regscale-cli 6.21.2.2__py3-none-any.whl → 6.22.0.1__py3-none-any.whl

regscale/integrations/scanner_integration.py

@@ -1211,7 +1211,6 @@ class ScannerIntegration(ABC):
                         name=software_name,
                         parentHardwareAssetId=new_asset.id,
                         version=software_version,
-                        # references=software.get("references", []),
                     )
                 )
             else:
@@ -1615,7 +1614,40 @@ class ScannerIntegration(ABC):
         # Get consolidated asset identifier
         asset_identifier = self.get_consolidated_asset_identifier(finding, existing_issue)
 
-        # Update all fields
+        # Set basic issue fields
+        self._set_basic_issue_fields(issue, finding, issue_status, issue_title, asset_identifier)
+
+        # Set due date
+        self._set_issue_due_date(issue, finding)
+
+        # Set additional issue fields
+        self._set_additional_issue_fields(issue, finding, description, remediation_description)
+
+        # Set control-related fields
+        self._set_control_fields(issue, finding)
+
+        # Set risk and operational fields
+        self._set_risk_and_operational_fields(issue, finding, is_poam)
+
+        # Update KEV data if CVE exists
+        if finding.cve:
+            issue = self.lookup_kev_and_update_issue(cve=finding.cve, issue=issue, cisa_kevs=self._kev_data)
+
+        # Save or create the issue
+        self._save_or_create_issue(issue, finding, existing_issue, is_poam)
+
+        self._handle_property_and_milestone_creation(issue, finding, existing_issue)
+        return issue
+
+    def _set_basic_issue_fields(
+        self,
+        issue: regscale_models.Issue,
+        finding: IntegrationFinding,
+        issue_status: regscale_models.IssueStatus,
+        issue_title: str,
+        asset_identifier: str,
+    ) -> None:
+        """Set basic fields for the issue."""
         issue.parentId = self.plan_id
         issue.parentModule = self.parent_module
         issue.vulnerabilityId = finding.vulnerability_id
@@ -1632,7 +1664,10 @@ class ScannerIntegration(ABC):
         issue.securityPlanId = self.plan_id if not self.is_component else None
         issue.identification = finding.identification
         issue.dateFirstDetected = finding.first_seen
-        # Ensure a due date is always set using configured policy defaults (e.g., FedRAMP)
+        issue.assetIdentifier = asset_identifier
+
+    def _set_issue_due_date(self, issue: regscale_models.Issue, finding: IntegrationFinding) -> None:
+        """Set the due date for the issue."""
         if not finding.due_date:
             try:
                 base_created = finding.date_created or issue.dateCreated
@@ -1650,22 +1685,27 @@ class ScannerIntegration(ABC):
                     title=self.title,
                 )
         issue.dueDate = finding.due_date
+
+    def _set_additional_issue_fields(
+        self, issue: regscale_models.Issue, finding: IntegrationFinding, description: str, remediation_description: str
+    ) -> None:
+        """Set additional fields for the issue."""
         issue.description = description
         issue.sourceReport = finding.source_report or self.title
         issue.recommendedActions = finding.recommendation_for_mitigation
-        issue.assetIdentifier = asset_identifier
         issue.securityChecks = finding.security_check or finding.external_id
         issue.remediationDescription = remediation_description
         issue.integrationFindingId = self.get_finding_identifier(finding)
         issue.poamComments = finding.poam_comments
         issue.cve = finding.cve
         issue.assessmentId = finding.assessment_id
+
+    def _set_control_fields(self, issue: regscale_models.Issue, finding: IntegrationFinding) -> None:
+        """Set control-related fields for the issue."""
         control_id = self.get_control_implementation_id_for_cci(finding.cci_ref) if finding.cci_ref else None
-        issue.controlId = control_id  # TODO REMOVE
-        # Add the control implementation ids and the cci ref if it exists
-        # Get control implementation ID for CCI if it exists
-        # Only add CCI control ID if it exists
+        # Note: controlId is deprecated, using controlImplementationIds instead
         cci_control_ids = [control_id] if control_id is not None else []
+
         # Ensure failed control labels (e.g., AC-4(21)) are present in affectedControls
         if finding.affected_controls:
             issue.affectedControls = finding.affected_controls
@@ -1673,15 +1713,17 @@ class ScannerIntegration(ABC):
             issue.affectedControls = ", ".join(sorted({cl for cl in finding.control_labels if cl}))
 
         issue.controlImplementationIds = list(set(finding._control_implementation_ids + cci_control_ids))  # noqa
-        # Always ensure isPoam reflects current settings, even when updating existing issues
+
+    def _set_risk_and_operational_fields(
+        self, issue: regscale_models.Issue, finding: IntegrationFinding, is_poam: bool
+    ) -> None:
+        """Set risk and operational fields for the issue."""
         issue.isPoam = is_poam
         issue.basisForAdjustment = (
             finding.basis_for_adjustment if finding.basis_for_adjustment else f"{self.title} import"
         )
         issue.pluginId = finding.plugin_id
         issue.originalRiskRating = regscale_models.Issue.assign_risk_rating(finding.severity)
-        # Current: changes
-        # Planned: planned changes
         issue.changes = "<p>Current: {}</p><p>Planned: {}</p>".format(
             finding.milestone_changes, finding.planned_milestone_changes
         )
@@ -1690,17 +1732,20 @@ class ScannerIntegration(ABC):
         issue.operationalRequirement = finding.operational_requirements
         issue.deviationRationale = finding.deviation_rationale
         issue.dateLastUpdated = get_current_datetime()
-        ## set affected controls if they exist
         issue.affectedControls = finding.affected_controls
 
-        if finding.cve:
-            issue = self.lookup_kev_and_update_issue(cve=finding.cve, issue=issue, cisa_kevs=self._kev_data)
-
+    def _save_or_create_issue(
+        self,
+        issue: regscale_models.Issue,
+        finding: IntegrationFinding,
+        existing_issue: Optional[regscale_models.Issue],
+        is_poam: bool,
+    ) -> None:
+        """Save or create the issue."""
         if existing_issue:
             logger.debug("Saving Old Issue: %s  with assetIdentifier: %s", issue.id, issue.assetIdentifier)
             issue.save(bulk=True)
             logger.debug("Saved existing issue %s with assetIdentifier: %s", issue.id, issue.assetIdentifier)
-
         else:
             issue = issue.create_or_update(
                 bulk_update=True, defaults={"otherIdentifier": self._get_other_identifier(finding, is_poam)}
@@ -2190,33 +2235,44 @@ class ScannerIntegration(ABC):
         scan_history = self.create_scan_history()
         current_vulnerabilities: Dict[int, Set[int]] = defaultdict(set)
         processed_findings_count = 0
-        loading_findings = self.finding_progress.add_task(
+        loading_findings = self._setup_finding_progress()
+
+        # Process findings
+        processed_findings_count = self._process_findings_with_threading(
+            findings, scan_history, current_vulnerabilities, loading_findings
+        )
+
+        # Finalize processing
+        self._finalize_finding_processing(scan_history, current_vulnerabilities)
+
+        return processed_findings_count
+
+    def _setup_finding_progress(self):
+        """Setup progress tracking for findings processing."""
+        return self.finding_progress.add_task(
             f"[#f8b737]Processing {f'{self.num_findings_to_process} ' if self.num_findings_to_process else ''}finding(s) from {self.title}",
             total=self.num_findings_to_process if self.num_findings_to_process else None,
         )
 
-        # Locks for thread-safe operations
+    def _process_findings_with_threading(
+        self,
+        findings: Iterator[IntegrationFinding],
+        scan_history: regscale_models.ScanHistory,
+        current_vulnerabilities: Dict[int, Set[int]],
+        loading_findings,
+    ) -> int:
+        """Process findings using threading or sequential processing."""
+        processed_findings_count = 0
         count_lock = threading.RLock()
 
         def process_finding_with_progress(finding_to_process: IntegrationFinding) -> None:
-            """
-            Process a single finding and update progress.
-
-            :param IntegrationFinding finding_to_process: The finding to process
-            :rtype: None
-            """
+            """Process a single finding and update progress."""
             nonlocal processed_findings_count
             try:
                 self.process_finding(finding_to_process, scan_history, current_vulnerabilities)
                 with count_lock:
                     processed_findings_count += 1
-                    if self.num_findings_to_process:
-                        self.finding_progress.update(
-                            loading_findings,
-                            total=self.num_findings_to_process,
-                            description=f"[#f8b737]Processing {self.num_findings_to_process} findings from {self.title}.",
-                        )
-                    self.finding_progress.advance(loading_findings, 1)
+                    self._update_finding_progress(loading_findings)
             except Exception as exc:
                 self.log_error(
                     "An error occurred when processing finding %s: %s",
@@ -2228,30 +2284,70 @@ class ScannerIntegration(ABC):
             for finding in findings:
                 process_finding_with_progress(finding)
         else:
-            # Process findings in batches to control memory usage
-            batch_size = get_thread_workers_max() * 2  # Set batch size based on thread count
-            with concurrent.futures.ThreadPoolExecutor(max_workers=get_thread_workers_max()) as executor:
-                batch = []
-                for finding in findings:
-                    batch.append(finding)
-                    if len(batch) >= batch_size:
-                        # Process this batch
-                        list(executor.map(process_finding_with_progress, batch))
-                        # Clear the batch
-                        batch = []
-
-                # Process any remaining items
-                if batch:
+            processed_findings_count = self._process_findings_in_batches(findings, process_finding_with_progress)
+
+        return processed_findings_count
+
+    def _update_finding_progress(self, loading_findings):
+        """Update the finding progress bar."""
+        if self.num_findings_to_process:
+            self.finding_progress.update(
+                loading_findings,
+                total=self.num_findings_to_process,
+                description=f"[#f8b737]Processing {self.num_findings_to_process} findings from {self.title}.",
+            )
+        self.finding_progress.advance(loading_findings, 1)
+
+    def _process_findings_in_batches(
+        self, findings: Iterator[IntegrationFinding], process_finding_with_progress
+    ) -> int:
+        """Process findings in batches using thread pool executor."""
+        processed_findings_count = 0
+        batch_size = get_thread_workers_max() * 2
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=get_thread_workers_max()) as executor:
+            batch = []
+            for finding in findings:
+                batch.append(finding)
+                if len(batch) >= batch_size:
+                    # Process this batch
                     list(executor.map(process_finding_with_progress, batch))
+                    processed_findings_count += len(batch)
+                    # Clear the batch
+                    batch = []
+
+            # Process any remaining items
+            if batch:
+                list(executor.map(process_finding_with_progress, batch))
+                processed_findings_count += len(batch)
+
+        return processed_findings_count
 
-        # Close outdated issues
-        self._results["scan_history"] = scan_history.save()
+    def _finalize_finding_processing(
+        self, scan_history: regscale_models.ScanHistory, current_vulnerabilities: Dict[int, Set[int]]
+    ) -> None:
+        """Finalize the finding processing by saving scan history and closing outdated issues."""
+        logger.info(
+            f"Saving scan history with final counts - Low: {scan_history.vLow}, Medium: {scan_history.vMedium}, High: {scan_history.vHigh}, Critical: {scan_history.vCritical}, Info: {scan_history.vInfo}"
+        )
+
+        # Ensure scan history is properly saved with updated counts
+        try:
+            scan_history.save()
+        except Exception as e:
+            logger.error(f"Error saving scan history: {e}")
+            # Try to save again with a fresh fetch
+            try:
+                scan_history.fetch()
+                scan_history.save()
+            except Exception as e2:
+                logger.error(f"Failed to save scan history after retry: {e2}")
+
+        self._results["scan_history"] = scan_history
         self.update_result_counts("issues", regscale_models.Issue.bulk_save(progress_context=self.finding_progress))
         self.close_outdated_issues(current_vulnerabilities)
         self._perform_batch_operations(self.finding_progress)
 
-        return processed_findings_count
-
     @staticmethod
     def parse_poam_id(poam_identifier: str) -> Optional[int]:
         """
@@ -2285,15 +2381,15 @@ class ScannerIntegration(ABC):
                     parent_id=self.plan_id,
                     parent_module=self.parent_module,
                 )
-                self._max_poam_id = max(
-                    (
-                        parsed_id
-                        for issue in issues
-                        if issue.otherIdentifier
-                        and (parsed_id := self.parse_poam_id(issue.otherIdentifier)) is not None
-                    ),
-                    default=0,
-                )
+                # Extract parsed IDs for valid identifiers
+                parsed_ids = []
+                for issue in issues:
+                    if issue.otherIdentifier:
+                        parsed_id = self.parse_poam_id(issue.otherIdentifier)
+                        if parsed_id is not None:
+                            parsed_ids.append(parsed_id)
+
+                self._max_poam_id = max(parsed_ids, default=0)
 
             # Increment the cached max ID and store it
             self._max_poam_id = (self._max_poam_id or 0) + 1
@@ -2351,57 +2447,168 @@ class ScannerIntegration(ABC):
 
         # Process checklist if applicable
         if self.type == ScannerIntegrationType.CHECKLIST:
-            if not (asset := self.get_asset_by_identifier(finding.asset_identifier)):
-                if not getattr(self, "suppress_asset_not_found_errors", False):
-                    logger.error("2. Asset not found for identifier %s", finding.asset_identifier)
-                return
-
-            tool = regscale_models.ChecklistTool.STIGs
-            if finding.vulnerability_type == "Vulnerability Scan":
-                tool = regscale_models.ChecklistTool.VulnerabilityScanner
-
-            if not finding.cci_ref:
-                finding.cci_ref = "CCI-000366"
-
-            # Convert checklist status to string
-            checklist_status_str = str(finding.checklist_status.value)
-
-            logger.debug("Create or update checklist for %s", finding.external_id)
-            regscale_models.Checklist(
-                status=checklist_status_str,
-                assetId=asset.id,
-                tool=tool,
-                baseline=finding.baseline,
-                vulnerabilityId=finding.vulnerability_number,
-                results=finding.results,
-                check=finding.title,
-                cci=finding.cci_ref,
-                ruleId=finding.rule_id,
-                version=finding.rule_version,
-                comments=finding.comments,
-                datePerformed=finding.date_created,
-            ).create_or_update()
-
-            # For failing findings, handle control implementation updates
-            if finding.status != regscale_models.IssueStatus.Closed:
-                logger.debug("Handling failing checklist for %s", finding.external_id)
-                if self.type == ScannerIntegrationType.CHECKLIST:
-                    self.handle_failing_checklist(finding=finding, plan_id=self.plan_id)
-            else:
-                logger.debug("Handling passing checklist for %s", finding.external_id)
-                self.handle_passing_checklist(finding=finding, plan_id=self.plan_id)
+            self._process_checklist_finding(finding)
 
         # Process vulnerability if applicable
         if finding.status != regscale_models.IssueStatus.Closed or ScannerVariables.ingestClosedIssues:
-            if asset := self.get_asset_by_identifier(finding.asset_identifier):
-                if vulnerability_id := self.handle_vulnerability(finding, asset, scan_history):
-                    current_vulnerabilities[asset.id].add(vulnerability_id)
+            vulnerability_created = self._process_vulnerability_finding(finding, scan_history, current_vulnerabilities)
+
             self.handle_failing_finding(
                 issue_title=finding.issue_title or finding.title,
                 finding=finding,
             )
-            # Update scan history severity counts
-            self.set_severity_count_for_scan(finding.severity, scan_history)
+
+            # Update scan history severity counts only if vulnerability was successfully created
+            if vulnerability_created:
+                logger.debug(
+                    f"Updating severity count for successfully created vulnerability with severity: {finding.severity}"
+                )
+                self.set_severity_count_for_scan(finding.severity, scan_history)
+            else:
+                logger.debug(
+                    f"Skipping severity count update for finding {finding.external_id} - no vulnerability created"
+                )
+
+    def _process_checklist_finding(self, finding: IntegrationFinding) -> None:
+        """Process a checklist finding."""
+        if not (asset := self.get_asset_by_identifier(finding.asset_identifier)):
+            if not getattr(self, "suppress_asset_not_found_errors", False):
+                logger.error("2. Asset not found for identifier %s", finding.asset_identifier)
+            return
+
+        tool = regscale_models.ChecklistTool.STIGs
+        if finding.vulnerability_type == "Vulnerability Scan":
+            tool = regscale_models.ChecklistTool.VulnerabilityScanner
+
+        if not finding.cci_ref:
+            finding.cci_ref = "CCI-000366"
+
+        # Convert checklist status to string
+        checklist_status_str = str(finding.checklist_status.value)
+
+        logger.debug("Create or update checklist for %s", finding.external_id)
+        regscale_models.Checklist(
+            status=checklist_status_str,
+            assetId=asset.id,
+            tool=tool,
+            baseline=finding.baseline,
+            vulnerabilityId=finding.vulnerability_number,
+            results=finding.results,
+            check=finding.title,
+            cci=finding.cci_ref,
+            ruleId=finding.rule_id,
+            version=finding.rule_version,
+            comments=finding.comments,
+            datePerformed=finding.date_created,
+        ).create_or_update()
+
+        # Handle checklist status
+        self._handle_checklist_status(finding)
+
+    def _handle_checklist_status(self, finding: IntegrationFinding) -> None:
+        """Handle the status of a checklist finding."""
+        if finding.status != regscale_models.IssueStatus.Closed:
+            logger.debug("Handling failing checklist for %s", finding.external_id)
+            if self.type == ScannerIntegrationType.CHECKLIST:
+                self.handle_failing_checklist(finding=finding, plan_id=self.plan_id)
+        else:
+            logger.debug("Handling passing checklist for %s", finding.external_id)
+            self.handle_passing_checklist(finding=finding, plan_id=self.plan_id)
+
+    def _process_vulnerability_finding(
+        self,
+        finding: IntegrationFinding,
+        scan_history: regscale_models.ScanHistory,
+        current_vulnerabilities: Dict[int, Set[int]],
+    ) -> bool:
+        """Process a vulnerability finding and return whether vulnerability was created."""
+        logger.debug(f"Processing vulnerability for finding {finding.external_id} with status {finding.status}")
+
+        if asset := self.get_asset_by_identifier(finding.asset_identifier):
+            logger.debug(f"Found asset {asset.id} for finding {finding.external_id}")
+            if vulnerability_id := self.handle_vulnerability(finding, asset, scan_history):
+                current_vulnerabilities[asset.id].add(vulnerability_id)
+                logger.debug(
+                    f"Vulnerability created successfully for finding {finding.external_id} with ID {vulnerability_id}"
+                )
+                return True
+            else:
+                logger.debug(f"Vulnerability creation failed for finding {finding.external_id}")
+        else:
+            logger.debug(f"No asset found for finding {finding.external_id} with identifier {finding.asset_identifier}")
+
+        return False
+
+    def handle_vulnerability(
+        self,
+        finding: IntegrationFinding,
+        asset: Optional[regscale_models.Asset],
+        scan_history: regscale_models.ScanHistory,
+    ) -> Optional[int]:
+        """
+        Handles the vulnerabilities for a finding.
+
+        :param IntegrationFinding finding: The integration finding
+        :param Optional[regscale_models.Asset] asset: The associated asset
+        :param regscale_models.ScanHistory scan_history: The scan history
+        :rtype: Optional[int]
+        :return: The vulnerability ID
+        """
+        logger.debug(f"Processing vulnerability for finding: {finding.external_id} - {finding.title}")
+
+        # Check for required fields - either plugin_name or cve must be present
+        plugin_name = getattr(finding, "plugin_name", None)
+        cve = getattr(finding, "cve", None)
+
+        if not plugin_name and not cve:
+            logger.warning("No Plugin Name or CVE found for finding %s", finding.title)
+            logger.debug(f"Finding plugin_name: {plugin_name}, cve: {cve}")
+            return None
+
+        if not asset:
+            if not getattr(self, "suppress_asset_not_found_errors", False):
+                logger.warning(
+                    "VulnerabilityMapping Error: Asset not found for identifier %s", finding.asset_identifier
+                )
+            return None
+
+        logger.debug(f"Found asset: {asset.id} for finding {finding.external_id}")
+        logger.debug(f"Finding plugin_name: {plugin_name}, cve: {cve}")
+
+        # Add retry logic for vulnerability creation
+        max_retries = 3
+        retry_delay = 2  # seconds
+
+        for attempt in range(max_retries):
+            try:
+                logger.debug(f"Creating vulnerability for finding {finding.external_id} (attempt {attempt + 1})")
+                vulnerability = self.create_vulnerability_from_finding(finding, asset, scan_history)
+                finding.vulnerability_id = vulnerability.id
+                logger.info(f"Successfully created vulnerability {vulnerability.id} for finding {finding.external_id}")
+
+                if ScannerVariables.vulnerabilityCreation.lower() != "noissue":
+                    # Handle associated issue
+                    self.create_or_update_issue_from_finding(
+                        title=finding.title,
+                        finding=finding,
+                    )
+
+                return vulnerability.id
+
+            except Exception as e:
+                if attempt < max_retries - 1:
+                    logger.warning(
+                        f"Vulnerability creation failed for finding {finding.external_id} (attempt {attempt + 1}/{max_retries}): {e}. Retrying in {retry_delay} seconds..."
+                    )
+                    import time
+
+                    time.sleep(retry_delay)
+                    retry_delay *= 2  # Exponential backoff
+                else:
+                    logger.error(
+                        f"Failed to create vulnerability for finding {finding.external_id} after {max_retries} attempts: {e}"
+                    )
+                    return None
 
     def create_vulnerability_from_finding(
         self, finding: IntegrationFinding, asset: regscale_models.Asset, scan_history: regscale_models.ScanHistory
@@ -2415,6 +2622,14 @@ class ScannerIntegration(ABC):
         :return: The created vulnerability
         :rtype: regscale_models.Vulnerability
         """
+        logger.debug(f"Creating vulnerability object for finding {finding.external_id}")
+
+        logger.debug(f"Finding severity: '{finding.severity}' (type: {type(finding.severity)})")
+        mapped_severity = self.issue_to_vulnerability_map.get(
+            finding.severity, regscale_models.VulnerabilitySeverity.Low
+        )
+        logger.debug(f"Mapped severity: {mapped_severity}")
+
         vulnerability = regscale_models.Vulnerability(
             title=finding.title,
             cve=finding.cve,
@@ -2426,7 +2641,7 @@ class ScannerIntegration(ABC):
             cvsSv3BaseVector=finding.cvss_v3_vector,
             cvsSv2BaseVector=finding.cvss_v2_vector,
             scanId=scan_history.id,
-            severity=self.issue_to_vulnerability_map.get(finding.severity, regscale_models.VulnerabilitySeverity.Low),
+            severity=mapped_severity,
             description=finding.description,
             dateLastUpdated=finding.date_last_updated,
             parentId=self.plan_id,
@@ -2454,8 +2669,14 @@ class ScannerIntegration(ABC):
             affectedPackages=finding.affected_packages,
         )
 
+        logger.debug(f"Calling create_or_update for vulnerability with title: {vulnerability.title}")
         vulnerability = vulnerability.create_or_update()
-        regscale_models.VulnerabilityMapping(
+        logger.debug(f"Vulnerability created/updated with ID: {vulnerability.id}")
+
+        logger.debug(f"Creating vulnerability mapping for vulnerability {vulnerability.id}")
+        logger.debug(f"Scan History ID: {scan_history.id}, Asset ID: {asset.id}, Plan ID: {self.plan_id}")
+
+        vulnerability_mapping = regscale_models.VulnerabilityMapping(
             vulnerabilityId=vulnerability.id,
             assetId=asset.id,
             scanId=scan_history.id,
@@ -2468,46 +2689,17 @@ class ScannerIntegration(ABC):
             lastSeen=finding.last_seen,
             status=finding.status,
             dateLastUpdated=get_current_datetime(),
-        ).create_unique()
-        return vulnerability
-
-    def handle_vulnerability(
-        self,
-        finding: IntegrationFinding,
-        asset: Optional[regscale_models.Asset],
-        scan_history: regscale_models.ScanHistory,
-    ) -> Optional[int]:
-        """
-        Handles the vulnerabilities for a finding.
-
-        :param IntegrationFinding finding: The integration finding
-        :param Optional[regscale_models.Asset] asset: The associated asset
-        :param regscale_models.ScanHistory scan_history: The scan history
-        :rtype: Optional[int]
-        :return: The vulnerability ID
-        """
-        if not (finding.plugin_name or finding.cve):
-            logger.warning("No Plugin Name or CVE found for finding %s", finding.title)
-            return None
-
-        if not asset:
-            if not getattr(self, "suppress_asset_not_found_errors", False):
-                logger.warning(
-                    "VulnerabilityMapping Error: Asset not found for identifier %s", finding.asset_identifier
-                )
-            return None
+        )
 
-        vulnerability = self.create_vulnerability_from_finding(finding, asset, scan_history)
-        finding.vulnerability_id = vulnerability.id
+        logger.debug(
+            f"Vulnerability mapping payload: vulnerabilityId={vulnerability_mapping.vulnerabilityId}, "
+            f"assetId={vulnerability_mapping.assetId}, scanId={vulnerability_mapping.scanId}"
+        )
 
-        if ScannerVariables.vulnerabilityCreation.lower() != "noissue":
-            # Handle associated issue
-            self.create_or_update_issue_from_finding(
-                title=finding.title,
-                finding=finding,
-            )
+        vulnerability_mapping.create_unique()
+        logger.debug(f"Vulnerability mapping created for vulnerability {vulnerability.id}")
 
-        return vulnerability.id
+        return vulnerability
 
     def _filter_vulns_open_by_other_tools(
         self, all_vulns: list[regscale_models.Vulnerability]
@@ -2786,16 +2978,44 @@ class ScannerIntegration(ABC):
         :param regscale_models.ScanHistory scan_history: Scan history object
         :rtype: None
         """
-        if severity == regscale_models.IssueSeverity.Low:
+        logger.debug(f"Setting severity count for scan {scan_history.id}: severity='{severity}'")
+        logger.debug(
+            f"Current counts - Low: {scan_history.vLow}, Medium: {scan_history.vMedium}, High: {scan_history.vHigh}, Critical: {scan_history.vCritical}, Info: {scan_history.vInfo}"
+        )
+
+        if severity == regscale_models.IssueSeverity.Low.value:
             scan_history.vLow += 1
-        elif severity == regscale_models.IssueSeverity.Moderate:
+            logger.debug(f"Incremented vLow count to {scan_history.vLow}")
+        elif severity == regscale_models.IssueSeverity.Moderate.value:
             scan_history.vMedium += 1
-        elif severity == regscale_models.IssueSeverity.High:
+            logger.debug(f"Incremented vMedium count to {scan_history.vMedium}")
+        elif severity == regscale_models.IssueSeverity.High.value:
             scan_history.vHigh += 1
-        elif severity == regscale_models.IssueSeverity.Critical:
+            logger.debug(f"Incremented vHigh count to {scan_history.vHigh}")
+        elif severity == regscale_models.IssueSeverity.Critical.value:
             scan_history.vCritical += 1
+            logger.debug(f"Incremented vCritical count to {scan_history.vCritical}")
         else:
             scan_history.vInfo += 1
+            logger.debug(f"Incremented vInfo count to {scan_history.vInfo}")
+
+        logger.debug(
+            f"Final counts - Low: {scan_history.vLow}, Medium: {scan_history.vMedium}, High: {scan_history.vHigh}, Critical: {scan_history.vCritical}, Info: {scan_history.vInfo}"
+        )
+
+        # Save the scan history immediately to persist the count changes
+        try:
+            scan_history.save()
+            logger.debug(f"Successfully saved scan history {scan_history.id} with updated counts")
+        except Exception as e:
+            logger.error(f"Error saving scan history {scan_history.id} after updating counts: {e}")
+            # Try to save again with a fresh fetch
+            try:
+                scan_history.fetch()
+                scan_history.save()
+                logger.debug(f"Successfully saved scan history {scan_history.id} after retry")
+            except Exception as e2:
+                logger.error(f"Failed to save scan history {scan_history.id} after retry: {e2}")
 
     @classmethod
     def cci_assessment(cls, plan_id: int) -> None:
@@ -3309,3 +3529,151 @@ class ScannerIntegration(ABC):
                 datetime.strptime(issue_date_created, "%Y-%m-%d %H:%M:%S") + diff
             )
         return None
+
+    def create_vulnerabilities_bulk(
+        self,
+        findings: List[IntegrationFinding],
+        assets: Dict[str, regscale_models.Asset],
+        scan_history: regscale_models.ScanHistory,
+    ) -> Dict[str, int]:
+        """
+        Create vulnerabilities in bulk to improve performance and reduce API calls.
+
+        :param List[IntegrationFinding] findings: List of findings to create vulnerabilities for
+        :param Dict[str, regscale_models.Asset] assets: Dictionary of assets by identifier
+        :param regscale_models.ScanHistory scan_history: The scan history
+        :return: Dictionary mapping finding external_id to vulnerability_id
+        :rtype: Dict[str, int]
+        """
+        vulnerabilities_to_create, finding_to_vuln_map = self._prepare_vulnerabilities_for_bulk(
+            findings, assets, scan_history
+        )
+
+        if not vulnerabilities_to_create:
+            logger.warning("No vulnerabilities to create in bulk")
+            return {}
+
+        return self._execute_bulk_vulnerability_creation(
+            vulnerabilities_to_create, finding_to_vuln_map, findings, assets, scan_history
+        )
+
+    def _prepare_vulnerabilities_for_bulk(
+        self,
+        findings: List[IntegrationFinding],
+        assets: Dict[str, regscale_models.Asset],
+        scan_history: regscale_models.ScanHistory,
+    ) -> tuple[List, Dict]:
+        """Prepare vulnerability objects for bulk creation."""
+        vulnerabilities_to_create = []
+        finding_to_vuln_map = {}
+
+        for finding in findings:
+            if not self._is_finding_valid_for_vulnerability(finding):
+                continue
+
+            asset = assets.get(finding.asset_identifier)
+            if not self._is_asset_valid(asset, finding):
+                continue
+
+            vulnerability = self._create_vulnerability_object(finding, asset, scan_history)
+            if vulnerability:
+                vulnerabilities_to_create.append(vulnerability)
+                finding_to_vuln_map[finding.external_id] = vulnerability
+
+        return vulnerabilities_to_create, finding_to_vuln_map
+
+    def _is_finding_valid_for_vulnerability(self, finding: IntegrationFinding) -> bool:
+        """Check if a finding is valid for vulnerability creation."""
+        if not (finding.plugin_name or finding.cve):
+            logger.warning("No Plugin Name or CVE found for finding %s", finding.title)
+            return False
+        return True
+
+    def _is_asset_valid(self, asset: Optional[regscale_models.Asset], finding: IntegrationFinding) -> bool:
+        """Check if an asset is valid for vulnerability creation."""
+        if not asset:
+            if not getattr(self, "suppress_asset_not_found_errors", False):
+                logger.warning(
+                    "VulnerabilityMapping Error: Asset not found for identifier %s", finding.asset_identifier
+                )
+            return False
+        return True
+
+    def _create_vulnerability_object(
+        self,
+        finding: IntegrationFinding,
+        asset: regscale_models.Asset,
+        scan_history: regscale_models.ScanHistory,
+    ) -> Optional[regscale_models.Vulnerability]:
+        """Create a vulnerability object from a finding."""
+        try:
+            return self.create_vulnerability_from_finding(finding, asset, scan_history)
+        except Exception as e:
+            logger.error(f"Failed to prepare vulnerability for finding {finding.external_id}: {e}")
+            return None
+
+    def _execute_bulk_vulnerability_creation(
+        self,
+        vulnerabilities_to_create: List,
+        finding_to_vuln_map: Dict,
+        findings: List[IntegrationFinding],
+        assets: Dict[str, regscale_models.Asset],
+        scan_history: regscale_models.ScanHistory,
+    ) -> Dict[str, int]:
+        """Execute bulk vulnerability creation with fallback to individual creation."""
+        try:
+            created_vulnerabilities = regscale_models.Vulnerability.batch_create(
+                vulnerabilities_to_create, progress_context=self.finding_progress
+            )
+
+            result = self._map_vulnerabilities_to_findings(
+                created_vulnerabilities, vulnerabilities_to_create, finding_to_vuln_map
+            )
+
+            logger.info(f"Successfully created {len(created_vulnerabilities)} vulnerabilities in bulk")
+            return result
+
+        except Exception as e:
+            logger.error(f"Bulk vulnerability creation failed: {e}")
+            logger.info("Falling back to individual vulnerability creation...")
+            return self._create_vulnerabilities_individual(findings, assets, scan_history)
+
+    def _map_vulnerabilities_to_findings(
+        self,
+        created_vulnerabilities: List,
+        vulnerabilities_to_create: List,
+        finding_to_vuln_map: Dict,
+    ) -> Dict[str, int]:
+        """Map created vulnerabilities back to findings."""
+        result = {}
+        for i, created_vuln in enumerate(created_vulnerabilities):
+            if i < len(vulnerabilities_to_create):
+                original_vuln = vulnerabilities_to_create[i]
+                # Find the finding that corresponds to this vulnerability
+                for finding_id, vuln in finding_to_vuln_map.items():
+                    if vuln == original_vuln:
+                        result[finding_id] = created_vuln.id
+                        break
+        return result
+
+    def _create_vulnerabilities_individual(
+        self,
+        findings: List[IntegrationFinding],
+        assets: Dict[str, regscale_models.Asset],
+        scan_history: regscale_models.ScanHistory,
+    ) -> Dict[str, int]:
+        """
+        Create vulnerabilities individually as fallback.
+
+        :param List[IntegrationFinding] findings: List of findings
+        :param Dict[str, regscale_models.Asset] assets: Dictionary of assets
+        :param regscale_models.ScanHistory scan_history: The scan history
+        :return: Dictionary mapping finding external_id to vulnerability_id
+        :rtype: Dict[str, int]
+        """
+        result = {}
+        for finding in findings:
+            vulnerability_id = self.handle_vulnerability(finding, assets.get(finding.asset_identifier), scan_history)
+            if vulnerability_id:
+                result[finding.external_id] = vulnerability_id
+        return result