Finding Deduplication and Merge

In ETM, all security findings related to a particular asset are imported and aggregated from multiple sources. Because the same issue can appear multiple times across tools, ETM de-duplicates overlapping records and consolidates them into a single, accurate view of risk.

This section explains what a duplicate finding is, how ETM detects and consolidates duplicates, how the rules that govern this behavior work, and what you can do with consolidated findings.

Why Duplicate Findings Occur

Finding data is imported from many external sources, such as Qualys VMDR, CrowdStrike, Microsoft Defender, Tenable, and other scanners and agents. It is expected to encounter overlapping information — for example, an identical CVE with the same asset context for a given vulnerability, or an identical control technology with asset context for a given misconfiguration.

Without deduplication, one vulnerability generates a separate console record for every tool that happens to see it. Deduplication reconciles those overlapping detections into a single, trustworthy finding while keeping genuinely distinct installations apart.

Why Deduplication and Merge Matter

Your environment is typically covered by more than one source of truth — for example, Qualys VMDR, CrowdStrike, Microsoft Defender, and Tenable may all scan the same asset. If each source's record were kept separately, the same vulnerability or misconfiguration could appear several times in your findings list. That inflates your counts, makes prioritization harder, and can hide whether an issue is actually resolved because one source says "fixed" while another still reports it as active.

Deduplication and merge solve this by:

• Recognizing when two or more incoming records describe the same finding on the same asset
• Combining those records into a single consolidated finding
• Keeping the most complete and most trustworthy details from all contributing sources
• Preserving a link back to every contributing source record, so you can still trace a consolidated finding to each console it came from

How ETM Handles Duplicates

Deduplication works in three stages:

Stage	What Happens
Identify	Incoming records are matched against existing findings on the same asset using identification attributes such as CVE ID, port, protocol, and title. Each finding is uniquely recognized and duplicates are flagged.
Merge	Identified duplicates are consolidated into a single aggregated record. Attribute conflicts are resolved by precedence — most recent data, highest severity, or most trusted source.
Purge	Outdated or irrelevant findings are removed based on conditions you define, keeping the security posture current.

The result is that duplicate findings are detected and removed, related findings are consolidated into one record, and outdated findings are automatically cleaned up.

AI-based Findings Consolidation Engine 2.0

The AI-based Findings Consolidation Engine 2.0 uniquely identifies, deduplicates, and normalizes vulnerability data reported across all your connected sources. Instead of one vulnerability generating a separate record for every tool that sees it, the engine reconciles overlapping detections into a single finding while keeping genuinely distinct installations apart.

The engine powers two related capabilities:

• Static consolidation — reconciling the set of records seen today
• Lifecycle-aware consolidation — tracking how a finding's contributors change as new scans arrive over time

AI-based Findings Consolidation Engine 2.0 currently applies to vulnerability findings only. Merge rules for misconfigurations remain unchanged and continue to operate as before.

This capability is being rolled out in a phased manner. Once Consolidation Engine 2.0 is deployed on your platform, the Merge Rules tab no longer lists rules for vulnerabilities. Vulnerability consolidation is handled automatically by the engine. Only misconfiguration merge rules continue to appear in that tab.