Trying to apply an override to all NVTs for a particular host

How To
1

Hello,

Is there a way to create an override such that it would enable me to exclude all of a hosts results from any scan, report, result, etc. past present or future? For example if we have been scanning a few networks weekly for the past 6 months, and then you realize that one of the IPs in the scan ranges is a host that is not part of your infrastructure?

I know how to modify my scan targets going forward to exclude that IP but i was hoping to also be able to remove , omit, or change all results from the previous scans and reports to override any result for a particular IP address from any scan or report or result set to be either LOG or False Positive with an override or Note that says this host does not belong to us so any resutls for it can be disregarded . But when i attempt to create an override for the host it wants me to specifiy the OID for a particular NVT, is there a global OID? How else might i be able to accomplish this ?

Thank you ,

B

2

Hello,

There is no way to create a single override for a group of, or all, NVTs. While you could use overrides to achieve your use case, overrides were not designed to hide information about entire hosts, but rather individual results or results of the same type.

If you do want to go that route, you will have to create an override for each NVT that has results for the host in question. You should also delete the host from “Asset > Hosts” for the sake of order, although this will not remove its references from reports.

The cleanest way would be to delete all reports which include the host in question as well as the host entry in “Assets > Hosts”, but I recognize that this may not be a viable solution for you.

1 Like