Post-Scan Tools

Once a session exists, a family of CLIs analyze the findings, raise notifications, track remediation, benchmark against peers, and map results to compliance frameworks. Most of them default to the latest session and read the structured session_results.json described in Session Data.

Scan Diff

scripts/scan_diff.sh compares two sessions to detect new, resolved, and changed findings. Its exit code makes it suitable for CI and automated alerting.

scan_diff.sh [options]

Session Selection:
  --current <file>    Current session JSON
  --prior <file>      Prior session JSON to compare against
  --latest            Use the most recent session (default)

Output:
  --json              Output the diff as JSON (for scripting)
  --quiet             Print a single summary line only

Options:
  -h, --help          Show help

Exit codes: 0 when there are no new critical or high findings, and 2 when new critical or high severity findings appear. A non-zero exit is the signal to page someone.

# Compare the latest two sessions
./scripts/scan_diff.sh --latest

# Machine-readable diff for a pipeline step
./scripts/scan_diff.sh --current new.json --prior old.json --json

The recon pipeline can run this automatically with its --diff flag; see Recon Pipeline.

Alert Notifications

scripts/alert_notifier.sh sends multi-channel alerts (email, Slack, and generic webhook) based on scan results and configurable thresholds.

alert_notifier.sh [options]

Required (one of):
  -s, --session <file>   Session JSON file
  --latest               Use the most recent session

Options:
  -c, --config <file>    Config file with ALERT_* settings
  --test                 Send a test alert to all configured channels
  --dry-run              Show what would be sent without sending
  -h, --help             Show help

Channels and thresholds are configured through ALERT_* variables in the config file. Use --test to confirm channel wiring before relying on automated alerts. The full configuration reference lives in Alert Notifications.

# Alert on the latest session using a config file
./scripts/alert_notifier.sh --latest -c ~/netvuln-tool/configs/client.conf

# Verify all channels are wired up
./scripts/alert_notifier.sh --test -c ~/netvuln-tool/configs/client.conf

Remediation Update

scripts/remediation_update.sh changes remediation status and notes for individual findings, and manages formally accepted risk exceptions.

remediation_update.sh [options]

Session Selection:
  --latest                   Use the most recent session
  -S, --session <dir>        Session directory path

Actions:
  -l, --list                 List remediation items with status
  -s, --set <idx> <status>   Set status (new, in_progress, resolved, deferred, persistent)
  -n, --note <idx> <text>    Add or update a note for an item

Exception Management:
  -a, --accept <idx>         Accept risk for an item (mark it an exception)
      --reason <text>        Justification (required with --accept)
      --approver <name>      Who approved (required with --accept)
      --expiry <YYYY-MM-DD>  Exception expiry date (optional)
  -r, --revoke <idx>         Revoke the exception on an item

Status values

Status	Meaning
new	Newly discovered finding (default)
in_progress	Remediation work underway
resolved	Finding has been remediated
deferred	Remediation postponed
persistent	Known issue, accepted as ongoing

Exceptions

--accept marks a finding as a formally accepted risk and requires both --reason and --approver so there is an audit trail. --expiry optionally sets a review date. --revoke removes the exception. Exceptions are carried forward across sessions by remediation_tracker.sh and surface in the portal's Risk Register.

# List items with their current status
./scripts/remediation_update.sh --latest --list

# Mark item 3 as in progress with a note
./scripts/remediation_update.sh --latest -s 3 in_progress -n 3 "Patch scheduled for next window"

# Accept risk on item 5 with an expiry
./scripts/remediation_update.sh --latest -a 5 \
    --reason "Compensating control in place" --approver "J. Smith" --expiry 2026-12-31

Scan Reminder

scripts/scan_reminder.sh checks sessions for approaching or passed report expiration and can email reminders.

scan_reminder.sh -c <config.conf> [options]

Required:
  -c <file>         Report config file

Options:
  --send-email      Send email reminders for expiring or expired reports
  --dry-run         Show what would be sent without sending
  -h, --help        Show help

Relevant config settings: REPORT_VALIDITY_DAYS (default 30), REMINDER_DAYS_BEFORE (default 7), REMINDER_EMAIL, and REMINDER_FROM.

# Check expiration status for all sessions
./scripts/scan_reminder.sh -c ~/netvuln-tool/configs/client.conf

# Send reminders for reports nearing expiry
./scripts/scan_reminder.sh -c ~/netvuln-tool/configs/client.conf --send-email

Benchmark Compare

scripts/benchmark_compare.sh fetches comparative benchmark data from the portal so a client's posture can be shown against anonymized peers.

benchmark_compare.sh -c <config.conf> [options]

Required:
  -c <file>         Report config file (must have CONSULTATION_API_URL and key)

Session Selection (pick one):
  -s <session_dir>  Session directory containing session_results.json
  -i <session_id>   Session ID (format YYYYMMDD_HHMMSS)
  --latest          Use the most recent session (default)

Options:
  --dry-run         Show what would be fetched without making API calls
  -h, --help        Show help

Set BENCHMARK_ENABLED="true" in the config to benchmark automatically after each upload.

./scripts/benchmark_compare.sh -c ~/netvuln-tool/configs/client.conf --latest
./scripts/benchmark_compare.sh -c ~/netvuln-tool/configs/client.conf -i 20260226_120000

Compliance Mapper

scripts/compliance_mapper.sh maps scan findings to compliance framework controls (CIS Controls v8, NIST CSF, PCI-DSS v4.0, SOC 2, and Ohio ORC 9.64). It runs as a pipeline reporting module and can also be invoked standalone against a session JSON.

./scripts/compliance_mapper.sh ~/netvuln-tool/sessions/20260224_120000/session_results.json

The mapped data is embedded in the report and extracted by the portal's compliance panel. For the control mappings themselves, see Compliance Mapping.

Network Topology

scripts/network_topology.sh derives network topology data (hosts, hop distances, and relationships) from scan results for the report's topology visualization. Like the compliance mapper, it runs inside the pipeline and can be invoked standalone.

./scripts/network_topology.sh ~/netvuln-tool/sessions/20260224_120000/session_results.json