Resolve uses correlation references to tie a finding to a master finding.
When a finding is created in Resolve, it points to a correlation reference. The correlation reference then points to a master finding and variation. If no master finding for the reported vulnerability exists, Resolve creates these new entities based on the data reported from the tool:
- Correlation reference
- Master finding
- Default master finding variation
When a finding is correlated to a different master finding, the correlation reference is updated to point to the new master finding and variation. While the finding reflects the information in the master finding, the correlation reference retains the data that was created in Resolve when the finding was imported. This provides historical context on what tool generated the finding and what data was originally reported by the tool. This way, even if a finding has been correlated to a new master finding, you have access to the current master finding data as well as the data originally reported by the scanner or tool.
