Filtering and Deduplication
During staged enrichment, VRM compares incoming findings with the current Export Findings and Export Assets files. Unchanged findings can be skipped so only new or modified findings are written.
How Comparison Works
- Bootstrap or refresh the export record. See Export Records and Delta Training.
- VRM - Enrich Findings reads those attachments from the tracking ID stored on VRM Client Configuration.
- The action reports Created, Updated, Skipped, Failed, and Total Processed on the VRM - Staged Ingestion record.
- Failed items are attached on Failed Findings.
The 26.3.0 package does not include VRM - Filtering Activity. Use the staging record counts and failed-finding attachment instead of the earlier filtering-activity application.
Staging Record Outcomes
Outcome | What It Means |
|---|---|
Created | The finding was not present and a new Vulnerability Finding record was written. |
Updated | A matching finding existed and was updated. |
Skipped | The finding matched the current export and did not require a write. |
Failed | The finding could not be enriched or written. Review Failed Findings and Error Message on the Support tab. |
Tuning Recommendations
- Start with the package Page Size of 5000 on VRM Client Configuration unless Swimlane provides a different value for your tenant.
- If skip counts stay high, refresh Export All Findings & Assets so the comparison file is current.
- If fail counts rise, open Failed Findings and confirm VRM Client Configuration, the enrichment connector version, and that Swimlane Support has enabled Security Intelligence.
Next Steps
- Inspect a batch in Accessing Detailed Batch Information.