Report Results

Control how cnspec reports scan results, including terminal output formats, JSON, YAML, CSV, JUnit, SARIF, OCSF, and OHDF.

After you run a scan, cnspec reports what it found. This page is the reference for every way cnspec can present those results.

cnspec writes scan results to your terminal by default. Use the -o (or --output) flag to choose a different format, and --output-target to send results to a file or message queue instead of standard output.

cnspec scan local -o FORMAT

Terminal formats

These formats are designed for reading directly in the terminal.

compact (default)

The passing and failing checks for each asset, followed by each asset's risk rating:

cnspec scan local

full

Every check, control, data point, risk factor, and vulnerability, with descriptions and remediation guidance for each finding:

cnspec scan local -o full

summary

Only the risk rating for each asset, with no per-check detail:

cnspec scan local -o summary

report

A structured, printable report ideal for sharing with stakeholders:

cnspec scan local -o report

Customize what's printed

You can refine any terminal format by appending one or more modifiers, separated by commas. Prefix any modifier with no to hide that section.

Modifier	Effect
`checks` / `nochecks`	Show or hide individual policy checks
`controls` / `nocontrols`	Show or hide compliance controls
`data` / `nodata`	Show or hide raw data queries
`risks` / `norisks`	Show or hide risk factors
`vulns` / `novulns`	Show or hide vulnerabilities

For example, to print a compact report without data queries or controls:

cnspec scan local -o compact,nodata,nocontrols

To print the full format but suppress vulnerabilities:

cnspec scan local -o full,novulns

Machine-readable formats

These formats are useful for automation, scripting, and integration with other tools.

json

Exports results as JSON. Use shell redirection to save to a file:

cnspec scan local -o json > results.json

For example, to scan a Kubernetes cluster and save the results:

cnspec scan k8s -o json > k8s-results.json

Each check result carries a status and a riskScore. The riskScore is the inverse of the check's score: a passing check has a risk score of 0 (and the field is omitted), and a check that fails completely has a risk score of 100.

"//local.cnspec.io/run/local-execution/queries/check-fail": {
  "status": "fail",
  "riskScore": 100
}

The score field is removed in cnspec 14

Before cnspec 14, JSON output also included a score field, where 100 meant a pass. cnspec 14 removes it. If your scripts read score, read riskScore instead and invert the comparison.

json is an alias for json-v2. The older json-v1 layout is still available.

yaml

Exports results as YAML:

cnspec scan local -o yaml > results.yaml

yaml is an alias for yaml-v1. Use yaml-v2 for the YAML equivalent of json-v2.

csv

Exports one row per check on each asset, for filtering, sorting, and pivoting in a spreadsheet:

cnspec scan local -o csv > results.csv

The columns are Asset, Asset MRN, Platform, Platform Version, Check, Title, Status, Score, Impact, and Message. Score is the 0 to 100 score, where 100 is a pass.

Asset,Asset MRN,Platform,Platform Version,Check,Title,Status,Score,Impact,Message
lunalectric-web01,//policy.api.mondoo.com/assets/2abc...,ubuntu,24.04,//local.cnspec.io/run/local-execution/queries/check-fail,failing,fail,0,80,

cnspec vuln also supports -o csv. For vulnerability reports, each row lists an advisory with its severity, affected package, installed version, fixed version, PURL, references, and remediation:

cnspec vuln local -o csv > vulnerabilities.csv

CI/CD integration

junit

Exports results in JUnit XML format, which most CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, CircleCI) can parse to display test results:

cnspec scan local -o junit > results.xml

Add the detailed modifier to include each failed or errored check's description, query, assessment, remediation, and references in the JUnit failure body:

cnspec scan local -o junit,detailed > results.xml

sarif

Exports results in SARIF (Static Analysis Results Interchange Format) 2.1.0, which integrates with tools like GitHub Code Scanning and VS Code SARIF Viewer:

cnspec scan local -o sarif > results.sarif

Each scanned asset produces a separate SARIF run. cnspec sets the SARIF level of a failed check from its risk (100 minus its score): a risk of 70 or higher is an error, 40 to 69 is a warning, and below 40 is a note. A check that errors is reported as an error. Passing and skipped checks have the level none.

Security data lakes and compliance tools

ocsf-json and ocsf-parquet

Exports results as OCSF (Open Cybersecurity Schema Framework) events, which you can load into Amazon Security Lake or a SIEM.

ocsf-json writes newline-delimited JSON events. Send it to standard output or a file, or point --output-target at a directory to get one file per OCSF event class:

cnspec scan local -o ocsf-json > events.json

ocsf-parquet writes one Parquet file per OCSF event class, so it always needs a directory as its --output-target:

cnspec scan aws -o ocsf-parquet --output-target ./events/

By default, cnspec reports each check as a Compliance Finding (class 2003) and emits OCSF 1.3.0, the highest version Amazon Security Lake accepts for custom sources. Two modifiers change that:

Modifier	Effect
`ocsf-findings=detection`	Report checks as Detection Findings (class 2004), the class Splunk Enterprise Security models on. Detection Findings have no compliance object, so mappings are carried in `unmapped`.
`ocsf-version=1.9.0`	Emit OCSF 1.9.0 instead of 1.3.0, for a SIEM that tracks the current schema.

For example:

cnspec scan local -o ocsf-json,ocsf-findings=detection,ocsf-version=1.9.0 > events.json

hdf

Exports results as InSpec exec-json, the OHDF format that Heimdall and the MITRE Security Automation Framework tools read:

cnspec scan local -o hdf > results.hdf.json

An OHDF document describes a single asset. When you scan more than one asset, point --output-target at a directory and cnspec writes one document per asset:

cnspec scan --inventory-file inventory.yml -o hdf --output-target ./hdf/

Send results to a file, directory, or queue

As an alternative to shell redirection, the --output-target flag writes results directly to a destination. cnspec auto-detects the destination type from the value you pass:

Local file:

cnspec scan local -o json --output-target results.json

You can also use a file:// URL:

cnspec scan local -o json --output-target file:///var/log/cnspec/results.json

Local directory: For hdf, ocsf-json, and ocsf-parquet, a target that is an existing directory, or a path that ends in /, writes one file per asset (hdf) or per OCSF event class (ocsf-json and ocsf-parquet):

cnspec scan local -o ocsf-json --output-target ./events/

AWS SQS queue:

cnspec scan local -o json --output-target https://sqs.us-east-1.amazonaws.com/123456789/my-queue

Azure Service Bus topic or queue:

cnspec scan local -o json --output-target https://my-bus.servicebus.windows.net/my-topic

AWS SQS and Azure Service Bus targets accept only json, json-v1, json-v2, yaml, yaml-v1, or yaml-v2. Other formats can't be sent to a queue.

View results in the Mondoo App

When cnspec completes a registered scan, it prints a link to the Mondoo App, where you can explore graphical results.

You must register cnspec to see results in the Mondoo App. To learn more, read Register cnspec with Mondoo Platform.

Results in the Mondoo App

To open a printer-friendly view in a new browser tab, select the print icon near the top-right corner of the Mondoo App.

Learn more

To scan many assets at once and feed results into these formats, read Remote Scanning with Inventory Files.
To understand the policies and checks behind a score, read About Policies.

On this page