Reporting
Faraday
Vulnerability management workspace that normalizes scanner output into a single engagement view.
What it is
Faraday ingests Nmap, Burp, nuclei, and other tool outputs so the desk can dedupe, assign, and track status without living in spreadsheets. Community covers small desks; commercial adds scale and workflows. It is a workspace, not a scanner.
Reach for it when
Engagements with several scanners where you need a normalized finding list before writing the narrative report.
Watch-outs
Centralizing scanner data concentrates secrets. Run it where the BAA allows, map statuses to the desk (open/remediation/retest), and do not treat a Faraday 'critical' as client-ready until an operator has reproduced it.
Typical invocation
Import nmap and nuclei XML/JSON into the engagement workspace, dedupe hosts, then export the confirmed set to the reporter.
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- PwnDoc
Self-hosted pentest reporting platform with reusable finding templates and collaborative review.
- SysReptor
Pentest reporting suite with finding design, CVSS, and export, community or professional.
- Dradis
Collaboration platform for evidence, notes, and report generation across a pentest team.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.