Check Result Export Schema

Reference the check result object schema and properties used in Mondoo JSONL exports.

This is the schema Mondoo uses when exporting check result data to JSONL. Check results include all fields from query results as well as additional check-specific fields.

Result type

object

Result properties

Property	Type	Required?	Nullable?
space_mrn	`string`	Yes	No
space_id	`string`	Yes	No
space_name	`string`	Yes	No
asset_id	`string`	Yes	No
asset_mrn	`string`	Yes	No
query_mrn	`string`	Yes	No
title	`string`	Yes	No
mql	`string`	Yes	No
data	`JSON`	Yes	No
exported_at	`string`	Yes	No
score	Deprecated
base_score	`integer`	Yes	Yes
risk_score	`integer`	Yes	Yes
risk_value	`integer`	Yes	Yes
status	`string`	Yes	No
modified_at	`string`	Yes	No
failed_at	`string`	Yes	Yes
assessment	`string`	Yes	No
severity	`string`	Yes	No
remediation	`JSON`	No	Yes
enforcement_state	`string`	Yes	No

space_mrn property

Mondoo identifier for the space containing the asset

space_mrn

Type	Required?	Nullable?
String	Yes	No

space_id property

Unique identifier for the space containing the asset

space_id

Type	Required?	Nullable?
String	Yes	No

space_name property

Name of the space containing the asset

space_name

Type	Required?	Nullable?
String	Yes	No

asset_id property

Space-unique asset identifier

asset_id

Type	Required?	Nullable?
String	Yes	No

asset_mrn property

Globally unique asset MRN

asset_mrn

Type	Required?	Nullable?
String	Yes	No

query_mrn property

Mondoo identifier for the check query

query_mrn

Type	Required?	Nullable?
String	Yes	No

title property

Title of the check query

title

Type	Required?	Nullable?
String	Yes	No

mql property

MQL query text

mql

Type	Required?	Nullable?
String	Yes	No

data property

JSON query result data

data

Type	Required?	Nullable?
JSON	Yes	No

exported_at property

Timestamp when this data was exported. This is a date-time string matching RFC 3339, section 5.6.

exported_at

Type	Required?	Nullable?
String	Yes	No

score property

Deprecated: Use base_score instead.

base_score property

Base score (0-100)

base_score

Type	Required?	Nullable?
Integer	Yes	Yes

risk_score property

Risk score (0-100)

risk_score

Type	Required?	Nullable?
Integer	Yes	Yes

risk_value property

Derived value: 100 - risk_score

risk_value

Type	Required?	Nullable?
Integer	Yes	Yes

status property

Translation of the check base score value:

If the check base score is 100, the status is pass.
If the check base score is lower than 100, the status is fail.

Other possible values: error, skip.

status

Type	Required?	Nullable?
String	Yes	No

modified_at property

Timestamp from when this check result item was last modified. This is a date-time string matching RFC 3339, section 5.6.

modified_at

Type	Required?	Nullable?
String	Yes	No

failed_at property

Timestamp from when this check result item last failed. This is a date-time string matching RFC 3339, section 5.6. If the check has never failed, the value is null.

failed_at

Type	Required?	Nullable?
String	Yes	Yes

assessment property

Assessment message

assessment

Type	Required?	Nullable?
String	Yes	No

severity property

Severity level of the check

severity

Type	Required?	Nullable?
String	Yes	No

remediation property

JSON-encoded remediation scripts

remediation

Type	Required?	Nullable?
JSON	No	Yes

enforcement_state property

Enforcement state of the check: enforcing or preview

enforcement_state

Type	Required?	Nullable?
String	Yes	No

Check Result Export Schema

On this page