Generate a Compliance Report

Two paths to a report

ADscan PRO supports two flows. Pick the one that fits how you work.

The interactive flow is what every pentester and consultant gets onboarded on. The CI flow is a power-user shortcut once the engagement shape is known.

Audit mode vs CTF mode

ADscan has two scan modes. For compliance reports, always use audit mode (--type audit in CI, or pick audit at the REPL prompt).

CTF mode exits early by design. Audit mode runs every check and produces the full finding set the report engine needs. If you run CTF mode, your report will be sparse.

Interactive flow (recommended)

This is the same REPL you already know from LITE. The PRO image just adds the report engine.

export ADSCAN_DOCKER_IMAGE=ghcr.io/adscanpro/adscan-pro:latest
adscan start

Banner should show ADscan 9.0.0 PRO. From the prompt, the REPL guides each phase:

recon → kerberos → ACL → attack-path collection → exploitation

When the scan is complete, package the four client PDFs with one command:

deliver --display-name "Client Name"

That produces the Security Assessment Report, AD Hardening Playbook, and AD Control Coverage Report — plus the MITRE ATT&CK Navigator bundle — all under ~/.adscan/workspaces/<workspace>/deliverables/.

For framework selection, the REPL prompts you at report-time. Or call generate_report directly to override.

Automated CI flow (experimental)

adscan ci is the non-interactive variant — useful for CI/CD pipelines or running batches after you've validated the engagement shape. Flag coverage is narrower than the REPL.

It requires a positional mode argument — auth or unauth. Each has different required flags.

Auth mode (you have credentials — standard for compliance engagements):

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain <domain.local> \
  --dc-ip <dc_ip> \
  --username <user> \
  --password '<pass>' \
  --generate-report \
  --frameworks iso27001 \
  --display-name "Client Name" \
  --report-theme premium_dark \
  --keep-workspace

Unauth mode (no credentials — documents unauthenticated exposure):

adscan ci unauth \
  --type audit \
  --interface eth0 \
  --hosts 10.10.10.0/24 \
  --generate-report \
  --frameworks iso27001 \
  --keep-workspace

In unauth mode you can pass --dc-ip instead of --hosts to skip host discovery and target a known DC directly.

ADscan will:

1. Enumerate the AD environment (DNS, LDAP, SMB, Kerberos, ADCS)
2. Generate the attack graph and exploit all available paths
3. Produce a PDF + JSON report mapped to the requested framework
4. Write outputs to ~/.adscan/workspaces/<workspace>/ (and copy to ./artifacts/ in the current directory)

All flags reference

Scan flags

Report flags

Framework examples

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks iso27001 \
  --report-theme premium_dark \
  --display-name "Acme Corp" \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks ens \
  --display-name "Empresa S.A." \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks nis2 \
  --display-name "Operador Crítico S.A." \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain bank.internal \
  --dc-ip 192.168.1.5 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks dora \
  --report-theme corporate_light \
  --display-name "Financial Entity" \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks iso27001,dora \
  --display-name "Client Name" \
  --keep-workspace

Generate report from the interactive shell

Same flow most pentesters and consultants are already used to from LITE: the REPL walks every phase and deliver packages the three PDFs plus the MITRE ATT&CK Navigator bundle at the end.

export ADSCAN_DOCKER_IMAGE=ghcr.io/adscanpro/adscan-pro:latest
adscan start

Inside the shell, first configure the workspace type:

set type audit

Then run your scan as usual. Once the scan completes, generate the report:

generate_report

ADscan will guide you through two interactive prompts:

1. Framework selection (checkbox — select one or more):

❯ ◉ ENS Alto — Spain / CCN-CERT (recommended)
  ◯ NIS2 — EU Directive (EU) 2022/2555 (critical infrastructure)
  ◯ ISO 27001:2022 — International ISMS standard
  ◯ DORA — EU 2022/2554 (financial sector)
  ◯ PCI DSS v4.0 — Payment Card Industry

2. Theme selection:

❯ Corporate Light — white/navy, print-safe
  Premium Dark — navy/cyan palette

You can also pass arguments directly to skip the prompts:

generate_report full iso27001
generate_report technical ens,iso27001
generate_report executive dora

The profiles (full, technical, executive) control which report sections are included. full is the default and recommended for most engagements.

Regenerate the deliverable kit from an existing workspace

If the scan already ran (or you want to regenerate the PDFs without re-scanning), use adscan deliver:

adscan deliver --workspace <workspace_name>

To regenerate just the executive PDF (functional equivalent of the legacy adscan report command):

adscan deliver --workspace <workspace_name> --only executive

Where are the outputs?

After the scan completes:

~/.adscan/workspaces/<workspace>/
├── report.pdf              ← client-ready PDF
└── technical_report.json   ← structured data for your pipeline

ADscan also copies the PDF to ./artifacts/report.pdf in your current working directory.

Find the workspace name in the scan output, or list workspaces inside the ADscan shell:

adscan start
# Inside ADscan shell:
workspaces

Timing

Report generation adds ~2–5 minutes after the scan completes.