Getting Started: Maester and Zero Trust Assessment

What this guide covers

Maester and the Microsoft Zero Trust Assessment write their results to files. Siemserva reads those files and loads the findings into its own dashboard, reports, and database. Once the findings are in, you can sort them by Severity, generate reports from them, compare them across runs, and query them through Claude.

The guide covers the whole path in order: installing Siemserva, creating the conversion script, converting your result files, importing them, reading the dashboard, and producing a report. It does not change how you run Maester or ZTA. You keep running those exactly as you do now, and add a Siemserva step afterwards.

Siemserva is one self-contained file, about 100 MB, with no installer and no separate runtime to configure. It covers Microsoft 365, Intune, Defender, Entra ID, and Purview.

Where results come from

You run these; Siemserva does not.

What Siemserva does

The steps in this guide.

Converts the result file
Stores the findings locally
Adds AI analysis, if you supply a key

What you can do once imported

Covered in Parts 6 and 7.

Sort findings by Severity
Generate any of seven reports
Compare results across runs
Query them through Claude

Siemserva reads the output; it does not run Maester or ZTA for you.

What you will accomplish

Seven parts, in order. Do them in order the first time, even the ones that look skippable: each part assumes the one before it. First check you have results to import, then start at Part 1. If Siemserva is already installed and set up, start at Part 2 instead.

01

Install and launch

Download the single binary and run it. No installer, no runtime.

Go to Part 1

02

Get the SDK

One flag writes out the conversion scripts and demo data you need.

Go to Part 2

03

Import ZTA results

Bring Zero Trust Assessment output in directly, or convert and pipe it.

Go to Part 3

04

Import Maester results

Convert your Maester report and stream it into the live dashboard.

Go to Part 4

05

Generate reports

Press R and produce self-contained HTML reports from imported data.

Go to Part 6

06

Go further

Trend results over time, share with your team, and query with Claude.

Go to Part 7

First, do you have results to import?

This guide takes result files that Maester or the Microsoft Zero Trust Assessment have already produced and brings them into Siemserva. So before you start, you need at least one of those files. Check which of these you are:

Where you are	What to do
I have already run Maester, ZTA, or SCuBA, and I have the output	You are ready. Find that file or folder now and note where it is saved, because you will type its location later. Then start at Part 1.
I have not run any of them yet	Stop here and run one first, then come back. Maester is a free PowerShell module that tests your tenant and writes a JSON report. The Microsoft Zero Trust Assessment writes an output folder. Either one gives you the file this guide imports.

Siemserva's demo data will not work for this guide

Siemserva has a built-in demo, which shows you what the dashboard and reports look like without using real data. It is not a way to practise the steps below. The demo builds Siemserva's own fictional tenants; it does not produce Maester or Zero Trust Assessment files, so there is nothing in it for the converter in Part 2 to convert. To follow this guide you need output from a real Maester or ZTA run. If you only want to look around Siemserva first, use demo mode and come back here afterwards.

Before you begin

Requirement	Detail
Operating system	Windows 10 or later, or macOS (x64 and Apple Silicon).
Runtime	None. The binary is fully self-contained, about 100 MB on disk.
Existing results	A Maester report (JSON) and/or a Zero Trust Assessment output directory or report JSON. SCuBA and generic JSON results are supported the same way. See the section above if you do not have one yet.
PowerShell	Needed to run `ConvertTo-SiemservaNdjson.ps1`. That is a script file that Siemserva writes to disk for you in Part 2, not a command that exists until then. Windows has PowerShell built in.
Two terminal windows	The Siemserva dashboard takes over the window it runs in, so some steps need a second window open at the same time. This is called out where it matters.
Permissions	None needed to import existing results. Read-only Microsoft Graph access is only required if you later run Siemserva's own native scans.
AI (optional)	An Anthropic Claude API key enables AI-enhanced report sections. Not required to import or report.

Part 1

Install and launch

1

Download the binary

Grab the latest signed release for your platform. There is no installer, just one executable.

Platform	How to get it
Windows (x64)	Direct download: siemserva-win-x64-signed.exe, or the Windows ZIP.
macOS (Apple Silicon)	Direct download: siemserva-osx-arm64-signed.zip, unzip, then run `run-siemserva.sh` on first launch (it clears the macOS quarantine flag).

All releases are code-signed with Azure Artifact Signing. Both platforms are also available from the latest release page. Commands in this guide are shown as siemserva. On Windows, substitute the downloaded executable name (siemserva-win-x64-signed.exe) or rename the file for easier entry.

2

Open a terminal in the folder you saved it to

Every command in this guide is typed into a terminal, and the folder the terminal is pointed at matters. Commands only find the file if you are in the same folder as it. So open the terminal at the download folder rather than opening a terminal and hoping:

Windows: open File Explorer and go to the folder holding the file you just downloaded. Hold Shift, right-click an empty part of the window, and choose Open PowerShell window here. (If you do not see that option, click the address bar, type powershell, and press Enter.)
macOS: open Finder and find the folder. Right-click it and choose New Terminal at Folder. (If that is missing, open Terminal, type cd with a trailing space, then drag the folder onto the window and press Enter.)

A window with a text prompt opens. To confirm you are in the right place, list what is in the folder. You should see the Siemserva file you downloaded in the output:

Check where you are

# Windows (PowerShell) and macOS both accept this
dir

3

Run it for the first time

Now run the file with no extra words after it. This starts the first-run wizard, beginning with the End User License Agreement. Accept it once; your acceptance is saved locally, so you are not asked again (pass --accept-eula for automated runs).

First launch

# Windows (PowerShell)
./siemserva.exe

# macOS
./siemserva

Important: the dashboard takes over the window

Once Siemserva opens its dashboard, that terminal is busy showing it. You cannot type other commands into it, which is why siemserva --full-help and the other commands in this guide appear to do nothing if you try them there. You have two options, and you will need one of them repeatedly:

Open a second terminal the same way you opened the first (Shift, right-click, Open PowerShell window here) and run the other commands in that one. The dashboard keeps running in the first window. This is what you want most of the time.

Or close the dashboard first: press Q, then press it again to confirm. That returns you to the prompt in the same window.

4

Complete the setup wizard

After the EULA, the wizard continues with two one-time steps. Everything you enter is stored for subsequent runs, so this is a single pass.

Step	What happens
License key validation	Enter your Siemserva license key. The wizard validates it and saves it to your configuration, so later runs start without prompting.
Claude MCP setup	The wizard offers to register Siemserva's MCP server with Claude Desktop or the Claude Code CLI, so Claude can query your findings later (see Part 7). The connection is saved to your Claude config file.

Need a license key?

Request one from Senserva, or see pricing to purchase.

Every step offers Go Back, Cancel, and Help, and you can re-run the wizard at any time with siemserva --setup.

There is also a full reference for every command, which opens in your web browser: siemserva --full-help. Run it at a terminal prompt, not inside the dashboard. If the dashboard is currently open, use your second terminal window, or press Q twice to close it first. This is the single most common thing to get stuck on, so it is worth trying --full-help once now, before you go any further, while the prompt is still in front of you.

With setup complete, you are ready to bring in your Maester and ZTA results.

Part 2

Get the SDK and conversion script

Siemserva cannot read a Maester or ZTA file directly. Something has to translate it first, and that translator is a PowerShell script which does not exist on your machine yet. This part creates it, finds it, and proves it runs. Take these four steps slowly; this is the part people get stuck on.

1

Write out the SDK

Back in the terminal, in the same folder as the Siemserva file, and at a prompt rather than inside the dashboard (press Q twice to leave it, or use your second window), run:

Create the SDK files

siemserva --sdk

It finishes almost instantly and looks like nothing happened

There is no progress bar and no "done" fanfare. It writes its files in about a second and hands you back the prompt. That blank-looking result is success. The files did not go into the window; they went onto your disk, into a new folder of their own next to the Siemserva file. That new folder is the thing nobody tells you about, and it is where the rest of this part happens.

2

Find the folder it just created

List the folder again and compare it with what was there before. A folder that was not there a moment ago is the SDK folder:

See what appeared

dir

Now move into that folder. Type cd, a space, then the folder's name. You do not have to type the whole name: type the first few letters and press Tab, and the terminal completes it for you.

Go into the SDK folder, then look inside

# Replace <sdk-folder> with the name you just saw
cd <sdk-folder>
dir

In that listing you should see ConvertTo-SiemservaNdjson.ps1. If you do, you are in the right place. If you do not, you are in the wrong folder: run cd .. to go back up one level and look again.

3

Understand what you are about to run, and why it is not a command

This trips up nearly everyone. ConvertTo-SiemservaNdjson.ps1 is a file sitting in that folder, not a command Siemserva installed. So three things are true, and all three cause the same confusing silence when you get them wrong:

It only works from inside the SDK folder, because that is where the file is. Running it from the folder above does nothing.
PowerShell will not run a script in the current folder unless you put .\ in front of the name. Typing the name on its own gets you an error, which is exactly what happens if you copy the bare name out of older instructions.
The .ps1 on the end is part of the file name. Leave it on.

If you see "is not recognized as the name of a cmdlet"

That error means one of the three things above. Check, in order: are you inside the SDK folder (run dir and look for the script), did you type .\ before the name, and did you keep the .ps1. Nothing is broken and nothing needs reinstalling.

Some machines also refuse to run downloaded scripts at all, and say something about an execution policy instead. If that happens, allow scripts for just this terminal window, which resets the moment you close it:

Only if you get an execution policy error

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

4

Know what the converter accepts

The script converts results from your assessment tool into the format Siemserva imports. Supported sources:

Source	Notes
Maester	Convert the Maester JSON report, then pipe it in (Part 4).
Microsoft Zero Trust Assessment	Convert and pipe, or skip conversion and import the ZTA output directory directly (Part 3).
SCuBA	Convert and pipe, the same way as Maester (Part 5).
Generic JSON	Bring results from other tools along the same path (Part 5).

5

Run your first conversion

Point the script at your own Maester or ZTA file. Note the .\ at the front, and that -Path takes the location of your result file. If that file is not in the SDK folder, give the full path to it, for example -Path C:\Users\you\Downloads\MaesterReport.json. Dragging the file from Explorer onto the terminal window types its full path for you.

Convert a Zero Trust Assessment report

.\ConvertTo-SiemservaNdjson.ps1 -Path ZeroTrustAssessmentReport.json

Converted 116 findings (ZeroTrust) -> Siemserva_ZeroTrust_20260401_123525.json

Convert a Maester report

.\ConvertTo-SiemservaNdjson.ps1 -Path MaesterReport.json

Converted 89 findings (Maester) -> Siemserva_Maester_20260401_123526.json

How to know it worked

A line like the ones above appears, naming how many findings it converted and the new file it created. Write that new file name down, because you type it in Parts 3 to 5. It is saved next to the file you converted, and it always starts with Siemserva_. If you get no such line, the conversion did not run: go back to step 3.

Part 3

Import your Zero Trust Assessment results

ZTA results can enter Siemserva two ways. Direct import is the recommended default; the convert-and-pipe path is there when you want results on the live dashboard.

1

Direct import (recommended)

Point Siemserva at your ZTA output directory. No conversion step is needed.

Direct import

siemserva import-zta <directory>

With this method, ZTA results are stored in the Siemserva database, which means they contribute to historical trends across runs and are available to Claude over MCP (Part 7).

2

Optional: convert and pipe into a live dashboard

This method populates the live scan page with your ZTA results and is used to generate reports from them. First, convert your ZTA report with the SDK script, run from inside the SDK folder exactly as in Part 2:

Convert

.\ConvertTo-SiemservaNdjson.ps1 -Path ZTAReport.json

Converted 116 findings (ZeroTrust) -> Siemserva_ZeroTrust_20260401_123525.json

Next, start a dashboard instance listening on a named pipe. This is the two-window situation from Part 1: the dashboard takes over this window and stays running in it, so you will open a second window for the next command. Leave this one alone.

Terminal 1: start the dashboard instance

siemserva --reporter --reporter-dashboard --pipe my-scan

Open a second terminal window, move it into the folder holding the converted file, and pipe that file into the running dashboard. Replace the file name below with the one your own conversion printed.

Terminal 2: pipe the findings in

Get-Content Siemserva_ZeroTrust_20260401_123525.json | siemserva --reader --pipe my-scan

Findings stream into the dashboard immediately, sorted by Severity, exactly as they would during a native scan.

Which path when?

Use direct import to build up history and enable Claude MCP queries over your ZTA data. Use convert and pipe when you want this run's results live on the dashboard and in the report picker right now. To do both, run the one-line siemserva import-zta <directory> first, then use the two terminals above to convert and pipe the same report onto the dashboard.

Part 4

Import your Maester results

1

Convert the Maester report

Run the SDK converter against your Maester JSON report, from inside the SDK folder, with the .\ in front, exactly as in Part 2:

Convert

.\ConvertTo-SiemservaNdjson.ps1 -Path MaesterReport.json

Converted 89 findings (Maester) -> Siemserva_Maester_20260401_123526.json

2

Pipe it into the dashboard

Start a dashboard instance, or reuse the one from Part 3, then stream the converted file in.

Two terminals

# Terminal 1: start the dashboard instance
siemserva --reporter --reporter-dashboard --pipe my-scan

# Terminal 2: pipe the converted Maester findings into it
Get-Content Siemserva_Maester_20260401_123526.json | siemserva --reader --pipe my-scan

Part 5

Import SCuBA and generic JSON results

Results from CISA SCuBA, or any other tool that produces JSON, follow the same convert-and-pipe path as Maester: convert the report, then stream the converted file into a running dashboard instance. As before, the converter runs from inside the SDK folder with .\ in front, the dashboard needs its own terminal window, and you substitute the file name your own conversion printed.

Convert, then pipe

.\ConvertTo-SiemservaNdjson.ps1 -Path ScubaResults.json
Get-Content Siemserva_Scuba_20260401_123527.json | siemserva --reader --pipe my-scan

Tip: combine sources

You can pipe converted Maester, ZTA, and SCuBA findings into the same dashboard instance, giving you a single Severity-ranked view, and a single report, across all of your assessment tools at once.

One dashboard, every source

# Terminal 1: one dashboard instance
siemserva --reporter --reporter-dashboard --pipe my-scan

# Terminal 2: pipe each converted file into the same instance
Get-Content Siemserva_ZeroTrust_20260401_123525.json | siemserva --reader --pipe my-scan
Get-Content Siemserva_Maester_20260401_123526.json | siemserva --reader --pipe my-scan
Get-Content Siemserva_Scuba_20260401_123527.json | siemserva --reader --pipe my-scan

Part 6

Review findings and generate reports

1

Navigate the dashboard

Imported findings appear in the live terminal dashboard sorted by Severity, so Critical and High items rise to the top. The essentials are below. There is a fuller dashboard guide in siemserva --full-help, but remember you cannot run that from inside the dashboard: use your second terminal window, or press Q twice to exit first.

Key	Action
Up / Down	Move the cursor through findings
Enter	Open full detail for the selected finding
/	Search findings
[ / ]	Cycle the Severity filter, for example show only High and above
I	Ask a plain-language question about your data
O	Open the current tab or finding as HTML in your browser
R	Open the report picker
?	Help overlay
Q	Quit (double-tap to confirm)

Findings carry a badge indicating their source, such as Maester or ZTA, so you always know which tool raised each item.

Top Priorities

Severity-sorted, source-badged

1. High Maester Default Authorization Settings 8 affected

Enabled self-service password reset for administrators. Review the finding and remediate per the source tool's guidance.

2. High Maester Consent Policy Settings 8 affected

Block user consent for risky apps is not configured explicitly. Review the finding and remediate per the source tool's guidance.

3. High Maester Authentication Method 6 affected

FIDO2 security key state is disabled. Review the finding and remediate per the source tool's guidance.

4. High ZTA Purview audit logging is enabled 1 affected

Purview audit logging is disabled, creating a visibility gap where unauthorized access, policy violations, and security incidents cannot be detected or investigated.

5. High ZTA Communication compliance monitoring is configured for Microsoft Copilot 1 affected

Communication compliance rules targeting Copilot content are not properly configured or enabled.

Illustration of the imported view: your own findings, counts, and sources will differ.

2

Pick a report

Press R from any tab. Siemserva offers seven report types, each written for a different audience. All seven can be generated from imported Maester and ZTA findings.

#	Report	Best for
1	Detailed	Sysadmins and security engineers: every finding, with technical drilldown
2	Compliance	Compliance officers: MCSB and SCuBA control status and gap analysis
3	Business Focused Review	VPs, CFOs, IT directors: business risk and investment decisions
4	Remediation	SOC and IT ops: priority-ordered fixes with step-by-step instructions
5	Audit	Security auditors: a formal, branded audit trail
6	Portfolio	MSPs and MSSPs: a multi-tenant view across managed clients
7	Patch & Vulnerability	Vulnerability management and endpoint teams: critical CVEs, exposed software, and patch priorities across the device fleet

Select a number and Siemserva generates a self-contained HTML file with embedded CSS, inline graphics, and no external assets, then opens it in your browser. For a fixed copy, use your browser's Print, then Save as PDF.

New user tip

Coming from Maester or ZTA, start with the Remediation report: it turns your pass/fail results into a priority-ordered fix list your team can act on. The Detailed report gives the most complete technical detail.

3

Add AI insights (optional)

There are two ways to add AI analysis to a report. Run siemserva setup-ai once, then press R, pick a report, and press A so analysis streams directly into it. Without a key, press A to copy a PII-scrubbed prompt to your clipboard, paste it into any AI tool, copy the reply, and press Ctrl+V to import it before building the report. See works with any AI.

Privacy first

Before anything leaves your machine, all personally identifiable information (tenant names, user names, email addresses, and GUIDs) is replaced with anonymized session aliases. More on our approach in Senserva Trustworthy AI.

Part 7

Make this part of your regular Maester and ZTA runs

Everything so far was a one-off import. To keep the data current, run the import step after each Maester or ZTA run. Four things become possible once you do that regularly, each optional.

1

Track posture over time

Each siemserva import-zta run lands in the Siemserva database, so successive ZTA runs build historical trends: watch findings close, catch regressions, and show measurable progress between assessments instead of comparing static reports by hand. Note that import-zta is specific to Zero Trust Assessment output; Maester, SCuBA, and generic JSON results enter through the converter as shown in Parts 4 and 5.

2

Share one set of data with your team

By default Siemserva stores data in a local SQLite file that only one person on one machine can see. Run siemserva setup-storage and choose Azure Tables to point the whole team at a shared remote backend, roughly $10 a month for typical usage, so everyone reviews the same imported findings from any machine. Credentials are saved only to an encrypted config, never in plaintext. See the shared cloud database.

3

Ask Claude about your findings (MCP)

Siemserva can run as a Model Context Protocol (MCP) server with 31 purpose-built tools, so Claude Desktop or the Claude Code CLI can query your imported data in plain English, including the ZTA results you stored with direct import. More on Claude and MCP.

Prove it, then register it

# Prove the connection end to end with demo data (no login, no key)
siemserva demo claude

# Register the MCP server against your real data
siemserva --claude mcp-install   # Claude Desktop
siemserva --claude cli-install   # Claude Code (CLI)

Run it from the folder holding your scan files; the server auto-discovers every *.sqlite scan file in the working directory. Restart Claude and ask things like "Summarize the top 5 risks from my latest Zero Trust Assessment" or "Which Maester checks failed for Conditional Access?"

4

Optional: run Siemserva's own scans as well

When you want to go beyond your imported results, a single read-only Siemserva scan (siemserva --tenantids <your-tenant-id>) runs 650+ checks across 18 domains, covering identity and MFA, Conditional Access, PIM, applications, Intune devices, Defender, sign-in logs, and Purview, mapped automatically to MCSB and CISA SCuBA. It never modifies your tenant, and the results land in the same dashboard and reports as your Maester and ZTA imports. SIEM mode (siemserva --siem) rescans on a schedule. Browse the full checks catalog.

You are done

You have installed Siemserva, converted and imported your Maester and Zero Trust Assessment results, reviewed them by Severity in the live dashboard, and produced a shareable report, all without changing the free tools and processes you already rely on. From here:

Re-run import-zta after each ZTA run, and the converter after each Maester or SCuBA run, to keep trends and dashboards current.
Run siemserva --setup any time to reconfigure.
For deeper documentation, including the checks reference and the dashboard guide, run siemserva --full-help at a terminal prompt, with the dashboard closed or in a second window. It opens the complete guide in your browser.

How to import Maester and Zero Trust Assessment results into Siemserva by Senserva

What this guide covers

What you will accomplish

Install and launch

Get the SDK

Import ZTA results

Import Maester results

Generate reports

Go further

First, do you have results to import?

Before you begin

Install and launch

Download the binary

Open a terminal in the folder you saved it to

Run it for the first time

Complete the setup wizard

Get the SDK and conversion script

Write out the SDK

Find the folder it just created

Understand what you are about to run, and why it is not a command

Know what the converter accepts

Run your first conversion

Import your Zero Trust Assessment results

Direct import (recommended)

Optional: convert and pipe into a live dashboard

Import your Maester results

Convert the Maester report

Pipe it into the dashboard

Import SCuBA and generic JSON results

Review findings and generate reports

Navigate the dashboard

Pick a report

Add AI insights (optional)

Make this part of your regular Maester and ZTA runs

Track posture over time

Share one set of data with your team

Ask Claude about your findings (MCP)

Optional: run Siemserva's own scans as well

You are done

Related reading