too, and the pool can differ from the Same Tool one.
Membership is per matching kind →
Where to look instead: An Asset can be in only one pool per kind. Adding it to a second one is refused, and the message names the pool that holds it.
Membership is per matching kind →
17. An SCA tool uses Global Component for Same Tool matching, so its Findings match across the whole instance. You then add one of its Assets to a Same Tool Dedupe Pool. What happens to that Asset’s matching?A.
Nothing changes, because pools and global algorithms are independent
B.
Its Findings now match only against the pool’s other members, not the whole instance
C.
Matching widens to include Findings outside the instance
D.
DefectDojo refuses the change, because an Asset using a global algorithm can’t be pooled Pooling narrows a global algorithm to the pool for that matching kind. To keep a tool matching across every Asset, leave its Assets out of a pool for that kind.
Read more Where to look instead: They interact. Once an Asset is pooled for a kind, the global algorithms for that kind are bounded to the pool.
Pools vs. the global algorithms →
Where to look instead: Deduplication never reaches outside the instance. The widest scope is every Asset in it.
How Global Component matching works →
Where to look instead: The change is allowed. It just narrows the scope, which is why it’s worth checking before you pool.
Configuring Global Component →
18. You’ve added three Assets to a Dedupe Pool, but the Findings already in them haven’t been linked across the pool. How do you deduplicate those existing Findings?A.
Under Apply to Existing Findings , run Preview Re-run , then Apply Now
B.
Wait. Adding members reprocesses existing Findings in the background
C.
Change the tool’s hash fields, which re-runs deduplication on every existing Finding
D.
Delete the Assets’ Tests and import the scans again Pool membership only affects future imports. Apply Now re-runs deduplication over the pool’s Findings for one matching kind. It stays disabled until a preview has shown you what it would link.
Read more Where to look instead: Adding members only affects future imports. Existing Findings are left alone until you ask.
Adding Assets, and previewing first →
Where to look instead: A field change re-hashes the tool’s Findings, but doesn’t revisit duplicate links that already exist.
Running deduplication retroactively →
Where to look instead: There’s no need to throw away history. Apply Now re-runs deduplication in place.
Applying a pool to existing Findings →
19. Your staging and production Assets share a Dedupe Pool. Staging is scanned first, but your team works Findings in production. How do you make new originals land in production?A.
Set Original Placement to Newest Finding Wins
B.
Use a Triage Engine On Dedupe Match rule set to Keep Both Active
C.
Use Set as Original Finding on each Finding from now on
D.
Set Original Placement to Designated Asset, Then Oldest and choose the production Asset Duplicates then point at production’s matching Finding when it’s old enough to be the original, and at the oldest Finding otherwise. The change applies to new matches.
Read more Where to look instead: There’s deliberately no newest-wins option. It would let an established original change hands.
Where originals collect →
Where to look instead: That keeps matching Findings active in both Assets and links them. It doesn’t choose where originals land.
Keeping matching Findings active →
Where to look instead: That works one Finding at a time from Similar Findings. Original Placement sets it for the whole pool.
Similar Findings actions →
20. Which Finding data can a tool’s hash code be built from?A.
Only the Finding’s title
B.
The Test’s name and the date it was imported
C.
Fields such as title, severity, CWE, vulnerability IDs, component name and version, file path, line and endpoints
D.
The Finding’s notes and comments 21. Two otherwise identical Findings in the same Asset don’t deduplicate. One was imported with the Service payments and the other with billing. Why?A.
The Service value is added to every hash, so different services never match on hash code
B.
Findings with different services are stored in different Assets
C.
Service only matters to the Unique ID From Tool algorithm
D.
Service has no effect, so something else must differ Service is included in every tool’s hash by default. Setting the Service field on an import overrides the parser’s value, so it can change deduplication results.
Read more Where to look instead: Service is a field on the Finding. It doesn’t move Findings between Assets.
Service field and its impact →
Where to look instead: It’s the hash-based paths that Service affects.
Service field and its impact →
Where to look instead: Service is part of the hash by default. That makes it a common reason for missed duplicates.
Service field and its impact →
22. With Locations enabled, the same CVE in the same package shows up in two different container images that are scanned into one Asset. What does Hash Code deduplication do?A.
Marks the second image’s Finding as a duplicate of the first
B.
Merges them into one Finding that lists both images
C.
Keeps two Findings, one per image, because Findings in different container images aren’t treated as duplicates
D.
Deduplicates them only if both images use the same tag Under Locations, Hash Code and Unique ID From Tool or Hash Code don’t mark Findings as duplicates when they sit in different container images, so each image keeps its own Findings. Different cloud resources are kept apart the same way.
Read more Where to look instead: That was the behavior before images counted as part of a Finding’s location.
Container image findings →
Where to look instead: Deduplication links Findings. It never merges them.
How duplicates are displayed and linked →
Where to look instead: An image is identified by its digest when the scanner knows it, and by its tag only when it doesn’t. Two different images stay separate either way.
Container Image Locations →
23. Why won’t Matching Configuration let a CWE field be a tool’s only hash field?A.
CWEs are optional, so most Findings would have no hash
B.
A CWE is a weakness class rather than a specific vulnerability, so matching on it alone would merge unrelated Findings
C.
CWE fields can only be used for Cross Tool matching
D.
A CWE field must always be paired with Line Number A vulnerability ID field can stand alone, because a CVE or GHSA identifies a specific vulnerability. Pair a CWE field with an identifying field such as title or file path.
Read more Where to look instead: Empty values are handled separately. The rule exists because a CWE is too broad to identify a Finding.
Set-based hash code fields →
Where to look instead: CWE fields work for Same Tool and Cross Tool Hash Code.
Set-based hash code fields →
Where to look instead: Any identifying field will do, such as title or file path.
Set-based hash code fields →
24. On Matching Configuration, you change a tool’s hash fields and save. What happens to that tool’s existing Findings?A.
Nothing. Only the next import uses the new fields
B.
Every existing duplicate link for the tool is recalculated
C.
The tool’s existing Findings are deleted and must be imported again
D.
Their stored hashes are recomputed in the background, but existing duplicate links aren’t revisited Changing hash fields makes every stored hash for that tool stale, so a background re-hash runs. Until it finishes, the tool’s Findings may not match each other. Changing only the algorithm recomputes nothing.
Read more Where to look instead: That’s what changing the algorithm does. Changing the fields re-hashes the backlog.
Changing a tool's matching →
Where to look instead: Re-hashing changes what future comparisons produce. To re-link Findings that are already in DefectDojo, use a Dedupe Pool’s Apply Now.
Applying a pool to existing Findings →
Where to look instead: Nothing is deleted. The re-hash only updates stored values.
Running deduplication retroactively →
25. Delete Deduplicate Findings is on, with Maximum Duplicates set to 1. Finding A is an original, and B is already its duplicate. A third import adds Finding C as another duplicate of A. What happens?A.
Finding A is deleted, and B becomes the original
B.
Finding C is deleted straight away
C.
Finding B, the oldest duplicate, is deleted. A is never deleted automatically
D.
Nothing. The setting only applies to Findings imported before it was enabled Once the limit is crossed, the oldest duplicates are removed first. A background task does it, usually within a minute or two.
Read more Where to look instead: The original is never deleted automatically.
Which duplicates will be deleted →
Where to look instead: The newest duplicate is kept. Deletion starts with the oldest.
Which duplicates will be deleted →
Where to look instead: Turning the setting on starts deleting straight away, and it keeps running as duplicates build up.
Applying this setting →
