How to read a report
What you get
A run writes report.json, report.md and report.csv. Their fields are in docs/report-schema.md. An item can be on more than one list.
The lists
- Past end of life
- The end-of-life date has passed.
- Ends within the lookahead window
- The window is 12 months unless you change it.
- Dates disagree
- This covers three cases: the export's own date and the endoflife.date date differ; a golden source has expired; or a golden source says to use the export date and the export has no usable one (
GOLDEN_EXPORT_UNUSABLE). - Couldn't match
- The name and version did not map to a known product and cycle, and the tool claims no date for these. Some names it refused on purpose: a product title on a row with no publisher, or a row whose name and version fit more than one support line, such as Internet Explorer 11. Those are listed again under "Names to review". They are not a finding.
- In CISA KEV, past or near end of life
- The item is past or near end of life, and its vendor and product appear in CISA KEV. The wording is "needs review". KEV matches vendor and product only, never version. The tool never says "vulnerable".
- Accepted risk
- The item is listed in your exceptions file.
- Ownerless
- The export has no owner for the item.
- Golden overrides
- The item's state changed because a golden source chose a different date. A golden source that changes the date but not the state is not listed.
Counts are not installs
rows in the report counts inventory rows, not installs or machines. An item's count is taken from your file; it is not discovered installs. See The count column.
Sample report
examples/sample-report.md is the report.md the demo run writes, from made-up data only. A test keeps it the same as the real output. The words it uses are explained in the glossary.
Override files you own
The tool never changes these files. Blank copies are in templates/.
- golden-sources.csv says which date is right for a product and when to review that choice.
- exceptions.csv records accepted risk.
- tracking.csv links a finding's item ID to a change reference and a problem reference.
- support-records.csv lists the support records you hold. It is a lifecycle and renewal aid, not a licence or audit position. A record never changes a state, a list or
--fail-on.
Quarterly review
The process is in docs/sop.md and docs/checklist.md. The crosswalk to standards is explained in docs/themes.md.
How it can be wrong
- Coverage is partial.
- Names must match strictly, so a name with extra words often lands in "couldn't match".
- KEV matches vendor and product only, never version.
- The data is a snapshot and can be out of date.
Dates come from endoflife.date unless a golden source overrides them. Report a wrong date to endoflife.date, not here. More in How it can be wrong.