Documentation

Reporters reference

This page is generated from the reporter plugins in the ASH source code by scripts/generate_reporter_docs.py. Edits made to this file by hand are overwritten the next time it is generated.

Built-in reporters

Reporter	File extension	Enabled by default	Primary use case	Standard
CSV (csv)	.csv	yes	Spreadsheet analysis, filtering	RFC 4180
CycloneDX (cyclonedx)	.cdx.json	yes	Software bill of materials (SBOM)	CycloneDX 1.6
Flat JSON (flat-json)	.flat.json	yes	Programmatic consumption, dashboards	ASH-native
GitHub GHAS (github-ghas)	.ghas.sarif	yes	GitHub Advanced Security code scanning upload	OASIS SARIF 2.1.0
GitLab CycloneDX (gitlab-cyclonedx)	.gl-dependency-scanning-report.cdx.json	yes	GitLab dependency scanning	GitLab dependency scanning report
GitLab SAST (gitlab-sast)	.gl-sast-report.json	yes	GitLab Security Dashboard	GitLab SAST report
HTML (html)	.html	yes	Interactive browser-based reports	--
JUnit XML (junitxml)	.junit.xml	yes	CI/CD test result reporting	JUnit XML
Markdown (markdown)	.summary.md	yes	Pull request comments, documentation	CommonMark
OCSF (ocsf)	.ocsf.json	yes	Security data lakes, SIEM ingestion	OCSF 1.0
SARIF (sarif)	.sarif	yes	IDE integration, GitHub/GitLab code scanning	OASIS SARIF 2.1.0
SPDX (spdx)	.spdx.json	no	License compliance, SBOM	SPDX 2.3
Text (text)	.summary.txt	yes	Console output, logs	--
Unused suppressions (unused-suppressions)	.unused-suppressions.json	yes	Suppression hygiene: rules that matched nothing this scan	ASH-native
YAML (yaml)	.yaml	no	Human-readable structured data	--

Of the 15 built-in reporters, 13 are enabled by default: csv, cyclonedx, flat-json, github-ghas, gitlab-cyclonedx, gitlab-sast, html, junitxml, markdown, ocsf, sarif, text, and unused-suppressions. spdx and yaml are available but disabled by default.

A default written as from NAME, else value is read from that environment variable when ASH starts; value applies when the variable is not set.

Reporters in plugin modules

These are loaded only when the configuration's ash_plugin_modules names their module.

Reporter	File extension	Enabled by default	Provided by
aws-security-hub	.aws-security-hub.asff.json	no	plugin module ash_aws_plugins
bedrock-summary-reporter	.bedrock.summary.md	no	plugin module ash_aws_plugins
cloudwatch-logs	.cwlog.json	no	plugin module ash_aws_plugins
s3	.s3.json	no	plugin module ash_aws_plugins

csv

Formats results as CSV.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.csv_reporter.CsvReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .csv
• Runs with --python-only: yes

This plugin has no options.

cyclonedx

Formats results as CycloneDX.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.cyclonedx_reporter.CycloneDXReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .cdx.json
• Runs with --python-only: yes

This plugin has no options.

flat-json

Formats results as a flattened JSON array of findings.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.flatjson_reporter.FlatJSONReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .flat.json
• Runs with --python-only: yes

Options, under reporters.flat-json.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
include_scanner_metrics	boolean	true	No description in the code.
include_summary_metrics	boolean	true	No description in the code.
include_metadata	boolean	true	No description in the code.

github-ghas

Produces a SARIF report optimized for GitHub Advanced Security Code Scanning.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.github_ghas_reporter.GHASReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .ghas.sarif
• Runs with --python-only: yes

Options, under reporters.github-ghas.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
exclude_suppressed	boolean	true	When true (default), suppressed findings are excluded from the GHAS report. GitHub has its own dismissal workflow so suppressed findings are typically not needed.

gitlab-cyclonedx

Enriches CycloneDX SBOM with GitLab dependency scanning properties.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.gitlab_cyclonedx_reporter.GitLabCycloneDXReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .gl-dependency-scanning-report.cdx.json
• Runs with --python-only: yes

Options, under reporters.gitlab-cyclonedx.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
category	string	production	Default dependency category injected as gitlab:dependency_scanning:category. Typically 'production' or 'development'.
package_manager_override	string or null	null	If set, overrides the auto-detected package manager name for ALL components. Useful for single-ecosystem repos.
language_override	string or null	null	If set, overrides the auto-detected language name for ALL components.
input_file_path_override	string or null	null	If set, overrides the auto-detected input file path for ALL components. Useful when Syft reports absolute container paths that don't match the repo layout.

gitlab-sast

Formats vulnerability findings report as GitLab SAST format.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.gitlab_sast_reporter.GitLabSASTReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .gl-sast-report.json
• Runs with --python-only: yes

Options, under reporters.gitlab-sast.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
exclude_suppressed	boolean	false	When true, suppressed findings are excluded entirely from the GitLab SAST report. When false (default), suppressed findings are included with Info severity and the suppression reason in the solution field.

html

Formats results as HTML.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.html_reporter.HtmlReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .html
• Runs with --python-only: yes

This plugin has no options.

junitxml

Formats results as JUnitXML.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.junitxml_reporter.JunitXmlReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .junit.xml
• Runs with --python-only: yes

Options, under reporters.junitxml.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
respect_severity_threshold	boolean	true	No description in the code.

markdown

A triage-first report shared by files, CI summaries, and GitHub comments.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.markdown_reporter.MarkdownReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .summary.md
• Runs with --python-only: yes

Options, under reporters.markdown.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
include_summary	boolean	true	No description in the code.
include_findings_table	boolean	false	No description in the code.
include_detailed_findings	boolean	true	No description in the code.
max_detailed_findings	integer	20	No description in the code.
top_hotspots_limit	integer	10	No description in the code.
use_collapsible_details	boolean	true	No description in the code.
compact	boolean	false	No description in the code.

ocsf

Formats results as an array of Open Cybersecurity Schema Framework (OCSF) VulnerabilityFinding objects.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.ocsf_reporter.OcsfReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .ocsf.json
• Runs with --python-only: yes

This plugin has no options.

sarif

Formats results as SARIF.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.sarif_reporter.SarifReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .sarif
• Runs with --python-only: yes

This plugin has no options.

spdx

Formats results as an SPDX 2.3 JSON document.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.spdx_reporter.SpdxReporter
• Provided by: built in, loaded on every scan
• Enabled by default: no
• File extension: .spdx.json
• Runs with --python-only: yes

This plugin has no options.

text

Formats results as a human-readable plain text document.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.text_reporter.TextReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .summary.txt
• Runs with --python-only: yes

Options, under reporters.text.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
include_summary	boolean	true	No description in the code.
include_findings_table	boolean	false	No description in the code. The comment on its line in the code: This can be lengthy, default to False.
include_detailed_findings	boolean	false	No description in the code.
max_detailed_findings	integer	20	No description in the code.
top_hotspots_limit	integer	20	No description in the code.

unused-suppressions

Identifies and reports suppressions that were not applied to any findings.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.unused_suppressions_reporter.UnusedSuppressionsReporter
• Provided by: built in, loaded on every scan
• Enabled by default: yes
• File extension: .unused-suppressions.json
• Runs with --python-only: yes
• Also writes, with the default options: reports/ash.unused-suppressions.md

Options, under reporters.unused-suppressions.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
output_format	string	both	No description in the code. The comment on its line in the code: "json", "markdown", or "both".

yaml

Formats results as YAML.

• Class: automated_security_helper.plugin_modules.ash_builtin.reporters.yaml_reporter.YamlReporter
• Provided by: built in, loaded on every scan
• Enabled by default: no
• File extension: .yaml
• Runs with --python-only: yes

This plugin has no options.

aws-security-hub

Sends security findings to AWS Security Hub in ASFF format.

• Class: automated_security_helper.plugin_modules.ash_aws_plugins.security_hub_reporter.SecurityHubReporter
• Provided by: plugin module ash_aws_plugins, loaded when ash_plugin_modules names automated_security_helper.plugin_modules.ash_aws_plugins
• Enabled by default: no
• File extension: .aws-security-hub.asff.json
• Runs with --python-only: yes

Options, under reporters.aws-security-hub.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
aws_region	string or null	from AWS_REGION, else from AWS_DEFAULT_REGION, else null	AWS Region for Security Hub integration
aws_profile	string or null	from AWS_PROFILE, else null	AWS Profile to use for authentication
account_id	string or null	null	AWS account ID the findings are imported into. Looked up from the credentials if not set; when set, it must be the credentials' account, because Security Hub accepts findings sent with the account's default product ARN only from the account they name
max_retries	integer, at most 10	3	Maximum number of retries for a throttled or failed BatchImportFindings request
base_delay	number, at most 60	1.0	Base delay in seconds between retry attempts
max_delay	number, at most 60	60.0	Maximum delay in seconds between retry attempts
findings_scope	string or null, length at most 1,024	null	Name of the findings this scan owns in Security Hub, unique among the repositories that import into the same account and Region: finding Ids are derived from it, and archiving touches only the findings recorded with it. Required; project_name is not used. Set it only in the operator's configuration (--config-overrides, or a config file outside the scanned tree), because it decides which findings a scan updates and archives
archive_resolved_findings	boolean	false	Archive findings an earlier scan of the same scope imported that this scan no longer reports, for the scanners that lost no target. Off by default: a finding a scan did not report is not always fixed. Needs securityhub:GetFindings, which is also used to keep each existing finding's CreatedAt. Set it only in the operator's configuration

bedrock-summary-reporter

Generates a summary of security findings using Amazon Bedrock.

• Class: automated_security_helper.plugin_modules.ash_aws_plugins.bedrock_summary_reporter.BedrockSummaryReporter
• Provided by: plugin module ash_aws_plugins, loaded when ash_plugin_modules names automated_security_helper.plugin_modules.ash_aws_plugins
• Enabled by default: no
• File extension: .bedrock.summary.md
• Runs with --python-only: yes

Options, under reporters.bedrock-summary-reporter.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
aws_region	string or null, matches (af|il|ap|ca|eu|me|sa|us|cn|us-gov|us-iso|us-isob)-(central|north|(north(?:east|west))|south|south(?:east|west)|east|west)-\d{1}	from AWS_REGION, else from AWS_DEFAULT_REGION, else us-east-1	AWS region to use for Bedrock. If not specified, the default region will be used. If specified, the region will be used for all Bedrock requests.
aws_profile	string or null	from AWS_PROFILE, else null	AWS profile to use for Bedrock. If not specified, the default profile will be used.
model_id	string	from ASH_BEDROCK_MODEL_ID, else us.anthropic.claude-3-7-sonnet-20250219-v1:0	Bedrock model ID to use for generating summaries.
temperature	number	from ASH_BEDROCK_TEMPERATURE, else 0.5	Temperature parameter for the Bedrock model. Higher values make output more random.
max_tokens	integer	from ASH_BEDROCK_MAX_TOKENS, else 4000	Maximum number of tokens to generate in the response.
top_p	number	0.9	Top-p parameter for the Bedrock model. Controls diversity of generated text.
max_findings_to_analyze	integer	10	Maximum number of findings to include in the analysis.
max_findings_per_severity	integer	5	Maximum number of findings to include per severity level when grouping by severity.
group_by_severity	boolean	true	Whether to group findings by severity level in the report.
add_section_headers	boolean	true	Whether to add section headers to the report for better organization.
add_table_of_contents	boolean	true	Whether to add a table of contents to the report.
enable_caching	boolean	true	Whether to cache Bedrock responses to avoid duplicate API calls.
output_markdown	boolean	true	Whether to output the report as a markdown file.
output_file	string	ash.bedrock.summary.md	Filename for the main output markdown report, a file name in the reports directory.
max_retries	integer or null, at most 10	null	Maximum number of retries for Bedrock API calls. Unset, a model call is retried 3 times and a model listing makes 3 attempts.
base_delay	number, at most 60	1.0	Base delay in seconds between retries (will be increased exponentially).
max_delay	number, at most 60	60.0	Maximum delay in seconds between retries.
enable_fallback_models	boolean	true	Whether to try fallback models if the primary model fails.
output_executive_file	string	bedrock-executive.md	Filename for the executive summary markdown report, a file name in the reports directory.
output_technical_file	string	bedrock-technical.md	Filename for the technical analysis markdown report, a file name in the reports directory.
include_code_snippets	boolean	false	Whether to include code snippets in the report.
summary_style	one of executive, technical, detailed	executive	Style of summary to generate: executive (high-level), technical (detailed), or detailed (comprehensive).
custom_prompt	string or null	null	Custom prompt to prepend to all Bedrock requests for more tailored analysis.
exclude_scanner_types	list of string	["SECRET"]	Scanner tool types whose findings are counted but not sent to the model (e.g., 'SECRETS'). A finding's type is its scanner's tool type, looked up from the scanner's name, or a tool_type:: tag on the finding; 'SECRET' and 'SECRETS' both name the secrets type. A finding whose type cannot be determined is sent without its code snippets.
actionable_only	boolean	true	Whether to include only actionable findings (not suppressed, above severity threshold).
include_sections	list of string	["executive_summary", "risk_assessment", "technical_analysis", "remediation_guide", "compliance_impact"]	List of sections to include in the report.
exclude_sections	list of string	[]	List of sections to exclude from the report.
industry_context	string or null	null	Industry context to provide to the model for more relevant analysis.
compliance_frameworks	list of string	[]	List of compliance frameworks to consider in the analysis.
custom_context	string or null	null	Custom context information to provide to the model.
summarize_findings	boolean	false	Whether to summarize findings to reduce token usage.
batch_processing	boolean	false	Whether to process findings in batches for better performance with large datasets.

cloudwatch-logs

Formats results and publishes to CloudWatch Logs.

• Class: automated_security_helper.plugin_modules.ash_aws_plugins.cloudwatch_logs_reporter.CloudWatchLogsReporter
• Provided by: plugin module ash_aws_plugins, loaded when ash_plugin_modules names automated_security_helper.plugin_modules.ash_aws_plugins
• Enabled by default: no
• File extension: .cwlog.json
• Runs with --python-only: yes

Options, under reporters.cloudwatch-logs.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
aws_region	string or null, matches (af|il|ap|ca|eu|me|sa|us|cn|us-gov|us-iso|us-isob)-(central|north|(north(?:east|west))|south|south(?:east|west)|east|west)-\d{1}	from AWS_REGION, else from AWS_DEFAULT_REGION, else null	AWS region for CloudWatch Logs
log_group_name	string or null	from ASH_CLOUDWATCH_LOG_GROUP_NAME, else null	CloudWatch Logs group name to publish results to
log_stream_name	string	ASHScanResults	CloudWatch Logs stream name to publish results to
max_retries	integer, at most 10	3	Maximum number of retry attempts for CloudWatch API calls
base_delay	number, at most 60	1.0	Base delay in seconds between retry attempts
max_delay	number, at most 60	60.0	Maximum delay in seconds between retry attempts

s3

Formats results and uploads to an S3 bucket.

• Class: automated_security_helper.plugin_modules.ash_aws_plugins.s3_reporter.S3Reporter
• Provided by: plugin module ash_aws_plugins, loaded when ash_plugin_modules names automated_security_helper.plugin_modules.ash_aws_plugins
• Enabled by default: no
• File extension: .s3.json
• Runs with --python-only: yes

Options, under reporters.s3.options. An option not listed here refuses the configuration.

Option	Type	Default	Description
aws_region	string or null, matches (af|il|ap|ca|eu|me|sa|us|cn|us-gov|us-iso|us-isob)-(central|north|(north(?:east|west))|south|south(?:east|west)|east|west)-\d{1}	from AWS_REGION, else from AWS_DEFAULT_REGION, else null	AWS region to use for S3 operations
aws_profile	string or null	from AWS_PROFILE, else null	AWS profile to use for authentication
bucket_name	string or null	from ASH_S3_BUCKET_NAME, else null	Name of the S3 bucket to store reports
key_prefix	string	ash-reports/	Prefix for S3 object keys
file_format	one of json, yaml	json	Format to use for the report file
max_retries	integer, at most 10	3	Maximum number of retry attempts for S3 operations
base_delay	number, at most 60	1.0	Base delay in seconds between retry attempts
max_delay	number, at most 60	60.0	Maximum delay in seconds between retry attempts