Cogent Scanner Ingestion Asset Graph And Normalization

Scanner A reports 'CVE-2026-1234'; Scanner B reports the same finding as a vendor advisory id 'RHSA-2026-1234' that maps to that CVE.

Per the documented capability ('connects to existing security tools, turns fragmented findings into prioritized actions'), normalization must map vendor advisory ids to the underlying CVE id and treat the two scanner outputs as evidence for the same finding. Preserve both source ids in the evidence…

Scanner A identifies a host by hostname; Scanner B identifies the same host by IP address (DHCP-assigned); a CMDB identifies it by asset-id. The host is one machine.

Asset graph normalization must reconcile the three identifiers to a single canonical asset record. Persist all three as aliases. New scanner runs that match any alias must hit the same canonical asset — consistent with Cogent's stated 'asset correlation' capability.

An ephemeral container with a CVE in its image exits 90 seconds after scan. A long-running ticket against the container is meaningless.

Per Cogent's real-time data foundation, ingestion must distinguish ephemeral compute from long-running hosts and roll up findings to the underlying image / template / deployment rather than the ephemeral instance. Otherwise the queue fills with un-ticketable findings.