## Analyzing Scan Reports

Scanners (Nessus, Qualys) generate 500-page PDF reports. Nobody reads them.
Your job is to filter.

### False Positives
*   **Backporting**: Linux distros (RedHat) fix bugs but keep the version number same.
    *   Scanner sees "Apache 2.4.6". Says "Vulnerable to CVE-2019...".
    *   Reality: It is `Apache 2.4.6-97.el7`. The fix is applied.
    *   *Action*: Verify using package manager (`yum info httpd`).

### Supersedence
*   Patch A fixes Bug 1.
*   Patch B fixes Bug 1 and Bug 2.
*   Report: Lists both.
*   *Action*: Just install Patch B.

### Focus on Exploitable
*   A "Critical" bug with **No Exploit Available** is less dangerous than a "High" bug with a **Metasploit Module** available right now.
*   Use Threat Intel to tag "Exploited in the Wild".