Managing Explorers

The runZero Explorer is a lightweight scan engine for network and asset discovery. You should have at least one Explorer deployed, and once you do, you manage your Explorers from the Deploy page in your runZero web console.

Viewing all Explorers

For each Explorer, you can see:

• The Explorer status (whether it’s communicating with runZero)
• The OS it runs on
• Its name
• Any site it’s associated with
• Its IP addresses
• The software version it runs
• Whether the installed npcap version is up to date, if the OS is Windows (see upgrading npcap below)
• The CPU architecture of the host machine
• Any tags associated with the Explorer
• The status of its last scan
• Its capabilities, like Chrome support

Screenshot capabilities

To capture screenshots, the Explorer needs Chrome installed. To check whether an Explorer has screenshot capabilities, look for the Chrome icon in the Capabilities column:

• Green icon: the Explorer has access to a Google Chrome binary and can take screenshots.
• Red icon: no suitable Chrome binary was found.

If the icon is red, see Explorer not capturing screenshots.

Searching for Explorers

Use the search bar to find Explorers. The query syntax is similar to the other search bars in runZero, with keywords to filter by specific fields:

Explorer actions

Each Explorer has a set of action buttons:

• Reinstall an Explorer: runs a reinstall or upgrade of the Explorer. The current Explorer downloads the latest Explorer code from runZero, then runs the install process.
• Configure an Explorer: associates the Explorer with a specific site, enables recurring speed tests, and adds tags to it. You can also set the maximum number of concurrent scans allowed; a single Explorer can run multiple tasks at once.
• Reassign an Explorer: moves the Explorer to a different organization within your account, or even to a different runZero client account entirely.
• Remove an Explorer: asks a running Explorer to uninstall itself from the host machine. If the Explorer is not running, you can still tell runZero to forget it, which is useful when you’ve decommissioned the machine it ran on or uninstalled it manually. If a forgotten Explorer runs again, runZero adds it back to the registered Explorers list.

Bulk management operations

Bulk operations act on many Explorers at once. They live in the Manage all Explorers menu:

• Update all online Explorers: tells every Explorer that is up and communicating with runZero to upgrade its software.
• Forget all offline Explorers: clears every Explorer that is currently offline and makes runZero forget it. No data is lost, and any Explorer that comes back online rejoins the active list.
• Uninstall all online Explorers: tells every online Explorer to uninstall itself from its host system.
• Automatically assign sites: goes through every Explorer not currently assigned to a specific site and checks its IP address against the CIDR ranges of the registered subnets of all sites in the current organization. If the address matches exactly one site, runZero assigns the Explorer to that site.

Viewing Explorer details

Click an Explorer’s name to open a page of diagnostic information for that Explorer, including its software version, available memory, and network interfaces.

At the bottom of the page is a diagnostics text area. Click Update Diagnostics to fetch a fresh list of all sub-processes active within the Explorer. This is useful to send to runZero support when a particular Explorer is giving you trouble.

Internet speed tests

Explorers can run internet speed tests on recurring hourly intervals or on demand. The “Internet speed tests” table shows the most recent results, which can help you monitor the network performance of the Explorer’s host machine over time.

To run one now, click the “Start speed test” button; it runs a single speed test and updates the table with the results.

To configure recurring speed tests:

1. From the Registered Explorers page, select the Explorer that should run speed tests.
2. In the “Explorer details” card, click the “Edit” button and enter how often the speed test should run, in hours, into the “Speed tests” input.
3. Click Save to confirm your configuration and start recurring speed tests at that interval.

Speed tests need an up-to-date Explorer. If yours is behind, click the “Update Explorer” button to bring it to the latest version, then configure the tests.

To download the results table in CSV, JSON, or JSONL format, click the “Download speed test results” button and pick the file type. Every speed test also generates a speedtest-completed event in the runZero audit log with its results.

Traffic sampling

Community Platform

You also configure traffic sampling from the Explorer details page.

1. From the Registered Explorers page, select the Explorer that should perform traffic sampling.
2. In the traffic sampling card, configure these options:
   • Site: the site that assets discovered through traffic sampling are added to.
   • Discovery scope: the IP addresses or CIDR networks that traffic sampling observes on this Explorer.
   • Asset tags (optional): the tags to apply to assets discovered through traffic sampling.
   • Excluded hosts (optional): the IP addresses or CIDR networks that traffic sampling leaves out of the results.
   • Interfaces: toggle on the interfaces this Explorer should listen on.
3. Click Save to store your configuration and start the traffic sampling task.

To disable traffic sampling later, return to this page, toggle off the selected interfaces, and save. The traffic sampling tasks stop automatically.

Explorer groups

An Explorer group is a logical grouping of Explorers that distribute scheduled tasks among themselves. With a group, you can schedule many tasks without managing which Explorer each one runs on.

Create and manage groups from the Explorer groups page. A new group needs a name, description, and site, plus the Explorers you want in it. Every Explorer in the group must be set to the same site as the group, because any Explorer in the group might run a given task; without that rule, assets could be merged into the wrong site.

To use a group, select it when configuring a scan or integration task, and the group elects the best-fit Explorer for the task.

Upgrading npcap

On Windows, runZero uses a licensed third-party library called npcap for access to raw network traffic. Other software on the Explorer’s host machine may also use npcap, and sometimes it has installed an obsolete version, which can cause reliability problems.

runZero flags an obsolete npcap with a warning icon in the list of Explorers.

runZero can’t yet reliably upgrade npcap for you, though. Because npcap/winpcap tends to be shared between applications, forcing an upgrade from the runZero side can break other services (EDRs, Wireshark, and so on).

To upgrade npcap manually:

1. Stop any running runZero services from the Windows Services app. Look for “runZero Network Discovery Explorer”.
2. Stop any other running software that uses npcap.
3. Uninstall Winpcap and any npcap installations from the Windows Control Panel.
4. Reboot the computer.

runZero restarts automatically and installs the latest npcap.