Data import wizard format

The Data Wizard creates objects in bulk from an Excel workbook. This page is the format reference it links to: which columns each object type accepts, which values those columns take, and what happens when a cell is blank. Fields marked with an asterisk are mandatory and have no fallback.

Where to find it

Extra → Data Wizard. Accepted files are .xls and .xlsx.

How an import runs

1. Select your file and make sure it matches the format below.

2. Choose the corresponding model — Assets, Users, Applied controls, Perimeters, Compliance assessment or Findings assessment.

3. Select the scope. Depending on the model you pick, the form asks for a fallback Domain, a Perimeter, or a Framework; the fields that do not apply are greyed out.

4. Click Upload and confirm the warning.

Rows are processed one by one. A row that fails validation is reported and skipped; the rest of the file still imports.

Caution

An import creates many objects at once, possibly across several domains, and there is no undo. Test on a handful of rows first, and take a backup before a large run.

Domains and permissions

If the object type supports a domain column, the wizard puts each row in the domain named there, provided you have permission to create objects in it. When the column is absent or the cell is empty, the row falls back to the domain selected on the wizard form.

Assets

Column	Notes
ref_id	Your own reference. Needed if other rows point at this asset as a parent.
name*
description
domain	Falls back to the wizard’s domain.
type	PR (primary) or SP (supporting); primary and support are also accepted. Defaults to supporting.
business_value
reference_link	Also accepted as link.
observation
is_business_function	true or yes for true.
filtering_labels	Pipe- or comma-separated label names; also accepted as labels or label.
asset_class	Also accepted as class. Unknown values are reported as a warning.
security_objectives	confidentiality: 3, integrity: 2, availability: 1 — values on your configured scale.
disaster_recovery_objectives	rto: 1h01m01s, rpo: 2h01m01s, mtd: 3h.
parent_assets	Comma- or pipe-separated ref_id values of parents in the same domain.

Parent links are resolved in a second pass after every asset in the file exists, so a row may name a parent that appears further down. On a supporting asset, the two objective columns are stored as capabilities rather than objectives.

Applied controls

Column	Notes
ref_id
name*
description
domain	Falls back to the wizard’s domain.
status	to_do, in_progress, on_hold, active, degraded, deprecated. Defaults to to_do.
category	policy, process, technical, physical, procedure.
priority	Integer 1 to 4.
csf_function	govern, identify, protect, detect, respond, recover. Defaults to govern.
effort	XS, S, M, L, XL; full names such as Extra Small are accepted.
control_impact	Integer 1 to 5, or very low to very high. Also accepted as impact.
start_date, eta, expiry_date	Dates, YYYY-MM-DD.
link
observation
filtering_labels	Pipe- or comma-separated label names.
reference_control	Looked up by ref_id. Also accepted as reference_control_ref_id.
owner	Semicolon-separated user emails and team names.
cost_currency	Defaults to the instance currency.
cost_amortization_period	Integer; defaults to 1.
cost_build_fixed, cost_build_people_days	Numbers; default to 0.
cost_run_fixed, cost_run_people_days	Numbers; default to 0.

Owners are matched first as a user email, then as a team name. An entry that matches neither is skipped with a warning rather than failing the row, so create the users and teams first.

Perimeters

Column	Notes
ref_id
name*
description
domain	Falls back to the wizard’s domain.
status	undefined, in_design, in_dev, in_prod, eol, dropped. Also accepted as lc_status; defaults to in_design. The display labels (Design, Development, Production, EndOfLife, Dropped) are accepted too. An unrecognised value fails the row rather than being guessed.
default_assignee	Semicolon-separated user emails and team names.

If the default_assignee column is present but empty, the existing assignees are cleared. Leave the column out entirely to keep them.

Audits

Do not hand-build this file. Load the framework, open it under Catalog → Frameworks, and use the Excel export button — the template then carries the exact requirement references the audit expects.

Column	Notes
urn*
ref_id*
assessable	Rows that are not assessable are skipped.
name, description	Not imported; they exist so you can see which row you are on.
compliance_result	not_assessed, partially_compliant, non_compliant, compliant, not_applicable.
requirement_progress	to_do, in_progress, in_review, done.
score	Within the requirement’s effective scale.
implementation_score, documentation_score	Fill both to import a split score; the audit starts showing the documentation score.
is_score_overridden	true/yes/1 or false/no/0. Only meaningful on requirements with questions.
observations
answers	Answers to the requirement’s questions.

Matching is by ref_id first, falling back to urn. A row matching neither is skipped. Only cells that hold a value are written, so blanks never wipe existing answers.

Findings

Column	Notes
ref_id
name*
description
severity	info, low, medium, high, critical.
status	identified, confirmed, dismissed, assigned, in_progress, mitigated, resolved, closed, deprecated.
priority	Integer 1 to 4.
eta, due_date	Dates, YYYY-MM-DD.
observation
filtering_labels	Multiple labels separated by a pipe character, for example internal|pentest.
vulnerabilities	Pipe- or comma-separated vulnerability names.
asset	A single asset name or ref_id, looked up in the domain.

Findings land in a findings binder: pick the perimeter on the wizard form and one is created for the import, or target an existing binder. A finding carries one asset, so if the cell lists several, only the first is linked and the row is reported as a warning.

Users

Column	Notes
email*	Also the matching key — an existing user with the same address is reused.
first_name
last_name

Importing users creates accounts but grants nothing. Assign them to user groups afterwards.

Related

• Data wizard — the module itself.
• Domains — the scope every row lands in.
• Users and User groups — after a user import.
• Frameworks — where the audit template comes from.