reporting and host normalization (getting rid of duplicate Hosts) about risu HOT 2 CLOSED

Currently there is no normalization of this data. Something like this is on my list of things to add but I really dont have a solution for this at the moment. I am open to any idea.

The only idea I can come up with is to unique the plugin_id per each host so that only 1 plugin is shown for each host. That could cause some misleading results though in an automated process.

from risu.

I ran into something like this a couple of years ago for a client that wanted to track output from another product based around nessus. I resolved it then by assuming that for each unique IP/hostname there should be one or more unique plugin IDs. I also associated each record with a date stamp so that if I subsequently found an identical IP/PluginID pair with a later date I could treat it as a rescan and update rather than add. With this I could have single IP/hostname referencing multiple unique PluginIDs each referencing multiple results etc. depending on the IP/Plugin pairing. It's been a couple of years since I looked at the code, but the client was happy with the results. Don't know if this gives you any ideas, but...

from risu.