Exporting Reports
Export audit results in nine formats — from PDF and HTML to spreadsheets, Markdown, and DISA STIG checklists.
Generate professional reports for auditors, documentation, and compliance tracking.
Export Formats
MACE can export audit results in nine formats:
Professional report format. Ideal for sharing with auditors, management, or for official documentation. Includes charts and formatted tables.
HTML
Interactive web report. Can be opened in any browser. Includes responsive design and expandable details. Great for internal review.
CSV
Spreadsheet format. Import into Excel, Google Sheets, or other tools. Useful for data analysis, filtering, and custom reporting.
XLSX
Excel spreadsheet with formatted table, auto-filters, and frozen header row. Ideal for compliance teams who need to sort, filter, and analyze results in a spreadsheet.
JSON
Structured data format containing audit results and summary statistics. Ideal for automation, custom dashboards, or feeding results into other tools and scripts.
Markdown
Plain-text report with Markdown formatting. Drop it into wikis, GitHub, or ticketing systems that render Markdown.
AsciiDoc
Plain-text report in AsciiDoc format. Fits documentation pipelines built on Asciidoctor or Antora.
STIG CKL
DISA STIG Checklist format (XML). Required for DoD compliance. Updates existing CKL templates with your audit results. Only available for STIG frameworks.
STIG CKLB
DISA STIG Viewer 3.x checklist format (JSON). The modern replacement for the XML-based CKL. Can update an existing CKLB template or generate one from an XCCDF benchmark. Only available for STIG frameworks.
Which Format Should I Use?
| 📄 | Share with auditors or management | |
| 🌐 | HTML | Review results in a browser |
| 📊 | CSV | Analyze data in Excel or Google Sheets |
| 📋 | XLSX | Pre-formatted Excel file with filters and frozen headers |
| 🧩 | JSON | Feed results into automation, dashboards, or other tools |
| 📝 | Markdown | Paste into wikis, GitHub, or Markdown-aware tools |
| 📃 | AsciiDoc | Use in Asciidoctor/Antora documentation pipelines |
| 🛡️ | STIG CKL | Submit for DoD compliance (STIG Viewer 2.x) — STIG frameworks only |
| 🛡️ | STIG CKLB | Submit for DoD compliance (STIG Viewer 3.x) — STIG frameworks only |
Live Preview
When your audit finishes, click Export Preview in the results toolbar to open the live export preview. The preview renders your report exactly as it will export, and updates in real time as you change options — what you see is what you get.
Switch Formats Live
Toggle between HTML, PDF, Markdown, AsciiDoc, XLSX, CSV, and JSON with the format tabs at the top — the preview re-renders instantly for each.
Theme & Zoom
Preview in light, auto, or dark mode and adjust the zoom level to check exactly how the report will look before exporting.
Configure Everything
The sidebar groups all options into Branding, Audit Info, Device Info, and Structure. Toggle content on or off and watch the preview update live.
Remember for Quick Export
Enable Remember for Quick Export to save your current settings — a Quick Export menu then appears in the results toolbar with every format plus Export All Formats, no preview needed.
How to Export
The flow is the same for every report format:
The live preview covers all the report formats above. To produce a STIG CKL or CKLB checklist, use the STIG Checklist button in the results toolbar instead — these formats map your results onto a DISA checklist rather than a formatted report. See STIG Checklist Export below.
Export Options
The export preview sidebar holds everything you can configure — toggle options on or off and the preview updates live. The exact set of options evolves with each release, but they fall into these groups:
Control the report's look — choose the logo (M.A.C.E., a custom image, or none), and decide whether attribution and the footer appear. Useful for white-labeled or sanitized reports.
Identify the audit itself — author name, organization, benchmark name, and other metadata shown in the report header.
Identify the audited Mac — serial number, model, macOS version, hostname, and similar device details. Off by default; enable what you need.
Shape the report's content — which columns and sections appear, such as outputs, discussions, check and fix scripts, section summaries, executive summary, and signature lines.
Some Options Are Contextual
Certain options only appear for specific formats or baselines — for example, pagination applies to PDF, STIG IDs appear for STIG baselines, and CIS IDs for CIS baselines. The preview always shows what's available for your current format and project.
PDF Export
The PDF export creates a professional compliance report suitable for auditors and official documentation.
| 🎨 | Header | Logo, report title, author, organization, date |
| 📊 | Summary Statistics | Total rules, pass/fail counts, pass rate percentage |
| 🥧 | Pie Chart | Visual breakdown of results by status |
| 💻 | Device Information | Serial number, model, OS version (optional) |
| 📋 | Executive Summary | High-level findings overview (optional) |
| 📈 | Section Summary | Pass rates by category (optional) |
| 🗂️ | Results Table | All rules with status, expected/actual values, comments |
| ✍️ | Signature Section | Sign-off lines for auditors (optional) |
| 🦶 | Footer | Generation timestamp, page numbers (if paginated) |
HTML Export
The HTML export creates an interactive web report that can be opened in any browser.
| 📱 | Responsive Design | Works on desktop, tablet, and mobile |
| 🌓 | Dark Mode Support | Automatically adapts to system preferences |
| 🔽 | Expandable Details | Click rows to see more information |
| 🚦 | Status Color Coding | Visual pass/fail indicators |
| 🧭 | Section Navigation | Jump to specific sections |
| 🥧 | Pie Chart | SVG visualization of results |
Viewing the Report
Open the exported .html file in any web browser (Safari, Chrome, Firefox, etc.). The report is self-contained with all styles embedded — no internet connection needed.
CSV Export
The CSV export creates a spreadsheet-compatible file for data analysis:
| 📊 | Summary Info | Pass/fail counts at the top of the file |
| 🏷️ | Column Headers | Based on your export options |
| 🗂️ | One Row Per Rule | All the details for every checked rule |
Using the CSV
Import into Excel (File → Open), Google Sheets (File → Import), or Numbers (File → Open) to create custom pivot tables, apply your own filtering and sorting, generate charts, or combine audit data with other sources.
XLSX Export
The XLSX export creates a formatted Excel spreadsheet ready to open in Microsoft Excel or Numbers:
| 🎨 | Formatted Table | Styled header row, ready to read on open |
| 🔽 | Auto-Filters | Every column can be sorted and filtered instantly |
| 🧊 | Frozen Header Row | Column names stay visible as you scroll |
| 🗂️ | One Row Per Rule | Status, rule ID, title, section, expected/actual output, and comments |
| 🚦 | Status Color Coding | Visually distinguishes pass, fail, and other statuses |
XLSX vs CSV
XLSX is more structured than CSV — filters, column widths, and formatting are already set up when you open it. Choose CSV when you want raw data for pipelines; choose XLSX when a person will read it.
JSON Export
The JSON export creates a structured data file containing your audit results and summary statistics — ideal for automation, custom dashboards, or feeding results into other tools:
| 📊 | Summary | Total rules, pass/fail/manual counts, and pass rate |
| 🧾 | Audit Metadata | Platform, baseline version, framework, device info |
| 🗂️ | One Entry Per Rule | Status, expected/actual output, and comments |
Using the JSON
Parse the file in any language or pipeline to build dashboards, track compliance trends over time, or integrate results with ticketing and SIEM tools.
Markdown & AsciiDoc Export
Both create plain-text reports for documentation workflows:
| 📝 | Markdown | Renders anywhere Markdown does — wikis, GitHub, ticketing systems, and note apps |
| 📃 | AsciiDoc | Slots into Asciidoctor and Antora documentation pipelines |
| 🗂️ | Same Content | Summary statistics and the full results table, following your export options |
Why Plain Text?
Text-based reports diff cleanly in version control — commit one per audit and your compliance history becomes reviewable over time.
STIG Checklist Export (CKL & CKLB)
For DoD security assessments, MACE can export your results as a DISA STIG checklist in two formats. Both are produced from the STIG Checklist button in the results toolbar (rather than the live Export Preview):
The XML checklist format. Requires a template (from DISA or your organization) that MACE updates with your results.
The modern JSON checklist format. Can update an existing template, or be generated from scratch — including directly from an XCCDF benchmark with authoritative DISA metadata.
Both formats are the standard for DISA STIG checklists and contain device identification, vulnerability assessments, finding details and status, and comments.
How Checklist Export Works
For CKL and for updating an existing CKLB, MACE merges your results into a template:
Status Mapping
MACE audit statuses map to checklist statuses:
| Pass | NotAFinding / not_a_finding | The control is in place |
| Fail | Open / open | The control is not in place — an open finding |
| N/A | Not_Applicable / not_applicable | The control doesn't apply to this system |
| Error | Not_Reviewed / not_reviewed | The check couldn't run — needs review |
| Manual Review | Not_Reviewed / not_reviewed | Human verification still required |
| Pending | Not_Reviewed / not_reviewed | The rule wasn't checked |
(CKL uses the capitalized XML statuses; CKLB uses the lowercase JSON statuses.)
How to Export a Checklist
What Gets Updated
For each matching STIG ID:
| 🚦 | STATUS | Updated to match your audit result |
| 🔍 | FINDING_DETAILS | Populated with the check command and output |
| 💬 | COMMENTS | Filled with user comments or rule discussion |
| 🖥️ | HOST_NAME | Set from device information |
Requirements
The audit must use a STIG baseline, and STIG IDs must match between your audit and the template. A template file is required for CKL and for updating an existing CKLB — CKLB can also be generated from scratch or from an XCCDF benchmark.
Custom Logo
To use your organization's logo in reports, open the Branding section of the export preview:
Your Logo Travels With the Project
MACE saves your uploaded logo as logo.png in the project folder, so it's reused across exports. If a logo.png already exists in the project folder, MACE detects it automatically and offers it as the Custom logo. Use the trash button next to Upload Logo to remove it (Logo Source falls back to M.A.C.E.).
Logo recommendations:
| 🖼️ | Format | PNG with transparency |
| 📏 | Size | 200–400 pixels wide |
| ↔️ | Aspect Ratio | Horizontal works best |
Best Practices
Create a "before" snapshot of your compliance state. This documents your starting point for comparison after fixes.
When sharing with auditors, enable "Include Override Indicators" so they can see which results were manually changed.
Enable "Section Summary" when creating reports for management. It highlights problem areas at a glance.
Export to CSV if you need to do custom analysis, create charts, or combine audit data with other systems.
If you're submitting to a DoD security assessment, the CKL format is required. Keep your template CKL up to date.