Understanding fingerprints

View as Markdown

runZero automatically builds fingerprints for every asset it discovers. A fingerprint describes how runZero identified a device, service, or operating system from the evidence it collected, and its attributes show what was matched and where it came from.

runZero relies on fingerprints to normalize your inventory, so it can correlate and deduplicate assets accurately across discovery sources.

How fingerprints work

During discovery, runZero gathers clues such as TCP banners, mDNS names, SMB negotiation data, and TLS certificates, then classifies each clue into one or more fingerprint categories.

Fingerprints are stored in the asset record under keys that follow this pattern:

fp.<category>.<attribute>

For example:

  • fp.os.source identifies which source provided the operating system fingerprint
  • fp.os.match shows the string or probe result matched to identify the OS
  • fp.hw.vendor lists the hardware vendor name

These values are visible in exports, the API, and internal datasets.

Refingerprinting and submitting improvements

If a fingerprint looks incorrect or incomplete, you can:

  • Refingerprint the asset to re-run fingerprinting for that asset with the latest detection logic. This can update the OS, hardware, type, category, and function fields.

  • Refingerprint in bulk by selecting one or more assets in the Asset Inventory and choosing Modify > Refingerprint assets, which re-runs fingerprinting against every selected asset with the latest detection logic.

  • Submit a fingerprint improvement to give feedback that helps improve fingerprinting accuracy. When submitting an improvement, you can specify:

    • Type (e.g., Server, Router)
    • Operating System (e.g., Windows 10, Ubuntu 22.04)
    • Hardware (e.g., VMware VM, Synology NAS)
    • Optional comments for additional context.

These improvements help refine fingerprinting logic in future releases and improve identification of similar devices.

Fingerprint categories

Each fingerprint category covers one area of asset identification. Common categories include:

Category Description Example sources
os Vendor, operating system, and version detected TCP banners, SMB, mDNS
hw Hardware and vendor identification SNMP, MAC lookup, integrations
type Asset type classification runZero service probe

Common fingerprint attributes

This table lists the fingerprint attributes seen in exports and the API.

Attribute Meaning Sample Values
fp.build Internal fingerprinting engine build version v4.0.251103.0-2fd02762da549a3e87ffb5b0649e1621011872dd
fp.hw.certainty Confidence level of hardware fingerprint 0.8, 1.0
fp.hw.cpe23 CPE 2.3 identifier for the hardware cpe:2.3:h:dell:optiplex_7080:-:*:*:*:*:*:*:*
fp.hw.device Detected hardware device type Laptop, Server, Switch
fp.hw.match Raw hardware identification string Dell Inc. OptiPlex 7080, HP ProLiant DL360
fp.hw.product Hardware product name OptiPlex 7080, ProLiant DL360, MacBookPro18,3
fp.hw.serialNumber Serial number extracted from hardware probe ABC123XYZ, VMware-564d4a4a
fp.hw.source Source that provided the hardware fingerprint SNMP, Intune, CrowdStrike, runZero
fp.hw.vendor Vendor identified from hardware data Dell, HP, Apple, Lenovo
fp.hw.version Hardware or firmware version string 1.0.3, rev A00
fp.os.build OS build number parsed from source data 22621, 19045, 22D68
fp.os.certainty Confidence level of OS fingerprint 0.95, 1.0
fp.os.cpe23 CPE 2.3 identifier for the operating system cpe:2.3:o:microsoft:windows_10:19045:*:*:*:*:*:*:*
fp.os.device Detected OS device type Desktop, Server, Mobile
fp.os.edition OS edition or variant Pro, Enterprise, Home
fp.os.match String matched to infer the OS Windows 10.0, Ubuntu 22.04, macOS 14.1
fp.os.product OS product name Windows 10, Ubuntu, macOS
fp.os.source Source that provided OS identification runZero, MDNS, Intune, AzureAD
fp.os.vendor Vendor identified from OS data Microsoft, Canonical, Apple
fp.os.version OS version parsed from matched data 10.0.19045, 22.04, 14.1
fp.type.source Source that provided type classification runZero, Integration, Hostname, AzureAD

Using fingerprints in queries

During asset processing, runZero normalizes these fp.x.y values into the os, os_version, hw, and type attributes.

Some sample searches using the normalized attributes:

  • Windows os assets

    os:windows

  • Ubuntu assets running os_version less than 20.04

    os_version:<20.04 os:ubuntu

  • Assets with Dell hardware

    hw:dell

  • Assets with the type server

    type:server

Troubleshooting fingerprints

To track down why a fingerprint is wrong or incomplete:

  1. Check which fp.*.source values contributed to the identification. Multiple integrations or probes may overlap.
  2. Review recent discovery runs to confirm whether an updated probe result is available.
  3. Consider enriching the asset with integration data sources (e.g., Intune, CrowdStrike) to improve fingerprint accuracy.

If you run a self-hosted instance or the standalone scanner, you can also write your own custom fingerprints.

Updated