Catalogues & Reference
The two questions everyone asks first — what does it collect and what does it assess — each have one page, and both are generated from the product rather than hand-maintained.
The two catalogues
| Page | Contents |
|---|---|
| Assessment Catalogue | All 46 assessments, grouped into CAF design areas, WAF pillars, per-service slices and specialised reviews — with the rule files, rule counts, and the automated-versus-manual split behind each |
| Framework Coverage | How much of each framework actually has a rule behind it. Scout enumerates every framework in full; this is the gap between enumerating an item and testing it |
| ARM Modules | All 245 collector definitions across Microsoft's 18 published service categories, each mapped to the resource types it targets |
| Collector Fields | The worksheet and the ordered columns each collector produces — what actually comes back, as opposed to what is covered |
Both pages are generated
scripts/Build-AssessmentCatalog.ps1 and scripts/Build-ArmModuleCatalog.ps1 regenerate them from manifests/, and CI fails if a committed page and a fresh regeneration disagree. An earlier hand-maintained catalogue claimed to be generated and drifted fifteen collectors out of date before anyone noticed, which is why they are built this way now.
Supporting reference
| Page | Contents |
|---|---|
| Entra ID Modules | Identity collectors that query Microsoft Graph rather than ARM |
| Coverage Table | Service coverage per category, from the same pass over the manifests |
| Category Structure | How the 18 categories are organised |
| Category Reference | Every report section heading mapped to its category, aliases, and collector folder |
| Validation Matrix | Which checks are verified by automated tests and which need a live tenant |
| React Report Section Contract | The v6 page structure of the one supported deliverable, the register completeness rule, and what a section must satisfy so an assessment can be added without touching the shell |
Reading a count on any page here
Counts on these pages come from the manifests at generation time, so they match the shipped product exactly. Counts written into prose elsewhere in the documentation are maintained by hand and are the ones to distrust — if two pages disagree, these two win.