Show progress with reports

Generate a report for multiple apps

1. Click Apps in the left navigation menu.
2. Click Generate Report.
3. From the Generate Executive Report screen, enter a Report Name and select a calendar month. The report pulls in data for completed calendar months only, so you have to wait until the beginning of the next month to generate the report. It may take up to 7 days from the start of each month for the previous month's data to become available.
4. In Report Types, select one of the following:
   • InsightAppSec All App Executive Report
   • Combined InsightAppSec and InsightVM Executive Report
5. Click Generate Report.

Generate a report for one app

1. Click Apps in the left navigation menu.
2. Select an app from the Apps vulnerability table.
3. Click Generate Report.
4. On the Generate Report screen, enter a Report Name and select a date range.
5. Select Executive Report under Report Types.
6. Select a Format Type (PDF or HTML).
7. Click Generate Report.

Generate an InsightAppSec scan-level report

1. Click Scans in the left navigation menu.
2. Select a scan from the scan-level vulnerability table. You can also select scans from within an App.
3. Click Generate Report.
4. From the Generate Report screen, enter a Report Name and select a Report Type.
5. Select a scan report.
6. Select a Format.
7. Click Generate Report.

Filter scan report data

You can add filters to a scan-level report to refine the data before generating the report.

1. Go to the Scans page and select a scan.
2. Select the filter criteria.
3. Click Apply.
4. Click Generate Report.

Applied filters are visible in a banner on the Vulnerabilities Summary and the Vulnerabilities with Remediation Report in PDF or HTML format when printed.

You can access all app level reports for the apps that you are assigned, including:

• Single app executive report
• Scan-level vulnerability reports
• Scan-level compliance reports

You can only download the multi-app executive level reports and the combined InsightAppSec InsightVM all apps reports that you generated.

Download reports

Only reports generated after March 28, 2022 are displayed on the Reports page. Historical reports are not available.

1. Click Reports in the left navigation menu.
2. Select the report(s) you want to download and click the Download button.

InsightAppSec Apps Executive Report

This report provides an overview of all apps scanned during a selected month. The report contains the number of apps scanned, unreviewed vulnerabilities, high severity vulnerabilities and remediated vulnerabilities with each of these compared to the previous month. It also shows the top vulnerability types and the vulnerabilities by severity and status.

Combined InsightAppSec and InsightVM Executive Report

This report provides an overview of the assets and apps scanned by InsightAppSec and InsightVM. The report contains sections relating to your overall vulnerability management programs, including details on apps and assets scanned along with the vulnerabilities found and remediation efforts. Where applicable, it also showcases details on location, owner, and criticality tags.

Vulnerabilities Summary

The Vulnerabilities Summary is an overview of the vulnerabilities found in the app during the scan. The report is organized by vulnerability and the number of vulnerabilities found during the scan for the app.

Vulnerabilities with Remediation Report

The Vulnerabilities with Remediation report contains all vulnerabilities found in an app from the chosen scan and the recommended remediation. Before making the report, you can use a filter to focus on certain vulnerabilities. Within the report, you can view the attack type, recommendation, and replay the attack using the Rapid7 Chrome Plugin.

The OWASP foundation focused on helping organizations build more secure applications. They educate the community about top security risks to web applications along with top remediations. The OWASP Top 10 is a popular reference framework used by developers and web application security teams for guidance on the most critical security risks to web applications.

OWASP TOP 10 API Security Risks - 2023

Based on scan data, the OWASP Top 10 API Security Risks - 2023 Report shows whether the API passed or failed on each of the top 10 OWASP API security risks and related attacks. It also shows vulnerabilities within each of the top 10 issues along with the response and request data for the vulnerability.

OWASP 2021 Report

The OWASP 2021 Report shows the top 10 risks in 2021 that OWASP determined. The report shows whether you passed or failed on each OWASP Top 10-based attack for the scan. It also shows vulnerabilities within each of the top 10 issues along with the response and request data for the vulnerability.

OWASP 2017 Report

The OWASP 2017 Report shows the top 10 OWASP issues and whether you passed or failed on each for the scan. It also shows vulnerabilities within each of the top 10 issues along with the response and request data for the vulnerability.

OWASP 2013 Report

The OWASP 2013 Report shows the top 10 OWASP issues and whether you passed or failed on each for the scan. It also shows vulnerabilities within each of the top 10 issues along with the response and request data for the vulnerability.

Payment Card Industry Report (PCI Report)

The Payment Card Industry report helps you prepare for an audit, an assessment, or a questionnaire around PCI compliance. Uncovering potential issues that will affect the outcome of any of these exercises allows you to take action and secure critical vulnerabilities on any assets that deal with payment card data.

SOX Report

The SOX (Sarbanes-Oxley Compliance) details compliance issues and whether you passed or failed on each, for that particular scan. The report shows each requirement and the details of the vulnerabilities that caused you to fail, if you did.

HIPAA Compliance Results

The HIPAA compliance report shows each requirement, if you passed or failed, and the details of the vulnerabilities that caused you to fail, if you did.

GDPR Report

The GDPR report is an advisory report that shows how vulnerabilities in scanned targets might jeopardize your GDPR compliance and highlights which vulnerabilities need to be addressed.

Web Application

API