Scan imports

Scan imports files vulnerability scans that Proofroom cannot read through an API: you upload a scanner’s export file, or a script pushes the findings as data. Each scan is filed at once as evidence, with the same findings summary the Qualys, Tenable and Rapid7 connectors give. Use it when your scanner has no API access, runs on your own network, or is not one Proofroom connects to.

What it files

A scan expected every quarter. Each collector’s quarterly run fails when no scan of its kind arrived in the quarter: “ASV report expected each quarter: none was imported or pushed between …”. A failed run is retried daily, the admins are emailed after two failures in a row, and the integration shows on the posture page as failing. The External ASV scans run also fails when the quarter has ASV scans but none that counts as passing (PCI DSS 11.3.2 needs a pass: rescan until it passes). Switch a collector off if you do not need that kind of scan.

ASV results are checked and reviewed.

• A scan stated as passing is refused when it has an open finding scored CVSS 4.0 or more (medium and above when the file has no score): under the ASV Program Guide such a scan fails.
• A report without findings data must be a PDF.
• A result stated by a person or a script counts as passing (in the quarterly run, the posture score and PCI DSS 11.3.2) only once a reviewer accepts that scan’s evidence. Until then it shows as “pass (stated, not reviewed)”.
• A scan dated by the date typed on upload (the file has no dates) says “as stated” next to its date.

Each scan’s evidence holds the summary (open findings by severity with their age, findings past the remediation target, fixed findings when the file has them), internal-scans.json or asv-scans.json with every finding, findings.csv for spreadsheets, and the original file. Uploading the same file again files nothing new.

Remediation targets. Set critical days (default 30, PCI DSS 6.3.3) and high days (default 90) on the integration. A finding is past target only when the file says when it was first found: Qualys and Tenable CSV exports do; Nessus and OpenVAS files do not, so their evidence shows counts and says that ages cannot be judged from the file. A critical or high finding of unknown age is never counted as within target: it earns no posture points (“age unknown”) and an open critical of unknown age raises a suggested risk.

Posture reads the newest scan of each group (scanner and targets, or the scan’s name) received in the last 100 days, internal and ASV alike, so separate networks or scanners imported one by one all count.

Upload a file

On the integration’s page, under Import a scan, choose the file, its format (or let Proofroom recognise it), the kind of scan and, when the file has no dates, the date the scan ran. For an ASV scan, give the ASV’s name and the result on its report.

Limits, so a large file fails before it fills a small server’s memory:

• At most SCAN_IMPORT_MAX_MB (25 MB by default, and never more than MAX_UPLOAD_MB). The upload must declare its length (browsers do); a request without Content-Length is refused.
• UTF-8 text (except a PDF report), at most 100,000 findings.
• CSV: a cell longer than 64 KB, or more rows than the findings limit, fails the import while it is read.
• XML: at most 500,000 elements, read without DTDs: a file that declares its own entities is refused, and nothing outside the file is ever fetched.
• OpenVAS and Greenbone: a report holding fewer results than its result_count says is refused (export it again with every result); a report exported with a filter says so.

A cell a spreadsheet would run as a formula is written to findings.csv with a leading '.

Importing needs the right to manage integrations (admins and analysts).

Push findings from a script

Create an API key on the integration’s page and send the scan as records to /api/v1/evidence (the inbound API):

{
  "externalRef": "nightly-2026-10-27",
  "title": "Nightly internal scan",
  "collectedAt": "2026-10-27T03:00:00Z",
  "records": {
    "type": "vulnerability-scan",
    "version": 1,
    "scanner": "OpenVAS 23",
    "kind": "internal",
    "scan": { "name": "Nightly internal scan", "startedAt": "2026-10-27T02:00:00Z", "finishedAt": "2026-10-27T02:50:00Z", "targets": "10.0.0.0/24", "authenticated": true },
    "findings": [
      { "asset": "web-1.example.internal", "id": "CVE-2024-6387", "title": "OpenSSH regreSSHion", "severity": "critical", "cvss": 8.1, "state": "open", "firstFound": "2026-10-01T02:10:00Z", "port": "22/tcp" }
    ]
  }
}

• kind is internal, external or asv. An asv scan needs scan.asv with result (pass or fail) and optionally company. A pass with an open finding of CVSS 4.0 or more (medium and above without a score) is refused with 400, and a stated pass counts once a reviewer accepts the evidence.
• Each finding needs asset, id and severity (critical, high, medium, low or info; info is counted and left out). state is open (the default), reopened or fixed; a fixed finding needs fixedAt. Times are ISO 8601 with a zone. Unknown fields are refused.
• At most 100,000 findings, within the request size limit.
• The scan is filed under the collector for its kind, dated when it finished (or started, or collectedAt). The title is Proofroom’s; text, when given, is added to the summary under “From the sender”. files are attached.
• Pushing the same externalRef again files nothing new.

Known limits

• The ASV result of an imported or pushed scan is as stated by the person or script and counts once a reviewer accepts it; Proofroom does not read the PDF’s wording.
• UNVERIFIED: Tenable’s findings CSV header names (Tenable documents export keys); Nessus CSV score column names; whether Greenbone 24 writes a “Critical” threat word (Proofroom reads the score instead).