How to get a detailed report?

[obones]

Hello

I have run a recon pipeline and used the "Generate report" button under the reports section which gave me a summary of the findings, nice looking with pretty graphs.

But what I'm missing here is a detailed explanation of the individual issues, or family of issues.
For instance it tells me that I have dom.sink problems, or 3 unvalidated debug flags issues and a few others.

How can I get a report that gives me details about each one of those, along with justification of the threat level and suggestions for fixes?

[muhammadmobi]

The details live in the report's 4. Findings section, and that section is only filled once CypherFix triage has run. Before that it only says "No remediation findings have been generated yet. Run CypherFix triage to generate prioritized findings." (reportTemplate.ts#L819-L829). Section 5 ("Other Vulnerability Details") only lists the raw rows: name, severity, CVSS, host.

To get per-issue details:

1. Open the project's Red Zone → CypherFix tab → Start Triage (docs). Triage scores every finding, groups the ones that share a fix, and writes one fix item per group. You don't need the GitHub token for this step. That's only for the CodeFix agent that opens PRs.
2. For explanations rather than standard wording, pick a Triage review model in Global Settings → LLM Providers → Models by feature, and keep "Priority Board: findings the AI reviews" above 0. At 0 the run needs no model, but the fix items get their standard wording (Priority Board docs).
3. Generate the report again. Each finding in section 4 then shows its severity, status, description, affected assets, steps to reproduce, suggested fix and references (reportTemplate.ts#L865-L867). With a Report narratives model set, you also get the risk analysis and the prioritized remediation triage in sections 3 and 11 (Pentest Reports docs).

For the reasoning behind a single finding's priority (its score, the four factors, and the AI's verdict with the quoted evidence), the Priority Board shows that per finding, from the same triage run.

[obones]

Thanks, the key point here is that I had to upgrade to version 6.24 as those settings were missing in the 6.21 that I had before.

After this, I do get nice wording and explanations.

I also went to the priority board, and clicked on one of the findings, but I can't say its content is helpful:

I mean, the affected asset says 1 but the list is empty, and the evidence does not seem to match the issue itself as I can't see any comment inside it.

[muhammadmobi]

Glad 6.24 sorted out the wording. The two things in your screenshot have different causes:

Empty "Affected assets (1)" row: a display bug. Triage stores a fix item's affected assets as plain hostnames (remediation.py#L202). The fix-item panel expects objects and prints asset.type and asset.name (EvidenceSection.tsx#L32-L35). A string has neither, so the count is right but the row is blank. The generated report prints the hostname correctly, so check it there for now. It's worth opening an issue with these two links.

Raw evidence without the comment: that's the AI reviewer's quote, not the finding's full evidence. A fix item shows the evidence_quote from the first grouped finding that has one (remediation.py#L174-L181). The quote is only checked to be at least 8 characters long and to appear somewhere in that finding's evidence (review.py#L209-L217), not to show the comment itself. So the model can quote the code around it, which is what happened here. To see the actual comments, open the individual findings on the Priority Board. Each finding's panel loads the full evidence the reviewer read (Priority Board docs).

(Checked against the current source, v6.26.1. Neither part has changed since 6.24.)