When working on complex assessments, you may encounter vulnerabilities that are interconnected or variations of the same issue. To help you organize your report and distinguish between independent and related issues, you can link findings together directly within a project.
Before linking findings, choose the correct relationship type based on how the vulnerabilities interact.
Relates To (Bidirectional)
Use this when two findings are connected but hold equal weight, or when you want to cross-reference them without establishing a parent-child structure.
- Bidirectional: If you link Finding A to Finding B, the system automatically updates Finding B to show that it relates to Finding A.
- No Restrictions: There are no hierarchical limits; you can freely relate multiple findings to each other.
Sub-findings (Hierarchical)
Use this when one primary vulnerability (the Parent) encompasses several smaller or derivative vulnerabilities (the Children).
- Directional (Parent → Child): If Finding A is the parent of Finding B, Finding B becomes a sub-finding.
- Detail Page View: On the child finding's detail page, its parent is displayed as a clickable link in the Sub-finding of field, allowing you to easily navigate back to the main issue.
- Read-Only Edit Mode: When you open the Edit screen for a child finding, the Sub-finding of field is displayed as read-only. This reinforces the hierarchy rule: a finding cannot be a sub-finding and have its own sub-findings at the same time. (However, you can still link other findings using the Relates To field).
- Hierarchy Rule: A finding can either have sub-findings OR be a sub-finding. You cannot nest findings into multiple levels.
How to Link Findings
You can establish relationships while creating a new finding or editing an existing one.
- Navigate to Create Finding or Edit Finding.
- You will see two fields: Relates To and Sub-findings.
- Click on the desired field and select the target findings from the dropdown list.
- Click Save.
Filtering Linked Findings
To quickly locate specific groups of related vulnerabilities, you can use the Relates To and Sub-finding of advanced filters directly from the Findings view.
Reporting
Finding relationships can be included in your reports to ensure your clients see the full context of the vulnerabilities.
Report Token Setting: By default, sub-findings are hidden in reports. To include them in your generated report, you must add the
setting.show_subfindings=trueparameter to your finding token.
Keep in Mind (Exclusions)
Finding relationships are strictly project-specific. If you save a linked finding to your Finding Library or create a Finding Field Template from it, the Relates To and Sub-findings data will not be included or saved to the library.