Reporting commands

Quick reference

Trend

$python3 trend_report.py history.json
$jq '.[].opened - .closed' history.json
$jq -r '.[-1].date' history.json
$python3 trend_report.py h.json --drop 3

Coverage

$python3 coverage_report.py inv scans
$jq -r '.[].asset' inv.json | sort -u
$jq -r '.[].asset' scans.json | sort -u
$jq -r '.[].tool' scans.json | sort -u

Controls

$python3 control_map.py f.json soc2.json
$jq -r '.controls | keys[]' soc2.json
$jq -r '.[].category' f.json | sort -u
$jq -r '.controls[][]' soc2.json | sort -u

Evidence

$sha256sum evidence/* > manifest.txt
$grep -c '^FILE ' packet.txt
$tar --sort=name -cf packet.tar evidence/
$gpg --verify packet.tar.sig packet.tar

Explained

Trend

trend_report.py prints net flow and the closure rate with its denominator. The jq lines pull the flows and the latest date, and --drop tightens the line.

Coverage

coverage_report.py joins inventory to scans; the jq lines list assets and tools. A gap list is only useful when the inventory is the population.

Controls

control_map.py maps categories to SOC 2 ids; jq lists the categories and the ids. A finding with no id is a finding the auditor cannot file.

Evidence

audit_packet.py prints the manifest and the per-control index. sha256sum and tar seal the files, grep counts the manifest lines, and gpg verifies the signature. The packet is printed, so redirect it.

The fix

Run the sheet at the start of the review and paste the output into the pack. Each command answers one question with a number.

Prevention

Keep the sheet beside the report job and update it when a column changes. A sheet nobody edits becomes a museum of last year's paths.

In one line

Run the sheet

$python3 coverage_report.py inv scans