Had to change the last_seen_by in Discovery when we succeeded in WMI or SSH detail retreival to nmap because when processing the result, if we had a last_seen of audit, it flagged all attributes in the first 'real' audit (script based) as new and hence generated alerts, et al. It would also have flagged all subsequent discovery then audit as well - all new alerts created for all attributes every time discovery was run. Not good. Fixed before 1.8.4 release and not in 1.8.2.
Had to change the last_seen_by in Discovery when we succeeded in WMI or SSH detail retreival to nmap because when processing the result, if we had a last_seen of audit, it flagged all attributes in the first 'real' audit (script based) as new and hence generated alerts, et al. It would also have flagged all subsequent discovery then audit as well - all new alerts created for all attributes every time discovery was run. Not good. Fixed before 1.8.4 release and not in 1.8.2.

Opmantek/open-audit,Opmantek/open-audit,Opmantek/open-audit,Opmantek/open-audit,Opmantek/open-audit