findings-classifier

Consolidating audit findings requires merging outputs from architecture, code, and security phases into a unified list. This process deduplicates overlapping findings while preserving evidence and phase origin, resulting in a single priority-ordered backlog ready for remediation.

Deduplicating overlapping findings involves processing collected audit data to identify repeated issues across architecture, code, and security phases. The system preserves evidence and phase origin while removing redundancies, producing a clean backlog for remediation.

Severity assignments and effort estimates can be customized using an optional audit.config.yaml file. This allows fine-tuning of deduplication rules, severity rankings, and effort estimates to match specific post-audit workflow requirements.

Running a findings classifier requires access to findings.json outputs generated from all completed audit phases. An optional audit.config.yaml file can also be provided to apply custom overrides for deduplication and severity ranking.

A prioritized backlog should be generated after all audit phases complete. Running the classification process at this stage ensures all raw findings from architecture, code, and security audits are collected and available for deduplication and severity ranking.

The best way to turn raw audit findings into actionable remediation items is to apply automated deduplication and severity ranking. This consolidates data across phases into a unified, priority-ordered backlog that clearly identifies the most critical issues.