> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Reports

> Generate structured security reports for management, audits, and compliance

Reports turn the data collected from your attack surface — assets, vulnerabilities, and their trends — into structured documents that stakeholders can act on. Whether the audience is management, auditors, or compliance reviewers, OASM Reports let you generate consistent, repeatable outputs instead of assembling findings by hand.

Reports are generated from workspace data on demand. A preview-before-generate workflow lets you inspect the output before committing a report, so you never generate a document you have not seen.

## Report types

<Table>
  | Type          | Audience                           | Contents                                                                                                 |
  | ------------- | ---------------------------------- | -------------------------------------------------------------------------------------------------------- |
  | Summary       | Management, executive stakeholders | Workspace-wide security posture overview: statistics, top vulnerabilities, TLS status, and asset trends  |
  | Vulnerability | Security teams, auditors           | Per-vulnerability detail: description, affected asset/URL/ports, risk analysis, and remediation guidance |
</Table>

* **Summary report** — a workspace-wide posture overview. It aggregates statistics, highlights the top vulnerabilities, summarizes TLS/SSL status, and shows asset trends over time. Use it for regular executive updates and high-level compliance reporting.
* **Vulnerability report** — a per-vulnerability breakdown. For each finding it covers the description, the affected asset (URL and ports), risk analysis, and remediation steps. Use it to drive remediation sprints and document audit evidence.

<Accordion title="Which report type should I use?">
  Choose **Summary** when the goal is a posture snapshot: leadership briefings, recurring status updates, and program-level compliance summaries. Choose **Vulnerability** when the goal is action: remediation sprints, audit evidence for a specific finding, or handoff to the team that fixes the issue. A common rhythm is a weekly summary for management plus vulnerability reports whenever a critical finding is confirmed — see [Vulnerabilities](/vulnerability).
</Accordion>

## Report templates

Templates let you standardize report formats. The **Templates** button on the Reports page opens template management for report and workflow templates. Templates are file-based, which means an entire organization can share the same standardized formats.

<Steps>
  <Step title="Create or upload a template">
    Add a template file through the Templates feature — create it directly or upload an existing file.
  </Step>

  <Step title="Rename and organize">
    Rename templates to keep the library understandable as it grows.
  </Step>

  <Step title="Reference templates in generation">
    Use the stored templates to keep report and workflow output consistent across teams and time periods.
  </Step>
</Steps>

## Key concepts

<Table>
  | Concept         | Description                                                                                                |
  | --------------- | ---------------------------------------------------------------------------------------------------------- |
  | Report          | A generated document, stored in the workspace and listed on the Reports page                               |
  | Preview         | A preview of a report — generated on the fly so you can inspect content before saving                      |
  | Report template | A file-based template that standardizes report or workflow formats — managed through the Templates feature |
</Table>

<Info>
  Report templates are managed through the **Templates** feature — the **Templates** button on the Reports page. Templates are file-based and standardized across generated documents; see [Report templates](#report-templates) below.
</Info>

## Browse reports in the Console

The **Reports** page (under **Security → Reports**, route `/reports`) lists all generated reports.

<Steps>
  <Step title="Open Security → Reports">
    Navigate to the Reports page (`/reports`).
  </Step>

  <Step title="Filter the list">
    Use the filters to narrow the list: **All**, **Summary**, or **Vulnerability**.
  </Step>

  <Step title="Inspect a report">
    The table shows **File name** and **Created** for each report. Open a row to view or download the document.
  </Step>
</Steps>

<Accordion title="What is the Templates button for?">
  The **Templates** button opens template management for report and workflow templates. Create, upload, rename, and organize templates to keep your organization's formats standardized.
</Accordion>

## Preview a report

Previewing renders the report content from current workspace data without saving a report — the right way to validate filters and scope before generating.

## Generate a report

Once the preview looks right, generate the report. Generation creates a stored report that appears in the list on the Reports page.

<Steps>
  <Step title="Preview the report">
    Inspect the preview so you generate exactly what you intend.
  </Step>

  <Step title="Generate the report">
    Generate the report with the same scope you previewed.
  </Step>

  <Step title="Verify the report is listed">
    The generated report appears in the Reports table with its file name and creation time.
  </Step>
</Steps>

<Info>
  You can scope a report to a date range and to a subset of targets — or include the whole workspace. A narrow scope keeps reports focused.
</Info>

## Download and view a report

Generated reports are stored in the workspace. From the Reports page, open a report by its **File name** to view or download it for distribution — attach it to notifications, share it with stakeholders, or archive it for audits.

## Delete a report

Remove a report when it is outdated or was generated by mistake.

<Danger>
  Deleting a report is permanent — the document is removed from the workspace and cannot be recovered. Export or archive anything you still need before deleting.
</Danger>

<Info>
  Everything available in the console is also available through the API — see the API Reference tab.
</Info>

## Best practices

* **Preview before generating.** Always preview when the date range or target set changed, so you validate scope and content before committing a report.
* **Schedule generation.** Combine report generation with [workflows](/jobs): attach a scheduled workflow to produce posture reports automatically — for example, a weekly summary — instead of generating manually.
* **Distribute through channels.** Push generated reports through [integrations](/integrations) so stakeholders receive them without manual download steps.
* **Scope reports to their audience.** Keep executive summaries high-level and include only the evidence a compliance review actually needs.
* **Clean up the registry.** Delete superseded drafts; keep the Reports table as a curated list of current, shareable documents.

## Related

<Card icon="bell" title="Notifications" horizontal href="/notifications">
  Get notified when scheduled report generation completes
</Card>

<Card icon="list-checks" title="Job Registry" horizontal href="/jobs">
  Verify the scan and discovery tasks that feed report data completed
</Card>

<Card icon="plug" title="Integrations" horizontal href="/integrations">
  Distribute generated reports through connected channels
</Card>

<Card icon="shield" title="Vulnerabilities" horizontal href="/vulnerability">
  Understand the findings that populate vulnerability reports
</Card>