External reporting

Platform

External reporting lets you package a dashboard, an inventory view, or a runZero report into a point-in-time snapshot and share it with people who do not have a runZero account. Recipients open a link, verify their email address, and view the snapshot in a read-only browser page. Snapshots are immutable, scoped to the organizations you select, and can be regenerated on a recurring schedule.

External reporting is useful when you need to give executives, auditors, customers, or other teams an at-a-glance view of your asset inventory, security posture, or a specific report without provisioning runZero accounts for them.

What you can share

Two types of external reports are supported:

• Dashboard — any dashboard you can view, including cross-organization shared dashboards. The snapshot captures the dashboard widgets for a configurable date window.
• Inventory — an asset, software, service, or vulnerability inventory query, including the columns you have selected and the current sort order. The snapshot freezes the matching rows and serves them as a read-only table to the recipient.

Sharing a report

You can start an external report from anywhere in the runZero Console that displays one of the supported views:

• From a dashboard: open the dashboard and click the Share button in the header. This option is available on dashboards that can be shared, such as runZero-managed and cross-organization dashboards.
• From an inventory page: on the Assets, Software, Services, or Vulnerabilities page, run the query you want to share and use the Share button to create an external report. The current query, columns, and sort order are saved with the report.

The External Reports page lists all reports you have already created and lets you edit or delete them.

Share dialog options

When you create or edit an external report, the share dialog collects the following information:

• Report name — identifies the report in the runZero Console and appears in the email sent to recipients.
• Email recipients — one or more email addresses that should be notified each time a snapshot is generated. The notification email contains the link recipients use to access the report.
• Report frequency — how often the report regenerates. Choose One time for a single snapshot, or Daily, Weekly, or Monthly for a recurring schedule.
• Organizations (My Organizations view) — the organizations whose data should be included in the snapshot. You can only include organizations you have access to.
• Automatically include new organizations (My Organizations view) — when enabled, organizations created after the report is set up are automatically added to future runs of a recurring report, provided you have access to them.

Click Send report to save the configuration and queue the first snapshot. Snapshot generation runs in the background; the recipient email is sent as soon as the snapshot is ready.

How recipients view a report

When a snapshot is generated, each recipient receives an email containing a link to the report. The first time they open the link, recipients are asked to accept the runZero terms of service.

runZero then emails a single-use verification link to that address. Clicking the verification link confirms the recipient’s identity, sets a secure session cookie that lasts for 30 days, and redirects them to the report. While the cookie is valid the recipient can return to the same report (or any other report shared with the same email address by the same runZero account) without verifying again.

The verification link itself is short-lived and expires 30 minutes after it is sent. If a recipient does not click it in time, they can request a new one by reopening the report link and entering their email address again.

Recipients with a runZero account that has access to one of the report’s organizations can open the report directly using their existing session, without going through the email verification step.

Managing reports and snapshots

The External Reports page shows every external report your organization has created. Reports are grouped under three tabs:

• All — every external report.
• One-time — reports configured to run once.
• Recurring — reports configured to run on a daily, weekly, or monthly schedule.

Clicking a report opens its details page, which shows the report’s configuration along with a table of every snapshot that has been generated. From this page you can:

• Edit the parent report to change its name, recipients, schedule, date window, or organizations. Edits affect future runs only; existing snapshots are not modified.
• Delete the parent report. Deleting the parent stops future runs and removes all of its snapshots.
• Copy the share link for an individual snapshot.
• Revoke a snapshot’s access link. Revoking invalidates the URL so it can no longer be used to view the report, but leaves the snapshot record in place for auditing purposes.
• Delete an individual snapshot. Deleting a snapshot revokes its link and removes the captured data.

Each generated snapshot link is valid for 90 days from the time the snapshot is created. After that the link stops working automatically; recipients of recurring reports continue to receive a fresh link in each run’s email.

Security and access

External reporting is designed so that report data only ever leaves runZero through links you explicitly create:

• Cryptographic share links. Each snapshot link contains a 256-bit random token signed with a per-account HMAC key. Tampered or fabricated links are rejected without a database lookup.
• Email gate. Before a recipient can view a snapshot they must prove ownership of an email address by clicking a verification link sent to that address. Identity is then carried in a secure, account-scoped browser cookie.
• Organization access reconciliation. Each time a recurring report runs, runZero re-checks the original creator’s access to the report’s organizations. Organizations they no longer have access to are dropped from the snapshot. If they have lost access to all of the report’s organizations, the run is skipped.
• Audit events. Every successful access of an external report is recorded as an external-report-viewed event for each organization included in the snapshot. The event includes the recipient’s email address, IP, and user agent and is visible in the runZero activity log.
• Rate limiting. The public verification and access endpoints are rate limited to mitigate abuse.
• Revocation. You can revoke any snapshot link at any time from the report’s details page. Revoked links cannot be reactivated.