SIS CLI

Report Guide

This guide explains when to use sis report instead of sis scan --format json or sis query.

When to use report

Use sis report when you need:

• a durable human-readable investigation summary
• a report file for analyst hand-off
• a curated view of findings, chains, and verdict context

Use sis scan --format json when you need machine-stable raw analysis output. Use sis query when you need one specific slice rather than a full narrative report.

Command shape

sis report <input> [options]

Common examples:

sis report sample.docx
sis report sample.hta --deep --format markdown --out report.md
sis report sample.one --deep --format json --out report.json
sis report sample.pdf --format yaml

Output formats

• markdown: best for analyst review and hand-off
• json: best when downstream tooling wants full report structure as a structured report object
• yaml: useful for ad hoc inspection and configuration-adjacent workflows

Key controls

• --deep to align the report with deep-analysis triage
• --report-verbosity compact|standard|verbose to tune detail level
• --report-chain-summary minimal|events|full to control chain expansion
• --out <path> to write the report to disk
• --config <path> on the scan surface if a specific runtime policy or config must be reproduced

Choosing between scan, query, and report

• scan: canonical detector pipeline and machine output
• query: one forensic slice, count, or filtered view
• report: full operator-facing summary

Typical sequence:

1. sis scan <sample> --deep --format json
2. sis query findings <sample> --format json
3. sis report <sample> --deep --format markdown --out report.md
4. sis explain finding <sample> <finding-id> for the most important findings

Investigation notes

• report reanalyses; it is not a projection of a saved scan. It has no explicit --config flag. Use query --from-report for supported saved-result projections.
• Prefer markdown for hand-offs and case-study drafting.
• Prefer json if another tool needs the report body but not the scan wrapper.

Related guides

• sis docs investigate
• sis docs explain
• sis docs query