Request a demoDemo
Menu

Connect · CSV and NDJSON exports

The same columns everywhere, and every export on the record.

Seven lists download as formula-safe CSV or NDJSON with the same columns everywhere, and every export from the interface is logged.

Request a demoTechnical detail
Status
Available
Screens
Designed, not built yet
Command line
appliance export

The problem

Banks and MSPs feed spreadsheets, BI tools and SIEMs. Exports from security tools are often inconsistent from one list to the next.

And a CSV file is a common way to smuggle a formula into someone’s spreadsheet.

How it works, illustrated

appliance export -data-dir /var/lib/appliance -list devices -format ndjson -out devices.ndjson# read-only; prints the row count and the file's SHA-256# -out creates a new file and never overwrites one# lists: devices, alerts, decisions, audit, coverage, polls, reviews
Command-line usage from the appliance’s reference.

Devices, alerts, decisions, audit, coverage, polls and reviews. Download them from the data routes today, or schedule them on the box from the command line.

Export menus on every list arrive with the new interface.

How it works

  • The same column name means the same thing in every list, and every time is in UTC.
  • A cell a spreadsheet would treat as a formula gets a leading apostrophe, even when a tab or a full-width equals sign hides it. Packs, exports and the verifier share one function for this.
  • The audit list in NDJSON carries each entry exactly as hashed, so you can re-hash the log from it.
  • Lists are streamed, so memory stays flat on large ones.
  • Viewers cannot export, and exports are rate-limited per account.

What it proves

An examiner can tie any spreadsheet the bank hands over to a log entry, by its SHA-256.

What it records

Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.

  • list_exportedThe list, format, window, row count, bytes and SHA-256 of exactly what was sent, and whether the download completed.

Limits

What it does not do yet, stated plainly. The technical page lists every known gap.

  • Exports from the command line are not logged, because a second process must not write to the log the running appliance owns.
  • Reconcile list downloads are not logged yet.

Technical detail

Docs · Feature referenceCSV and NDJSON exports: how it is builtWhat it does, how it works, what it records, security notes, limits and known gaps, the command line, data routes and the review summary.

Also in Connect

Reconcile against IT’s lists

Compares the wire with Active Directory, Entra ID, Intune, CrowdStrike, Defender and DHCP lists. An import never approves a device.

Integrations

Sends alerts to Splunk, Microsoft Sentinel, syslog (CEF, LEEF), Teams, Slack, ServiceNow, ConnectWise, Autotask, HaloPSA, PagerDuty, email and your NMS (SNMP informs or traps), filtered per destination, and streams the evidence log to Splunk, Sentinel, syslog and signed webhooks.

Your policy, measured

Time to detect, time to decision, coverage over time and policy pass or fail, measured from the signed log against the targets your board set.

Early access: now taking pilot customers.

See it on your own network.

A live demo with the engineers who built it. We bring a simulated network; you bring your questions.

Request a demoDocumentation