Data Export and Import

📖 Canonical version: read this page on the official docs site — https://www.redamon.org/docs/data-export-and-import. The GitHub wiki is a mirror.

Data Export & Import

RedAmon provides multiple ways to export scan data, back up projects, and import previously exported projects. This page covers all export and import capabilities.

---

Scan Data Downloads

Each scanning module produces downloadable results from the Red Zone toolbar:

Module	Format	Button Location	Filename
Reconnaissance	JSON	Recon Actions group (blue) > Download icon	recon_{projectId}.json
GVM Vulnerability Scan	JSON	GVM group (red) > Download icon	gvm_{projectId}.json
GitHub Secret Hunt	JSON	Other Scans modal > GitHub Hunt > Download icon	github_hunt_{projectId}.json
Secret Multiscanner	JSON	Other Scans modal > Secret Multiscanner > Download icon	One file holding every configured source's findings

Download buttons only appear after the respective scan has completed.

Versioned graph snapshots. Scan Timeline keeps each full scan as an immutable graph version. The Recon Delta view can export a diff between any two versions as JSON (recon-delta-{from}-to-{to}.json), and the Version Manager lets you save the current graph as a version on demand.

---

Data Table Export

Every page-level table on the Attack Surface Graph supports three export formats: XLSX, JSON, and Markdown (MD). The three buttons sit next to each other in the table header bar.

Format	Use case	Notes
XLSX	Spreadsheets, pivot tables, sharing with non-technical stakeholders	Numbers, booleans and dates keep their native cell type for sorting/filtering. Cells that exceed Excel's 32 767-char limit are truncated; XML-illegal control characters (e.g. NUL bytes from raw banners) are stripped so Excel does not flag the file as corrupt.
JSON	Programmatic post-processing, diffing, ingestion into other tools	Native arrays/objects are preserved (no flattening), null-normalised, pretty-printed (2-space indent).
MD	Pasting into pentest reports, notes, GitHub issues, Slack	Renders as a GitHub-flavoured Markdown table. Pipes inside cells are escaped, newlines collapsed to spaces, multi-section docs (JS Recon) get ## Section headings per finding type.

All three buttons honour the current search/filter state — only visible/filtered rows are exported.

Tables that expose all three buttons

Tab / Sub-tab	XLSX filename	JSON filename	MD filename
Node Inspector (Data Table, default)	redamon-<nodetype>-<ts>.xlsx	redamon-<nodetype>-<ts>.json	redamon-<nodetype>-<ts>.md
All Nodes (Data Table)	redamon-data-<ts>.xlsx	redamon-data-<ts>.json	redamon-data-<ts>.md
JS Recon	js-recon-<ts>.xlsx	js-recon-<ts>.json	js-recon-<ts>.md
Red Zone sub-tables (Kill-Chain, Blast Radius, Secrets, Web Init Access, Net Init Access, Param Matrix, GraphQL, DNS Email, DNS Drift, Threat Intel, JS Dep Signals, Shared Infra, Subdomain Takeover, Web Cache Poisoning)	redzone-<slug>-<ts>.xlsx	redzone-<slug>-<ts>.json	redzone-<slug>-<ts>.md
Red Zone multi-sheet tables (AI Surface, AI Risk, Supply-Chain SCA), exports the ACTIVE sheet only	<table>-<sheet>-<ts>.xlsx	<table>-<sheet>-<ts>.json	<table>-<sheet>-<ts>.md

<ts> is YYYY-MM-DD-HH-MM-SS (UTC). For Node Inspector, <nodetype> is the lower-cased, dash-normalised type slug (e.g. domain, chain-step).

Node Inspector exports are scoped to the currently selected node type AND honor the user's column-visibility preferences — only visible columns are written, in display order (Name, then dynamic property columns alphabetically, then In/Out if visible). The JSON variant additionally includes a header object: { nodeType, generatedAt, columns, rows }. The Markdown variant uses # <NodeType> — Node Inspector Export as the title.

Step-by-step

1. Open the project on the Attack Surface Graph
2. Switch to the Table view using the view tabs below the toolbar
3. (Optional) pick a sub-tab — Node Inspector (default), All Nodes, JS Recon, or any Red Zone analytic
4. (Optional) filter the data using the search bar or node-type chips
5. Click XLSX, JSON, or MD in the header bar of the table
6. The browser downloads the file immediately — a toast confirms success or surfaces the error reason

Note: XLSX export validates the workbook before it leaves the browser; if a row contains data Excel cannot represent (e.g. corrupt UTF-8, raw binary), the file is repaired automatically rather than silently producing a file Excel refuses to open.

---

AI Agent Session Export

You can export any AI agent conversation as a Markdown report:

1. Open the AI Agent Drawer on the Red Zone
2. Load the conversation you want to export (or use the current one)
3. Click the download icon in the drawer header
4. A .md file downloads containing:
   • All user messages and agent responses
   • Thinking/reasoning steps
   • Tool executions with output
   • Findings and recommendations
   • Todo list states

---

Project Export

Export an entire project as a ZIP archive for backup or migration:

1. Go to the Projects page
2. Click on the project card to open its settings
3. Click the Export button
4. A ZIP file downloads containing:
   • Project configuration (all 180+ settings)
   • Conversation history with all messages
   • Neo4j graph data (all nodes and relationships)
   • Artifact files (scan results JSON files)

---

Project Import

Import a previously exported project:

1. Go to the Projects page
2. Click the Import Project button
3. Select the ZIP file from a previous export
4. The project is recreated with all its data:
   • Configuration settings are restored
   • Conversations are recreated
   • Graph nodes and relationships are re-imported
   • Artifacts are restored

Mutes travel with the graph. A muted finding stays muted after an import, with who muted it and why. A mute an external agent made over MCP also keeps the prefix of the access token that made it (muted_token), which is only the first characters of the token, never the token itself. In the imported project those prefixes belong to the exporting account's tokens, so the Token filter in Muted Nodes lists them even though no token of yours matches.

A Multi mute keeps its batch id (mm- followed by eight hex characters) in the same muted_token field. It is a random label that groups the findings muted from one suggestion, not a credential, so it is harmless in an export. In the imported project it still groups those mutes in Muted Nodes.

Jev engine choices are kept. A recon AI hook set to the TypeSafe Jev engine in the exported project stays on Jev after the import, even when your account has no Jev token. It then uses its static fallback at scan time, and the project form shows a No Jev token badge on it until you add a token or switch the hook back to the LLM. The token itself is never part of an export.

Note: On import, a new project ID is generated. The imported project will not conflict with existing projects even if the original still exists.

---

Neo4j Direct Access

For advanced users, the Neo4j graph database is directly accessible:

• Browser UI: http://localhost:7474 — Neo4j's built-in web interface for running Cypher queries
• Bolt protocol: bolt://localhost:7687 — for programmatic access from scripts or applications

Both ports are published on 127.0.0.1 only (not the LAN); reach them from the host.

Credentials: neo4j / your NEO4J_PASSWORD from .env. On a fresh install this is a strong value generated by redamon.sh; there is no insecure fallback, Compose refuses to start Neo4j if the variable is unset (${NEO4J_PASSWORD:?...}, STRIDE S13). Get it with grep '^NEO4J_PASSWORD=' .env.

---

Next Steps

• Red Zone — learn about the Data Table view
• Scan Timeline — version, diff, and schedule recon scans
• Troubleshooting — resolve common issues