📖 Canonical version: read this page on the official docs site — https://www.redamon.org/docs/insights-dashboard. The GitHub wiki is a mirror.

The Insights Dashboard (/insights) provides a comprehensive analytics view of your project's security posture. It aggregates data from reconnaissance, vulnerability scanning, AI agent activity, and attack chain execution into interactive charts, KPI cards, and detailed tables — giving you a single-pane-of-glass overview of your entire engagement.

1. Select a project from the Project Selector in the top navigation bar
2. Click "Insights" (the trending-up icon) in the navigation bar
3. The dashboard loads all analytics data for the selected project

If no project is selected, a prompt will guide you to the Projects page.

The header displays the project name, target domain (or IP mode indicator), and a Refresh button to manually reload all analytics data. A loading indicator appears while data is being fetched.

The top row shows 10 cards summarizing key metrics at a glance. These update in real time and provide immediate situational awareness.

The pipeline status cards show a colored dot indicator:

• Gray — Idle
• Blue (blinking) — Running or Starting
• Green — Completed
• Red — Error or Failed
• Yellow — Paused

The first section below the KPI cards provides a high-level risk overview through three complementary charts. Together they answer: how exposed are we?, how bad is it?, and how far did attackers get?

A 6-axis radar chart showing the overall risk profile normalized to 0–100 on each axis. Each axis uses logarithmic normalization (min(100, scale × ln(value + 1))) so that both small and large targets produce meaningful scores without saturation.

Reading the radar: Attack Surface, Vuln Density, Exploitability, and Injectable are "higher = worse" axes. Cert Health and Sec Headers are "higher = better" axes. A compact shape close to the center indicates a well-defended target.

A single composite score from 0 to 100 displayed as a semicircle gauge. It aggregates 12 weighted risk signals into one number using a logarithmic scale: score = min(100, 15 × ln(raw + 1)).

Score thresholds:

The logarithmic scale means the first few findings raise the score rapidly, but it progressively takes more risk signals to push higher. A score of 100 indicates severe, multi-vector exposure.

A funnel chart showing how many attack chain steps were executed at each phase of the kill chain, visualizing the narrowing from reconnaissance through exploitation to post-exploitation.

Each funnel segment shows the total steps for that phase. Hover to see how many steps succeeded versus total. A wide top narrowing to a small bottom indicates strong defenses; a wide funnel throughout indicates the agent progressed easily through all phases.

The funnel data comes from AttackChain → ChainStep phase progression. If no attack chains have been run, this chart shows "No data available."

This is the most data-rich section, covering all aspects of AI-driven attack chain execution. It draws data from six node types: AttackChain, ChainStep, ChainFinding, ChainDecision, ChainFailure, and ExploitGvm.

A donut chart showing the distribution of attack chain statuses (e.g., completed, running, failed, aborted). Provides a quick read on how many chains reached their objectives versus those that stalled or failed.

Breaks down all chain findings by their type — such as exploit_success, credential_found, info_disclosure, misconfiguration, and others. Each bar is colored by finding type, making it easy to see what classes of findings the agent is producing.

A severity donut (critical / high / medium / low / info) specifically for chain findings, separate from the vulnerability severity in the Vulnerabilities section. Shows how severe the agent's findings are.

Shows how many steps were executed in each attack phase (informational, exploitation, post_exploitation) and how many succeeded. Each phase shows a stacked bar with total steps and successful steps, revealing where the agent is spending effort and where it succeeds.

A detailed card list of every successful exploit achieved by the AI agent. Each card displays:

This card only appears when exploit successes exist.

Shows the breakdown of AI agent decisions by type — such as escalate, pivot, skip, retry, abort. Reveals the agent's strategic reasoning patterns during chain execution.

Displays the most-attacked targets (hosts/IPs) with dual metrics: total attack steps directed at each target and how many succeeded. Helps identify which targets received the most attention from the agent.

Only shown when GVM-confirmed exploits exist. Lists each exploit with:

A sortable table of the top 20 chain findings, ranked by severity. Columns include:

A 4-column Sankey diagram visualizing theoretical vulnerability chains from the CVE intelligence graph:

Technology → CVE → CWE → CAPEC

Link width represents connection frequency. Hover any node to highlight connected paths. Top 10 nodes per column are shown.

This shows what could be attacked based on known vulnerability intelligence.

A 4-column Sankey diagram visualizing actual attack chain execution paths:

Target → Tool → Finding → Severity

Also includes GVM-confirmed exploits (ExploitGvm nodes) as openvas → exploit_success → critical flows.

This shows what actually happened during AI agent attack chains and GVM scanning — the real execution trace.

Lists each attack chain with its title, status, and metrics (steps, findings, failures). Below the chain list, a Tool Usage table shows which tools the agent used, how many times, and their success rate.

Breaks down failure types encountered during chain execution (e.g., timeout, connection_refused, auth_failed, exploit_failed). Helps identify systemic issues or well-defended targets.

Provides a detailed view of the discovered attack surface from reconnaissance.

Distribution of discovered services (HTTP, HTTPS, SSH, FTP, etc.) showing which service types are most prevalent across the attack surface.

Top ports by frequency. Shows which ports are most commonly open across all discovered hosts.

A treemap visualization of detected technologies (web servers, frameworks, CMSes, programming languages). Area represents relative prevalence.

Breakdown of DNS record types discovered (A, AAAA, CNAME, MX, TXT, NS, etc.).

Shows all HTTP headers found across scanned URLs, colored by whether they are security-relevant headers (green) or standard headers (blue). Based on actual Header nodes and their is_security_header property in the graph.

Categorizes discovered headers into groups (security, caching, CORS, content-type, etc.) to show the overall header landscape.

Proportion of IPs served through CDN providers versus directly exposed. Useful for understanding how much of the infrastructure is shielded.

Groups discovered endpoints by category (API, static assets, admin panels, authentication, etc.).

Distribution of endpoint types (pages, APIs, resources, redirects, etc.).

Analyzes discovered parameters by type and context (query parameters, form fields, path parameters) — useful for identifying potential injection points.

Shows which IP addresses host the most services/subdomains, revealing infrastructure concentration points.

Aggregates all vulnerability data from GVM scanning, CVE correlation, and other sources.

Distribution of vulnerability severity levels (critical, high, medium, low) from all scanning sources.

Severity distribution specifically for matched CVEs, which may differ from vulnerability severity due to CVSS scoring.

Histogram of CVSS scores across all CVEs, showing the score distribution in bins (0-1, 1-2, ... 9-10).

Breakdown of where vulnerabilities were found — GVM scanner, AI agent findings, reconnaissance, etc.

Detailed count of findings per scanning source/tool.

Groups findings by vulnerability category (injection, XSS, misconfig, information disclosure, etc.).

Top CWE (Common Weakness Enumeration) identifiers found across all CVEs, showing the most common weakness patterns.

Which hosts/targets have the most vulnerabilities, helping prioritize remediation efforts.

Shows which technologies (and versions) have the most associated CVEs. Bars are colored by the highest severity CVE for that technology. Data from Technology-[:HAS_KNOWN_CVE]->CVE relationships.

CAPEC attack patterns linked to discovered CVEs via the CVE-[:HAS_CWE]->MitreData-[:HAS_CAPEC]->Capec chain, revealing what types of attacks the target is susceptible to.

A Recharts scatter chart plotting each CVE to identify the danger zone — vulnerabilities that are both high-severity AND have known attack patterns.

CVEs are aggregated by unique cveId from the cveChains data. Pentesters should focus on the top-right quadrant (high CVSS + many attack patterns) — especially those with a red ring (confirmed exploitable).

A rose/polar diagram showing vulnerability distribution across categories. Each radial bar represents a category (sqli, xss, rce, misconfig, info-disclosure, etc.) with bar height proportional to finding count.

Data source: Vulnerability and SecurityCheck findings grouped by category. Top 8 categories are shown with palette-cycled colors. More visually striking than a standard bar chart for comparing category proportions.

A bubble chart ranking the 12 riskiest technologies by CVE volume and maximum CVSS score.

Data aggregated from cveChains: group by tech, count unique cveId, find max cvss. Helps prioritize which technologies to patch or replace first.

Only shown when exploit or GVM remediation data exists.

Lists publicly known exploits matching discovered CVEs, with links, source databases, and severity indicators.

Breakdown of GVM remediation recommendations by status or type.

Shows how many of the discovered vulnerabilities appear in CISA's Known Exploited Vulnerabilities catalog — a critical prioritization metric.

High-level structural analysis of the project's knowledge graph.

Top 10 node types by count (e.g., Endpoint, Parameter, Header, CVE, IP, Subdomain). Each bar is colored by the node type's palette color.

Top 10 nodes ranked by degree centrality (number of relationships). Reveals the most interconnected entities in your attack surface — often the most important targets. Colored by node type.

Tracks operational activity over the engagement timeline.

Time-series chart showing when remediations were created, helping track the pace of remediation efforts.

Timeline of AI agent conversations, showing when the agent was most active during the engagement.

Breakdown of remediations by their current status (pending, in progress, verified, etc.).

A Recharts stacked area chart showing cumulative vulnerability discovery over time, segmented by severity level.

Severity keys are dynamically detected from the data (any key besides date and count). Each area uses a gradient fill for visual depth.

Shows whether vulnerability discovery is accelerating or plateauing — key for tracking pentest progress. A flat line indicates scanning has reached diminishing returns; a steep rise means new attack vectors are still being found.

Only shown when GitHub secret hunting has been performed and produced results.

• All data hooks use React Query with configurable stale times (typically 30 seconds)
• The Active Shells card refreshes every 15 seconds automatically
• Pipeline status cards update in near real-time via polling
• Use the Refresh button in the header to force-reload all sections simultaneously

The Insights Dashboard pulls data from four API endpoints, each querying the Neo4j graph and/or PostgreSQL database:

Technology -[:HAS_KNOWN_CVE]-> CVE -[:HAS_CWE]-> MitreData -[:HAS_CAPEC]-> Capec
IP -[:HAS_PORT]-> Port -[:RUNS_SERVICE]-> Service
BaseURL -[:HAS_ENDPOINT]-> Endpoint -[:HAS_PARAMETER]-> Parameter
Vulnerability -[:AFFECTS_PARAMETER]-> Parameter  (marks injectable)
BaseURL -[:HAS_CERTIFICATE]-> Certificate
IP -[:HAS_CERTIFICATE]-> Certificate  (GVM-discovered)
BaseURL -[:HAS_HEADER]-> Header  (is_security_header flag)
AttackChain -[:HAS_STEP]-> ChainStep -[:PRODUCED]-> ChainFinding
ChainStep -[:STEP_TARGETED]-> IP/Subdomain/Port
ChainStep -[:STEP_EXPLOITED]-> CVE
ChainStep -[:STEP_IDENTIFIED]-> Technology
ChainFinding -[:FOUND_ON]-> IP/Subdomain
ChainFinding -[:FINDING_RELATES_CVE]-> CVE
ExploitGvm -[:EXPLOITED_CVE]-> CVE

• Empty states: Charts gracefully show "No data available" when there is no data for that metric. This is normal for a fresh project before running any scans.
• Conditional sections: Some rows (GVM Exploits, Known Exploits, GitHub Intelligence) only appear when relevant data exists, keeping the dashboard clean.
• Tooltips: Hover over any chart bar or segment to see exact values. Tooltips adapt to your current theme (light or dark).
• Color consistency: Node types use consistent colors across all charts (Nodes by Type, Most Connected Nodes, and the Red Zone). Severity levels (critical/high/medium/low) also use a consistent palette throughout.
• Theme support: All charts use chartTheme.ts utilities (getChartPalette(), getChartChrome(), severityColor()) and respond to light/dark theme changes via the useTheme hook.

• Red Zone — Explore your attack surface visually
• AI Agent Guide — Learn how the AI agent executes attack chains
• EvoGraph — Attack Chain Evolution — Visualize how attack chains evolve over time
• Agent Skills — Built-in and user-defined agent skill workflows