DEV Community

Wen Ping
Wen Ping

Posted on

How to export security scan reports as frozen snapshots

#security #vulnerabilities #report #angussecurity

Leadership asks for “last week’s security report,” you paste a screenshot of the live Findings list—and next week the same link shows different numbers auditors will not accept. Usually the scan ran; you treated a live issue list as a report.

Takeaway: A report is a frozen snapshot: severity distribution, gate result, scope, and engine versions land in the Document and do not auto-rewrite on the next check. Day-to-day work uses alerts and Findings; reviews, monthly packs, and external delivery use reports. Job-scoped reports require completed jobs. Formats follow the console: commonly HTML, JSON, CSV, PDF; finding details may also download as SARIF.

How to read severity and paths: see Reference. Below is how to export (audience, scope, monthly, formats, share). Filtering by SAST/deps/image/secret/license: see capability-scoped reports.

1. Report vs Finding vs alert 

Engine output → Finding (items to fix)
              → Alert (high-signal ops)
              → Report (downloadable snapshot frozen at generation)
Enter fullscreen mode Exit fullscreen mode
Object Changes by itself? Typical use
Finding / alert Yes—new checks, suppressions, fixes Daily triage
Report Frozen after generation Review, archive, external

Upload success or registry ingest ≠ scanned ≠ gate passed ≠ a deliverable report exists.

2. Four audiences (pick a template)

Console create wizard commonly shows four audience cards (UI labels win):

Audience Reader takes away Default feel
Management posture How bad, vs last period, what to decide Short, conclusion-first; often PDF; avoid dumping finding details
Engineering remediation What to fix first, paths, CVE order Full detail; often HTML/CSV; can enable findings + SARIF
Third-party / external What was tested, method/versions, who approved exceptions, verifiability Stronger redaction; often PDF+JSON; may attach evidence pack
Custom Free chapter mix Team templates; still under redaction and RBAC

Legacy enums like EXECUTIVE / ENGINEERING / EXTERNAL map to management / engineering / external—use console copy on materials; do not print raw enums externally.

3. Shortest console path (text only)

No screenshots needed—follow wizard labels:

  1. Sidebar Reports → Create (or Quick start: monthly posture / engineering checklist / job-scoped report).
  2. Audience: switching may reset chapters/display while keeping scope/filters (follow on-page hints).
  3. Scope one of:
    • All assets current state (still freezes as a snapshot);
    • Time range (last month / last 30 days—monthly path);
    • Selected jobs: only completed; never use failed/incomplete as release evidence.
  4. Filters (optional): severity, engine, capability. For “SAST-only” etc., see capability article.
  5. Detail/chapters: management stays brief; engineering opens finding details if you need SARIF; job-scoped mode may disable trend chapters—follow hints.
  6. Formats: at least one; primary format sorts first in download. CSV may be a ZIP of chapter CSVs.
  7. Generate → Generating → Ready (READY) before download. Font failures (e.g. missing CJK for PDF) mark the report failed—do not treat partials as success.
  8. External: header often Unpublished; Publish then share. Shares may set TTL and password; access should be audited. Create/download: analyst or admin (RBAC).

To narrow a “vuln scan report” by severity: raise minimum severity or keep only CRITICAL/HIGH so INFO noise stays out of management PDFs.

4. Monthly security report

Step Do this
Entry Quick start “monthly posture” or Create → management audience
Scope Time range → last month (or last 30 days)
Primary format PDF for minutes/archive
Questions to answer Risk up/down, asset ranking, gate coverage, exception drift

Weekly reports reuse the same template with a shorter window. Scheduled subscriptions, if offered, should use relative windows; otherwise generate manually. Mail/channel config follows the console.

What auditors need beyond a monthly PDF: see compliance evidence article—do not call a monthly report an assessment report.

5. Export formats

Format Use Watch-outs
HTML Browser reading, internal share Self-contained preview per page
PDF Management / formal external Missing CJK fonts can fail generation
CSV Spreadsheets Often a ZIP of chapter CSVs
JSON Integration / archive Full Document; external JSON should redact repo URLs / member names
SARIF Findings into IDE / tickets / GitHub Findings only; unavailable without finding-details chapter; management/external defaults often lack details; quality-only or license-only scopes often lack SARIF—trust the download menu

Multi-format downloads from one Document should match numerically. External evidence packs (PDF/HTML/JSON + method/coverage, often with checksums) may attach by default—console wins.

6. Share and external delivery

  • Shares: TTL, password, audited access.
  • External: redact paths, repo URLs, member IDs; never put secret bodies or recoverable snippets in external files (engineering audience for locations; external for counts).
  • Unpublished external reports should block share.
  • Revoke old shares after republishing so auditors do not get drafts.

7. Failure table

Symptom Cause Fix
Download 4xx / not ready Still generating Wait for READY
Numbers ≠ home page Comparing live Findings to an old report Snapshot semantics; regenerate for new numbers
Job-scoped empty Job incomplete/failed Select completed jobs only
No SARIF menu Finding details off, or scope without finding-like items Engineering audience + details, or CSV/JSON
PDF failed / tofu glyphs Fonts missing Install fonts per ops runbook; do not deliver failed state
External PDF has repo URLs Wrong audience/redaction External template + publish, then share
Pentest template pasted in Product does not do pentest/DAST reports Stay in AppSec scan report scope

FAQ

If another scan runs after generation, does the report update?

No. Generate a new report for new results.

Host / Qualys-style asset reports?

No. Scope is code and artifact supply-chain scanning, not host inventory.

Does finishing a scan mean MLPS pass?

No. Reports are one evidence input; assessors and process decide. See compliance evidence article.

Not allowed to download?

Create/download usually need analyst or admin; follow tenant RBAC.

How does this relate to capability-scoped reports?

This piece covers freeze and delivery (audience, window, formats, share). Filter recipes (SAST-only, image job-only, …) are in the capability-scoped reports article. Learn export first, then narrow.

Summary

  • Report = frozen snapshot; Finding = daily triage.
  • Audience → scope → completed jobs → READY download.
  • Monthly = management audience + time window; SARIF is findings-only.
  • External: publish then share; no raw secrets outbound.

Reference articles

Top comments (0)