9. Finding History and Remediation Tracking

A single scan file is a photograph. It tells you what was true at one moment and carries no memory of what came before, which is why the question everyone actually asks — are we getting better? — cannot be answered from one scan.

Finding history answers it. As you load scans with a Baseline open, NESSviewer records each one into that Baseline and works out, for every host-and-plugin pair, when it was first seen, whether it is still open, when it was fixed and which scan proved it. From that it can tell you how long remediation actually takes, how much is overdue, and whether your fixes are holding.

Important

Finding history lives in the Baseline, not in the scan files and not in application settings. With no Baseline open, none of this works — the Remediation tab and the Finding History tab both show only an explanation of what to do. Chapter 4 covers opening a Baseline.

9.1 Building the history

There is no import step and nothing to set up. Open the system’s Baseline on Files → Baseline and load your scans; each scan is recorded as it loads. Open the Baseline afterwards instead and everything already loaded is recorded at that moment. Either way round works.

Behaviour	Detail
Each scan is recorded once	Identified by the content of the file, not its name or location — so the same scan loaded from a different folder, or renamed, is still one scan.
Order does not matter	Dates are worked out from every recorded scan in scan-date order, never in the order you happened to load them.
Unloading keeps the history	Taking a scan out of the Files page does not remove it from the Baseline’s history.
Walkthrough samples are never recorded	The sample scan a walkthrough loads cannot contaminate your history.
Informational findings are not tracked	Only Low severity and above.

Tip

Load your oldest scans once, early. First Identified can only reach back as far as the oldest scan recorded — so a history built from this month’s scans alone will say every finding is new, and your remediation figures will be meaningless until it fills out.

Note

A Baseline in the older XML format cannot hold history. If yours is one, the Finding History tab offers to convert it; the original is kept as a .bak.

9.2 How a fix is recognised

This is the part worth understanding, because it is what stops the numbers being nonsense.

NESSviewer only accepts that a finding was fixed when a later scan could have seen it and did not. The proving scan must have a Good scan status, and if any credentialed scan ever found that finding, the proving scan must also be credentialed and have run local checks. A failed scan, or one that ran without credentials, is ignored rather than treated as proof — so a broken scan can never produce a false “fixed”.

When a finding comes back

A finding that reappears is handled by the grace period, set under Options → Analysis → Finding history grace period and defaulting to 30 days.

Situation	What NESSviewer records
Reappears within the grace period of the scan that showed it fixed	The fix is cancelled — it was never really fixed. The finding is flagged Intermittent.
Reappears after the grace period	A genuine new occurrence. The finding is flagged Recurred.

Important

First Identified deliberately survives a fix and a return. The clock is never reset by fixing something that comes back, so a finding cannot be made to look young by repeatedly half-fixing it.

9.3 The Finding History tab

Open Reports → Finding History. The page has a status banner, a filter row, the findings grid, and beneath it a list of the scans that have been recorded.

The findings grid

Column	What it shows
Status	Open or Remediated.
Hostname / Host IP	The machine, as named in the most recent scan that saw it.
Plugin ID / Plugin Name	The finding.
Nessus Severity	The scan’s own severity — not the calculated DOD severity.
First Identified	The date of the earliest recorded scan that found it on this machine.
Last Seen	The date of the latest scan that found it in the current stretch.
Remediated	The date of the scan that proved it fixed. Blank while open.
Proved Fixed By	The name of that scan file — your evidence.
Occurrences	How many separate stretches it has been present for. More than 1 means it came back.
Finding History	The flag text, such as Recurred (2nd occurrence, since 2026-08-15) or Intermittent.
Asset ID	The machine identity the history is keyed to.

Controls

Control	What it does
Show	Filters the grid: Remediated, Open or All. It opens on Remediated, so if the grid looks short, that is why.
Match hosts with no name, MAC or FQDN on IP (this Baseline)	Off by default, and saved per Baseline. Turn it on only where IP addresses are stable in your system — the same IP can be a different machine in a different enclave.
Remove from history…	Select a recorded scan below, then use this to take it out — for a scan recorded into the wrong system’s Baseline.

Important

Removing a scan from history is confirmed but permanent: its findings stop counting toward first-identified and remediated dates, and it will not be recorded again even if you load it. The prompt is titled Remove scan from history.

Recorded scans

The lower grid lists every scan in the history, newest first, with File, Report, Scanned, Hosts, Good Hosts, Credentialed Hosts, Recorded and Scan ID. Good Hosts and Credentialed Hosts are worth watching — they are what determines whether that scan can prove anything fixed.

9.4 The Dashboard Remediation tab

The same history, read as performance. Open Dashboard → Remediation.

The tiles

Tile	What it measures
Fixed on time	The share of all recorded fixes completed within that severity’s POA&M deadline.
Median time to fix	The middle number of days from identification to the scan that proved it fixed, across fixes in the last 90 days.
Overdue	Open findings whose age has passed their severity’s deadline, counted from First Identified.
Fixes that didn’t stick	The share of findings ever fixed whose fix did not hold, split into {n} recurred · {n} intermittent.

By severity

A grid with one row per severity plus a Total, columns Severity, Deadline (d), Fixed, On time, Median (d), 90th (d), Open and Overdue. The 90th percentile is the honest companion to the median: it is where your slow tail actually sits.

Open backlog by First Identified

The same age buckets as Vulnerability Aging on the Summary tab — ≤7 through >180 — but aged from when a finding was first identified on the host, not from when the plugin was published.

Note

These two tables answer different questions and will not match. Vulnerability Aging measures how long a fix has been publicly available. This one measures how long you have known. For a POA&M conversation the second is usually the fairer number, and for an auditor the first is usually the one they quote.

New vs fixed by month

Two bars per month over the last twelve active months: New (identified, or back after a fix) against Fixed, with a net figure where a plus means the backlog grew. This is the single clearest picture of whether remediation is keeping up.

Important

The first month in the history counts everything already open as new, because that is when NESSviewer first saw it. Expect a large spike at the start that is an artefact of when you began recording, not a real event.

9.5 Ageing the POA&M from first identified

By default, the POA&M Required column ages a finding from the date its plugin was published. With a history in place you can age it from when you actually first saw it instead, using Options → POA&M Rules → Age from First Identified.

Findings the history has no date for still age from publication, and the original date is used even after a recurrence — so fixing something and letting it regress cannot reset its clock.

Tip

Which basis to use is a programme decision, not a technical one. Ageing from publication is stricter and is what most assessors expect. Ageing from first identified is fairer to a system that has only recently come under scan coverage. Agree it with your ISSM once and leave it alone.

9.6 What the history cannot tell you

Being clear about the limits keeps the numbers defensible:

• Nothing before the oldest recorded scan. Load old scans once if you need the history to reach back.

• Nothing about a scan removed from history, deliberately or otherwise.

• No remediation date for a finding whose only later scans were non-credentialed or incomplete — the fix may well have happened, but nothing proved it.

• Nothing at all without a Baseline open, or with a Baseline still in the older XML format.

• Nothing about informational findings, which are not tracked.