Edit

Review agentic code scan results from the terminal (private preview)

After a scan completes, Defender CLI automatically generates result files in the directory where the scan was initiated. Two output formats are available: an interactive HTML report for human review and a SARIF file for programmatic processing and tool integration.

Prerequisites

  • Defender CLI installed and authenticated. See Defender CLI setup.

  • To view AI code scan results, you need the Scan results permission at the Read level in Microsoft Defender unified RBAC. See Security posture – AI code scan.

  • A completed AI scan:

    defender scan ai-scan wait <JOB_ID>

Result files

Two files are created in your scan directory when a scan completes:

File type Best for
HTML report Human review — visual summary of findings, severity levels, affected code paths, and recommended remediations.
SARIF file Programmatic processing — CI/CD integration, import into security dashboards, custom reporting workflows.

Review the HTML report

The HTML report provides a structured, human-readable view of all findings from your scan.

  1. Navigate to the directory where you initiated the scan.
  2. Open the generated .html file in any browser.

The report includes:

  • Findings summary — Total count of vulnerabilities discovered, grouped by severity (Critical, Important, Moderate, Low).
  • Severity breakdown — Each finding shows its CWE classification, severity rating, and confidence score from the validation stage.
  • Affected code paths — File paths, line numbers, and code snippets showing where the vulnerability exists.
  • Recommended remediations — AI-generated fix suggestions for each finding.

Review the SARIF file

The SARIF (Static Analysis Results Interchange Format) v2.1.0 file provides machine-readable scan results compatible with industry-standard security tooling.

Use the SARIF output to:

  • Import into CI/CD pipelines — Integrate with GitHub Advanced Security, Azure DevOps, or other SARIF-compatible tools to surface findings in pull request annotations.
  • Feed security dashboards — Ingest results into SIEM or security posture management tools.
  • Build custom reports — Parse the JSON structure programmatically for organization-specific reporting.
  • Track remediation — Compare SARIF outputs for scans to measure remediation velocity.

SARIF file structure

The SARIF output follows the OASIS SARIF v2.1.0 specification. Key sections include:

Section Description
runs[].results[] Array of individual findings with rule IDs, severity, message text, and locations.
runs[].tool Metadata about the scanning harness version and configuration.
runs[].results[].locations[] Physical and logical locations (file path, line, column) of each finding.
runs[].results[].codeFlows[] Step-by-step execution paths showing how the vulnerability is reached (when available from the prove stage).

Download results via CLI

To download results for a completed scan:

# Wait for scan completion and download SARIF results
defender status wait <JOB_ID> -o results.sarif

Related content

  • Last updated on