Alerting on asset and service changes

View as Markdown

runZero scans capture detailed data about all of the assets in your environment and the services they run. You can query that data to find points of interest and alert on new matches. A few common use cases:

Identifying network misconfigurations
Identifying potential vulnerabilities
Finding new open services

Who is this playbook for and why?

Security teams who want to reduce misconfigurations and potential vulnerabilities in their environment, or to spot new services that could be malicious.
IT teams who want to confirm that their teams follow standard procedures when making changes in their environment.

How will runZero help?

runZero safely scans your entire network with benign traffic, which gives it complete visibility into the assets and services on your network. With that visibility you can find misconfigurations, potential vulnerabilities, and new services that other tools would not show you.

What will I need to do?

To alert on asset or service changes, you will:

Identify queries of interest, such as:
Create an alert template.
Configure a notification channel.
Create rules.

Prerequisites

Build a complete asset inventory.

Steps to implement

Follow these steps to configure a notification rule based on a query.

Identify queries of interest

Go to the Inventory page in the runZero console.
Run the sample queries to find ones that meet your needs.
When a query looks promising, add filters until it is ready to alert on new matches:
- Asset inventory filters
- Service inventory filters

Configure an alert template

Go to Alerts > Templates and select Create Template.
Enter a Name.
Select a Template type.
Choose a Subject line for message.
Format the Body of message.
Click Save Template.

Configure a notification channel

Go to Alerts > Channels and select Create Channel.
Enter a Name.
Select a Channel type.
- For Email, enter the Email address that will receive notifications.
- For Webhook, enter the Webhook URL and any Additional headers the notification may require.
Select Save Channel.

Configure an alert rule

Go to Alerts > Rules and select Create Rule.
Select asset-query-results for asset queries or service-query-results for service queries.
Select Configure Rule.
Enter a Name for the new rule.
Select the Conditions for the rule. By default, Any organization and Any site are selected. For Query, use the query from the earlier steps.
Select the Notification channel that you created.
Select the Notification template that you created.
Confirm that Enabled is checked and click Save Rule.

Sample queries

Use these sample queries to find network misconfigurations, potential vulnerabilities, and new services.

Unnecessary public facing services

Identify non-standard public facing services

service_haspublic:t and service_hasip6:f
and not protocol:icmp
and not (port:22 and protocol:ssh)
and not (port:80 and protocol:http)
and not (port:179)
and not (port:443 and (protocol:http or protocol:tls))
and not (port:500 and protocol:ike)
and not (port:5061 and protocol:tls)

Identify insecure public facing services

has_public:t and (protocol:telnet or protocol:ftp or protocol:tftp)

Identify insecure public facing web services

has_public:t and protocol:http and not protocol:tls

Identify non-standard public facing web services

service_haspublic:t and protocol:http and not port:80 and not port:443

High outlier score with public facing IP

outlier:>2 has_public_v4:t

High risk score with public facing IP

risk_rank:>2 has_public_v4:t

See more examples

Insecure services

Database or secrets manager that does not require authentication

(_asset.protocol:redis AND protocol:redis AND has:redis.redisVersion)
OR (_asset.protocol:etcd2 protocol:etcd2 etcd2.access:allowed)
OR (_asset.protocol:zookeeper AND protocol:zookeeper AND zk.access:allowed)
OR (_asset.protocol:mongodb AND protocol:mongodb AND mongodb.auth:open)
OR (_asset.protocol:consul protocol:consul has:consul.config.datacenter)

Vulnerable application: PrinterLogic web service

_asset.protocol:http protocol:http (html.title:="Printer%Logic" OR favicon.ico.image.md5:=ab2fc8886bfbf3e986f8015539d29736 OR favicon.ico.image.md5:=95825f2984a2f708205212d05444938e)

Unpatched application: Android debug bridge

_asset.protocol:adb AND protocol:adb AND has:adb.features

Unpatched application: HID VertX/Edge controllers vulnerable to command_blink_on command execution

_asset.protocol:hiddiscoveryd protocol:hiddiscoveryd has:hiddiscoveryd.unpatchedVertXploit

Vulnerable hardware: Accellion legacy file transfer appliances

products:apache AND (
 favicon.ico.image.md5:=9423d9e9ce004c29dd5bc622f0112123 OR
 http.head.setCookie:sfcurl=deleted OR
 http.head.location:/wmLogin OR
 last.http.head.location:/wmLogin
 )

More examples

Sample alert templates

Alert templates let you customize and format the alerts your rules trigger. Start with one of these three common templates for raw JSON, Slack, and Microsoft Teams payloads.

Asset, service, or wireless query alert to SIEM or SOAR using JSON

One-liner for use in the template:

{"organization":{"name":"{{organization.name}}","id":"{{organization.id}}"},"site":{"name":"{{site.name}}","id":"{{site.id}}"},"rule":{"action":"{{rule.action}}","created_at":"{{rule.created_at}}","created_by":"{{rule.created_by}}","event":"{{rule.event}}","id":"{{rule.id}}","name":"{{rule.name}}","updated_at":"{{rule.updated_at}}"},"search":{"url":"{{search.url}}","found":"{{search.found}}","comparator":"{{search.comparator}}","value":"{{search.value}}"}}

Human-readable version for review:

{
  "organization": {
    "name": "{{organization.name}}",
    "id": "{{organization.id}}"
  },
  "site": {
    "name": "{{site.name}}",
    "id": "{{site.id}}"
  },
  "rule": {
    "action": "{{rule.action}}",
    "created_at": "{{rule.created_at}}",
    "created_by": "{{rule.created_by}}",
    "event": "{{rule.event}}",
    "id": "{{rule.id}}",
    "name": "{{rule.name}}",
    "updated_at": "{{rule.updated_at}}"
  },
  "search": {
    "url": "{{search.url}}",
    "found": "{{search.found}}",
    "comparator": "{{search.comparator}}",
    "value": "{{search.value}}"
  }
}

Asset, service, or wireless query alert to Slack

One-liner for use in the template:

{"blocks":[{"type":"section","text":{"type":"mrkdwn","text":":red_circle: *runZero Alert* - {{rule.name}}"}},{"type":"divider"},{"type":"section","text":{"type":"mrkdwn","text":"*Rule information*\n\n_Name_: {{rule.name}}\n_Type_: {{rule.event}}\n_Link_: https://console.runzero.com/alerts/rules/{{rule.id}}"}},{"type":"section","text":{"type":"mrkdwn","text":"*Match information*\n\n_Organization_: {{organization.name}}\n_Site_: {{site.name}}\n_Match count_: {{search.found}}\n_Search_: {{search.value}}\n_Link_: {{search.url}}"}}]}

Human-readable version for review:

{
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": ":red_circle: *runZero Alert* - {{rule.name}}"
      }
    },
    {
      "type": "divider"
    },
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*Rule information*\n\n_Name_: {{rule.name}}\n_Type_: {{rule.event}}\n_Link_: https://console.runzero.com/alerts/rules/{{rule.id}}"
      }
    },
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*Match information*\n\n_Organization_: {{organization.name}}\n_Site_: {{site.name}}\n_Match count_: {{search.found}}\n_Search_: {{search.value}}\n_Link_: {{search.url}}"
      }
    }
  ]
}

Asset, service, or wireless query alert to Microsoft Teams

One-liner for use in the template:

{"type":"message","attachments":[{"contentType":"application/vnd.microsoft.card.adaptive","contentUrl":null,"content":{"$schema":"http://adaptivecards.io/schemas/adaptive-card.json","type":"AdaptiveCard","version":"1.5","body":[{"type":"TextBlock","text":"runZero Alert-{{rule.name}}"},{"type":"TextBlock","text":"**Rule information**\n\n_Name_: {{rule.name}}\n\n_Type_: {{rule.event}}\n\n_Link_: [Rule](https://console.runzero.com/alerts/rules/{{rule.id}})","wrap":true},{"type":"TextBlock","text":"**Match information**\n\n_Organization_: {{organization.name}}\n\n_Site_: {{site.name}}\n\n_Match count_:{{search.found}}\n\n_Search_: {{search.value}}\n\n_Link_: [Search]({{search.url}})","wrap":true,"spacing":"Medium"}]}}]}

Human-readable version for review:

{
  "type": "message",
  "attachments": [
    {
      "contentType": "application/vnd.microsoft.card.adaptive",
      "contentUrl": null,
      "content": {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.5",
        "body": [
          {
            "type": "TextBlock",
            "text": "runZero Alert - {{rule.name}}"
          },
          {
            "type": "TextBlock",
            "text": "**Rule information**\n\n_Name_: {{rule.name}}\n\n_Type_: {{rule.event}}\n\n_Link_: [Rule](https://console.runzero.com/alerts/rules/{{rule.id}})",
            "wrap": true
          },
          {
            "type": "TextBlock",
            "text": "**Match information**\n\n_Organization_: {{organization.name}}\n\n_Site_: {{site.name}}\n\n_Match count_: {{search.found}}\n\n_Search_: {{search.value}}\n\n_Link_: [Search]({{search.url}})",
            "wrap": true,
            "spacing": "Medium"
          }
        ]
      }
    }
  ]
}

Outcome demo

This short video shows what the outcome of alerting on runZero query results may look like.

Getting help

For help building out this process, book a session with a runZero Customer Success Engineer.

Updated September 17, 2026

← Achieving RFC 1918 coverage

Alerting on runZero system events →