How do I share an OpenVAS report?

Export it from the Greenbone Security Assistant as HTML (Scans → Reports → the download icon → HTML), then publish that file to Comma. You get a revocable URL rather than an attachment, and each host or finding can carry its own comment thread.

Can I export the report from the command line?

Yes, via GMP: `gvm-cli` with a ` ` request, passing the HTML report format id. That is the route to use if you want the publish step inside a scheduled scan job rather than done by hand.

Why not just send the PDF?

A PDF of a network vulnerability scan is a static, un-revocable copy of your internal host inventory and its weaknesses. It also loses the per-host drilldown. A published HTML report keeps the structure and lets you remove access when the remediation window closes.

How do I keep the report from being overwhelming?

Filter before exporting. A default full-and-fast scan across a /24 produces thousands of low-severity informational results. Filter to medium-and-above with `apply_overrides` on, and publish the actionable set — the full export can be attached as an asset for anyone who wants it.

Should this report be public?

Never. It lists internal hostnames, IP addresses, open ports, service versions and the vulnerabilities on each. Team, domain-gated or named-reviewer access only.

Share an OpenVAS / Greenbone report

A Greenbone vulnerability scan produces the most operationally sensitive document in a typical infrastructure team's year: every host it could reach, every open port, every service version, and every known vulnerability against them.

The export options are HTML, PDF, CSV and XML:

Scans → Reports → select the report → Download → Report format: HTML

And then it becomes an email attachment, or a file on a share drive, and stays there — accurate for about a week, and permanently un-recallable.

Filter before you export

The default full-and-fast configuration produces enormous reports, most of it informational. A report that opens on 4,000 "Log" severity entries does not get read past the first screen.

In the report view, filter to what somebody will act on:

severity>3.9 and apply_overrides=1 and rows=1000

That gives you medium and above, with your accepted-risk overrides applied, and it usually reduces the report by an order of magnitude. Export that view — Greenbone applies the active filter to the download.

Publish it

Drag the exported HTML into the app, or POST it:

curl -fsS -X POST "https://commareports.com/api/v1/reports" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html openvas-report.html \
        --arg t "Greenbone — DMZ subnet, 2026-09-08" \
        '{title: $t, html: $html}')"

To do it from the scan job rather than by hand, pull the report over GMP first:

gvm-cli --gmp-username "$GVM_USER" --gmp-password "$GVM_PASS" \
  socket --xml "<get_reports report_id=\"$REPORT_UUID\" \
    format_id=\"6c248850-1f62-11e1-b082-406186ea4fc5\" \
    filter=\"severity&gt;3.9 apply_overrides=1\"/>" \
  | xmlstarlet sel -t -v '//report_format/../text()' | base64 -d > openvas-report.html

(6c248850-… is the built-in HTML report format id; confirm it against <get_report_formats/> on your installation.)

Set the access first

Reports are private by default, and this is a report type where that default is load-bearing. It is an inventory of your internal estate and its weaknesses.

Team access for the infrastructure group that owns remediation.
Named reviewers when an auditor or a specific external party needs it.
Never public, and think twice before domain-gated if the domain is large.

See the sharing model.

Scheduled scans, one URL

The point of a recurring scan is the trend, and the trend is invisible when every run produces a new attachment. PATCH one report id per scan target:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html openvas-report.html \
        --arg t "Greenbone — DMZ subnet, $(date +%F)" '{title: $t, html: $html}')"

One stable URL per subnet, one revision per scan. "Did the patch window actually clear those?" becomes a comparison between two revisions rather than a search through a mailbox.

What review adds

Anchored threads per host or finding, so "10.4.2.19 is decommissioned, ticket INF-882" is recorded where the finding is, not in a side channel.
Revisions, which give you the remediation trend as evidence.
Revocable access, so a contractor's view ends when the engagement does.

See commenting on HTML.

Limits

Entry HTML: 5 MB. An unfiltered scan of a large network will exceed it — which is the same reason it would not be read. Filter by severity, or publish per-subnet reports.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a scan privately →