Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/morwn/github-threat-detector/llms.txt

Use this file to discover all available pages before exploring further.

The report command reads the findings table written by analyze and presents results either as a color-coded terminal table or as a JSON array suitable for programmatic consumption. Filters for severity, repository, and time window let you narrow the output to exactly what is relevant for a given investigation or automated alert pipeline.

​
Usage

python cli.py report [OPTIONS]

​
Options

​
--severity
string
Comma-separated severity levels to include. Accepted values: critical, high, medium, low. When omitted, findings of all severities are returned.Example: --severity critical,high
​
--repos
string
Filter findings to a single repository in owner/repo format. When omitted, findings across all repositories are returned.
​
--since
string
Limit results to findings created on or after a given point in time. Accepts three formats:
  • 7d — the last 7 days
  • 24h — the last 24 hours
  • ISO 8601 timestamp — e.g. 2025-01-15T00:00:00+00:00
When omitted, all findings are returned regardless of age.
​
--format
string
default:"table"
Output format. Choose table (default) for a color-coded terminal table rendered by Rich, or json to emit a JSON array to stdout.Accepted values: table, json

​
Examples

Show all findings as a terminal table (default): 
python cli.py report
Show only critical and high findings: 
python cli.py report --severity critical,high
Show findings from the last 7 days for a single repository: 
python cli.py report --since 7d --repos aquasecurity/trivy
Show findings from the last 24 hours: 
python cli.py report --since 24h
Show findings since a specific timestamp: 
python cli.py report --since 2025-01-15T00:00:00+00:00
Output as JSON for scripting or SIEM ingestion: 
python cli.py report --format json

​
Output Formats

​
Table Output

The terminal table is rendered by Rich with rounded borders and per-row lines. Severity cells are color-coded:
SeverityColor
criticalBold red
highRed
mediumYellow
lowGreen
Columns displayed: ID, Severity, Rule, Repo, Actor, Description, When. 
╭──────┬────────────┬──────────────────────────────┬─────────────────────────────────────┬────────────────────────┬──────────────────────────────────────────────────────────────────────────┬─────────────────────╮
│ ID   │ Severity   │ Rule                         │ Repo                                │ Actor                  │ Description                                                              │ When                │
├──────┼────────────┼──────────────────────────────┼─────────────────────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────────────────┼─────────────────────┤
│ 42   │ critical   │ pr-target-abuse              │ aquasecurity/trivy                  │ hackerbot-claw         │ Fork PR opened by hackerbot-claw -- potential pull_request_target        │ 2025-02-28 03:28:05 │
│      │            │                              │                                     │                        │ privilege escalation                                                     │                     │
├──────┼────────────┼──────────────────────────────┼─────────────────────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────────────────┼─────────────────────┤
│ 43   │ high       │ workflow-file-change         │ aquasecurity/trivy                  │ dependency-updater     │ Workflow file .github/workflows/release.yml modified by dependency-       │ 2025-02-28 04:10:22 │
│      │            │                              │                                     │                        │ updater                                                                  │                     │
├──────┼────────────┼──────────────────────────────┼─────────────────────────────────────┼────────────────────────┼──────────────────────────────────────────────────────────────────────────┼─────────────────────┤
│ 44   │ medium     │ fork-spike                   │ kubernetes/kubernetes               │                        │ Fork count increased by 312 in under 10 minutes                          │ 2025-02-28 11:45:00 │
╰──────┴────────────┴──────────────────────────────┴─────────────────────────────────────┴────────────────────────┴──────────────────────────────────────────────────────────────────────────┴─────────────────────╯

Total: 3 finding(s)

​
JSON Output

When --format json is passed, report prints a JSON array to stdout. Each element is a finding object with the following fields:
FieldTypeDescription
idintegerAuto-incremented primary key in the findings table
rule_idstringThe rule that generated this finding (e.g. pr-target-abuse)
severitystringOne of critical, high, medium, low
repo_namestringRepository in owner/repo format
actor_loginstringGitHub username of the actor that triggered the event
event_idstringThe originating GitHub API event ID
descriptionstringHuman-readable summary of the anomaly
evidenceobjectRule-specific JSONB evidence object
created_atstringISO 8601 timestamp of when the finding was written
Example JSON output: 
[
  {
    "id": 42,
    "rule_id": "pr-target-abuse",
    "severity": "critical",
    "repo_name": "aquasecurity/trivy",
    "actor_login": "hackerbot-claw",
    "event_id": "12345678901",
    "description": "Fork PR opened by hackerbot-claw -- potential pull_request_target privilege escalation",
    "evidence": {
      "pr_number": 10254,
      "head_repo": "hackerbot-claw/trivy",
      "created_at": "2025-02-28T03:28:00+00:00"
    },
    "created_at": "2025-02-28T03:28:05.123456+00:00"
  }
]
The JSON output is written to stdout via click.echo, making it straightforward to pipe into tools like jq, forward to a SIEM, or process in a downstream script: 
python cli.py report --format json --severity critical | jq '.[].actor_login'

Build docs developers (and LLMs) love

Get started for freeTalk to us