Data Export & Import
RedAmon provides multiple ways to export scan data, back up projects, and import previously exported projects. This page covers all export and import capabilities.
Scan Data Downloads
Each scanning module produces downloadable results from the Red Zone toolbar:
| Module | Format | Button Location | Filename |
|---|---|---|---|
| Reconnaissance | JSON | Recon Actions group (blue) > Download icon | recon_{projectId}.json |
| GVM Vulnerability Scan | JSON | GVM group (red) > Download icon | gvm_{projectId}.json |
| GitHub Secret Hunt | JSON | Other Scans modal > GitHub Hunt > Download icon | github_hunt_{projectId}.json |
| Secret Multiscanner | JSON | Other Scans modal > Secret Multiscanner > Download icon | One file holding every configured source's findings |
Download buttons only appear after the respective scan has completed.
Versioned graph snapshots. Scan Timeline keeps each full scan as an immutable graph version. The Recon Delta view can export a diff between any two versions as JSON (
recon-delta-{from}-to-{to}.json), and the Version Manager lets you save the current graph as a version on demand.
Data Table Export
Every page-level table on the Attack Surface Graph supports three export formats: XLSX, JSON, and Markdown (MD). The three buttons sit next to each other in the table header bar.
| Format | Use case | Notes |
|---|---|---|
| XLSX | Spreadsheets, pivot tables, sharing with non-technical stakeholders | Numbers, booleans and dates keep their native cell type for sorting/filtering. Cells that exceed Excel's 32 767-char limit are truncated; XML-illegal control characters (e.g. NUL bytes from raw banners) are stripped so Excel does not flag the file as corrupt. |
| JSON | Programmatic post-processing, diffing, ingestion into other tools | Native arrays/objects are preserved (no flattening), null-normalised, pretty-printed (2-space indent). |
| MD | Pasting into pentest reports, notes, GitHub issues, Slack | Renders as a GitHub-flavoured Markdown table. Pipes inside cells are escaped, newlines collapsed to spaces, multi-section docs (JS Recon) get ## Section headings per finding type. |
All three buttons honour the current search/filter state — only visible/filtered rows are exported.
Tables that expose all three buttons
| Tab / Sub-tab | XLSX filename | JSON filename | MD filename |
|---|---|---|---|
| Node Inspector (Data Table, default) | redamon-<nodetype>-<ts>.xlsx | redamon-<nodetype>-<ts>.json | redamon-<nodetype>-<ts>.md |
| All Nodes (Data Table) | redamon-data-<ts>.xlsx | redamon-data-<ts>.json | redamon-data-<ts>.md |
| JS Recon | js-recon-<ts>.xlsx | js-recon-<ts>.json | js-recon-<ts>.md |
| Red Zone sub-tables (Kill-Chain, Blast Radius, Secrets, Web Init Access, Net Init Access, Param Matrix, GraphQL, DNS Email, DNS Drift, Threat Intel, JS Dep Signals, Shared Infra, Subdomain Takeover, Web Cache Poisoning) | redzone-<slug>-<ts>.xlsx | redzone-<slug>-<ts>.json | redzone-<slug>-<ts>.md |
| Red Zone multi-sheet tables (AI Surface, AI Risk, Supply-Chain SCA), exports the ACTIVE sheet only | <table>-<sheet>-<ts>.xlsx | <table>-<sheet>-<ts>.json | <table>-<sheet>-<ts>.md |
<ts> is YYYY-MM-DD-HH-MM-SS (UTC). For Node Inspector, <nodetype> is the lower-cased, dash-normalised type slug (e.g. domain, chain-step).
Node Inspector exports are scoped to the currently selected node type AND honor the user's column-visibility preferences — only visible columns are written, in display order (Name, then dynamic property columns alphabetically, then In/Out if visible). The JSON variant additionally includes a header object:
{ nodeType, generatedAt, columns, rows }. The Markdown variant uses# <NodeType> — Node Inspector Exportas the title.
Step-by-step
- Open the project on the Attack Surface Graph
- Switch to the Table view using the view tabs below the toolbar
- (Optional) pick a sub-tab — Node Inspector (default), All Nodes, JS Recon, or any Red Zone analytic
- (Optional) filter the data using the search bar or node-type chips
- Click XLSX, JSON, or MD in the header bar of the table
- The browser downloads the file immediately — a toast confirms success or surfaces the error reason
Note: XLSX export validates the workbook before it leaves the browser; if a row contains data Excel cannot represent (e.g. corrupt UTF-8, raw binary), the file is repaired automatically rather than silently producing a file Excel refuses to open.
AI Agent Session Export
You can export any AI agent conversation as a Markdown report:
- Open the AI Agent Drawer on the Red Zone
- Load the conversation you want to export (or use the current one)
- Click the download icon in the drawer header
- A
.mdfile downloads containing:- All user messages and agent responses
- Thinking/reasoning steps
- Tool executions with output
- Findings and recommendations
- Todo list states
Project Export
Export an entire project as a ZIP archive for backup or migration:
- Go to the Projects page
- Click on the project card to open its settings
- Click the Export button
- A ZIP file downloads containing:
- Project configuration (all 180+ settings)
- Conversation history with all messages
- Neo4j graph data (all nodes and relationships)
- Artifact files (scan results JSON files)
Project Import
Import a previously exported project:
- Go to the Projects page
- Click the Import Project button
- Select the ZIP file from a previous export
- The project is recreated with all its data:
- Configuration settings are restored
- Conversations are recreated
- Graph nodes and relationships are re-imported
- Artifacts are restored
Note: On import, a new project ID is generated. The imported project will not conflict with existing projects even if the original still exists.
Neo4j Direct Access
For advanced users, the Neo4j graph database is directly accessible:
- Browser UI:
http://localhost:7474— Neo4j's built-in web interface for running Cypher queries - Bolt protocol:
bolt://localhost:7687— for programmatic access from scripts or applications
Both ports are published on
127.0.0.1only (not the LAN); reach them from the host.
Credentials: neo4j / your NEO4J_PASSWORD from .env. On a fresh install this is a strong value generated by redamon.sh; there is no insecure fallback, Compose refuses to start Neo4j if the variable is unset (${NEO4J_PASSWORD:?...}, STRIDE S13). Get it with grep '^NEO4J_PASSWORD=' .env.
Next Steps
- Red Zone — learn about the Data Table view
- Scan Timeline — version, diff, and schedule recon scans
- Troubleshooting — resolve common issues