A completed analysis can be reopened from its files alone. You do not need the data source loaded, or even present. This is how last quarter's result gets reviewed, and how a result produced on one machine gets examined on another.
Steps
- Go to Import Result
- Select a previously exported analysis
- The result opens with its original execution log
What comes back
- The reports, browsable and filterable exactly as when first produced
- The Info tab showing the criteria the analysis actually ran with, including any simulation criteria
- The signature status of the log
The criteria are worth reading before you interpret anything. A result showing few conflicts because it was scoped to one department looks identical to a clean system until you check what was in scope.
Signature status
Each imported result shows an indicator for its log signature:
| Icon | Status | Meaning |
|---|---|---|
| Lock, green | Valid | Signature verified, including non-repudiation if present |
| Shield-cross, red | Tampered | Content changed after signing. Do not rely on it |
| Warning, orange | Unknown Key | Signed with a key this build does not recognize |
| Warning, orange | Non-Repudiation Invalid | Primary signature valid, BYOK signature failed |
| Lock-open, grey | Unsigned | Produced before log signing existed |
Check this first when reviewing a result you did not produce yourself. See Verifying Signatures.
Comparing two runs
Importing an older result alongside a current one is the practical way to show progress: same scope, two dates, and the difference in conflict count is your remediation evidence. For the comparison to mean anything, confirm in each Info tab that the criteria and the ruleset checksum match. A drop in findings caused by a narrower scope or a changed ruleset is not progress.