Skip to content

Reports

VirtualSutra AI generates downloadable reports after every completed inspection run. Access them from the Reports tab on the Run Detail page.

Report types

Type Description
Compliance Per-framework breakdown with control IDs, scores, and all findings
WAF Assessment Pillar-by-pillar scores, RAG ratings, and LLM recommendations
Executive Summary High-level overview for management and non-technical stakeholders

Download formats

Format Best for
PDF Sharing with stakeholders; print-ready
HTML In-browser reading; links between findings and compliance controls
JSON Programmatic consumption; import into other tools
CSV Spreadsheet analysis in Excel or Google Sheets
SARIF Import into GitHub Advanced Security, VS Code, or other SAST tooling

Not every report type is available in every format. The Reports tab shows only what was generated for that run.

Per-scope reports - Executive Summary PDF + per-scope HTML

After a run completes, the Reports tab lists a separate report file for each scope present in the run. The output mix is:

  • Executive Summary - rendered as both PDF and HTML. The PDF is the single artifact intended for offline distribution to leadership / auditors / GRC tools. It includes a "Detailed Reports" section at the bottom with deep-links into the per-scope HTML files for anyone reading it from a browser.
  • All other scopes - HTML only. PDFs are no longer produced for the per-scope reports because (a) the HTML opens directly in a browser tab and is searchable, zoomable, and easier to navigate than a printed PDF, and (b) generating thousands of PDFs per run was the dominant cause of reporting OOMs at large scale.

Per-scope HTML files are produced for each of the following (only those present in the run's scope appear):

  • WAF Assessment (waf/waf_assessment.html)
  • Per cloud account - one file per cloud_inspector alias (compliance/cloud_{alias}.html)
  • Per repository group - one file per codebase_analyzer alias (compliance/codebase_{alias}.html)
  • Per Kubernetes cluster - one file per cluster (compliance/k8s_{cluster}.html)
  • Per container image / registry - one file per container_scanner alias (compliance/registry_{alias}.html)
  • Per compliance framework - one file per active framework (compliance/framework_{name}.html, e.g. framework_cis.html, framework_soc2.html)

Each scope is rendered by a dedicated Kubernetes Job running in parallel, so large runs finish reporting much faster than when everything was rendered in a single process.

Need an offline copy of a per-scope report? Open the HTML in your browser and use File → Print → Save as PDF (or your browser's equivalent). You can also download the full machine-readable finding set as JSON, CSV, or SARIF - those formats are unaffected by the HTML-only change and always contain every finding regardless of scope size.

SIEM / SOAR export (OCSF, ASFF, Security Hub)

Beyond the standard download formats, the Reports tab offers two security-tooling-oriented exports:

Export Description
OCSF Findings mapped to the Open Cybersecurity Schema Framework's Detection Finding schema (v1.5.0), as gzip-compressible newline-delimited JSON, for ingestion into any OCSF-compatible SIEM
ASFF Findings mapped to AWS Security Finding Format

If your administrator has enabled the integration, an ASFF to Security Hub push sends findings directly into AWS Security Hub instead of (or in addition to) downloading the file. Findings are batched automatically to stay within Security Hub's per-request limits, and any individual finding too large to submit is skipped rather than failing the whole batch. You'll see a success or failure toast after a push.

Note: The Security Hub push button only appears when your deployment has Security Hub integration configured. If you don't see it, ask your administrator.

Accessing reports

  1. Open a completed run (/runs/{id})
  2. Click the Reports tab
  3. Click a format button to download

SARIF in GitHub

Upload the SARIF report to GitHub Advanced Security to see findings annotated directly on pull request diffs:

gh api repos/{owner}/{repo}/code-scanning/sarifs \
  -F sarif=@report.sarif.json \
  -F ref=refs/heads/main \
  -F commit_sha=$(git rev-parse HEAD)

Report retention

Reports are stored on the server volume. Retention depends on your administrator's storage configuration. Contact your admin if older reports are missing.