A completed analysis can be reopened from its files alone. You do not need the data source loaded, or even present. This is how last quarter's result gets reviewed, and how a result produced on one machine gets examined on another.
Steps
- Go to Import Result
- Select a previously exported analysis
- The result opens with its original execution log
What comes back
- The reports, browsable and filterable exactly as when first produced
- The Info tab showing the criteria the analysis actually ran with, including any simulation criteria
- The signature status of the log
The criteria are worth reading before you interpret anything. A result showing few conflicts because it was scoped to one department looks identical to a clean system until you check what was in scope.
Signature status
Each imported result shows an indicator for its log signature:
| Icon | Status | Meaning |
|---|---|---|
| Lock, green | Valid | Signature verified, including non-repudiation if present |
| Shield-cross, red | Tampered | Content changed after signing. Do not rely on it |
| Warning, orange | Unknown Key | Signed with a key this build does not recognize |
| Warning, orange | Non-Repudiation Invalid | Primary signature valid, BYOK signature failed |
| Lock-open, grey | Unsigned | Produced before log signing existed |
Check this first when reviewing a result you did not produce yourself. See Verifying Signatures.
Comparing runs
Tick two to ten analyses in the list and click Compare N selected to open them side by side: every conflict marked new, resolved or persisting, per-risk and per-user deltas, and the access behind each change. The comparison warns when the runs used different rulesets, an edited ruleset, or a different scope, because a drop in findings caused by any of those is not progress. See Comparing Analyses.