Report Results

cnspec writes scan results to your terminal by default. Use the -o (or --output) flag to choose a different format, and --output-target to send results to a file or message queue instead of standard output.

cnspec scan local -o FORMAT

Terminal formats

These formats are designed for reading directly in the terminal.

compact (default)

A condensed view of each policy with pass/fail counts and an overall score:

cnspec scan local

full

Every check, control, data point, risk factor, and vulnerability, with descriptions and remediation guidance for each finding:

cnspec scan local -o full

summary

A one-line score per policy, with no per-check detail:

cnspec scan local -o summary

report

A structured, printable report ideal for sharing with stakeholders:

cnspec scan local -o report

Customize what's printed

You can refine any terminal format by appending one or more modifiers, separated by commas. Prefix any modifier with no to hide that section.

For example, to print a compact report without data queries or controls:

cnspec scan local -o compact,nodata,nocontrols

To print the full format but suppress vulnerabilities:

cnspec scan local -o full,novulns

Machine-readable formats

These formats are useful for automation, scripting, and integration with other tools.

json

Exports results as JSON. Use shell redirection to save to a file:

cnspec scan local -o json > results.json

For example, to scan a Kubernetes cluster and save the results:

cnspec scan k8s -o json > k8s-results.json

yaml

Exports results as YAML:

cnspec scan local -o yaml > results.yaml

CI/CD integration

junit

Exports results in JUnit XML format, which most CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, CircleCI) can parse to display test results:

cnspec scan local -o junit > results.xml

sarif

Exports results in SARIF (Static Analysis Results Interchange Format) 2.1.0, which integrates with tools like GitHub Code Scanning and VS Code SARIF Viewer:

cnspec scan local -o sarif > results.sarif

Each scanned asset produces a separate SARIF run. cnspec maps scores to SARIF severity levels: a score of 100 is a pass, 50-99 is a warning, and below 50 is an error.

Send results to a file or queue

As an alternative to shell redirection, the --output-target flag writes results directly to a destination. cnspec auto-detects the destination type from the value you pass:

Local file:

cnspec scan local -o json --output-target results.json

You can also use a file:// URL:

cnspec scan local -o json --output-target file:///var/log/cnspec/results.json

AWS SQS queue:

cnspec scan local -o json --output-target https://sqs.us-east-1.amazonaws.com/123456789/my-queue

Azure Service Bus topic or queue:

cnspec scan local -o json --output-target https://my-bus.servicebus.windows.net/my-topic

CSV (vulnerabilities only)

The csv format is supported only for vulnerability reports produced by cnspec vuln, not for policy scans:

cnspec vuln local -o csv > vulnerabilities.csv

The output lists each affected package with its score, installed version, fixed version, available version, advisory, and CVE list.

View results in the Mondoo Console

When cnspec completes a registered scan, it prints a link to the Mondoo Console, where you can explore graphical results.

To open a printer-friendly view in a new browser tab, select the print icon near the top-right corner of the Mondoo Console.