Glossary
Finding deduplication
Recognising that several results from different sources or campaigns describe the same problem, and treating them as a single entity.
- Finding correlation
Deduplication is not a tidiness problem, it is an identity problem. If the same
SQL injection appears as FND-014 in the March campaign and FND-003 in the
September one, you have lost the ability to demonstrate it stayed open for six
months. Which is exactly what an auditor wants to know.
A sensible deduplication key combines asset, exact location — path and parameter, not just host — and vulnerability type. Using only the CVE merges different things; using the finding text splits identical things, because every tool words it its own way.
Two cases get confused and should not be. A duplicate is the same problem seen twice, and should be merged keeping the date of first sighting. A recurrence is the same problem that was closed and has come back, and should be reopened linked to its history. Merging the second case erases the most valuable information you hold about how well the fix worked.