Open the profile's Reporting section and type instructions into the Report guidance box, such as who will read the report or what to group by. Click Save. The reporting agent uses your words when it writes the final report.
Steps
- Open the profile. Use the pencil icon on its row in Scan Profiles, or start a new profile.
- Go to Reporting. Choose Reporting in the left-hand switcher.
- Find the box. Look under Report filters for Report guidance. Its hint reads "Steer how the final report is written and filtered."
- Write your instructions. Use plain sentences. Say who reads the report, which topics to stress and which to skip.
- Save. Click Save. The next scan from this profile follows the guidance.
Good to know
The final phase of every scan is Reporting. A reporting agent assembles the report from confirmed findings, filtered by your minimum severity and confidence, and it reads this box too. Good guidance is short and specific.
| Field | What to enter |
|---|---|
| Audience | Who reads the report, such as a board or a developer team |
| Focus | What to stress first, such as login and payment flows |
| Format | How to group things, such as by service |
Detected personal data in this box, such as emails, phone numbers, ID numbers and payment cards, is redacted before analysis. Web addresses and IP addresses stay, so the scan can still use them. Do not paste secrets here. A good habit is to read the guidance aloud once. If a new colleague could follow it without asking you anything, it is clear enough.
Guidance shapes wording and emphasis. It does not change what the scan finds, and it cannot make a finding disappear that clears your filters. For limits on testing itself, use rules of engagement. Need examples? Write to /contact.
Related questions
- How do I add rules of engagement, such as no destructive payloads in production?
- How do I set a minimum severity for a profile's report?
- How do I leave low-confidence findings out of the report?
- How do I fill in the Application context for a profile?
- Why does my report list fewer findings than the scan's Findings tab?
Reporting rules in Cyberlop: severity, confidence, guidance and PII redaction
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.