Report Templates: Different Fields and Layouts per Engagement

Most testing firms write more than one kind of report. A partner who passes you work wants it in their own layout, under their name, with the fields their report has always had. Your own work differs too: a cloud review may carry a section an internal infrastructure test has no use for. In Pental each Word template you upload for the report is a report: an engagement is created on one, its DOCX download button makes it, and the finding fields and assessment sections the engagement shows are the ones it prints, read from its placeholders as it goes up. Other Word files of the same report, a retest layout or a summary, are its versions, in the menu beside that button.

Your reports, in Settings

They are in Settings, Documents, on the report’s row, each a card. The first is your Default, made with the Word file you uploaded first, and then each report of your own. Each card says what it does: whether engagements are created on it or it is Offered when an engagement is created, how many finding fields and assessment sections it sets, and that it is On the DOCX download button. Under it are its versions, In the dropdown beside that button.

123456Full size

Calderwood SecurityTheir team, setting up their reportsDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

Uploading a report

1. Open Settings, Documents. With no Word file for the report yet, the row says Upload your report: choose the .docx of the report you send, or drop it on the area. It is your Default, and your finding fields and assessment sections are set to the ones it prints at once.
2. For a partner’s report, or another kind of work, use Upload another report in the same place. It becomes a report of its own there and then, named after its file, with exactly the fields and sections it prints, and its engagements’ report is made with it. Nothing is asked.
3. What changes is said as it is made, for example “CWE and References off, Retest Summary on”, and pressing the message puts everything back as it was.

Fields are read by Pental’s placeholders, the ones the report’s Placeholders lists and the Document Builder places, by any of them a field or section is printed with: References as a list of links counts as much as References in a sentence. A file that prints no finding field by name leaves the fields as they are, and one that prints no section by name leaves the sections, so a layout of its own is never taken for one that wants everything off. Retest Summary, Notes and sections of your own, which Pental puts in after the executive summary where a file has no place for them, are never switched off by a file that does not name them, and neither are Findings or the working areas no report prints, such as Credentials and Files. Artifacts is read by {artifacts_text} and its family, and the Severity Summary by the counts and the chart. Nothing written is deleted by a field going: a field switched off keeps what was written in it, and comes back with it when it is switched on again.

Where a report’s lists and its Word file disagree, for a report set up before its file or changed since, its lists say what would match the file over them, with Match it. A field or section ticked On that its Word file has no placeholder for stays on its engagements and out of its report.

A report without a Word file of its own, for a kind of work that needs other fields on Pental’s own PDF, is Or one without a Word file: it starts as a copy of your Default, and Upload its Word file on its card gives it one later.

Versions in the menu beside the button

Add a version under a report uploads another Word file of it. Its engagements’ DOCX download button still makes the report’s own file, and the version is in the dropdown beside it, which counts what is behind the arrow, +1 for one version, the same way it counts the PDFs filed with a report. A version changes no fields: the report decides those.

123Full size

Calderwood SecurityTheir team, on an engagementDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

On a version, the star makes it the report’s main file, and the main one becomes a version; the report’s fields and sections follow its new file. Replace on any file uploads a new copy of it, keeping its name and its place, and a report’s main file replaced sets its fields and sections again. Delete on a version takes it out of the menu.

What a report holds

Edit on a report’s card opens it there, your Default’s too, and every report has the same three tabs: what an engagement on it differs by. Press Save template (on the Default, Save the Default) when you are done, or Discard changes. A report is renamed with the pencil on its card.

What a field is, its type, its choices and its AI prompt, is shared by every report and changed under Settings, Finding Fields, as a section is under Assessment Sections, so a field means the same thing wherever it appears and the findings library serves them all. Its AI prompt is under it in every report’s list too: every report uses the one in Settings until its prompt is changed in its own list, which makes the change that report’s own, the one its engagements are written with, and Settings’ list names the reports with their own. Tick Change it for every report that has it and it is every report’s instead, any report’s own replaced, and Use the shared prompt puts a report back on the one in Settings. With only your Default, a change in its list is the one in Settings. A field or section you add in a report’s list, with Add field or Add section, gets its prompt there as you add it. Those two lists hold every field and section your reports can use, each with the reports that use it under Used by, and over each list a button for every report opens its own list right there. A name left empty in a report is the field’s own name. Delete on a report’s card says first how many engagements use it, which go back to your Default; its Word file and its versions go with it.

Choosing it for an engagement

Once you have a second report, New Assessment has a Report choice, your Default picked by its report’s name, and the sections offered for filling in as you create it follow whichever you choose. A copy of an engagement keeps its report. If you make engagements from your own tools, the Pental API takes a report’s id, shown on its card, as p_report_template.

1Full size

Calderwood SecurityTheir team, creating an engagementDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

Changing an engagement’s report

An engagement’s header shows which report it uses. Pressing it opens Report, and choosing another shows what would change before anything does:

• the finding fields it would put away, and how many findings have each written in;
• the fields it adds, and the ones it names differently;
• any field it requires that is still empty, and on how many findings, which show as drafts until it is filled;
• the sections it puts away, adds or renames, the Word file the report would be made with, and the severity names that change.

Where something is written in a field or section the new report does not show, the change asks where it goes. Left as kept aside, and back if it moves back, it stays on the finding, out of sight and out of the report, and is back if the engagement moves back. Set to added to a field the new report shows, such as Description, its words are added to that field on every finding that has them, under their own field’s name where that field had words already, and empties the old one. A report section’s words go to another of its sections the same way. Words go into a field or section that holds rich text, plain words as the words they are; a choice, a date, a score or the evidence is kept aside.

12Full size

Calderwood SecurityTheir team, moving an engagement to another reportDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

Use this report moves it, and what was written goes where you chose. A finding that cannot be written at that moment keeps its words where they were, kept aside, and the message says on how many.

Its reports and letters

Pental’s own PDF carries the report’s severity names, and its severity scale lists the levels the report offers, with any level a finding on it is already at. Every document carries your firm’s own name and details, from Settings, Company and Branding, wherever it asks for them, and a Word template its own logo and colours: a partner’s look is their Word file’s. A field the report does not have is printed nowhere, in Pental’s PDF or in a Word file, even if a finding still holds a value for it.

A report’s Word file and its versions are its own: your Default is never made with them, and engagements on other reports are not offered them. For the letter, picked under Its letter of attestation on the report’s card, a Word file your Default makes its letters with asks whose it is: The Default’s too keeps your Default using it, and This template’s alone hands the Default your next one, or Pental’s own PDF where there is none.

A report’s card also has Download a draft with its placeholders, a ready-made Word file of placeholders under the report’s names, its own fields included, to build a layout on, and Build its Word file with the Document Builder. A report with no Word file of its own says there how it is made until it has one: like the Default, or with Pental’s own PDF. The builder then says which template it is building for, offers that report’s fields, keeps a field it makes on that report alone, and saves the result as that report’s Word file, its fields and sections set to what it prints, with Build for the Default instead if you wanted your own. Making your Word template the one Pental fills covers the builder itself.

Severity under other names

Counts, charts and filters work on the same five levels whatever a report calls them, so a report that calls informational findings Note still counts them with everybody else’s. A report that does not offer Critical keeps it off the choices on a finding, but a CVSS score still sets the rating: a score of 9.0 or more gives Critical on any report. Penetration testing severity levels covers choosing a scale.

Who sees what

A client sees an engagement’s fields, sections and severity names as its report sets them, and never which report it is. A contractor sees which report their engagement uses and cannot change it: that is the firm’s to choose, and a contractor’s new engagement starts on the Default.

Doing overflow work for another consultancy? Reporting in another consultancy’s Word template walks through setting up a report for them, and what white-labelling actually buys a testing firm is worth a read on reports that carry somebody else’s name. Creating reports from your existing Word templates walks through all of it step by step, with a partner’s report beside your own.