> ## Documentation Index
> Fetch the complete documentation index at: https://docs.backline.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Upload Report

> In addition to automatically collecting vulnerabilities from connected scanners, you can manually upload vulnerability reports using the **Upload Report** action at the top of the page. <br/><br/> Backline supports uploads for SCA, container image, and Cloud misconfiguration reports.

### Supported Report Types

Backline currently supports the following vulnerability report types:

SCA reports from:

* Trivy - JSON format
* OSV - JSON format
* Custom Report - CSV format with YAML configuration

Image reports from:

* Custom Report - CSV format with YAML configuration

Cloud misconfiguration reports from:

* Custom Report - CSV format with configuration file

### How to Upload a Report

1. **Click Upload Report**

   At the top of the Vulnerabilities page, click the **Upload Report** button.

2. **Select Report Type**

   Choose your report type:

   * **SCA scan**: For Software Composition Analysis vulnerability reports
   * **Image scan**: For container image vulnerability reports
   * **Cloud misconfig scan**: For Cloud misconfiguration reports

3. **Configure Based on Report Type**

   For **SCA scan**:

   * Select your source scanner:
     * Trivy: Upload a JSON file in Trivy’s standard format
     * OSV: Upload a JSON file in OSV’s standard format
     * Custom Report: Upload a CSV file with a YAML configuration
   * Choose the repository that this vulnerability report relates to from the dropdown
   * Optionally configure Local Repository settings

   For **Image scan**:

   * Upload the report file and config file
   * Use the custom report configuration to map fields from your report to Backline fields

   For **Cloud misconfig scan**:

   * Select **Custom Report (CSV)** as the source scanner
   * Upload the Cloud misconfiguration report file
   * Upload the Cloud misconfiguration config file
   * Use the Cloud misconfiguration config template to map fields from your report to Backline fields

4. Repository-specific fields are not required for Cloud misconfiguration uploads.

5. **Configure Local Repository**

   This step is available for SCA reports only.

   If your SCA report was generated from a local environment:

   * Check the Local Repository checkbox
   * Specify the path to the root of your repository in your local environment

   This helps Backline correctly map file paths in your scan results to your source code structure.

6. **Upload Files**

   Upload the required file or files based on your selected report type and source scanner.

   For Cloud misconfiguration reports, both files are required:

   * Cloud misconfiguration report file
   * Cloud misconfiguration config file

The upload button is enabled only after all required fields and files are provided.

### Custom Report Configuration

When using the Custom Report option, you need to provide a report file and a configuration file.

The configuration file maps the columns in your report to the fields Backline expects.

For Cloud misconfiguration reports, click **Download Cloud misconfig config template** in the upload dialog to download the required template.

Before processing the upload, Backline validates that:

* The configuration file matches the selected report type
* Required field mappings are provided
* Required fields exist in the uploaded report
* The uploaded files can be processed successfully

If required information is missing or invalid, Backline shows a blocking error and the report cannot be uploaded until the issue is fixed.

Backline may also show warnings for issues that do not block the upload, but may affect the completeness or quality of the imported findings.

### After Upload

Once your report is uploaded, Backline will:

1. Analyze the vulnerabilities or misconfigurations in the report
2. De-duplicate findings that already exist in the system
3. Create remediation records when supported
4. Display the new findings in the Vulnerabilities lake

For Cloud misconfiguration reports, Backline creates remediation guidance when available. If Terraform remediation is supported, users may be able to open a Terraform PR from the remediation side panel.

Processing large reports may take a few minutes. You’ll see the findings appear in your dashboard once processing is complete.