Findings & reports

A finding is one issue the agent recorded during a run. A report is a rendering of a run's stored findings, together with the engagement's details, the rules-of-engagement document, the threat model and the evidence-integrity record. Anatomy of a run describes how findings come to exist. This section describes what they contain and how they are rendered.

A report is rebuilt from the database¶

A report is not a stored copy of the mapping. To render one, the application reads the engagement and its findings from the database, loads the framework's YAML file, maps the findings to that framework's controls, and builds the report from the result. The control ids a report prints are the ones the framework file produced at the moment of rendering.

Formats¶

A report downloads in three formats:

Format	When it is built	Described in
PDF	Once, when the report is generated	The PDF report
SARIF 2.1.0	At every download	SARIF and CSV exports
CSV	At every download	SARIF and CSV exports

Because the PDF is written once and the other two are rebuilt on request, a PDF and a CSV of the same run can carry different control ids if the framework file changed between the two. They can also list findings in different orders.

In the console¶

Reports exist for completed engagements; the server refuses to generate one for an engagement in any other status. Opening a completed engagement that has no report generates one, and so does the completion event when it arrives while the engagement page is open. The Report panel then offers Download PDF, SARIF and CSV, and the Export button at the top of the page downloads the PDF. If generation fails, the panel shows a Generate report button that tries again.

Where to start¶

• To read a finding: Anatomy of a finding, then Severity and taxonomy.
• To hand a report to an auditor: The PDF report, then What verification does not prove.
• To load findings into another tool: SARIF and CSV exports.
• To test again after a fix: Retesting after remediation.