Skip to main content

​
Supported Report Types

Backline currently supports the following vulnerability report types: SCA reports from:
  • Trivy - JSON format
  • OSV - JSON format
  • Custom Report - CSV format with YAML configuration
Image reports from:
  • Custom Report - CSV format with YAML configuration
Cloud misconfiguration reports from:
  • Custom Report - CSV format with configuration file

​
How to Upload a Report

  1. Click Upload Report At the top of the Vulnerabilities page, click the Upload Report button.
  2. Select Report Type Choose your report type:
    • SCA scan: For Software Composition Analysis vulnerability reports
    • Image scan: For container image vulnerability reports
    • Cloud misconfig scan: For Cloud misconfiguration reports
  3. Configure Based on Report Type For SCA scan:
    • Select your source scanner:
      • Trivy: Upload a JSON file in Trivy’s standard format
      • OSV: Upload a JSON file in OSV’s standard format
      • Custom Report: Upload a CSV file with a YAML configuration
    • Choose the repository that this vulnerability report relates to from the dropdown
    • Optionally configure Local Repository settings
    For Image scan:
    • Upload the report file and config file
    • Use the custom report configuration to map fields from your report to Backline fields
    For Cloud misconfig scan:
    • Select Custom Report (CSV) as the source scanner
    • Upload the Cloud misconfiguration report file
    • Upload the Cloud misconfiguration config file
    • Use the Cloud misconfiguration config template to map fields from your report to Backline fields
  4. Repository-specific fields are not required for Cloud misconfiguration uploads.
  5. Configure Local Repository This step is available for SCA reports only. If your SCA report was generated from a local environment:
    • Check the Local Repository checkbox
    • Specify the path to the root of your repository in your local environment
    This helps Backline correctly map file paths in your scan results to your source code structure.
  6. Upload Files Upload the required file or files based on your selected report type and source scanner. For Cloud misconfiguration reports, both files are required:
    • Cloud misconfiguration report file
    • Cloud misconfiguration config file
The upload button is enabled only after all required fields and files are provided.

​
Custom Report Configuration

When using the Custom Report option, you need to provide a report file and a configuration file. The configuration file maps the columns in your report to the fields Backline expects. For Cloud misconfiguration reports, click Download Cloud misconfig config template in the upload dialog to download the required template. Before processing the upload, Backline validates that:
  • The configuration file matches the selected report type
  • Required field mappings are provided
  • Required fields exist in the uploaded report
  • The uploaded files can be processed successfully
If required information is missing or invalid, Backline shows a blocking error and the report cannot be uploaded until the issue is fixed. Backline may also show warnings for issues that do not block the upload, but may affect the completeness or quality of the imported findings.

​
After Upload

Once your report is uploaded, Backline will:
  1. Analyze the vulnerabilities or misconfigurations in the report
  2. De-duplicate findings that already exist in the system
  3. Create remediation records when supported
  4. Display the new findings in the Vulnerabilities lake
For Cloud misconfiguration reports, Backline creates remediation guidance when available. If Terraform remediation is supported, users may be able to open a Terraform PR from the remediation side panel. Processing large reports may take a few minutes. You’ll see the findings appear in your dashboard once processing is complete.