Skip to main content
Version: 1.5.1

Duplicates and copies of security issues

TRON.ASOC uses mechanisms to detect copies and deduplicate security issues. These mechanisms help find duplicate records and reduce redundant information in the results.

Difference between a copy and a duplicate​

A copy is a vulnerability that exactly matches an already recorded vulnerability detected by the same scanning tool.

A duplicate is a similar vulnerability that may come from another tool or result from a code change. Duplicates aren't copies.

Detecting copies based on a hash​

The system detects copies of vulnerabilities based on a hash. The hash consists of the following vulnerability fields:

  • Tool_Type_name—scanning tool type;
  • CVE—CVE identifier;
  • CWE—CWE identifier;
  • Source_file—source file path;
  • Lib_name—library name;
  • Lib_version—library version;
  • Category—vulnerability category;
  • Source_object—source object;
  • Line—line number;
  • Matched_Code—matching code fragment.

The system detects copies as follows:

  1. When you start TRON.ASOC with hashing enabled, the system recalculates the hash for all existing vulnerabilities.
  2. The system identifies and removes copies, keeping the earliest record from each set of copies.
  3. The system determines the status of the remaining vulnerability according to the following rule:
    • New—if at least one vulnerability among the copies had an open status;
    • Fixed—if none of the copies had an open status.
warning

You can change hash parameters only through the configuration file. You can't manage them through the user interface.

note

The number of vulnerabilities in the scan results reflects hashing.

Deduplicating issues​

Deduplication automatically finds and combines duplicate security issue records.

tip

For more information about configuring global Deduplication rules, see the related section.

Finding duplicate security issues​

To view duplicate security issues, follow these steps:

  1. Go to the Issues section.
  2. Open the security issue that may be subject to deduplication.
  3. Select Find and deduplicate similar issues from the Actions drop-down list.

Find and deduplicate

  1. In the window that opens on the right, set the required filters.

Filter issues

  1. Select Continue.

  2. Select vulnerabilities from the list in the new window on the right.

  3. Select Mark as duplicate.

Mark duplicates

After you complete these steps, the system marks the issues as duplicates and links them to the new issue. A notification about this appears in the system interface.