docs: add Similar Findings pages for Open Source and Pro (#15190)

Document the Similar Findings feature on the View Finding page, with
separate Open Source and Pro pages (audience-scoped) reflecting the
distinct UIs: the collapsible filter panel in OS and the Duplicate &
Similar Findings card with tabs in Pro. Cover the matching fields, how
it differs from automatic deduplication, the manual mark-as-duplicate /
set-as-original actions, and the enable/disable system setting. Adds
screenshots and a cross-link from the deduplication overview.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

docs/assets/images/pro_similar_findings.png

@@ -0,0 +1,75 @@
+---
+title: "Similar Findings"
+description: "Find related Findings on the View Finding page and manually link them as duplicates"
+audience: opensource
+weight: 3
+---
+
+While [Deduplication](../about_deduplication) runs automatically at import time, **Similar Findings** is a manual, interactive tool that lives on the **View Finding** page. It surfaces other Findings in the same Asset that resemble the one you are looking at, and lets you link them into a duplicate cluster by hand.
+
+Use it when automatic deduplication did not group Findings you believe belong together, or when you want to explore what else in an Asset looks like the current vulnerability.
+
+## Where to find it
+
+Open any Finding to reach its View Finding page. Scroll down to the **Similar Findings** panel. The number in the heading is the count of Findings in the Asset that match the current Finding's values.
+
+![The Similar Findings panel heading on the View Finding page](images/similar_findings_panel.png)
+
+The panel is collapsed by default. Click the panel heading (or the chevron / filter button on the right) to expand it and run the query.
+
+## How Findings are matched
+
+When you open the panel, DefectDojo pre-fills a filter with the current Finding's values and searches the **same Asset** for other Findings that match. The fields used to seed the match are:
+
+- Vulnerability IDs (for example, CVE identifiers)
+- CWE
+- File path
+- Line number
+- Unique ID from tool
+- Test type
+- Asset (and Asset type)
+
+The current Finding is always excluded from its own results. Matching is scoped to the Asset, so Similar Findings never reaches across Assets. If either Engagement has Engagement-level deduplication enabled, matches that cross an Engagement boundary cannot be linked (see [Actions](#actions) below).
+
+This is different from the automatic deduplication algorithm, which compares `hash_code` (or Unique ID from tool) to decide matches. Similar Findings deliberately casts a wider net so you can discover related Findings that strict hash matching would miss.
+
+## Refining the match
+
+The seeded values are only a starting point. The filter panel at the top of the section lets you make matching stricter or looser: remove a field to broaden the results, or add criteria (severity, status, endpoint, dates, EPSS, and more) to narrow them.
+
+![The Similar Findings filter panel](images/similar_findings_filters.png)
+
+- **Clear filters** empties every field so you can build a query from scratch.
+- **Restart** returns to the default match based on the current Finding's values.
+
+## Reading the results
+
+Each matching Finding is listed in a table. The **Relationship** column tells you how that Finding relates to the one you are viewing:
+
+- **Original** – the root/original Finding of the current Finding's duplicate cluster
+- **Duplicate** – a Finding already marked as a duplicate of the current one
+- **Similar** – a match that is not yet part of the current Finding's cluster
+
+![The Similar Findings results table](images/similar_findings_list.png)
+
+The table also shows Severity, Title, Date, Status, Test, Engagement, CWE, Vulnerability Id, EPSS score, File (with line number), and JIRA (when the JIRA integration is enabled). Every column is sortable, and the results can be exported (Copy, Excel, CSV, PDF).
+
+## Actions
+
+If you have edit permission on a Finding, the **Action** column offers a dropdown to manage the duplicate cluster directly from this page:
+
+![The Similar Findings row action menu](images/similar_findings_actions.png)
+
+- **Mark as duplicate** – link the similar Finding into the current Finding's duplicate cluster.
+- **Set as original** – promote a Finding to be the original (cluster root).
+- **Reset finding duplicate status** – remove a Finding from its cluster.
+
+An action may be unavailable (shown as **None**) when it is not valid, for example when the similar Finding lives in a different Engagement and Engagement-level deduplication is enabled, or when it is already the original of a different cluster. These actions manipulate the same duplicate relationships that automatic deduplication uses, so a Finding you mark here behaves exactly like an automatically detected duplicate.
+
+## Enabling and disabling Similar Findings
+
+Similar Findings is controlled by a global system setting. Go to **Configuration > System Settings** and toggle **Enable Similar Findings**. It is enabled by default.
+
+![The Enable Similar Findings system setting](images/similar_findings_enable_setting.png)
+
+Because the query looks across an entire Asset, it can be expensive on large Assets. If you notice slow View Finding pages, you can disable the feature here, or limit the number of results returned with the `DD_SIMILAR_FINDINGS_MAX_RESULTS` environment variable (default `25`).

docs/assets/images/pro_similar_findings_actions.png

@@ -0,0 +1,55 @@
+---
+title: "Similar Findings"
+description: "Find related Findings on the View Finding page and manually link them as duplicates"
+audience: pro
+weight: 3
+---
+
+While [Deduplication](../about_deduplication) runs automatically at import time, **Similar Findings** is a manual, interactive tool on the **View Finding** page. It surfaces other Findings in the same Asset that resemble the one you are looking at, and lets you link them into a duplicate cluster by hand.
+
+Use it when automatic deduplication did not group Findings you believe belong together, or when you want to explore what else in an Asset looks like the current vulnerability.
+
+## Where to find it
+
+Open any Finding and scroll to the **Duplicate & Similar Findings** card. It has two tabs:
+
+- **Duplicate Findings** – the Findings already linked to this one as duplicates (the automatic cluster).
+- **Similar Findings** – other Findings in the Asset that match the current Finding's values but are not yet part of its cluster.
+
+Select the **Similar Findings** tab to run the query.
+
+![The Duplicate & Similar Findings card on the View Finding page](images/pro_similar_findings.png)
+
+## How Findings are matched
+
+DefectDojo searches the **same Asset** for Findings that resemble the current one, based on values such as Vulnerability IDs (for example, CVE identifiers), CWE, file path, line number, and unique ID from tool. The current Finding is always excluded from its own results, and matching never reaches across Assets.
+
+This is different from the automatic deduplication algorithm, which compares `hash_code` (or Unique ID from tool) to decide matches. Similar Findings deliberately casts a wider net so you can discover related Findings that strict hash matching would miss.
+
+## Working with the results
+
+The Similar Findings tab is a full data table with the same controls you use elsewhere in the Pro UI:
+
+- **Keyword Search** and the per-column filter (funnel) and sort controls let you narrow the list.
+- The **saved views** dropdown (**Default**) and the save icon let you store a filter/column layout for reuse.
+- The column settings and layout buttons control which columns are shown.
+- **Export** downloads the current results, and **Clear Filters** resets the table.
+
+Each row shows the matching Finding's ID, Severity, Priority, Risk, Finding name, CWE, CVSS scores, Vulnerability IDs, EPSS data, exploit intelligence (Known Exploited / Ransomware), status, Asset, and more. Click a Finding name to open it.
+
+## Actions
+
+Open the action menu (the **⋮** button at the start of a row) to manage the duplicate cluster directly from this page:
+
+![The Similar Findings row action menu](images/pro_similar_findings_actions.png)
+
+- **Set As Original Finding** – promote a Finding to be the original (cluster root).
+- **Mark As Duplicate** – link the similar Finding into the current Finding's duplicate cluster.
+
+These actions manipulate the same duplicate relationships that automatic deduplication uses, so a Finding you link here behaves exactly like an automatically detected duplicate. Any Finding you mark as a duplicate then appears under the **Duplicate Findings** tab of this card.
+
+An action may be unavailable when it is not valid, for example when the similar Finding is already the original of a different cluster, or when linking it would cross an Engagement boundary while Engagement-level deduplication is enabled.
+
+## Enabling and disabling Similar Findings
+
+Similar Findings is controlled by the global **Enable Similar Findings** system setting, which is enabled by default. Because the query looks across an entire Asset, it can be expensive on large Assets; if you notice slow View Finding pages, this setting can be turned off.

docs/assets/images/similar_findings_actions.png

@@ -159,3 +159,5 @@ Sometimes, Deduplication does not work as expected.  Here are some examples of w
 | Duplicates are created across different tools | Cross-tool matching is disabled or too strict | <strong>Cross Tool Deduplication (Pro only)</strong> (hash-based matching) |
 | The same SCA dependency imported into multiple Products creates separate Findings instead of duplicates | Deduplication is scoped per Product by default | <strong>Global Component Deduplication (Pro only)</strong> ([enable for your SCA tools](/triage_findings/finding_deduplication/pro__global_component_deduplication/)) |
 | Excess duplicates of the same Finding are being created, across Tests | Asset Hierarchy is not set up correctly | [Consider Reimport for continual testing](/triage_findings/finding_deduplication/avoid_excess_duplicates/) |
+
+When automatic deduplication misses Findings that you believe belong together, you can link them by hand from the View Finding page. See Similar Findings for how to discover related Findings and mark them as duplicates manually ([Open Source](/triage_findings/finding_deduplication/os__similar_findings/) | [Pro](/triage_findings/finding_deduplication/pro__similar_findings/)).