Posture reports
A target's Detection posture over a period — what changed, what is still open, and how its Tests ran.
A posture report answers "what did this target's detection coverage look like over the period, and what changed?" for one target, over whole days. You can build one on demand, save it as a frozen copy, or have one sent on a schedule.
Every member can build, save, and download reports.
Build a report
Open a target and choose Reports in the sidebar. The Report tab builds a live report for the period you pick:
- Last 7 days (the default), Last 30 days, Previous week, Previous month, or Custom with a First day and Last day.
- A Timezone — your own by default. Days start and end at midnight in it, and both the first and last day are included in full.
A period can span up to 366 days and cannot end after today. It can reach back as far as your workspace keeps history; an earlier start is rejected with the date history is kept from.
What a report contains
| Section | What it shows |
|---|---|
| Posture | Detection counts at the start and end of the period, with the change: active, covered, active but not covered, passing, failing, stale, not scored — plus Coverage and Health |
| Detection changes | Detections that regressed (and whether they recovered within the period), failed for the first time, lost coverage, went stale, recovered, passed for the first time, or gained coverage — each with when it first happened |
| Open issues at period end | Detections still failing or stale when the period ended, and since when |
| Change log | The changes recorded in the period, as in the target's Activity, most severe first. Filter to Needs attention to see only those that need action |
| Run activity | Suite runs and Test runs by outcome, and the Tests that went stale |
Coverage is the share of Detections covered by a Test; inactive Detections count only when they are covered. Health is the share of covered Detections that are passing. Detections removed from your SIEM are left out of both.
Detection changes and change-log entries link to the target's Activity.
Posture as recorded
A report shows posture as Tracemill recorded it at the time. Each change is reported in the period in which it was recorded. When a change was recorded after the moment it happened — for example, a Test noticed as stale only after the period ended — it appears in the next period's report, marked Recorded late — occurred date. Changes recorded later therefore never revise an ended period. A live report is still built from the target's history, so resetting the target, or the period passing out of history retention, changes what it shows — save a report to keep a frozen copy.
Notices
| Notice | Meaning |
|---|---|
| Partial | The period has not ended yet, or changes from its last moments were still being recorded, so its figures can still change |
| Approximate | Some Detections' state was repaired after the fact rather than recorded as it changed; the notice says how many |
| No start state | Detection history does not reach back to the start of the period, so start figures and changes are not shown. The change log and run activity are still shown |
Save a report
Save report keeps a frozen copy of the live report and opens it. Saved reports:
- live in the workspace Reports list in the sidebar, alongside scheduled reports, showing the period, target, origin (On demand or Scheduled), and who saved it;
- never change, and are kept until someone deletes them — including after the target is archived or reset;
- can be downloaded with Download CSV.
The target's Saved tab lists the saved and scheduled reports for that target.
CSV
The CSV has one row per Detection change and per open issue, with the Detection's name and identifier, the change or posture, when it first happened and was recorded, and its start and end posture. Posture totals, the change log, and run activity are not included; print the report for those.
Print or PDF
Print opens your browser's print dialog with a print layout; choose Save as PDF there for a PDF copy.
Delete
Deleting a saved report removes it for everyone in the workspace, along with the delivery history of any message that sent it. The member who saved a report can delete it; owners and admins can delete any report, including scheduled ones.
Scheduled reports
A scheduled report is generated for each completed week or month and stored in the Reports list; the email or chat message links to it. See Alerts and digests for how to schedule one.