[docs] Prioritization Engine adjustments

docs/content/en/working_with_findings/finding_priority.md

@@ -58,8 +58,9 @@ High. Criticality is a subjective field, so when assigning this field, consider
 Product compares to other Products in your organization.
 * **User Records** is a numerical estimation of user records in a database (or a system
 that can access that database).
-* **Revenue** is a numerical estimation of annual revenue for the Product. It is not
-possible to set a currency type in DefectDojo, so make sure that all of your Revenue
+* **Revenue** is a numerical estimation of annual revenue for the Product. To calculate Priority, DefectDojo will calculate a percentage by comparing this Product's revenue to the sum of all Products within the Product Type.
+
+It is not possible to set a currency type in DefectDojo, so make sure that all of your Revenue
 estimations have the same currency denomination. (“50000” could mean $50,000
 US Dollars or ¥50,000 Japanese Yen - the denomination does not matter as long as
 all of your Products have revenue calculated in the same currency).
@@ -85,9 +86,6 @@ Findings within a Product can have additional metadata which can further adjust
 * Whether the Finding is in the KEV (Known Exploited Vulnerabilities) database, which is checked by DefectDojo on a regular basis
 * The tool-reported Severity of a Finding (Info, Low, Medium, High, Critical)
 
-Currently, Priority calculation and the underlying formula cannot be adjusted. These
-numbers are meant as a reference only - your team’s actual priority for remediation
-may vary from the DefectDojo calculation.
 
 ## Finding Risk Calculation
 

docs/content/en/working_with_findings/priority_adjustments.md

@@ -0,0 +1,62 @@
+---
+title: "Adjusting Priority and Risk (Pro)"
+description: "Change weighting of Priority and Risk calculations"
+weight: 2
+---
+
+DefectDojo Pro's Priority and Risk calculations can be adjusted, allowing you to tailor DefectDojo Pro to match your internal standards for Finding Priority and Risk.
+
+## Prioritization Engines
+
+Similar to SLA configurations, Prioritization Engines allow you to set the rules governing how Priority and Risk are calculated.
+
+![image](images/priority_default.png)
+
+DefectDojo comes with a built-in Prioritization Engine, which is applied to all Products.  However, you can edit this Prioritization Engine to change the weighting of **Finding** and **Product** multipliers, which will adjust how Finding Priority and Risk are assigned.
+
+### Finding Multipliers
+
+Eight contextual factors impact the Priority score of a Finding.  Three of these are Finding-specific, and the other five are assigned based on the Product that holds the Finding.
+
+You can tune your Prioritization Engine by adjusting how these factors are applied to the final calculation.
+
+![image](images/priority_sliders.png)
+
+Select a factor by clicking the button, and adjust this slider allows you to control the percentage a particular factor is applied.  As you adjust the slider, you'll see the Risk thresholds change as a result.
+
+#### Finding-Level Multipliers
+
+* **Severity** - a Finding's Severity level
+* **Exploitability** - a Finding's KEV and/or EPSS score
+* **Endpoints** - the amount of Endpoints associated with a Finding
+
+#### Product-Level Multipliers
+
+* **Business Criticality** - the related Product's Business Criticality (None, Very Low, Low, Medium, High, or Very
+High)
+* **User Records** - the related Product's User Records count
+* **Revenue** - the related Product's revenue, relative to the total revenue of the Product Type
+* **External Audience** - whether or not the related Product has an external audience
+* **Internet Accessible** - whether or not the related Product is internet accessible
+
+### Risk Thresholds
+
+Based on the tuning of the Priority Engine, DefectDojo will automatically recommend Risk Thresholds.  However, these thresholds can be adjusted as well and set to whatever values you deem appropriate.
+
+![image](images/risk_threshold.png)
+
+## Creating New Prioritization Engines
+
+You can use multiple Prioritization Engines, which can each be assigned to different Products.
+
+![image](images/priority_engine_new.png)
+
+Creating a new Prioritization Engine will open the Prioritization Engine form.  Once this form is submitted, a new Prioritization Engine will be added to the table.
+
+## Assigning Prioritization Engines to Products
+
+Each Product can have a Prioritization Engine currently in use via the **Edit Product** form for a given Product.
+
+![image](images/priority_chooseengine.png)
+
+Note that when a Product's Prioritization Engine is changed, or a Prioritization Engine is updated, the Product's Prioritization Engine or the Prioritization Engine itself will be "Locked" until the prioritization calculation has completed.