Inventory and reports

Part ofMap and test your attack surface

This page explains how to search every host ATLAS knows about, and how to read and export an organisation's security posture. The Inventory lists the hosts; Reports sums up the posture and lets you download a report and a findings spreadsheet.

Who can do this

Everyone with access can open Inventory and Reports. People with the admin or user role can export. Exports also work for demo organisations.

Inventory

Open Inventory in the header. The heading shows how many hosts and services the organisation has, for example "25 hosts · 61 services".

Each row shows:

Column	What it shows
Host	The host's name. A marker shows a crown jewel.
Domain	The domain it belongs to.
IP	Its IP address.
OS / product	The operating system or main product ATLAS recognised.
Ports	How many open ports it has.
Criticality	Low, Medium or High, as marked on the Map.
Last seen	When a scan last saw the host.

Find a host

Type in the search box Search host, domain, product….

The list narrows as you type. If nothing matches, it reads "No hosts match."

Open a host

Choose a row. The host opens over the Map.

Read the two tabs:

Host information: the host's identity (full name, IP address, operating system, domain and zone, how it was discovered, when it was last seen, and other names it has), its services, the technologies ATLAS recognised, pages it found that the site does not link to, and its threat model: criticality, crown jewel and the kind of data it holds.

Issues & techniques: its vulnerabilities, misconfigurations and the attack techniques they enable. See Look at a host's issues.

Choose Focus map here to show the host on the Map, or Scan this host to scan only this host. See Scan one host.

Press Escape or choose the close button to return.

Reports

Open Reports in the header. The heading shows the organisation and today's date.

Read the overview

Tiles. Hosts, Critical hosts, Paths to crown jewels and Open findings, each with the change since the last scan, for example "+3 since last scan", "unchanged" or "first scan".

Posture summary. A bar that splits the hosts into "Critical hosts", "High", "Low" and "No open findings", with a sentence that sums up the posture, for example how many hosts carry an exploitable critical issue and how many paths reach a crown jewel.

Delta since last scan. New hosts, New critical findings, High findings and Fixed since, "Compared with scan of" the date of the previous scan. After the first scan it reads "First scan — nothing to compare against yet."

Scan history. Every scan and export, with its status, its duration or the reason it was refused, and how long ago it ran.

Export the posture report

The posture report is a readable summary for management or an auditor.

Open Reports.

Choose Export posture report.

You get a Markdown file named after the organisation, ending in -posture.md. You can open it in any text editor, or convert it with a Markdown tool. It contains:

Where the organization stands: hosts, domains, critical and high-severity hosts, open and accepted findings, and attack paths, compared with the previous scan;

Scope and authorization: whether the mandate is on file and who signed it, and which scope items are verified and how, including who attested;

What to fix first: a table of fixes, with the findings behind each;

How this was measured.

Export the findings as CSV

Open Reports.

Choose Export findings CSV.

You get a CSV file, ending in -findings.csv, with one row per finding. You can open it in a spreadsheet or import it into another tool. The columns are:

Column	Content
`finding_id`	A unique number for the finding
`status`	open, ticketed, accepted or fixed
`severity`, `cvss`, `epss`, `kev`	How severe it is and whether it is exploited
`issue_id`, `title`	The CVE or Soveryne check number, and its title
`host`, `fqdn`, `ip`, `port`, `protocol`, `transport`	Where it was found. `protocol` is the service, such as https; `transport` is tcp or udp.
`stage`	The scan stage that found it
`first_seen`, `last_seen`	When it was first and last seen
`remediation`, `evidence`	What to do, and what ATLAS observed
`accepted_by`, `accepted_reason`	Who accepted the risk. The reason stays empty for now, because accepting a risk does not ask for one yet

When the download starts

The export appears in the scan history on the Reports page while ATLAS prepares it. When it is ready in a few seconds, your browser downloads the file straight away.

Troubleshooting

What you see	What it means	What to do
"No hosts match."	No host matches your search.	Check the spelling, or clear the search.
A row reads "Stopped · no progress since …"	A scan or export stopped and will not finish.	Start it again.
The export did not download	The export took longer to prepare than usual.	Choose the export button again.

← PreviousFindings and attack paths Next →BAIT