Data Export & Import

RedAmon provides multiple ways to export scan data, back up projects, and import previously exported projects. This page covers all export and import capabilities.


Scan Data Downloads

Each scanning module produces downloadable results from the Red Zone toolbar:

ModuleFormatButton LocationFilename
ReconnaissanceJSONRecon Actions group (blue) > Download iconrecon_{projectId}.json
GVM Vulnerability ScanJSONGVM group (red) > Download icongvm_{projectId}.json
GitHub Secret HuntJSONOther Scans modal > GitHub Hunt > Download icongithub_hunt_{projectId}.json
Secret MultiscannerJSONOther Scans modal > Secret Multiscanner > Download iconOne file holding every configured source's findings

Download buttons only appear after the respective scan has completed.

Versioned graph snapshots. Scan Timeline keeps each full scan as an immutable graph version. The Recon Delta view can export a diff between any two versions as JSON (recon-delta-{from}-to-{to}.json), and the Version Manager lets you save the current graph as a version on demand.


Data Table Export

Every page-level table on the Attack Surface Graph supports three export formats: XLSX, JSON, and Markdown (MD). The three buttons sit next to each other in the table header bar.

FormatUse caseNotes
XLSXSpreadsheets, pivot tables, sharing with non-technical stakeholdersNumbers, booleans and dates keep their native cell type for sorting/filtering. Cells that exceed Excel's 32 767-char limit are truncated; XML-illegal control characters (e.g. NUL bytes from raw banners) are stripped so Excel does not flag the file as corrupt.
JSONProgrammatic post-processing, diffing, ingestion into other toolsNative arrays/objects are preserved (no flattening), null-normalised, pretty-printed (2-space indent).
MDPasting into pentest reports, notes, GitHub issues, SlackRenders as a GitHub-flavoured Markdown table. Pipes inside cells are escaped, newlines collapsed to spaces, multi-section docs (JS Recon) get ## Section headings per finding type.

All three buttons honour the current search/filter state — only visible/filtered rows are exported.

Tables that expose all three buttons

Tab / Sub-tabXLSX filenameJSON filenameMD filename
Node Inspector (Data Table, default)redamon-<nodetype>-<ts>.xlsxredamon-<nodetype>-<ts>.jsonredamon-<nodetype>-<ts>.md
All Nodes (Data Table)redamon-data-<ts>.xlsxredamon-data-<ts>.jsonredamon-data-<ts>.md
JS Reconjs-recon-<ts>.xlsxjs-recon-<ts>.jsonjs-recon-<ts>.md
Red Zone sub-tables (Kill-Chain, Blast Radius, Secrets, Web Init Access, Net Init Access, Param Matrix, GraphQL, DNS Email, DNS Drift, Threat Intel, JS Dep Signals, Shared Infra, Subdomain Takeover, Web Cache Poisoning)redzone-<slug>-<ts>.xlsxredzone-<slug>-<ts>.jsonredzone-<slug>-<ts>.md
Red Zone multi-sheet tables (AI Surface, AI Risk, Supply-Chain SCA), exports the ACTIVE sheet only<table>-<sheet>-<ts>.xlsx<table>-<sheet>-<ts>.json<table>-<sheet>-<ts>.md

<ts> is YYYY-MM-DD-HH-MM-SS (UTC). For Node Inspector, <nodetype> is the lower-cased, dash-normalised type slug (e.g. domain, chain-step).

Node Inspector exports are scoped to the currently selected node type AND honor the user's column-visibility preferences — only visible columns are written, in display order (Name, then dynamic property columns alphabetically, then In/Out if visible). The JSON variant additionally includes a header object: { nodeType, generatedAt, columns, rows }. The Markdown variant uses # <NodeType> — Node Inspector Export as the title.

Step-by-step

  1. Open the project on the Attack Surface Graph
  2. Switch to the Table view using the view tabs below the toolbar
  3. (Optional) pick a sub-tab — Node Inspector (default), All Nodes, JS Recon, or any Red Zone analytic
  4. (Optional) filter the data using the search bar or node-type chips
  5. Click XLSX, JSON, or MD in the header bar of the table
  6. The browser downloads the file immediately — a toast confirms success or surfaces the error reason

Note: XLSX export validates the workbook before it leaves the browser; if a row contains data Excel cannot represent (e.g. corrupt UTF-8, raw binary), the file is repaired automatically rather than silently producing a file Excel refuses to open.


AI Agent Session Export

You can export any AI agent conversation as a Markdown report:

  1. Open the AI Agent Drawer on the Red Zone
  2. Load the conversation you want to export (or use the current one)
  3. Click the download icon in the drawer header
  4. A .md file downloads containing:
    • All user messages and agent responses
    • Thinking/reasoning steps
    • Tool executions with output
    • Findings and recommendations
    • Todo list states

Project Export

Export an entire project as a ZIP archive for backup or migration:

  1. Go to the Projects page
  2. Click on the project card to open its settings
  3. Click the Export button
  4. A ZIP file downloads containing:
    • Project configuration (all 180+ settings)
    • Conversation history with all messages
    • Neo4j graph data (all nodes and relationships)
    • Artifact files (scan results JSON files)

Project Import

Import a previously exported project:

  1. Go to the Projects page
  2. Click the Import Project button
  3. Select the ZIP file from a previous export
  4. The project is recreated with all its data:
    • Configuration settings are restored
    • Conversations are recreated
    • Graph nodes and relationships are re-imported
    • Artifacts are restored

Note: On import, a new project ID is generated. The imported project will not conflict with existing projects even if the original still exists.


Neo4j Direct Access

For advanced users, the Neo4j graph database is directly accessible:

  • Browser UI: http://localhost:7474 — Neo4j's built-in web interface for running Cypher queries
  • Bolt protocol: bolt://localhost:7687 — for programmatic access from scripts or applications

Both ports are published on 127.0.0.1 only (not the LAN); reach them from the host.

Credentials: neo4j / your NEO4J_PASSWORD from .env. On a fresh install this is a strong value generated by redamon.sh; there is no insecure fallback, Compose refuses to start Neo4j if the variable is unset (${NEO4J_PASSWORD:?...}, STRIDE S13). Get it with grep '^NEO4J_PASSWORD=' .env.


Next Steps