Network discovery
runZero gathers asset data through unauthenticated active scanning, passive traffic sampling, and inbound integrations.
Active scanning
The runZero Explorer and scanner run unauthenticated active scanning against the networks you specify, using the configuration you set. They use several network protocols to discover and fingerprint the assets connected to the network.
You can run an active scan once or on a schedule, and scan templates keep the settings consistent across scan tasks.
Traffic sampling
An Explorer can passively sample traffic in your environment to identify the assets communicating across your networks. You configure traffic sampling per Explorer on the Explorer details page. When a scan task arrives, the Explorer automatically pauses traffic sampling to handle it, then resumes parsing sniffed traffic once the scan completes.
Traffic sampling can also ingest a PCAP file and pull asset data from it.
Inbound integrations
Inbound integrations with many platforms enrich your runZero asset context and give you insight into coverage and capabilities. You configure an integration as either a connector or a scan task.