ZAP Reporting,
Alerts Triaged, Not Exported
Send OWASP ZAP requests and alerts into your engagement with the Neuron ZAP add-on, or import a HAR export. ZAP reporting with every alert in one triage queue.
Send It Once. It Is Already in the Report.
ZAP finds plenty. Its alerts, the requests that raised them, and the history you browsed through it all stay inside a ZAP session until someone exports a report and starts copying. The Neuron ZAP add-on sends them to the engagement instead.
Pair a ZAP session with an engagement and right-click any request in History, Sites, or Search to send it with its response. Alerts go to the Scan Issues triage queue, one scan issue per alert type with every affected path as a location, when you sync them or automatically as ZAP raises them.
Captured traffic somewhere else? Export the messages from ZAP as HAR and import the file with neuron import --source zap, or upload it on the engagement's Import page.
$ neuron import --source zap \ --tag staging acme-staging.har✓ 312 requests, 4 web apps, 61 endpoints $ neuron import --source zap acme-portal.har✓ 97 requests, 1 web app, 22 endpoints- 16:48 Finding SQL Injection in /api/orders
- 16:40 ZAP Alert: SQL Injection on /api/orders
- 16:31 ZAP 14 alerts synced to Scan Issues
- 16:20 Import ZAP: 312 requests, 4 web apps
Why ZAP Reporting Takes So Long
ZAP's reports are built to show everything ZAP found, which is not the same as what the client needs to read. Informational alerts sit next to the handful that matter, and the report has no idea which of them a tester has already confirmed.
So the alerts get triaged in a spreadsheet, the evidence gets copied out of the request and response panes, and the session cookie gets redacted by hand, if someone remembers. When two testers run ZAP against the same application, the same alert gets written up twice.
Then the retest arrives, and the ZAP session that held the original evidence was never saved.
Everything ZAP Produces, On the Engagement
Send from ZAP with the Neuron extension and it lands on the engagement as you test.
Requests and Responses
Requests sent from History, Sites, or Search, stored with their responses on the web app they belong to, so the evidence sits next to the finding it supports.
The Application Map
The site tree ZAP builds as you browse, recreated in the engagement as hosts, web apps, endpoints, and parameters.
ZAP Alerts
Alerts on in-scope web apps in the Scan Issues triage queue, one scan issue per alert type, with every path ZAP reported it on as a location. Alerts marked false positive in ZAP stay behind.
Redacted Evidence
Session cookies, authorization headers, API keys, and tokens are swapped for [REDACTED] by your HTTP redaction patterns before a ZAP request is stored.
A Neuron Context in ZAP
Sync scope and ZAP gets a context named Neuron holding the in-scope web apps, with out-of-scope apps excluded from it and from your own in-scope contexts.
Back to the Requester and Fuzzer
Open a stored request in ZAP's Requester or Fuzzer from Neuron, or start an active scan of an endpoint, with redacted cookies filled back in from ZAP's History.
How to Send ZAP Traffic to Neuron
- 01
Load the Neuron add-on
Download the add-on from Tools on your own Neuron server and load it in ZAP with File, Load Add-on File. It needs ZAP 2.16 or later. Then enter your Neuron server's address in the Neuron tab.
- 02
Pair and save the ZAP session
Choose Pair this session, check the code, and approve it in Neuron. Save the ZAP session to keep the pairing, and it reconnects to the engagement whenever you open it.
- 03
Send requests and alerts
Right-click requests in History, Sites, or Search and choose Send to Neuron, or press Ctrl+Shift+N. Sync alerts sends every in-scope alert, and automatic sending keeps new ones flowing as ZAP raises them.
- 04
Or import a HAR export
Export the messages from ZAP as HAR and import the file with --source zap, since a HAR file is not recognised from its content alone. The Import page takes it too, as an upload or pasted HAR.
$ neuron import --source zap acme-app.har
Your Infrastructure. Your Data.
The extension sends straight from ZAP to your own Neuron server. Requests, responses, and evidence stay inside your network and never pass through a third-party cloud.
From ZAPto the Final Report
ZAP alerts land in the same triage queue as every other scanner on the engagement, so they are reviewed side by side with everything else. Confirm the real ones, dismiss the noise, and promote them into findings with the affected paths already listed.
The Findings Library supplies approved descriptions and remediation, so the finding the client reads is in your team's language, not the scanner's default text.
During the retest, send the stored request back to ZAP's Requester, replay it with your current session, and send the new response to Neuron as proof of the fix.
ZAP Integration FAQ
The questions teams ask most about ZAP and Neuron.
How do I import OWASP ZAP results into a pentest report?
Install the Neuron ZAP add-on and pair your ZAP session with the engagement. Requests go in with a right-click, and ZAP alerts go to the Scan Issues triage queue, where confirmed alerts promote into findings. For traffic captured elsewhere, import a ZAP HAR export with neuron import --source zap.
Which ZAP export format does Neuron accept?
HAR, the HTTP Archive format ZAP exports messages in. Neuron creates hosts, web apps, endpoints, parameters, and stored requests from it, and raises web configuration issues such as missing HSTS or insecure cookies. ZAP alerts come in through the add-on rather than an XML or HTML report.
Which version of ZAP does the Neuron add-on need?
ZAP 2.16 or later. Load the .zap file with File, Load Add-on File, and load the newer file the same way when the Neuron tab says an update is available.
Will syncing ZAP alerts again undo our triage?
No. A scan issue someone has already triaged keeps its content and state, and only gains affected paths it did not have. Alerts marked as false positives in ZAP are never sent.
Can Neuron send requests back to ZAP?
Yes. Send to ZAP opens a stored request in the Requester, Send to ZAP Fuzzer opens an endpoint's newest request in the Fuzzer, and Scan in ZAP starts an active scan once you confirm it in ZAP. Neuron never sends a secret, and the add-on fills redacted cookies and headers back in from ZAP's History.
Where does ZAP data go?
To your own self-hosted Neuron server, on the engagement the ZAP session is paired with. Nothing passes through a third-party cloud.
More Neuron Integrations
Burp Suite Reporting and Findings Import
Web TestingCaido Reporting and HTTP History Import
Web TestingOpenAPI and Swagger Import for API Pentests
Web TestingNuclei Scan Reporting and Import
Web Testingffuf Reporting and Content Discovery Logging
Web TestingNikto Reporting and Output Import
Web TestingAcunetix Report Import for Pentest Reports
Web TestingInvicti and Netsparker Report Import
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform