Skip to main content

Compliance Reports

After every successful image build, Klarity ImageFactory performs a series of automated scans and analyses to provide a comprehensive view of the image's security posture, software inventory, and changes. These reports are essential for auditing, regulatory compliance, and operational visibility.

Types of Generated Reports​

ImageFactory generates several distinct reports for each image:

1. Compliance Score​

The compliance score is a high-level summary of the image's adherence to the selected CIS Benchmark profile. It provides a percentage of passed checks for:

  • Level 1 Compliance: Essential security configurations.
  • Level 2 Compliance: Advanced defense-in-depth configurations (if applicable).

These scores are stored at both the individual image level and the distribution level, allowing for easy tracking of security trends across different image families.

2. Detailed JSON Report​

The JSON report is a machine-readable file containing the full results of the CIS benchmark scan. It includes every rule checked, its status (Pass, Fail, or Exception), and detailed output from the scanning tool. This report is ideal for integration with external security dashboards or automated compliance monitoring systems.

3. Formatted PDF Report​

The PDF report is a human-readable, professionally formatted document that summarizes the compliance scan results. It includes executive summaries, charts, and detailed breakdowns of failed checks, making it suitable for sharing with auditors or management.

4. Package Inventory​

ImageFactory generates a complete inventory of all software packages installed on the image. This report includes the package name, version, architecture, and source repository. It provides a clear view of the image's software footprint and helps in identifying unauthorized or outdated software.

5. Software Bill of Materials (SBOM)​

The SBOM is a formal, structured record containing the details and supply chain relationships of various components used in the image. It is generated per image and lists all software components, including libraries and dependencies. SBOM generation is performed on-demand and the results are cached for performance.

6. Change Log​

The change log provides a differential view of the changes made to the image compared to the previous build of the same template. It highlights added, removed, or updated packages and configuration changes, making it easy to track the evolution of the image over time.

Accessing Reports​

All reports are securely stored and accessible through the ImageFactory UI or GraphQL API.

Using the UI​

In the ImageFactory web console, navigate to the Images section and select a specific image build. The Compliance and Inventory tabs provide direct links to view or download the generated reports.

For a detailed walkthrough, see the Template Details guide.

Via API

To retrieve the reports programmatically, query the image with presign: true to receive temporary download URLs for the report files.

Example API Response Snippet:

{
  "id": "img-12345",
  "details": {
    "compliance": {
      "level_one": 98.5,
      "level_two": 85.0,
      "json_report": "https://reports.imagefactory.nordcloudapp.com/...temporary-download-url...",
      "pdf_report": "https://reports.imagefactory.nordcloudapp.com/...temporary-download-url..."
    }
  }
}

Data Retention and Storage​

Reports are permanently associated with the image build record. Even if the underlying cloud image (AMI, VHD, etc.) is deleted, the compliance and inventory data remains available in ImageFactory for historical auditing purposes.

Compliance at the Distribution Level​

In addition to image-specific reports, ImageFactory aggregates compliance data at the distribution level. This allows administrators to see the average compliance score for all images built using a particular OS (e.g., "What is the average Level 1 score for all Ubuntu 22.04 images?"). This data is stored in the compliance_score field of the distribution object.