Personal Customer Health Review

This page is designed to help improve your organizational usage of runZero. Each section below will outline how we at runZero measure success with our current health metrics and include resources to maximize the value of the runZero platform.

Who is this page intended for and why?

This page is for runZero users who are looking to improve their organizational use of runZero as a platform.

Current runZero health metrics

The following health metrics are used to calculate your overall health score within runZero:

• License Utilization
• User Activity
• Scanning Activity
• Inventory Usage
• Reports Usage
• Integrations

Health Scoring and Resources

1. Improving runZero license utilization

Currently, runZero measures license utilization by looking at the number of recent assets in your current inventory. Recent assets are defined as assets that have been scanned by runZero or brought in inbound via integrations within the past 30 days.

Health Scoring

• Red - Recent assets are between 0% and 60% of your license limit.
• Yellow - Recent assets are between 60% and 80% of your license limit.
• Green - Recent assets are between 80% and less than 120% of your license limit.

Resources to improve your license utilization within runZero

• RFC 1918 coverage report

  • This report shows which internal subnets have been scanned, which subnets likely contain assets, and which subnets have still not been scanned.
  • Review this resource: Identifying gaps in scanning

• Achieving RFC 1918 coverage

  • Scanning the entire RFC 1918 space helps identify assets that you were previously unaware of.
  • For small networks with limited complexity, runZero offers a Full RFC 1918 discovery scan option. This option scans the entire private network space in one task.
  • For more advanced networks that are larger or more complex, follow our playbook recommendations to achieve RFC 1918 coverage.

2. Improving user activity within runZero

Currently, runZero measures user activity by how often a user signs into the runZero console.

Health Scoring

• Red - no users have signed in to runZero in the past 30 days.
• Yellow - no users have signed in to runZero in the past seven days.
• Green - a user has signed in to runZero within the past seven days.

Resources to improve user activity within runZero

• Understand how others utilize runZero

  • Achieve better asset visibility
  • Reduce investigation times
  • Uncover risky assets

• Learn more about particular use cases for runZero

  • Alerting on asset and service changes
  • Alerting on runZero system events
  • Tracking hardware and operating system retirement
  • Finding gaps in endpoint protection
  • Finding gaps in vulnerability scanning

3. Improving scanning activity within runZero

Currently, runZero measures scan health by looking at how often scanning takes place in your environment.

Health Scoring

• Red - a scan has not been completed in the past 30 days.
• Yellow - a scan has not been completed in the past seven days.
• Green - a scan has been completed in the past seven days.

Resources to improve scanning activity within runZero

• Schedule scans to run on a recurring basis.

  • Defining a schedule for each scan task means having an up-to-date complete asset inventory without any manual intervention.

• Manage scan templates

  • A scan template is simply a predefined set of scan options and settings, and all updates that are made to the scan template are applied to new and recurring scans that use the template.
  • With scan templates, it is possible to break up larger scans that are run ad hoc into smaller, recurring scans that don’t require the manual effort of having to manually reconfigure settings. This saves time, as well as reduces the chance of misconfiguring any particular scan.
  • Please review this clickthrough that shows how to create and use scan templates.

4. Improving inventory usage within runZero

runZero measures inventory usage by looking at how exactly a user is leveraging the asset inventory within the runZero console.

Health Scoring

• Red - no Inventory or Export API use in the last 30 days.
• Yellow - Inventory or Export API used in the last 30 days.
• Green - Inventory or Export API used in the last 7 days.

Resources to improve inventory usage within runZero

• Training

  • Understanding the benefits of regularly searching and diving into the asset inventory is a key component of success with runZero. By building a complete asset inventory, this helps reduce asset risk as well as helps reduce investigation times to any new potential vulnerabilities.
  • Additionally, by understanding how to query for data, this allows you to quickly find the information you’re looking for within the inventory as well as save those queries for future use.

• runZero playbooks

  • Our playbooks highlight different ways that users leverage the asset inventory on a recurring basis.

• Managing ownership of assets

  • Another way to regularly interact with the asset inventory is by setting, updating, and reviewing ownership of assets.
  • This can be done via alert rules, or by manually querying the asset inventory and setting owners on particular assets.

5. Improving report usage in runZero

runZero measures report usage by determining if these five reports have been utilized in the past 90 days:

• Asset route pathing
• Network brdiges
• Organization Overview Report
• Switch topology
• Unmapped MACs

Health Scoring

• Red - No reports used in the last 90 days.
• Yellow - At least one report used in the last 90 days.
• Green - At least one report used in the last 30 days.

Resources to improve reporting

• Review these resources

  • Identifying gaps in scanning
  • Understanding network segmentation

• Review these click throughs on the reporting options available within runZero

  • Asset attribute report
  • Asset route pathing
  • Network bridges
  • Organization Overview Report
  • RFC 1918 coverage
  • Services attributes report
  • Site and Organization Comparison Report
  • Subnet utilization
  • Switch topology
  • Unmapped MACs

6. Integrations with runZero

runZero measures integration usage by determining if customers have completed an inbound integration within the past 30 days.

Health Scoring

• Red - No inbound integration has completed within the past 30 days.
• Green - An inbound integration has completed within the past 30 days.

Resources to configure inbound integrations

• Configure inbound integrations connections

  • Cloud inventory sources
  • Endpoint protection
  • Vulnerability management
  • Directory services

• Schedule connector tasks to run on a recurring basis

  • Similar to scan tasks, it’s recommended to schedule your connector tasks to run on a recurring basis.

• Note: Even though runZero does health scoring by looking at only inbound integrations, it is recommended to set up outbound integrations as well. runZero supports outbound integrations with several CMDB, SIEM, and SOAR platforms. If you’re utilizing a solution that runZero does not offer a standard outbound integration for at this time, be sure to review our API documentation to learn about how to export runZero data.

Getting help with runZero

If you need assistance with implementing any of these resources or want to discuss runZero usage and maximize the value of the platform, you can book a session with a runZero Customer Success Engineer to discuss further.