Audits
How Auditor scans your assets, and where to see the results of each scan.
An audit is one scan of one or more assets. Portal asks Auditor to run a sequence of jobs on each asset: download the code or pull the image, run the scanners, and send each scanner’s report back. The findings of all the reports are counted under the audit.
Audits start in several ways:
- by hand, for a few assets or products: see Run an audit;
- on a schedule: see Schedule audits;
- on every push to a repository, from the version control webhook;
- on every new image in a container registry.
Reports sent over the API or uploaded with an asset also create an audit, so you see them in the same list. See Import scan results.
See the audits
Audits in the sidebar lists all audits: when each one ran, its products, assets, scanners and pipelines. Each scanner shows how many findings it added and resolved; click a number to open those findings. The same list is on each product’s Audits page, at the bottom of each asset’s page and on each scanner’s page.
Open an audit to see its products and scanners. The Auditor pipelines of the audit show each job’s status and logs: open them when an audit finishes without findings you expected.
Audits need a license that includes Auditor: an Auditor license or a paid one. See License.