Documentation
The Reports section gives a tenant five views over its own data: a posture score, a compliance control checklist, a unified audit trail, user activity, and a resource inventory. Every report is computed live from your tenant's records when you open it, scoped to your tenant only, and can be exported.
These are single-tenant reports. There is no cross-tenant or portfolio-wide report; an MSSP that manages several client tenants views each tenant's reports in that tenant. See MSSP Console for what a portfolio view does cover.
The home Dashboard is also covered here because its Recent Activity feed is built from the same change history as the audit trail.
Open Reports in the sidebar (under the Operate group). Reports opens a "Reports & Analytics" page with a card for each report, and a tab bar to switch between them.
| Report | Route |
|---|---|
| Security Overview | /reports/security-overview |
| Compliance | /reports/compliance |
| Audit Logs | /reports/audit-logs |
| User Activity | /reports/user-activity |
| Resource Usage | /reports/resource-usage |
Access requires the report:read permission. The same five endpoints (GET /api/reports/audit-logs, user-activity, resource-usage, security-overview, compliance) accept either a portal session or a role-bound API key carrying that permission, so scheduled jobs and AI assistants can read them under the same rule. See REST API Reference.
Each report has an Export menu in its header with four formats:
| Format | What you get |
|---|---|
| CSV | The report's data rows (after your filters) as a spreadsheet-friendly text file. |
| Excel | The same data rows as an .xlsx workbook. |
| A rendering of the report content on screen, charts included. | |
| Image | The same rendering as a PNG. |
CSV and Excel export what the report currently shows: the Audit Logs export honors the filters and search, User Activity and Resource Usage export the active tab, and Compliance exports the framework summary, or the controls of the selected framework. PDF and Image capture the visible page. A failed export shows an error toast.
User Activity and Resource Usage keep their tab and filters in the page URL, so a filtered view can be bookmarked or shared (parameters are listed in each section).
Audit and activity data is kept for your plan's retention window (free 7 days, Starter 30, Professional 90, Enterprise 365; see Retention by Plan). Older rows are purged by a nightly job, so reports cannot show them.
A snapshot of your tenant's security posture, derived from live configuration data. Open Reports → Security Overview.
| Card | Meaning |
|---|---|
| Security Score | Overall score out of 100: the rounded average of the five component scores below. |
| Active Alerts | Count of unresolved platform alerts for your tenant. |
| Compliance Status | Frameworks currently fully compliant, shown as compliant/total (for example 1/3). |
| Critical Vulnerabilities | Count of unresolved configuration-drift records with critical severity. Despite the label, this counts drift, not scanner-detected vulnerabilities. |
A doughnut chart ("Security Score Breakdown") shows five component scores, each 0-100 and each a coverage percentage. A component with nothing to measure scores 100.
| Component | How it is computed |
|---|---|
| Identity & access | Share of active users who use two-factor authentication or sign in through single sign-on. |
| Data protection | Share of stored credential secrets that are encrypted at rest. |
| Network security | Share of registered deployment targets reachable through a connectivity provider. |
| Device security | Share of target connections reporting a connected or configured status. |
| Application security | Share of drift records that are resolved, out of all drift records ever detected. |
The report has no Time Range selector: it always uses the figures above and a fixed six-month trend.
A control-by-control view against three built-in frameworks: SOC 2, ISO 27001, and CIS Controls. Open Reports → Compliance ("Compliance Dashboard").
Each framework in the catalog has a small set of controls (7 each), and every control is mapped to one automated check of your tenant. The result is evaluated when you open the report; nobody has to attest manually.
| Check | Passes when |
|---|---|
| Access control | At least one RBAC role is defined. |
| Encryption | Credential secrets are encrypted at rest. |
| MFA / SSO | Active users use two-factor authentication or SSO. |
| Network | Deployment targets are routed through a connectivity provider. |
| Drift | Detected configuration drift has been resolved. |
| Audit logging | At least one audit event has been recorded. |
| Approvals | At least one environment approval or rollback policy is configured. |
A check is Compliant when everything it covers passes, Non-Compliant when nothing does, Partially Compliant when some does, and Not Applicable when there is nothing to measure (for example, no stored credentials). A control's evidence text states the counts, such as "3/4 active users use MFA or SSO."
Export: with no framework selected the export is the framework summary (name, description, status, score, control counts, last assessment). With a framework selected it is that framework's filtered controls, including requirement, evidence, last tested, and remediation (shown as N/A for automated checks).
This report shows how your configuration maps to the three catalog frameworks. It is a configuration-evidence aid, not a certification or an audit result, and it covers only the listed controls. It does not cover HIPAA, GDPR, PCI, or other frameworks.
A unified, filterable timeline of what happened in your tenant. Open Reports → Audit Logs.
Three record types are merged into one list, newest first:
The server returns the 1,000 most recent rows across these sources (drawn from up to 500 audit events, 400 history entries, and 200 deployments). Actions taken during a platform-admin impersonation session carry an impersonator marker in the details. Actions taken by an AI assistant through an API key appear under your tenant's "API Integration" identity. See MCP Server.
| Filter | Options |
|---|---|
| User | Any user in your tenant, or All Users. |
| Action | The distinct actions present in the loaded rows (for example login, logout, created, updated, approved, deployed). |
| Resource Type | The distinct resource types present (for example session, app, deployment, and configuration entity types). |
| Status | Success, Warning, or Failure. |
| From Date / To Date | Date pickers; a date is read as the start of that day, so choose the next day to include the whole last day. |
| Search | Free text across user name, action, resource type, resource name, and IP address. |
| Reset Filters | Clears everything. A "Showing N results" line reports the match count. |
| Column | Content |
|---|---|
| Timestamp | Date and time to the second. |
| User | The user's name and ID. Events with no user show "System" or the recorded actor name. |
| Action | An uppercase badge. |
| Resource | The resource type and, when known, its name. |
| Status | SUCCESS, WARNING, or FAILURE, with a short details line when present. |
| IP Address | The client IP and location. Configuration and deployment rows have no IP and show a dash. |
The list is virtualized, so long result sets scroll smoothly. The export (CSV, Excel, PDF, Image) uses the filtered rows and adds the full user ID, location, and details fields. The details field can carry change context, so handle exports as sensitive records.
Who is using the platform, and how. Open Reports → User Activity. It has three tabs and a toolbar.
The tab and filters are kept in the URL as tab (overview, sessions, actions), user, active, and period.
Three charts (User Activity Status: active today versus inactive; User Role Distribution; Most Frequent Actions) above a User Statistics table:
| Column | Content |
|---|---|
| User | Name or email. |
| Role | The user's role name. |
| Last Active | The most recent activity time (falls back to last login). |
| Sessions | Number of sessions in the loaded window. |
| Avg. Duration | Average length of sessions that have ended, in minutes (zero when none have). |
| Actions | Count of that user's audit events and configuration changes. |
| Status | "Active Today" or "Inactive", based on activity since local midnight on the server. |
Columns: User, Start Time, End Time / Duration ("Currently Active" for open sessions), IP Address, Location / Device, and Status. A session is active when it has not been revoked and has not expired. A session's duration is only known once it was explicitly ended.
Columns: Timestamp, User, Action, Resource, and Details. It is the user-attributed subset of the audit trail (audit events and configuration changes; deployments are not listed here). Events with no user, such as system events, are omitted.
Limits: the server returns up to 300 sessions and 300 actions, built from the most recent 500 sessions, 500 audit events, and 300 configuration changes. Export uses the active tab with your filters applied.
An inventory of what your tenant has set up. Open Reports → Resource Usage. It has Overview and Details tabs.
URL parameters: tab (overview, details), tenant, resource, period.
| Type | What it represents | Metric and unit in Details |
|---|---|---|
| compute | A registered deployment target (component). | deployment_target, 1 instance |
| storage | A developer sandbox's disk usage. | sandbox_disk, size in GB |
| network | A connectivity provider. | its provider type, 1 connection |
| api | An installed app. | enabled_app or installed_app, 1 app |
| database | A stored credential. | stored_credential, 1 secret |
Summary cards (Compute Usage, Storage Usage, Network Usage), two charts (Resource Distribution, Resource Usage Percentage), and a "Resource Usage by Tenant" table with Tenant, Compute, Storage, Network, and Usage % columns plus a Total row. Usage % is the share of your targets whose connection is connected or configured.
A row per resource: Timestamp, Tenant, Resource, Type, Metric, and Value.
Read the numbers as counts, not consumption. Compute Usage is the number of deployment targets and Network Usage is the number of connectivity providers, although the card captions say "cores" and "GB". The report shows no cost because it does not meter or bill usage. For plan limits and billing, see Plans and Trial.
The home page (/, titled "Dashboard") is a read-only overview. It is not part of Reports and has no filters or export.
/pipeline/drift) and "Open pipeline" (opens /pipeline).