I would like to extract list of devices thet "stopped to respond during the scan" (crashed or IPS enabled). I found now solution is reports module, does anyone has an idea on how to create such report?
The easiest way to do this is use/create a searchlist.
Go to Search Lists and create a new dynamic searchlist, give it a name of "stopped services". Under Vulnerability Title you can type in "stopped". Save the searchlist.
Now you can create a report template for that search list. Once you have put the searchlist in the report template, you can run the report against the asset group "All" and you will have the list of devices that have stopped.
You might want to take a look at the below QID's:
86476 Web Server Stopped Responding
38229 Service Stopped Responding
I used them a bit differently in helping me find & determine why certain Hosts took a long time to scan but they might help you as well.
Retrieving data ...