Reports & Evidence

RedStrike turns a scan's findings into shareable, audit-ready reports — complete with evidence, remediation, and framework mappings — so you can hand auditors and stakeholders proof instead of raw scanner output.

Generate a report

From Reports → New report, choose a scope:

• A single scan — a point-in-time snapshot.
• A target over a date range — trend and remediation progress.
• The whole organization — a program-level rollup.

Pick a template (Executive, Technical, or Compliance) and generate.

What's in a report

Evidence

Evidence is what makes a report defensible. Depending on the finding type, RedStrike attaches:

• Web — the exact request and response that demonstrate the issue.
• Network — the service banner and version matched to a CVE.
• Cloud — the resource identifier and the misconfigured setting value.

GET /search?q=<script>alert(1)</script> HTTP/1.1
Host: app.example.com
--- response ---
200 OK  (reflected unescaped in text/html) → XSS confirmed

Export formats

# JSON export via API (for pipelines / SIEM ingestion)
curl -X POST https://api.redstrike.io/v1/reports \
  -H "Authorization: Bearer $REDSTRIKE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "scan_id": "scan_456", "format": "json" }'

• PDF — polished, branded, ready for auditors and execs.
• JSON — machine-readable for SIEM, ticketing, or data warehouses.
• CSV — a flat findings list for spreadsheets.

Compliance mappings

Findings are tagged with the controls they affect, so a Compliance report can be filtered to a single framework:

Next

• Integrations — auto-deliver reports and alerts.
• API Reference — generate and fetch reports programmatically.