Generate a Compliance Report

Audit mode vs CTF mode

ADscan has two scan modes. For compliance reports, always use --type audit.

CTF mode exits early by design. Audit mode runs every check and produces the full finding set the report engine needs. If you run CTF mode, your report will be sparse.

Scan modes: auth vs unauth

adscan ci requires a positional mode argument — auth or unauth — and each has different required flags.

Auth mode (you have credentials — standard for compliance engagements):

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain <domain.local> \
  --dc-ip <dc_ip> \
  --username <user> \
  --password '<pass>' \
  --generate-report \
  --frameworks iso27001 \
  --display-name "Client Name" \
  --report-theme premium_dark \
  --keep-workspace

Unauth mode (no credentials — documents unauthenticated exposure):

adscan ci unauth \
  --type audit \
  --interface eth0 \
  --hosts 10.10.10.0/24 \
  --generate-report \
  --frameworks iso27001 \
  --keep-workspace

In unauth mode you can pass --dc-ip instead of --hosts to skip host discovery and target a known DC directly.

ADscan will:

1. Enumerate the AD environment (DNS, LDAP, SMB, Kerberos, ADCS)
2. Generate the attack graph and exploit all available paths
3. Produce a PDF + JSON report mapped to the requested framework
4. Write outputs to ~/.adscan/workspaces/<workspace>/ (and copy to ./artifacts/ in the current directory)

All flags reference

Scan flags

Report flags

Framework examples

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks iso27001 \
  --report-theme premium_dark \
  --display-name "Acme Corp" \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks ens \
  --display-name "Empresa S.A." \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain bank.internal \
  --dc-ip 192.168.1.5 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks dora \
  --report-theme corporate_light \
  --display-name "Financial Entity" \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks iso27001,dora \
  --display-name "Client Name" \
  --keep-workspace

Generate report from the interactive shell

If you prefer working inside the ADscan shell, you can run the scan interactively and then generate the report with a guided prompt flow.

adscan start --image 'adscan/adscan-pro:latest'

Inside the shell, first configure the workspace type:

set type audit

Then run your scan as usual. Once the scan completes, generate the report:

generate_report

ADscan will guide you through two interactive prompts:

1. Framework selection (checkbox — select one or more):

❯ ◉ ENS Alto + NIS2 — Spain / CCN-CERT (recommended)
  ◯ ISO 27001:2022 — International ISMS standard
  ◯ DORA — EU 2022/2554 (financial sector)
  ◯ PCI DSS v4.0 — Payment Card Industry

2. Theme selection:

❯ Corporate Light — white/navy, print-safe
  Premium Dark — navy/cyan palette

You can also pass arguments directly to skip the prompts:

generate_report full iso27001
generate_report technical ens,iso27001
generate_report executive dora

The profiles (full, technical, executive) control which report sections are included. full is the default and recommended for most engagements.

Regenerate the deliverable kit from an existing workspace

If the scan already ran (or you want to regenerate the PDFs without re-scanning), use adscan deliver:

adscan deliver --workspace <workspace_name>

To regenerate just the executive PDF (functional equivalent of the legacy adscan report command):

adscan deliver --workspace <workspace_name> --only executive

Where are the outputs?

After the scan completes:

~/.adscan/workspaces/<workspace>/
├── report.pdf              ← client-ready PDF
└── technical_report.json   ← structured data for your pipeline

ADscan also copies the PDF to ./artifacts/report.pdf in your current working directory.

Find the workspace name in the scan output, or list workspaces inside the ADscan shell:

adscan start
# Inside ADscan shell:
workspaces

Timing

Report generation adds ~2–5 minutes after the scan completes.