Generate a Compliance Report

Two paths to a report

ADscan PRO supports two flows. Pick the one that fits how you work.

Both drive the same engine. The difference is who answers the questions: you, or the documented defaults. Full flag reference on the adscan ci page.

Audit mode vs CTF mode

ADscan has two scan modes. For compliance reports, always use audit mode (--type audit in CI, or pick audit at the REPL prompt).

CTF mode exits early by design. Audit mode runs every check and produces the full finding set the report engine needs. If you run CTF mode, your report will be sparse.

Interactive flow (recommended)

This is the same REPL you already know from LITE. The PRO image just adds the report engine.

export ADSCAN_DOCKER_IMAGE=ghcr.io/adscanpro/adscan-pro:latest
adscan start

The banner shows the PRO tier. From the prompt, the REPL guides each phase:

recon → kerberos → ACL → attack-path collection → exploitation

When the scan is complete, package the kit with one command:

deliver --display-name "Client Name"

That produces three PDFs — the Security Assessment Report, the AD Hardening Playbook and the AD Control Coverage Report — plus the MITRE ATT&CK Navigator bundle, all under ~/.adscan/workspaces/<workspace>/deliverables/. See adscan deliver for what each document carries.

Framework selection is prompted at report time in an interactive terminal, or set with --frameworks.

Unattended flow

adscan ci runs the same pipeline with every prompt pre-answered. It is what the Enterprise appliance's worker and the ADscan platform use to launch scans.

adscan ci never prompts, so PRO has to be activated on the machine before it can run. Pass --partner-tag <tag> — the tag from your onboarding email — on the first run, and every later run reuses the saved tag. Exporting ADSCAN_PARTNER_TAG does the same job. Without either, the run stops on the activation gate instead of scanning. See Getting Started with PRO for the detail.

It requires a positional mode argument — auth or unauth. Each has different required flags.

Auth mode (you have credentials — standard for compliance engagements):

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain <domain.local> \
  --dc-ip <dc_ip> \
  --username <user> \
  --password '<pass>' \
  --generate-report \
  --frameworks iso27001 \
  --display-name "Client Name" \
  --report-theme premium_dark \
  --keep-workspace

Unauth mode (no credentials — documents unauthenticated exposure):

adscan ci unauth \
  --type audit \
  --interface eth0 \
  --hosts 10.10.10.0/24 \
  --generate-report \
  --frameworks iso27001 \
  --keep-workspace

In unauth mode you can pass --dc-ip instead of --hosts to skip host discovery and target a known DC directly.

ADscan will:

1. Enumerate the AD environment (DNS, LDAP, SMB, Kerberos, ADCS)
2. Generate the attack graph and exploit all available paths
3. Produce a PDF + JSON report mapped to the requested framework
4. Write outputs to ~/.adscan/workspaces/<workspace>/

All flags reference

Scan flags

Report flags

Framework examples

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks iso27001 \
  --report-theme premium_dark \
  --display-name "Acme Corp" \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks ens \
  --display-name "Empresa S.A." \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks nis2 \
  --display-name "Operador Crítico S.A." \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain bank.internal \
  --dc-ip 192.168.1.5 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks dora \
  --report-theme corporate_light \
  --display-name "Financial Entity" \
  --keep-workspace

adscan ci auth \
  --type audit \
  --interface eth0 \
  --domain corp.example.com \
  --dc-ip 10.10.10.10 \
  --username auditor \
  --password 'P@ssw0rd!' \
  --generate-report \
  --frameworks iso27001,dora \
  --display-name "Client Name" \
  --keep-workspace

Generate report from the interactive shell

The same flow you know from LITE: the REPL walks every phase, and deliver packages the three PDFs plus the ATT&CK Navigator bundle at the end.

export ADSCAN_DOCKER_IMAGE=ghcr.io/adscanpro/adscan-pro:latest
adscan start

Inside the shell, first configure the workspace type:

set type audit

Then run your scan as usual. Once the scan completes, generate the report:

generate_report

ADscan will guide you through two interactive prompts:

1. Framework selection (checkbox — select one or more):

❯ ◉ ENS Alto — Spain / CCN-CERT (recommended)
  ◯ NIS2 — EU Directive (EU) 2022/2555 (critical infrastructure)
  ◯ ISO 27001:2022 — International ISMS standard
  ◯ DORA — EU 2022/2554 (financial sector)
  ◯ PCI DSS v4.0.1 — Payment Card Industry

2. Theme selection:

❯ Editorial — warm bone, ember accent (premium, McKinsey-grade)
  Corporate — white/navy, print-safe (Big-4 / auditor)

corporate_light is the default when nothing is picked.

You can also pass arguments directly to skip the prompts:

generate_report full iso27001
generate_report technical ens,iso27001
generate_report executive dora

The profiles (full, technical, executive) control which report sections are included. full is the default and recommended for most engagements.

Regenerate the deliverable kit from an existing workspace

If the scan already ran (or you want to regenerate the PDFs without re-scanning), use adscan deliver:

adscan deliver --workspace <workspace_name>

To regenerate just the Security Assessment Report:

adscan deliver --workspace <workspace_name> --only report

Where are the outputs?

Everything lands in the workspace, not the working directory:

~/.adscan/workspaces/<workspace>/
├── technical_report.json          structured data for your pipeline
└── deliverables/
    ├── <YYYY-MM-DD>-adscan-kit.zip    the kit, ready to send
    ├── manifest.json
    └── staging/                       the rendered PDFs and Navigator files

Under GitHub Actions (GITHUB_ACTIONS=true) the report is additionally copied into ./artifacts/ so a workflow can upload it without knowing the workspace path. Nothing is copied there on a normal run.

The scan output names the workspace. To list them from inside the shell:

workspace list

Timing

Report generation adds ~2–5 minutes after the scan completes.