Managing ownership
runZero helps you track ownership: you configure different types of owners and assign them to runZero assets and vulnerability records. You can also track ownership coverage as a goal.
Ownership types
Superusers manage the available ownership types on the Account > Ownership types page and can configure custom types there. Common examples include Security owner, IT owner, and Compliance owner.
Each ownership type has three fields:
- Name: the name of the ownership type.
- Reference: whether the ownership type should be correlated with the user inventory, group inventory, or neither.
- Visibility: whether the ownership type is visible through the asset inventory and asset details pages.
When the default Asset Owner ownership type is visible, runZero populates it automatically with ownership data gleaned from your configured integrations. A superuser can rename this type.
Drag the ownership types into your preferred order to prioritize them. The inventory and asset details pages display the types in that order, and only types marked visible appear.
Issue ownership
Issues use a separate, built-in Issue owner ownership type. Each issue can have one owner, and you cannot assign custom ownership types to issues. Issue ownership and Jira synchronization cover assigning an issue owner and syncing it with Jira.
Default asset owner
Integrations populate the default asset ownership type. The table below is the prioritized mapping of which attribute from each integration sets that value. If an asset has more than one of these attributes, the first match in the table wins.
| Integration Source | Device/Object Type | Attribute Name | Reference Type |
|---|---|---|---|
| Google Workspace | Mobile | owner |
User |
| LDAP | Computer | managedBy |
User |
| LDAP | Computer | manager |
User |
| Google Workspace | ChromeOS | orgUnitPath |
Group |
| Defender 365 | Device | rbacGroupName |
Group |
| SentinelOne | Device | groupName |
Group |
| Google Workspace | ChromeOS | recentUsers.names |
User |
| Google Workspace | Mobile | email.names |
User |
| Google Workspace | Endpoint | email.names |
User |
| Miradore | Device | user.name |
User |
| Intune | Device | userDisplayName |
User |
| CrowdStrike | Falcon Device | email |
User |
| Google Workspace | ChromeOS | annotatedUser |
User |
| Google Workspace | ChromeOS | recentUsers |
User |
| Google Workspace | Mobile | email |
User |
| Google Workspace | Endpoint | email |
User |
| Miradore | Device | user.email |
User |
| Intune | Device | emailAddress |
User |
| Intune | Device | userPrincipalName |
User |
| SentinelOne | Device | lastLoggedInUserName |
User |
Assigning owners to assets and vulnerabilities
Once you have created custom ownership types, you can assign owners through the inventory or with an alert rule.
Superusers, administrators, and users can add, modify, and remove owners on assets and vulnerability records. Annotators can add owner values but cannot modify or remove them.
Ownership in the inventory
To assign owners through the asset or vulnerability inventory:
- Select the assets or vulnerability records you want to update, applying a query filter if needed.
- Click Manage asset ownership or Manage vulnerability ownership to open the ownership popup. Unowned vulnerability records on an asset inherit the ownership values applied to that asset. Vulnerability records that already have owners do not inherit the asset’s ownership value.
- Click Add ownership type and choose the type or types of owner to apply to the selected assets or vulnerability records.
- Add the owner value to the field.
- Click Save to apply your changes.
Applying owners with rules
To apply ownership values automatically after each scan, create an alert rule: go to Alerts > Rules and click Create rule.
- Select the inventory query to use, such as the
asset-query-resultsrule type, then click Configure rule. - Configure any settings you want.
- Set the Action to Modify asset.
- Enter a value in the Set [ownership type] field for each ownership type you want to apply. Unowned vulnerability records on an asset inherit the ownership values applied to that asset. Vulnerability records that already have owners do not inherit the asset’s ownership value.
- Save the rule.
When a scan completes, the rule adds the specified owner type and value to every asset that matches it.