Using Group By Options on the Findings Page

The Group By feature in Tenable Security Center is a data organization tool used to consolidate the Findings table. Conceptually similar to a GROUP BY clause in a relational database query, this feature aggregates individual findings into logical categories, allowing you to pivot between different risk perspectives and streamline remediation workflows.

The Group By options appear above the findings table in Explore > Findings.

What is Group By?

The Findings table is a collection of finding instances. Every time a scanner identifies a security issue on an asset, it creates a unique, individual row in the table. While this provides total granularity, it can lead to a high volume of repetitive data when the same issue exists across many assets.

Group By allows you to consolidate these individual instances based on shared attributes. Instead of reviewing the same issue 100 times because it exists on 100 different computers, you can Group By Plugin to see it as a single line item with a count of affected assets. This transformation shifts your view from a list of detections to a list of actionable remediation tasks or prioritized assets.

Using Group By Options

1. On the Findings page, select a Group By option above the table.

   The table updates to show one row per grouped value, with a count of findings for each group.

2. Select the expand icon on the left side of any row.

   A table appears that aggregates findings that a specific Plugin ID discovers across your entire environment into single rows. This shows the individual findings that make up that group, with granular details such as IP Address, Port, and Repository.

Group By Options

Tenable Security Center offers the following Group By options, all applying to vulnerability findings:

• None — The default view. Every finding is displayed as its own row, providing full granularity including port, protocol, IP address, and repository.

  • Primary Use Case — Technical verification, troubleshooting, or bulk export of all granular metadata across your entire finding set.

• CVE — Aggregates findings by CVE ID. Each row represents one CVE, with columns for Severity, VPR, EPSS, CVSS scores, and a total finding count.

  • Primary Use Case — Assess exposure to a specific CVE across all assets and repositories.

• IAVM — Aggregates findings by IAVM ID. Each row represents one IAVM advisory (DoD), with CVSS and VPR scores and a total count.

  • Primary Use Case — Track compliance against DoD IAVM requirements.

• Vulnerability — Groups all instances of a specific plugin (Plugin ID + Plugin Name) across your environment into a single row. This is a root cause view.

  • Primary Use Case — Determine the blast radius of a specific vulnerability and identify the most impactful remediation action, such as a specific patch.

• Severity — Groups findings by severity bucket (Critical, High, Medium, Low, Info). Each row shows the count of findings at that level.

  • Primary Use Case — Get a high-level overview of risk distribution across your environment.

• Operating System — Groups findings by the operating system detected on affected assets. Includes a Detection Method column.

  • Primary Use Case — Identify which OS platforms carry the most risk and prioritize OS-level patching or hardening.

• Asset — Aggregates all findings onto the specific asset where they were discovered. Each row represents a unique asset with severity counts.

  • Primary Use Case — Assess the total risk profile of individual devices and prioritize asset-level remediation.

• Asset Tag — Groups findings by asset tag, with severity counts per tag. Each row represents a tag applied to one or more assets.

  • Primary Use Case — Assess risk by logical grouping (for example, by business unit, location, or environment) using tags assigned to assets.

Group By to Promote Ease of Use

Here are examples of how Group By can improve your daily workflow.

• Reduced Noise — Clears potential clutter of seeing repetitive findings, allowing you to see the true scope of your exposure.

• Faster Prioritization — You can immediately see which specific vulnerability (Vulnerability), CVE (CVE), or server (Asset) represents the highest concentrated risk.

• Role-Based Views

  • Remediation teams can Group by Vulnerability to see what plugins need to be addressed and how many assets are affected.

  • System owners can Group By Asset to see the total risk profile of the specific machines they manage.

  • Security managers can Group By Asset Tag to assess risk across logical groups such as business units or environments.

  • DoD teams can Group By IAVM to track findings against specific IAVM advisories.