Skip to main content

Reports: Metric Reference

This page is the source of truth for the in-app Explain this panels on Reports (/reports) and the request flow at /reports/view for Security, Per-Instance Scorecard, and Data Inventory. Each section is written once as a content partial under _explain/reports/ and rendered both here and inside the app's info panel (scripts/build-explain.mjs compiles the registry).

Catalog cards that only show on-screen mock data (Performance & SLA Summary, Alerts Summary, Daily Operations Digest) are not documented here as available products.

Catalog of point-in-time reports across posture, security, compliance, performance, and operations.

How it's calculated​

  • Cards come from the app catalog (lib/reports/catalog.ts), grouped into five categories: Posture, Security, Compliance, Performance, Operations.
  • Each card shows audience · cadence, a short description, format chips (PDF / CSV), and an optional Email chip when delivery is async.
  • Request opens a form for server-built PDFs (no on-screen body). Open is for on-screen previews that are not requestable yet.
  • The surface is marked Beta.

Reading it​

Prefer Request cards for audit-ready PDFs delivered by email and in-app download. Catalog entries without async delivery are design previews — they are not generated by the report pipeline.

Request a report​

Ask for a PDF built in the background and emailed as a download link that works for 30 days.

How it's calculated​

  • POST /api/v1/reports with a ReportKind and scope parameters. The requester is always a recipient; extras come from the org member list (max 20 people including the requester).
  • Security and Data Inventory accept optional multi-instance filters (max 100 ids). Per-Instance Scorecard requires one instance, optional one database, and a from / to window (presets Last 7 / Last 30 days, or custom up to 31 days).
  • Generation is asynchronous. Status moves Queued → Building (Processing) → Ready or Failed. The email link and in-app download expire after the org retention window (default 30 days).

Reading it​

Share the pre-filled request URL — scope lives in query params. If an identical request is already building, the API reuses it instead of starting a duplicate.

Recent requests​

Every report request for this kind across the organization, newest first.

How it's calculated​

  • GET /api/v1/reports?kind=… pages of 20. Rows include requester, server-built scope label, recipient count, status, and download URL when Ready.
  • Statuses: Queued, Building (Processing), Ready, Failed, Expired. The table polls about every 5 seconds while any row is still Queued or Building.
  • Download uses the authenticated export tray while the request is Ready and not expired. Failed rows show the backend error code message.

Reading it​

Org-wide on purpose — someone else's in-flight copy is why you may see a deduped "already being built" confirmation on Request. Empty state means nobody in the org has requested this kind yet.

Security​

Engine versions and known vulnerabilities, support status, security findings, privileged accounts, and a remediation plan across active instances.

How it's calculated​

  • Backend kind Security. PDF sections: Summary, Versions and known vulnerabilities, Security findings, Privileged accounts, Remediation plan, Coverage and methodology, plus a CVE appendix.
  • Snapshot at generation time — there is no date-range picker. Optional multi-instance filter; empty scope means all active instances (inactive servers are counted but not assessed).
  • Delivered only as an emailed / downloadable PDF — this page shows the request form and history, not an on-screen report body.

Reading it​

Use empty scope for a full active-estate pass; narrow instances when you need a focused remediation pack. Foreign or invalid instance ids are rejected at create time.

Per-Instance Scorecard​

A single-instance health report over a chosen date range, computed from continuous monitoring (no separate health-check run required).

How it's calculated​

  • Backend kind InstanceScorecard. PDF sections include Overall health, Resource utilization, Alert history, Remediation plan, Recommendations, and Detailed results (Performance, Security, Configuration, Schema, Maintenance).
  • Requires exactly one instance; optional one database on that instance. Time window: Past 7 days, Past 30 days, or a custom range of at most 31 days (from / to UTC, floored to the minute at request time).
  • Async PDF delivery only — request form + history on this page.

Reading it​

Default landing window is Past 30 days. Database-scoped reports still include instance-wide findings in the score where the backend notes that. Ranges wider than 31 days are refused.

Data Inventory​

Where sensitive data lives right now: classification KPIs, sensitive tables by category, encryption coverage, and a risk-scored register.

How it's calculated​

  • Backend kind DataInventory. PDF sections: Summary (tables with PII, high-risk, unencrypted, classification coverage), Sensitive tables by category, Encryption coverage, Exceptions worklist, Risk register, Coverage and methodology.
  • Snapshot as of generation — no time chip. Optional multi-instance filter; empty means organization-wide. Classification currently covers PostgreSQL and SQL Server; encryption status focuses on SQL Server TDE.
  • Async PDF delivery only — request form + history on this page.

Reading it​

Fails when no completed classification exists in scope. Prefer org-wide for auditor packs; narrow instances when remediating a single estate slice.