Grouping & Deduplication
Multiple scanners and repeated scans can generate a large number of records for essentially the same issue. Grouping and deduplication reduce noise, so teams see a manageable list of work.
Use this guide to understand key considerations for identifying, managing, and reporting duplicate vulnerabilities in Cloudaware.
What Is a “Duplicate”
In most environments, you want to treat the following as a single logical finding:
- Same vulnerability (e.g., CVE) on the same asset.
- Same misconfiguration on a resource, even if reported by multiple scanners.
Cloudaware Vulnerability Management uses:
- Record types to distinguish sources (Qualys, Rapid7, Tenable, cloud‑native, etc.).
- Asset and CVE fields to group findings across sources.
Grouping Patterns
Typical grouping keys:
- CVE + Asset – “one finding per CVE per asset.”
- Rule/Check ID + Asset – for configuration or policy checks.
- Package + Version + Asset – for package‑centric views.
You can implement these groupings using:
- Summary objects or roll‑ups.
- Custom list views and reports that group by CVE and asset.
Deduplication Strategies
- Prefer a single “canonical” record for routing and SLA purposes, with other records treated as supporting evidence.
- Use source‑specific fields to debug discrepancies (e.g., one scanner flags an issue that another misses).
- Keep raw scanner data available for forensics and validation, even if not shown in day‑to‑day queues.
Impact on Workflows
Grouping and deduplication feed into:
- Remediation Tasks – Tasks should be scoped around logical issues (e.g., Fix OpenSSL CVE‑2024‑XXXX on payments‑api servers) rather than individual scan hits.
- Dashboards – Show counts by unique findings, not raw records, to avoid overstating volume.
- SLAs – Track age and deadlines at the grouped‑finding level.
For details on how grouped findings translate into tasks and escalations, see Vulnerability Management Processes.