Attack Surface Graph

RedAmon uses a Neo4j graph database as the single source of truth for every finding. The graph stores the complete topology of the target's attack surface as an interconnected knowledge graph, enabling both visual exploration in the webapp and intelligent querying by the AI agent.

Node Types

The graph contains 25 node types organized into eight categories.

Infrastructure Nodes

Represent the network topology:

Web Application Nodes

Represent the application layer:

Technology & Security Nodes

Represent detected software and security posture:

Vulnerability & Exploitation Nodes

Represent security findings and successful attacks:

JS Reconnaissance Nodes

Represent analyzed JavaScript files and their findings (hierarchical structure):

Each JS file becomes a JsReconFinding node with finding_type='js_file'. All findings, secrets, and endpoints from that file are linked to it -- not directly to Domain/BaseURL. Secrets and endpoints reuse the existing Secret and Endpoint node types with source='js_recon'. external_domain findings are the exception: they link directly to Domain since they have no single parent JS file. Phase 6 AI SDK findings ride on the existing JsReconFinding label with new finding_type values prefixed ai- — no new node labels, no parallel taxonomy.

Secret Multiscanner Nodes

Represent findings from the Secret Multiscanner. One scan node per project + source, so a Docker scan and a GitHub scan of the same project are two independent subgraphs:

Asset nodes are grouped by shape, not one label per source, so 14 sources produce 5 asset labels instead of 14. Findings are deduplicated on source + asset + location + line + detector, so the same secret found by two sources stays two findings: the second source's context is a separate fact.

Supply-Chain Nodes

Represent dependencies discovered by Supply-Chain Scanning and their malicious/suspicious verdicts. Shared by all three layers (L1 SBOM/repo audit, L2 live-target harvest, L3 agent tools), so the same package deduplicates onto one node no matter how it was found:

The CVE / GHSA half of an OSV verdict reuses the existing Vulnerability label with source='osv' (not a new node type), and a repository L1 scan anchors to the existing GithubRepository node shared with GitHub Secret Hunt. So only three labels are genuinely new.

Relationship Chain

The graph connects nodes through directed relationships that mirror real infrastructure:

Domain ──HAS_SUBDOMAIN──> Subdomain
Domain ──HAS_EXTERNAL_DOMAIN──> ExternalDomain
Subdomain ──RESOLVES_TO──> IP
IP ──HAS_PORT──> Port
Port ──RUNS_SERVICE──> Service
Port ──SERVES_URL──> BaseURL
Service ──POWERED_BY──> BaseURL
BaseURL ──HAS_ENDPOINT──> Endpoint
Endpoint ──USES_TECHNOLOGY──> Technology    [http_probe — incl. AI signatures]
Endpoint ──HAS_HEADER──> Header
Endpoint ──HAS_CERTIFICATE──> Certificate
Endpoint ──HAS_PARAMETER──> Parameter
Technology ──HAS_KNOWN_CVE──> CVE
CVE ──HAS_CWE──> MitreData
MitreData ──HAS_CAPEC──> Capec
Vulnerability ──FOUND_AT──> Endpoint
Vulnerability ──AFFECTS_PARAMETER──> Parameter
Vulnerability ──HAS_CVE──> CVE
IP/Subdomain/Domain ──HAS_VULNERABILITY──> Vulnerability

Nmap enrichment (service detection + NSE scripts):
Service ──USES_TECHNOLOGY──> Technology
Port ──HAS_TECHNOLOGY──> Technology
Vulnerability ──AFFECTS──> Port
Vulnerability ──FOUND_ON──> Technology

JS Reconnaissance (hierarchical: parent -> file -> findings):
BaseURL ──HAS_JS_FILE──> JsReconFinding(js_file)     [pipeline-crawled JS]
Domain  ──HAS_JS_FILE──> JsReconFinding(js_file)     [uploaded JS files]
JsReconFinding(js_file) ──HAS_JS_FINDING──> JsReconFinding
JsReconFinding(js_file) ──HAS_SECRET──> Secret        [source='js_recon']
JsReconFinding(js_file) ──HAS_ENDPOINT──> Endpoint    [source='js_recon']
Domain ──HAS_JS_FINDING──> JsReconFinding(external_domain)   [no single parent JS file]

Secret Multiscanner (one scan per project + source):
Domain ──HAS_MULTISCANNER_SCAN──> MultiscannerScan
MultiscannerScan ──HAS_ASSET──> MultiscannerRepository | MultiscannerImage | MultiscannerModel | MultiscannerBucket | MultiscannerEndpoint
<asset node> ──HAS_FINDING──> MultiscannerFinding

Supply-Chain scanning (L1 SBOM/repo audit + L2 live-target harvest):
Domain ──HAS_SBOM_DOCUMENT──> SbomDocument       [L1 upload anchor, when a Domain exists]
Domain ──HAS_REPOSITORY──> GithubRepository       [L1 repo anchor; GitHub Hunt reaches the same node via GithubHunt]
SbomDocument ──DEPENDS_ON──> Package               [L1 uploaded SBOM/lockfile]
GithubRepository ──DEPENDS_ON──> Package           [L1 cloned repo]
BaseURL ──DEPENDS_ON──> Package                    [L2 live target serves this dependency]
Package ──FLAGGED_AS──> MalPackageFinding          [malicious (OSV MAL-) / suspicious (GuardDog, typosquat)]
Package ──HAS_VULNERABILITY──> Vulnerability       [source='osv'; the CVE/GHSA half]
BaseURL ──CONTACTS_MALICIOUS_HOST──> ThreatPulse   [target contacted a host a published incident names]

EvoGraph bridges (attack chain → recon graph):
AttackChain ─ ─CHAIN_TARGETS─ ─> IP / Subdomain
ChainStep ─ ─STEP_TARGETED─ ─> IP / Port
ChainStep ─ ─STEP_EXPLOITED─ ─> CVE
ChainFinding ─ ─FOUND_ON─ ─> IP / Subdomain
ChainFinding ─ ─FINDING_RELATES_CVE─ ─> CVE

Vulnerability Source Differences

Vulnerabilities connect differently depending on their source:

Multi-Tenant Design

Every node includes user_id and project_id properties. All queries are automatically scoped to the current user and project — the AI agent never generates tenant filters itself, preventing accidental cross-project data access.

Query Pattern

MATCH (d:Domain {user_id: $userId, project_id: $projectId})
-[:HAS_SUBDOMAIN]->(s:Subdomain)
-[:RESOLVES_TO]->(ip:IP)
-[:HAS_PORT]->(p:Port)
RETURN d, s, ip, p

How the AI Agent Uses the Graph

Before taking any offensive action, the agent queries the graph to build situational awareness:

1. Attack surface mapping — queries the Domain → Subdomain → IP → Port → Service chain
2. Technology-CVE correlation — traverses Technology → CVE relationships, prioritizing by CVSS score
3. Injectable parameter discovery — queries Parameter nodes flagged as is_injectable: true
4. Exploit feasibility assessment — cross-references ports, services, and CVEs to find matching Metasploit modules
5. Post-exploitation context — after exploiting, creates a ChainFinding(exploit_success) in the EvoGraph, bridged to the target IP and CVE

The text-to-Cypher system includes 25+ example query patterns and automatically retries with error context on failure (up to 3 attempts).

Graph Visualization

The graph is visualized on the Red Zone:

• 2D mode — force-directed layout with pan, zoom, and node selection
• 3D mode — WebGL rendering with rotation for large graphs
• Render off — a persistent per-project switch that stops the graph being fetched or drawn at all, for projects large enough to slow the browser down; the data stays readable in the table views
• Color coding — each node type has a distinct color
• Filtering — use the bottom bar to show/hide specific node types
• Node drawer — click any node to see all properties

EvoGraph Bridge

The recon graph is connected to RedAmon's EvoGraph (Evolutive Attack Chain Graph) through bridge relationships. EvoGraph tracks everything the AI agent does during exploitation sessions — every tool execution, finding, decision, and failure — and bridges back to the recon graph nodes they relate to.

This means you can traverse from any recon graph node to see all attack chain activity that targeted it — enabling cross-session intelligence queries like "what has been tried against this IP?" or "which CVEs have been successfully exploited?".

Full details: See EvoGraph — Attack Chain Evolution for the complete attack chain graph schema, node types, and cross-session learning.

Next Steps

• Red Zone — learn how to explore the graph visually
• AI Agent Guide — see how the agent queries the graph
• EvoGraph — Attack Chain Evolution — understand the attack chain graph that bridges to the recon graph
• Scan Timeline — snapshot this graph as a version, activate past versions, and diff two scans (Recon Delta)
• Data Export & Import — export graph data