Command result processing

Reconmap can parse the output of many security tools, and incorporate their results in one of your projects. The instructions below show how to do so step by step.

When you initiate a scan under Scans -> Run scan and provide a URL as the target, Reconmap will automatically create a URL asset (type url) for the selected project if it does not already exist.

Everything a parser finds is stored as a tree of assets: re-running a scan does not duplicate what is already there, it only refreshes when each asset was last seen.

Step 1 - Choose a command under Scans

Reconmap has built-in, code-defined commands and usages. You do not need to manually configure executable paths or associate output parsers. Go to the Scans page and select the command you want to run. Choosing the specific command usage is handled internally and determined automatically by the system's LLM.

Reconmap supports several built-in output parsers, including: * Sarif: Parses Static Analysis Results Interchange Format (SARIF) JSON files (e.g. produced by gosec, semgrep, trivy, or gitleaks). It extracts findings, maps severity levels to Reconmap risk levels, maps source code locations to proof of concepts, and copies rule details/descriptions. * CycloneDX: Parses CycloneDX Software Bill of Materials (SBOM) JSON files (e.g. produced by syft or trivy). It extracts packages/dependencies as assets and embeds finding scanner disclosures as linked findings. * Nmap: Parses Nmap XML files to extract hosts as assets, with their open ports (for example 443/tcp, including the detected service and version) nested under them. * Shcheck: Parses security header analysis findings. * Subfinder: Parses subdomain discovery outputs. * Testssl: Parses SSL/TLS configuration test outputs.

Step 2 - Running the command and uploading the results

All scans now require a selected target project where the findings will be saved. When configuring a run, choose the target project from the project dropdown. The previously available "Findings storage action" option has been removed, making the project selection mandatory for all scan executions.

Run the command from the Scans page using the integrated web terminal (connected to a Reconmap runner). The runner will execute the command, capture the output, and automatically upload the results to the server for processing. Manual execution via a local rmap command line client is not supported.

Step 3 - Waiting for results

The file is now on the system and will be processed in the background. Findings and assets found in the scan output file are created automatically on the selected Reconmap project.