Output & Reports

infraudit generates detailed security audit reports in four formats. Each report groups findings by category, sorts them by severity, and provides actionable remediation for every finding.

Report Structure

Every report — regardless of format — contains the same information:

Status Levels

Each check returns one of four status levels:

Severity Levels

Severity indicates the risk level of the finding, guiding prioritization:

Console Output (default)

The console format is designed for interactive use. It groups checks by category, sorts failures first, uses ANSI colors for instant visual scanning, and includes a progress bar summary.

$ sudo infraudit audit --category auth

  infraudit v2.2.1 — Security Audit Report
  ────────────────────────────────────────────────────

  AUTH — Users & Authentication   5 passed  2 warn  1 fail
  ──────────────────────────────────────────────────────────────────
  ✗  FAIL   AUTH-001   CRITICAL PermitRootLogin is set to 'yes'
         ↳ Set 'PermitRootLogin no' in /etc/ssh/sshd_config
  !  WARN   AUTH-006   HIGH     Found 2 NOPASSWD entries in sudoers
         ↳ Review NOPASSWD entries and remove unnecessary ones
  !  WARN   AUTH-008   MEDIUM   su is not restricted via pam_wheel.so
         ↳ Uncomment 'auth required pam_wheel.so' in /etc/pam.d/su
  ✓  PASS   AUTH-003   CRITICAL Only root has UID 0
  ✓  PASS   AUTH-007   HIGH     Permissions correct
  ✓  PASS   AUTH-005   HIGH     All system accounts have nologin
  ✓  PASS   AUTH-002   HIGH     PasswordAuthentication is 'no'
  ✓  PASS   AUTH-004   CRITICAL No users have empty passwords

  ══════════════════════════════════════════════════════════════════
  SUMMARY

  ████████████████████████████████████████  5/8 checks

  ✓ 5 Passed    ! 2 Warnings    ✗ 1 Failures    0 Errors
  ══════════════════════════════════════════════════════════════════

Reading the console report

• Category headers show pass/warn/fail counts per category at a glance
• Findings are sorted: FAIL first, then WARN, then PASS — so critical issues are always at the top
• Remediation lines (↳) appear only for non-passing checks and give you the exact command or config change
• Progress bar gives a visual ratio of passed vs. total checks

JSON Output

Machine-readable format for CI/CD pipelines, monitoring systems, and custom dashboards. Use --format json to enable.

$ sudo infraudit audit --format json --output report.json

{
  "checks": [
    {
      "id": "AUTH-001",
      "name": "SSH root login disabled",
      "category": "auth",
      "severity": "CRITICAL",
      "status": "FAIL",
      "message": "PermitRootLogin is set to 'yes'",
      "remediation": "Set 'PermitRootLogin no' in /etc/ssh/sshd_config"
    },
    {
      "id": "AUTH-003",
      "name": "Only root has UID 0",
      "category": "auth",
      "severity": "CRITICAL",
      "status": "PASS",
      "message": "Only root has UID 0"
    }
  ],
  "summary": {
    "total": 287,
    "passed": 98,
    "warnings": 25,
    "failures": 7,
    "errors": 2,
    "skipped": 3,
    "score": 72,
    "grade": "C",
    "duration_seconds": 2.3,
    "os": {
      "id": "ubuntu",
      "name": "Ubuntu",
      "version": "24.04",
      "family": "debian",
      "pkg_manager": "apt",
      "init_system": "systemd",
      "arch": "amd64"
    }
  }
}

JSON use cases

• CI/CD gates: Parse the summary to block deployments with critical failures
• Monitoring: Feed results into Grafana, Datadog, or ELK for historical trending
• Automation: Use jq to extract specific findings: jq '.checks[] | select(.status=="FAIL")'
• Compliance: Archive JSON reports as evidence of periodic security assessments
• Comparison: Diff two JSON reports to track remediation progress over time

YAML Output

Human-friendly structured format for integration with configuration management tools. Use --format yaml.

$ sudo infraudit audit --format yaml --output report.yaml

summary:
  total: 287
  passed: 98
  warnings: 25
  failures: 7
  errors: 2
  skipped: 3
  score: 72
  grade: C
  duration_seconds: 2.3
  os:
    id: ubuntu
    name: Ubuntu
    version: "24.04"
    family: debian
    pkg_manager: apt
    init_system: systemd
    arch: amd64
checks:
  - id: AUTH-001
    name: SSH root login disabled
    category: auth
    severity: CRITICAL
    status: FAIL
    message: "PermitRootLogin is set to 'yes'"
    remediation: "Set 'PermitRootLogin no' in /etc/ssh/sshd_config"
  - id: AUTH-003
    name: Only root has UID 0
    category: auth
    severity: CRITICAL
    status: PASS
    message: Only root has UID 0

YAML use cases

• Ansible/Puppet: Parse YAML reports to generate remediation playbooks automatically
• Documentation: YAML is easy to include in wikis, tickets, and runbooks
• GitOps: Commit reports to a repository for change tracking and audit trails

HTML Output

Visual, self-contained report that opens in any browser. Use --format html. The report is a single .html file with embedded CSS — no external dependencies. Dark theme, responsive design, print-friendly.

$ sudo infraudit audit --format html --output report.html

What the HTML report includes

• Header: Version, hostname, timestamp, and audit duration
• Summary dashboard: Four metric cards (Passed, Warnings, Failures, Errors) with a color-coded progress bar
• Category sections: Checks grouped by category with status badges, severity indicators, and per-category statistics
• Remediation: Fix instructions shown inline for every non-passing check
• Print to PDF: Use Ctrl+P in the browser for a clean PDF export

HTML use cases

• Client deliverables: Send a professional audit report to clients or management
• Compliance evidence: Attach to compliance tickets as proof of security assessment
• Team review: Share via Slack, email, or wiki — opens in any browser, no tools needed
• PDF generation: Print from browser for a formatted PDF document

File Output

Use --output <file> with any format to write the report to a file instead of stdout:

# JSON report to file
sudo infraudit audit --format json --output /var/log/infraudit/audit-$(date +%F).json

# YAML report to file
sudo infraudit audit --format yaml --output /tmp/report.yaml

# HTML visual report
sudo infraudit audit --format html --output /var/log/infraudit/audit-$(date +%F).html

# Console report is still written to stdout when --output is used with console format
sudo infraudit audit --output /tmp/audit.txt

SARIF Output (GitHub / GitLab Integration)

SARIF (Static Analysis Results Interchange Format) is the standard format for security tools used by GitHub Code Scanning, GitLab SAST, and VS Code. Use --format sarif to generate it.

$ sudo infraudit audit --format sarif --output results.sarif

GitHub Action

Use the official civanmoreno/infraudit/action to integrate infraudit into your workflows. It supports two modes: local (audit the GHA runner) and SSH (audit a remote server).

Modo local (en el runner)

# .github/workflows/security-audit.yml
name: Security Audit
on: [push]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run infraudit
        uses: civanmoreno/infraudit/action@v2
        id: audit
        with:
          min-score: 70
          format: sarif

Modo SSH (servidor remoto)

- name: Audit production
  uses: civanmoreno/infraudit/action@v2
  with:
    mode: ssh
    host: deploy@prod.example.com
    ssh-key: ${{ secrets.SSH_PRIVATE_KEY }}
    profile: web-server
    min-score: 80
    format: sarif

Auditoría de flota (múltiples servidores)

jobs:
  audit:
    strategy:
      matrix:
        server:
          - { name: web-1, host: "deploy@web1.example.com", profile: web-server }
          - { name: db-1, host: "deploy@db1.example.com", profile: db-server }
    steps:
      - name: Audit ${{ matrix.server.name }}
        uses: civanmoreno/infraudit/action@v2
        with:
          mode: ssh
          host: ${{ matrix.server.host }}
          ssh-key: ${{ secrets.FLEET_SSH_KEY }}
          profile: ${{ matrix.server.profile }}
          min-score: 70

Outputs disponibles

Los resultados SARIF se suben automáticamente a Security → Code scanning alerts en GitHub.

What happens in GitHub

• Findings appear in Security → Code scanning alerts
• Each finding can be assigned, triaged, or dismissed with a reason
• Findings auto-close when the next scan no longer detects them
• GitHub sends notifications when new findings appear
• PRs can be blocked if there are open security alerts

Severity mapping

Other uses

• GitLab: Upload as a SAST artifact in your .gitlab-ci.yml
• VS Code: Open .sarif files directly with the SARIF Viewer extension
• Azure DevOps: Supports SARIF natively in its security dashboard

Comparing Reports (diff)

Use infraudit diff to compare two JSON audit reports and see what changed. This is essential for tracking remediation progress and detecting regressions.

# Run audit before remediation
sudo infraudit audit --format json --output before.json

# ... apply security fixes ...

# Run audit after remediation
sudo infraudit audit --format json --output after.json

# Compare the two reports
infraudit diff before.json after.json

What the diff shows

The diff output is organized into sections, ordered by priority:

The report also shows the Hardening Index delta — the score change between the two reports (e.g. 42 (F) → 78 (C) +36).

Example output

$ infraudit diff before.json after.json

  infraudit diff — Audit Comparison
  ────────────────────────────────────────────────────

  Hardening Index: 42 (F) → 78 (C)  +36

  Regressions (1)
  ──────────────────────────────────────────────────────
  ↓ NET-001      HIGH     PASS → FAIL

  Improvements (3)
  ──────────────────────────────────────────────────────
  ↑ FS-001       HIGH     WARN → PASS
  ↑ AUTH-001     CRITICAL FAIL → PASS
  ↑ AUTH-002     HIGH     FAIL → PASS

  New checks (1)
  ──────────────────────────────────────────────────────
  + LOG-001      MEDIUM   - → PASS

  ══════════════════════════════════════════════════════
  SUMMARY  ↑ 3 improved  ↓ 1 regressed  + 1 new  · 0 unchanged
  ══════════════════════════════════════════════════════

Exit codes for diff

CI/CD workflow with diff

# Store baseline report in your repo or artifact storage
infraudit audit --format json --output baseline.json

# In CI/CD pipeline: compare current state against baseline
infraudit audit --format json --output current.json
infraudit diff baseline.json current.json
if [ $? -ne 0 ]; then
    echo "Security regression detected — blocking deployment"
    exit 1
fi

# If passed, update baseline for next run
cp current.json baseline.json

Remote Scanning (SSH)

Use infraudit scan to audit remote servers without installing anything on them. The binary is copied via SCP, executed via SSH, and cleaned up automatically.

Single host

# Audit a remote server
infraudit scan --host root@192.168.1.10

# With custom SSH port and sudo
infraudit scan --host deploy@server.com:2222 --sudo

# With specific SSH key
infraudit scan --host ubuntu@server.com --identity ~/.ssh/prod_key

# With password authentication (requires sshpass)
infraudit scan --host root@server.com --password mypassword

# Filter checks on the remote
infraudit scan --host root@server.com --category auth,network --profile web-server

Multiple hosts

Create a hosts file (one per line, # for comments):

# servers.txt
root@web1.example.com
root@web2.example.com:2222
deploy@db1.example.com

# Scan all hosts, 5 concurrent
infraudit scan --hosts servers.txt --concurrency 5

# JSON output for all hosts
infraudit scan --hosts servers.txt --format json --output fleet-report.json

How it works

1. Detects remote architecture via ssh host uname -m
2. Copies the matching infraudit binary to /tmp via SCP
3. Executes infraudit audit --format json on the remote
4. Collects JSON output and renders locally
5. Removes the binary from the remote (unless --keep-binary)

Authentication

Two authentication methods are supported:

Requirements

• ssh and scp on PATH — uses your system SSH, inheriting agent, config, and ProxyJump settings
• sshpass on PATH (only if using --password) — install with your package manager
• Remote: Linux with /tmp writable — the binary is placed in /tmp temporarily

Fleet summary

Multi-host scans show a fleet summary table after individual reports:

  FLEET SUMMARY
  ────────────────────────────────────────────────────────────
  Host                          Score  Grade  Failures  Warnings
  ────────────────────────────────────────────────────────────
  root@web1.example.com            72      C         8         12
  root@web2.example.com            85      B         3          7
  deploy@db1.example.com          ERR      -    connection refused
  ════════════════════════════════════════════════════════════

Exit codes for scan

CIS Compliance Report

Generate a formal CIS Benchmark compliance report from your audit results. Shows compliance percentage per CIS section and lists all gaps that need remediation.

Usage

# Run audit and save JSON report
sudo infraudit audit --format json --output report.json

# Generate CIS Level 1 compliance report (default)
infraudit compliance report.json

# Generate CIS Level 2 compliance report
infraudit compliance report.json --level 2

# JSON output for automation
infraudit compliance report.json --format json

Example output

  CIS Benchmark Level 1 — Compliance Report
  ───────────────────────────────────────────────────────

  Overall: 78% compliant (117/150 controls passed)

  Section                                Pass  Total     %
  ───────────────────────────────────────────────────────
  1. Initial Setup                          28     35   80%
  2. Services                               22     26   84%
  3. Network Configuration                  24     30   80%
  4. Logging and Auditing                    4      6   66%
  5. Access, Authentication and Auth.       25     32   78%
  6. System Maintenance                     14     21   66%

  Gaps (33)
  ───────────────────────────────────────────────────────
  FAIL    AUTH-001   5.2.1 — Ensure SSH root login is disabled
  FAIL    NET-001    3.5.1 — Ensure a firewall is active
  WARN    PAM-001    5.4.1 — Ensure password creation requirements
  ...

CIS Levels

CIS Sections

CI/CD integration

# Generate audit + check compliance in CI
sudo infraudit audit --format json --output report.json
infraudit compliance report.json --format json > compliance.json

# Fail pipeline if compliance is below threshold
COMPLIANCE=$(cat compliance.json | jq '.overall_percentage')
if [ "$COMPLIANCE" -lt 80 ]; then
    echo "CIS compliance $COMPLIANCE% is below 80% threshold"
    exit 1
fi

Policy-as-Code

Define compliance requirements in a JSON policy file and enforce them automatically. Use --enforce-policy to validate audit results against your policy.

Policy file format

# .infraudit-policy.json
{
  "min_score": 80,
  "max_critical": 0,
  "max_high": 3,
  "required_pass": ["AUTH-001", "AUTH-002", "NET-001", "BOOT-005"],
  "ignore": ["HARD-009", "MAL-003"]
}

Usage

# Enforce with explicit policy file
sudo infraudit audit --enforce-policy .infraudit-policy.json

# Auto-detect policy file (searches ./, ~/, /etc/infraudit/)
sudo infraudit audit --enforce-policy ""

# Combine with other flags
sudo infraudit audit --profile web-server --enforce-policy policy.json --format json

Policy violation output

  POLICY VIOLATION (.infraudit-policy.json)
  ──────────────────────────────────────────────────
  min_score        Score 65 is below minimum 80
  max_critical     2 critical findings (maximum: 0)
  required_pass    AUTH-001: FAIL (required: PASS)
  required_pass    NET-001: WARN (required: PASS)
  ──────────────────────────────────────────────────

CI/CD integration

# In your CI/CD pipeline
sudo infraudit audit --enforce-policy .infraudit-policy.json --format json --output report.json
if [ $? -ne 0 ]; then
    echo "Policy violation — deployment blocked"
    exit 1
fi

Filtering & Profiles

Control which checks run to focus on what matters:

# Run only one category
sudo infraudit audit --category auth

# Skip specific checks you've accepted the risk for
sudo infraudit audit --skip HARD-007,SVC-012

# Use a server profile (skips irrelevant categories)
sudo infraudit audit --profile web-server

# Combine: web-server profile, JSON output, skip known exceptions
sudo infraudit audit --profile web-server --format json --skip NET-003 --output report.json

Exit Codes

infraudit returns meaningful exit codes for scripting and CI/CD integration:

CI/CD Example

# GitHub Actions / GitLab CI example
sudo infraudit audit --format json --output report.json --profile web-server
EXIT_CODE=$?

# Upload report as artifact
# Then gate on exit code
if [ $EXIT_CODE -eq 2 ]; then
    echo "BLOCKED: Security failures found"
    cat report.json | jq '.checks[] | select(.status=="FAIL") | .id + ": " + .message'
    exit 1
elif [ $EXIT_CODE -eq 1 ]; then
    echo "WARNING: Review findings before production"
fi