JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.
If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.
If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.
| CodeSonar® 9.2p0 | CONFIDENTIAL | CodeSecure Inc |
Management Reports provide user-customizable overviews of information from the CodeSonar hub in a variety of formats.
Management report templates are securable resources.
Management Reports are available for all analyses, independent of the language or languages involved.
Management report functionality is available in the Reports sections of the GUI Home / Project Tree, Analysis, and Project pages.
The following annotated screenshot fragment shows the different parts of the expanded Reports section.
| menu of templates |
Use this menu to select a template for editing or generating a
report. The menu lists:
|
|---|---|
| edit link | Click to edit the selected template. |
| new link | Click to create a new template. |
| permissions link | Click to navigate to the Report Template Role-Permissions page for the selected template. (The link will be greyed out if you do not have permission to access this page.) |
| view ... report links | Click to generate a report based on the selected template. See Generating Reports for information about the available report formats. |
| show ... options links | For HTML and PDF reports, choose formatting options before generating a report. See Generating Reports for information about the available options. |
Each management report template is associated with one or more scopes. These scopes determine the set of information that will be included in the report, and which page or pages the template will be available from.
| Template Scope | Template Availability | Generated Report Contains [*] |
|---|---|---|
| Analysis | Analysis | Information from a single analysis, including all warnings and files from that analysis. |
| Project | Project | Information from a single project, including all analyses of that project. |
| Latest Analyses | Home | Information from the most recent analysis of every project on the hub. |
| All Analyses | Home | Information from every analysis of every project on the hub. |
[*] The report contents can be refined from the starting points shown in this table by applying additional constraints to each report element, as described in the following section.
A report can contain multiple elements from any of several categories.
Arbitrary text (which may include metavariables) can be included throughout the report. The management report template editor provides a range of available formats; text elements are edited using the text editing dialog.
As with tables in the CodeSonar GUI, tables in management reports present summaries of various hub information along with hyperlinks to corresponding search results.
The management report template editor provides a range of predefined tables. Functionality for customizing tables is provided by the table editing dialog, including:
Metavariables can be used in table titles, and in constraints specified on the rows and columns of the table.
As with charts in the CodeSonar GUI, tables in management reports present graphical summaries of various hub information along with hyperlinks to corresponding search results.
The management report template editor provides two predefined charts. Functionality for customizing charts is provided by the chart editing dialog, including:
Metavariables can be used in charts titles, and in constraints specified on the chart data in the search tab of the chart editing dialog.
One of the main building blocks of the management report tool is the repeating section (or just "section"). A repeating section in a report template defines structure and content for describing the properties of a single CodeSonar artifact: for example, one file, one analysis, or one project. When it generates a report from the template, CodeSonar will iterate over the set of files (analyses, projects) associated with the section, producing one instance of the templated section for each. By default, all files (analyses, projects) in the enclosing scope are iterated over: use the iterations tab of the section editing dialog to specify a different set. (For non-nested sections, the enclosing scope is the scope of the report; otherwise it is the scope of the section that is the immediate parent.)
Sections can contain any combination of report elements, including other sections. For example, a report could contain a repeating section that iterates over every analysis of a project, nested inside a repeating section that iterates over every project on the hub.
The management report template editor provides functionality for adding sections to a report template; functionality for customizing sections is provided by the section editing dialog.
Every section has a section metavariable that is available inside the section (including in any sections nested inside it)
We use the following terminology.
| section type | the kind of artifact that is being iterated over. The most common section types are file, analysis, and project; these are available directly from the report elements menu. Other section types can be selected in the section type tab of the section editing dialog. |
|---|---|
| section type property | a basic property associated with the section type. For example, file properties include basename and language, file-granularity metrics, the analysis in which the file was analyzed, and the number of warnings issued in the file. |
| section property |
a property that
|
| repeating file section (repeating analysis section, repeating project section) |
a repeating section whose section
type is file (analysis, project). May also be referred to as
"file section" ("analysis section",
"project section"). |
| section iteration | a single concrete instantiation of the section structure with information from a specific file (analysis, project). |
Elements that do not fall into one of the previous categories are grouped under "Other" in the report elements menu of the management report template editor:
Management report elements can make use of metavariables. These metavariables are referred to by name in report templates, then instantiated to concrete values when reports are generated.
The global metavariables are available at all locations in the report template.
| Metavariable | Interpretation | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| {{AUTHOR}} | The username of the signed-in user who generated the report. If the report was generated in an anonymous session, defaults to "None". | ||||||||
| {{DATE}} | The date and time at which the report was generated, using the date display format specified for the hub. | ||||||||
| {{CSO_VERSION}} | The version number of the CodeSonar installation that the hub is using. | ||||||||
| {{CSO_LICENSEE}} | The entity to whom the CodeSonar installation is licensed. | ||||||||
| {{F()}} | A counter intended for use in chart ("figure") titles: starts at 1 and increments by 1 each time it is used. | ||||||||
| {{REPORT_SCOPE}} |
The scope in which the report was generated. The possible
values are as follows.
|
||||||||
| {{S()}} | A counter intended for use in section titles: value starts at 1 and increments by 1 each time it is used. | ||||||||
| {{T()}} | A counter intended for use in table titles: value starts at 1 and increments by 1 each time it is used. | ||||||||
| {{VAR}} | Provides a mechanism for users to define and use custom metavariables. For some usage examples, see the predefined Project Report template. |
For example, suppose a report template with project scope had the following paragraph text.
CodeSonar Hub Report
Generated by {{AUTHOR}}, on {{DATE}},
showing analyses for {{REPORT_SCOPE}},
using CodeSonar {{CSO_VERSION}}, licensed to {{CSO_LICENSEE}}
Then if user alex generates a report from this template, the corresponding report text will be (something) like the following.
CodeSonar Hub Report
Generated by alex, on 02/25/14 13:58:30,
showing analyses for pid:5,
using CodeSonar 9.2p0, licensed to Company,
Inc.
Every repeating section has a corresponding section metavariable that is available inside the section (including any included sections).
Section metavariables differ from global metavariables in several respects:
| Repeating Section Type | Section Metavariable Corresponds To |
|---|---|
| File | an analyzed file |
| Analysis | an analysis |
| Project | a project |
For example, suppose a project section included the following paragraph text.
{{project.Name}} has Project ID = {{project.PID}}.
Then if a user generates a report from this template, the corresponding report text will be (something) like the following.
ProjectX has Project ID = 6.
[...]
MyLittleProject has Project ID = 7.
[...]
ProjectX-beta has Project ID = 12.
[...]
(This example uses default project section properties.)
In general terms, a management report is generated by
The process for generating a management report is outlined in Task: Generate a Management Report.
There are various options for disseminating a generated report.
| Method | Applies To | Notes |
|---|---|---|
| URL specification | HTML, PDF, XML |
Generate the report, then copy and paste the URL from your
browser's address bar. The URL format will be
http://hub_location/report/<scope>-<template_id>.<ext>?<option_string>
When distributing the URL for a management report, be aware that:
|
| File saving and electronic distribution | HTML, PDF, XML |
Use your browser's file saving functionality to save the
generated report. (For HTML reports, this will be easiest if
you have generated the report as a single page)
This approach ensures that all readers of the report will see exactly the same contents. |
| Printing and physical distribution | (You can also print HTML and XML reports, but most users will never want to do so) |
| Format | Options | Notes |
|---|---|---|
| XML | none | The XML schema for management reports is report.xsd. |
| HTML |
|
The report includes an Outline sidebar with shortcut links to
each Heading 1, Figure (Chart), and Table.
The generated report provides hypertext navigation to other locations in the CodeSonar GUI. In particular, table rows link to search results, as do chart bars/slices/points. |
|
If your PDF viewer includes an outline tool, the outline will provide shortcut links to each Heading 1, Figure (Chart), and Table. |
A management report template specifies the abstract structure of a report: which elements it will contain, and in what order. Management reports are then generated by applying a template to a selected set of information.
CodeSonar ships with a set of predefined templates, and provides functionality for creating additional templates, editing existing template, and importing and exporting templates.
| Creating Templates | The process is outlined in Task: Create a New Management Report Template. |
|---|---|
| Editing | The process is outlined in Task: Edit an Existing Management Report Template. |
| Importing and Exporting | CodeSonar provides template import/export functionality based on JSON files. Use the Import and Export buttons in the report template editor toolbar to access this functionality. |
CodeSonar provides a set of predefined templates for common reporting scenarios.
Note that the predefined templates are protected from overwriting and are not securable resources. If you wish to make a template based on modifications to one of the predefined templates, specify a different name in order to save it.
| Template Name | Scope | Notes | |
|---|---|---|---|
| Hub Report | All Analyses | A summary table describing all projects on the hub, followed by a repeating project section with analysis summary and metric tables covering recent analyses of each project. | |
| Project Report | Project | Charts and tables summarizing warning counts, file counts, and metrics for recent analyses of the project. | |
| Metrics Over Time Report | Project | Charts showing the values of various analysis-granularity metrics for all analyses of the project. | |
| Analysis Report | Analysis | Charts and tables summarizing warning, file, and metric information for the analysis. | |
Warning Class Category ReportsWarning class category reports summarize analysis results with respect to a particular set of warning categories (typically an entire taxonomy). They contain a section for each category in the set, with
charts and tables describing the analysis warnings whose
warning
classes are closely
mapped to that category. A summary section at the beginning
provides an overview of the analysis alerts and parse log; the
full parse log is displayed at the end of the report. |
|||
| AUTOSAR C++ 2014 Report | Analysis | Analysis warnings related to AUTOSAR AP 18-10 rules (taxonomy AUTOSARC++14). | |
| CERT-C Report | Analysis | Analysis warnings related to rules and recommendations in the SEI CERT C Coding Standard (taxonomy CERT-C). | |
| CERT-C++ Report | Analysis | Analysis warnings related to rules and recommendations in the SEI CERT C++ Coding Standard (taxonomy CERT-CPP). | |
| CERT Java Report | Analysis | Analysis warnings related to rules and recommendations in the SEI CERT Oracle Coding Standard for Java (taxonomy CERT-Java). | |
| CWE Top 25 2025 Report | Analysis | Analysis warnings related to each of the 2025 CWE Top 25 Most Dangerous Software Weaknesses (a subset of the CWE taxonomy). | |
| CWE Top 25 2024 Report | Analysis | Analysis warnings related to each of the 2024 CWE Top 25 Most Dangerous Software Weaknesses (a subset of the CWE taxonomy). | |
| CWE Top 10 KEV Weaknesses 2024 Report | Analysis | Analysis warnings related to each of the 2024 CWE Top 10 KEV Weaknesses (a subset of the CWE taxonomy). | |
| CWE Top 25 2023 Report | Analysis | Analysis warnings related to each of the 2023 CWE Top 25 Most Dangerous Software Weaknesses (a subset of the CWE taxonomy). | |
| CWE Top 25 2022 Report | Analysis | Analysis warnings related to each of the 2022 CWE Top 25 Most Dangerous Software Weaknesses (a subset of the CWE taxonomy). | |
| CWE Top 25 2021 Report | Analysis | Analysis warnings related to each of the 2021 CWE Top 25 Most Dangerous Software Weaknesses (a subset of the CWE taxonomy). | |
| CWE Top 25 2020 Report | Analysis | Analysis warnings related to each of the 2020 CWE Top 25 Most Dangerous Software Weaknesses (a subset of the CWE taxonomy). | |
| DISA v6 r1 Report | Analysis | Analysis warnings related to 'findings' in the DISA Application Security and Development STIG version 6, release 1 (taxonomy DISA-6r1). | |
| DISA v5 r3 Report | Analysis | Analysis warnings related to 'findings' in the DISA Application Security and Development STIG version 5, release 3 (taxonomy DISA-5r3). | |
| DISA v4 r3 Report | Analysis | Analysis warnings related to 'findings' in the DISA Application Security and Development STIG version 4, release 3 (taxonomy DISA-4r3). | |
| DISA v3 r10 Report | Analysis | Analysis warnings related to 'findings' in the DISA Application Security and Development STIG version 3, release 10 (taxonomy DISA-3r10). | |
| ISO IEC TA 17961 Report | Analysis | Analysis warnings related to one or more ISO/IEC TS 17961 rules ("C Secure Coding Rules Technical Specification", taxonomy TS17961). | |
| JPL Report | Analysis | Analysis warnings related to JPL rules (taxonomy JPL). | |
| MISRA C 2025 Report | Analysis | Analysis warnings related to MISRA C:2025 rules and directives (taxonomy MisraC2025). | |
| MISRA C 2023 Report | Analysis | Analysis warnings related to MISRA C:2023 rules and directives (taxonomy MisraC2023). | |
| MISRA C 2012 Report | Analysis | Analysis warnings related to MISRA C:2012 rules and directives (taxonomy Misra2012). | |
| MISRA C 2004 Report | Analysis | Analysis warnings related to MISRA C:2004 rules (taxonomy Misra2004). | |
| MISRA C++ 2023 Report | Analysis | Analysis warnings related to MISRA C++:2023 rules (taxonomy MisraC++2023). | |
| MISRA C++ 2008 Report | Analysis | Analysis warnings related to MISRA C++:2008 rules (taxonomy MisraC++2008). | |
| OWASP Top Ten 2025 Report | Analysis | Analysis warnings related to the OWASP Top 10 2025 (taxonomy OWASP-2025). | |
| OWASP Top Ten 2021 Report | Analysis | Analysis warnings related to the OWASP Top 10 2021 (taxonomy OWASP-2021). | |
| OWASP Top Ten 2017 Report | Analysis | Analysis warnings related to the OWASP Top Ten 2017 (taxonomy OWASP-2017). | |
| Power of 10 Report | Analysis | Analysis warnings related to "Power of Ten" rules (taxonomy POW10). | |
Warning Class Category Severity ReportsWarning class category severity reports summarize analysis results with respect to a particular set of warning categories (typically an entire taxonomy), but with a little more detail than warning class category reports. The report is divided into sections by severity
category (as specified by the corresponding standard or
rule set), then into subsections for each category that has one
or more closely mapped CodeSonar warning classes. These
subsections contain information about the category and its
related warning classes, along with a (possibly-empty) table
containing warnings of those classes that were issued by the
analysis. A summary at the top of the report lists the number of
warnings reported in each severity category. |
|||
| DISA v6 r1 Severity Report | Analysis | Severity report for 'findings' in the DISA Application Security and Development STIG version 6, release 1 (taxonomy DISA-6r1). | |
| DISA v5 r3 Severity Report | Analysis | Severity report for 'findings' in the DISA Application Security and Development STIG version 5, release 3 (taxonomy DISA-5r3). | |
| DISA v4 r3 Severity Report | Analysis | Severity report for 'findings' in the DISA Application Security and Development STIG version 4, release 3 (taxonomy DISA-4r3). | |
| DISA v3 r10 Severity Report | Analysis | Severity report for 'findings' in the DISA Application Security and Development STIG version 3, release 10 (taxonomy DISA-3r10). | |
If an analysis was performed by a CodeSonar version from before mappings for a particular taxonomy were supported, the warnings issued by that analysis will not be associated with categories from that taxonomy. This means that if you create a warning class category report or warning class category severity report for that analysis and taxonomy, the warning class tables and charts will not contain any information.
To resolve this, you can re-analyze the same code with a newer
version of CodeSonar that supports the taxonomy you are interested
in, then create a report on the new analysis.
CodeSonar permissions apply to management report templates and management report contents as follows.
| Report: Availability | Users can only view or preview reports generated from templates which they have REPORTTEMPLATE_READ permission. |
|---|---|
| Report: Contents |
The information included in a management report (including a
report
preview) depends on the user's permissions for the
various resources involved.
|
| Template: Saving |
If a user attempts to save a
template with name N, behavior depends on whether or not
the user has REPORTTEMPLATE_EXISTS permission for
any existing saved template T with the same name N. If there
are multiple such templates, CodeSonar considers only the most
recently modified one.
The predefined templates cannot be overwritten. |
| Template: Import/Export | Permissions are not applied directly to report template import and export operations. The ability to save a template after importing it will depend on save permissions; template export functionality is only exposed when templates are viewed. |
| Template: Existence |
Lists of templates will only include:
|
| Template: Viewing |
Users can only open:
|
| Template: Deleting | Deleting a report template requires REPORTTEMPLATE_EXISTS and REPORTTEMPLATE_DELETE permission for that template. The predefined templates cannot be deleted. |
To report problems with this documentation, please visit https://support.codesecure.com/.