Reports: every screen, column and action¶
Complements How a report is produced. This page covers the screens — the template library, the search views and the very wide export tables behind them.
Reports Management¶
| Column | What it holds |
|---|---|
| Report Detail | What was generated |
| Output Type | PDF, XLSX, DOCX, CSV |
| Time Taken | How long generation took |
| Generated From | Which template or screen produced it |
| Created At | When |
| Status | Queued, generating, complete or failed |
Time Taken is the column to look at when reports start failing. A report that normally takes two minutes and now takes twenty is heading for a timeout, and the trend is visible here before anyone reports a failure.
Assessment reports¶
Application Name, Report Details, Audit Name, Size (MB), Created By,
Created On, Updated On.
Size (MB) matters because assessment reports are emailed. A report past your mail gateway's attachment limit will generate successfully and never arrive, and this is the only place the size is visible before someone reports it missing.
Report templates¶
| Column | What it holds |
|---|---|
| Template Id / Template Name | Identity |
| Template Type | The kind of report |
| Asset Type | Which assets it applies to |
| Output Type | The format it produces |
| Design Template | The layout it renders through |
| Created By | Who defined it |
| Download | Retrieves the template itself |
Row actions — seven¶
| Action | What it does |
|---|---|
| View Template | The template as defined |
| Edit Template | Change it |
| Run Template | Generate a report from it now |
| Manage Config | Which properties the template includes |
| Share View Template | Grants read access to another user |
| Share Copy Template | Gives another user their own copy |
| Delete Template | Removes it |
Share View and Share Copy are different commitments
Share View leaves one template with one owner — your later edits reach everyone using it. Share Copy creates an independent template that will drift from yours and never receive your corrections.
Copy is right when another team needs to diverge. View is right when consistency matters, which for a report going to a regulator it usually does.
Manage Config carries Property Name, Select Property, Check Linked Assets.
Check Linked Assets decides whether the report follows relationships — pulling in the
hosts an application runs on, for instance — which changes both the content and how long
generation takes.
Run Template opens a host selection of Host IP, Host Name, Application Name,
Application Code, so a template can be run against a subset rather than everything it is
scoped to.
Custom report templates¶
Template Id, Template Name, Template Type, Audit Type, Default.
Section editing offers Add Sub-Section, Edit Section Name and Re-Arrange Sub-Sections. Order is part of the deliverable: a report whose executive summary appears after the technical appendix is a different document to its reader.
Default marks the template used when none is chosen. Changing which template is default changes what everyone generating a report without thinking about it produces.
Build a report template walks the whole sequence — the cover fields, sections and their order, the difference between written and generated content, and what Share View versus Share Copy commits you to.
Report search¶
The widest table in the product. Every attribute a finding carries, so a report can be built by filtering rather than by writing a template:
Vuln #, Issue Type, Issue #, Org, BU, Project, Application,
Bifurcation Type, App code, Application Type, Application Facing, Audit,
Audit Type, Audit Category, Audit Considered, and the finding's own fields.
Row actions: Vulnerability History, View SLA History, View Advisories.
Audit Considered as a filterable column is what makes this screen useful for reconciliation. Filtering to considered audits reproduces the dashboard's numbers; including everything reproduces the module screens. Comparing the two answers most "why do these disagree" questions directly.
Findings across modules in one report¶
Because a report can span modules, the search and export tables carry each module's own identifiers alongside the shared ones:
| Column | Applies to |
|---|---|
| VID | The finding's own identifier |
| CVE | Network and container findings carrying an advisory |
| Title | The finding name as its source reported it |
| Technology | The stack the asset is built on |
| Network Types | The network classification of a host |
| Policy Details / Posture Status | Policy Compliance rows — which benchmark, and pass, fail or error |
| Opened on Date | When the finding was first opened |
A single export therefore mixes rows where some columns are empty by nature — a Policy Compliance row has no CVE, a container row has no policy. Empty cells in this table are a consequence of combining modules, not missing data.
SLA history¶
SLA Expiry Date, Audit ID, Audit Name, Updated By, Created At.
An SLA expiry can change — because the severity changed, because the SLA configuration changed, or because someone adjusted it. This is the record of that, and it is what settles a dispute about whether a finding was overdue at a particular moment.
The overall vulnerability report¶
Ticket ID, Key, Org, BU, Project, Audit Details, Vuln Details,
Application Details, Asset Property, Host Details, Source Details,
Port & Protocol, Group Details, Control ID, Plugin ID.
Actions: History, View Advisories. The page offers Overall report and Old overall report — the current format and the previous one, kept because customers build their own tooling on the export and cannot always switch formats on your schedule.
The detail tables behind it¶
Vulnerability detail — Ticket ID, Risk Acceptance Expiry Date, Risk Acceptance Comment,
First Reported On, Last Observed Date, Duration(In Days), Score, SLA Expiry Date,
Is Overdue, Vulnerability Status, Vulnerability Sub Status.
Duration (In Days) is the age of the finding, and read against First Reported On it
is the number that appears in board reporting. It counts from first report, not from the
current audit — so a finding carried through four audits shows its true age.
Audit detail — Audit Cycle, Audit Scope Length, Initial/Confirmatory,
Audit Assigned On, Assigned Auditor Name, Audit Completed On.
Application detail — Org, BU, Project.
Applications with no findings¶
Two tables cover the assets a report found nothing on:
No-vuln application detail — App Code, Asset Name, Internet Facing, Priority,
Host Accessibility, Asset Type, OS.
No-vuln audit detail — Audit Cycle, Audit Created On, Audit Assigned On,
Assigned Auditor Name, Audit Completed On.
A clean asset is evidence, and it needs the audit detail to be believable
"No findings" means nothing on its own — it could mean assessed and clean, or never assessed. The paired audit detail is what distinguishes them: an asset with a completed audit and no findings is evidence, and one with no audit is a coverage gap.
This is why the report carries both tables rather than simply omitting clean assets.
Vulnerability history¶
Audit ID, Audit Name, Risk, Vulnerability Status, Sub Status, Discovered Date,
Created On, Status Changed By — the same shape as the module histories, so a finding
traced from a report reads identically to one traced from its module.