Closed rlakey closed 1 year ago
Technically this was wiping out mitigations available, poam available, and poam as well but those really shouldn't have been in this table and neither should have mitigations. The fields outside of vulnerability discussion in the xccdf "description" node are not used and mitigations there is not the same as the mitigation field for a DNM requirement.
The mitigation field is in the disa_rule_descriptions table so since we are duping this entire object from the new SRG it is overwriting any existing mitigations for DNM requirements.