Trend Dashboard

Purpose

This is a multi-scan dashboard that compiles historical CSV exports into trend series:

• coverage over time (when scan metadata exists)

• findings / unique vulns over time

• severity distribution over time (by findings and by aggregates)

• top recurring QIDs

• risk posture index trend

Output

• Global (not per-scan): output/trends/trend.html

Optional supporting data:

• output/trends/history.json (compiled history used by the dashboard)

How to generate

Dedicated command

miyabi-qualys-ai-triage-pack trend --config config/config.yaml

During a regular run

Configuration

Enable / disable:

• reports.trend.enabled: true|false

History inputs:

• reports.trend.history.history_root_dir (default: history/)

• reports.trend.history.history_json_path (default: output/trends/history.json)

• reports.trend.history.mode (e.g., A+B)

Scope change detection:

• reports.trend.scope.host_change_threshold_pct

• reports.trend.scope.title_change_detector_enabled

UI options:

• reports.trend.ui.series_selector_enabled

• reports.trend.ui.default_series

• reports.trend.ui.max_qids_recurring

• reports.trend.ui.max_top_qids_per_scan

• reports.trend.ui.max_points_render

Optional LLM narrative refinement (guardrailed / JSON-only):

• reports.trend.llm.enabled

• reports.trend.llm.model

• reports.trend.llm.max_items_for_llm

Folder convention (recommended)

Organize history by “front” (scan stream), each containing multiple CSVs:

history/
  frontA/
    scan_2026-01-01.csv
    scan_2026-02-01.csv
  frontB/
    scan_2026-01-15.csv

Limitations

• Trend quality depends on consistent scan scope/methodology across time.

• Coverage depends on metadata fields (Active/Total hosts); if missing, coverage charts become approximate/limited.