An analysis writes its reports to the save directory you set in the analysis criteria, so the main export happens without you asking. What you export manually afterwards is whatever view you have filtered on screen.
What a run writes automatically
Every analysis writes, into the configured save directory:
- the summary report
- the detailed report
- a signed execution log (
.log), nameduser-analysis*orroles-analysis*depending on mode
The log is what makes the reports defensible: it records the criteria, the ruleset checksum, and a checksum and row count for every data source table, all Ed25519-signed. Keep it with the reports. A report without its log is a spreadsheet; a report with its log is audit evidence. See How Log Signing Works.
Exporting a view
Each result tab has its own export, which writes what you currently see, filters included. That is the point: filter to the population somebody owns, then export just that.
| Tab | Default filename |
|---|---|
| Summary report | analysis_summary.csv |
| Did-do, users mode | users_did_do.csv |
| Did-do, roles mode | roles_did_do.csv |
| Did-do field changes | field_changes.csv |
| Remediation, per user | users_remediation.csv |
| Remediation, per role | roles_remediation.csv |
| Recommendations summary | recommendations_summary.csv |
| Remediation instructions | remediation_instructions.csv |
| Grouped recommendations | grouped_recommendations.csv |
| Removed risks | removed_risks.csv |
Exports of large tables run in the background and report progress. You can keep working while one is writing.
Formats
Reports written by the analysis are tab-separated. Tab-separated is the safer default for this data, because role descriptions and risk descriptions routinely contain commas and semicolons that would break a CSV split.
Per-tab exports are comma-separated CSV, and the remediation report can additionally be written as JSON. See Exporting Recommendations.
Everything opens in Excel. For files large enough that Excel refuses them, which happens with detailed reports on a large landscape, either filter before exporting or load the file with a tool that streams.