SIS CLI

Report Guide

This guide explains when to use sis report instead of sis scan --json or sis query.

Free vs full build. The free/public sis keeps the full operator surface (including explain-*, corpus cluster, corpus correlate, workflow, query, …). The internal build adds the machine-readable engine-map exporters (contract, pdf generate, policy-bundle-normalise) and the corpus evaluation harnesses (corpus-eval, corpus-compare, corpus-evidence, gap-report).

When to use report

Use sis report when you need:

  • a durable human-readable investigation summary
  • a report file for analyst hand-off
  • a curated view of findings, chains, and verdict context

Use sis scan --json when you need machine-stable raw analysis output. Use sis query when you need one specific slice rather than a full narrative report.

Command shape

sis report <input> [options]

Common examples:

sis report sample.docx
sis report sample.hta --deep --format markdown --out report.md
sis report sample.one --deep --format json --out report.json
sis report sample.pdf --format yaml

Output formats

  • markdown: best for analyst review and hand-off
  • json: best when downstream tooling wants full report structure without scan wrappers
  • yaml: useful for ad hoc inspection and configuration-adjacent workflows

Key controls

  • --deep to align the report with deep-analysis triage
  • --report-verbosity compact|standard|verbose to tune detail level
  • --report-chain-summary minimal|events|full to control chain expansion
  • --out <path> to write the report to disk
  • --config <path> on the scan surface if a specific runtime policy or config must be reproduced

Choosing between scan, query, and report

  • scan: canonical detector pipeline and machine output
  • query: one forensic slice, count, or filtered view
  • report: full operator-facing summary

Typical sequence:

  1. sis scan <sample> --deep --json
  2. sis query <sample> findings --format json
  3. sis report <sample> --deep --format markdown --out report.md
  4. sis explain <sample> <finding-id> for the most important findings

Investigation notes

  • Keep report settings aligned with the original scan depth and chain-summary expectations.
  • Prefer markdown for hand-offs and case-study drafting.
  • Prefer json if another tool needs the report body but not the scan wrapper.
  • sis docs investigate
  • sis docs explain
  • sis docs query