encode findings as json
use generic names for vilnerability mappings