Asset inventory

View as Markdown

When viewing assets, use these keywords to search and filter. For ready-made queries that combine these keywords, see Query examples.

User-specified fields

Comments

Use comment:<text> to search comments on an asset.

comment:"contractor laptop"

comment:"imaging server"

Tags

Use tag:<term> to search tags added to an asset. The term is the tag name, or the tag name followed by an equal sign and the tag value. Tag value matches must be exact. An empty tag value matches only tags without a value.

tag:"group"

tag:"group="

tag:"group=production"

Organization name or ID

Use organization:<term> to filter by organization name or ID.

organization:runZero

organization:"Temporary Project"

organization:f1c3ef6d-cb41-4d55-8887-6ed3cfb3d42d

Site name or ID

Use site:<term> to filter by site name or ID.

site:Primary

site:"Branch Office"

site:ad67d649-041b-439d-af59-f200053a8899

Explorer name or ID

Use explorer:<term> to filter by Explorer name or ID.

explorer:DESKTOP-AB451F

explorer:8b927a8e-d405-40e9-aa47-d6afc9bff237

Hosted zone

Use hosted_zone:<zone name> to filter by the hosted runZero Explorer that found the asset. After a hosted scan, this filter can help you locate externally facing assets.

Owner

Use owner:<term> to filter by owner name.

owner:user@runzero.com
owner:"Security Team"

Ownership status

Use owner_count:<number> to filter by owner count. This search term supports numerical comparison operators (>, >=, <, <=, =).

owner_count:>0
owner_count:0

Use has_owner:<boolean> to find assets with owners or assets missing owners.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
has_owner:t
has_owner:f

Use ownership_type:<term> to filter assets by ownership type name. This returns assets that have an owner assigned for that ownership type.

ownership_type:"Asset Owner"
ownership_type:"Security Owner"

Asset fields

Asset ID

Use id:<uuid> to filter by the ID field, the asset’s unique identifier written as a UUID.

id:cdb084f9-4811-445c-8ea1-3ea9cf88d536

Operating system

Use os:<text> to search the operating system field, a string describing the detected operating system software. Use os_version:<number> to search the OS version, if available.

os:"Windows"

os:"Ubuntu Linux"

os_version:8

OS CPE

Use os.cpe23:<text> to search the operating system Common Platform Enumeration (CPE) field, a string describing the detected operating system software in the CPE naming scheme. When runZero fingerprints the operating system but the NIST database has no official matching entry, runZero generates an unofficial CPE that includes r0_unofficial in the other field of the CPE.

os.cpe23:"ubuntu"

os.cpe23:="cpe:/o:canonical:ubuntu_linux:22.04.1"

os.cpe23:="cpe:/o:alma:linux:-::~~~~~r0_unofficial"

Type

Use type:<text> to search the type field, a string describing the detected system type, such as Desktop, Laptop, Server, BMC, or Mobile.

type:Desktop

type:BMC

type:"Game Console"

Hardware

Use hardware:<text> to search the hardware field, a string describing the detected physical hardware, such as macMini or Nintendo Switch.

hardware:Switch

hardware:macMini

Hostnames

Use name:<text> to search the hostnames associated with an asset. runZero obtains these names from DNS and exposed services.

name:"www"

name:"TV"

To find assets with a hostname that has a specific prefix or suffix, use the := exact match operator with % as a wildcard:

name:="FTP.%"

name:="%-09"

Use name_count:<number> to search the hostname count. This search term supports numerical comparison operators (>, >=, <, <=, =).

name_count:>1

Use name_overlap:<boolean> to find assets sharing the same name. The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
name_overlap:t

Domains

Use domain:<domainname> to search the domain names associated with an asset. runZero obtains these domains from DNS and exposed services.

domain:"amazon.com"

domain:"corp.lan"

domain:"WORKGROUP"

Use domain_count:<number> to search the domain count. This search term supports numerical comparison operators (>, >=, <, <=, =).

domain_count:>1

Addresses

Use address:<ip> to search the primary and secondary addresses associated with an asset, primary_address:<ip> to search only the primary addresses, or secondary_address:<ip> to search only the secondary addresses. These keywords also match by CIDR mask and by wildcard using ‘%’. runZero treats a comma-separated list of addresses as an efficient multiple-match.

address:192.168.0.1

address:10.0.0

address:10.1.2.0/24

address:%.0.1

address:10.%.254

address:10.0.0.1,10.0.0.2,10.0.0.3

Use address_count:<term> and address_extra_count:<number> to search the primary and secondary address counts. These terms support numerical comparison operators (>, >=, <, <=, =).

address_extra_count:0

Use address_overlap:<boolean> to find assets sharing primary IP addresses. Add the site keyword to narrow the results to a single site. The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
address_overlap:t

Use address_extra_overlap:<boolean> to find assets sharing secondary IP addresses. Add the site keyword to narrow the results to a single site. The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
address_extra_overlap:t

Networks

Use net:<cidr> to search the primary and secondary addresses associated with an asset by CIDR mask.

net:192.168.0.0/24

Default SNMP communities

Use has:snmp.v2DefaultCommunities to find assets with a default SNMP community (public, private, and other defaults).

has:snmp.v2DefaultCommunities
snmp.v2DefaultCommunities:public

Public address

Use the keyword has_public and the syntax has_public:<boolean> to locate any asset with a non-reserved IP address. These are often public-facing systems, though public IPs can also be used internally behind a firewall. This filter includes public IPv6 addresses; to search for only public IPv4 addresses, use has_public_v4.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
has_public:true

Private address

Use the keyword has_private and the syntax has_private:<boolean> to locate any asset with a private IP address.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
has_private:false

IPv6 address

Use the keyword has_ipv6 and the syntax has_ipv6:<boolean> to locate any asset with an identified IPv6 address.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
has_ipv6:false

Link-local IPv6 address

Use the keyword has_link_local and the syntax has_link_local:<boolean> to locate any asset with an identified IPv6 link local (fe80::) address.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
has_link_local:true

MAC address

Use mac:<term> to search the MAC addresses associated with an asset.

mac:00:5c:04

mac:00:00:1c

Use mac_count:<number> to search the MAC address count. This search term supports numerical comparison operators (>, >=, <, <=, =).

mac_count:>2

With the exact match operator (:=), you can also search for full MAC addresses in Cisco format or dash-separated format:

mac:=00-10-fa-c2-bf-d5

mac:=0010.fac2.bfd5

Use mac_overlap:<boolean> to find assets sharing the same MAC address. The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
mac_overlap:t

MAC address vendors

Use mac_vendor:<text> to search the vendors associated with an asset’s MAC addresses.

mac_vendor:Apple

mac_vendor:"Intel Corporate"

Use newest_mac_vendor:<text> to search only the vendor of the newest MAC address.

newest_mac_vendor:Apple

Use mac_vendor_count:<number> to search the MAC address vendor count. This search term supports numerical comparison operators (>, >=, <, <=, =).

mac_vendor_count:0

MAC address age

Use mac_age:<term> to search the allocation date of the newest MAC address associated with an asset. The term supports the standard runZero time comparison syntax.

mac_age:>1year

mac_age:<6months

mac_age:2019-12-31

Outlier score

Use outlier_score:<value> to search the calculated outlier score of assets. The outlier score ranges from 0 to 5 inclusive. This search term supports numerical comparison operators (>, >=, <, <=, =).

outlier_score:>2

outlier_score:0

Upstream switch IP address

Use switch.ip:<address> to search the IP address of the upstream switch that assets connect to.

switch.ip:192.168.1.1

switch.ip:fe80::81f2:1c9d:5ac9:5420

Upstream switch name

Use switch.name:<hostname> to search the hostname of the upstream switch that assets connect to.

switch.name:"SWITCH-1"

switch.name:office

Upstream switch port

Use switch.port:<address>-<port number string> to search the port on the upstream switch that assets connect to.

switch.port:192.168.1.1-25

switch.port:10.1.2.3-0/1/2

Upstream switch shared port

Use attribute:switch.portShared to find assets that connect to a switch port reporting multiple MAC addresses.

attribute:switch.portShared

Attributes

Use attribute:<term> to search the asset attribute fields, such as the port used to detect the TTL.

attribute:"ip.ttl.port"

attribute:"cpe:/a:isc:bind:9.11.3"

attribute:"9.11.3"

Use the has:<attribute-name> keyword to check whether an asset has an attribute defined. Invert the has keyword with not has:<term> to find missing fields.

has:"ip.ttl.port"

not has:"rdns.names"

Alongside the standard fields, these special attributes are available:

  • has:screenshot returns assets where at least one screenshot was obtained.
  • has:icons returns assets where at least one icon was obtained (HTTP, UPnP, or similar).
  • has:uplink returns assets seen in the CAM table of a network switch.
  • has:switch is an alias of has:uplink.
  • has:downlink returns assets where the CAM table was queried and at least one other asset was connected.
  • has:unmapped returns assets where the CAM table was queried and at least one other asset was connected but not identified by IP.

See Topology role below for the related is:, gateway_kind:, child_kind:, downlink_count:, and hops_from_public: keywords.

You can also use the attribute name directly as a term. If the attribute name conflicts with an existing term, add the _asset. prefix to disambiguate the query.

ip.ttl.port:80

rdns.names:"router"

_asset.ip.ttl.hops:"1"

Use @<integration>.<source>.<attribute>:<term> to query foreign attributes from third-party inbound integrations. The table below lists the prefix for each integration.

Integration Prefix
Miradore @miradore.dev.
AWS EC2 @aws.ec2.
AWS ELB & ELBv2 @aws.elb.
AWS RDS @aws.rds.
CrowdStrike @crowdstrike.dev.
Azure Load Balancer @azure.vm.
Azure VM @azure.vm.
Azure Scale Set VM @azure.vmss.
Censys @censys.host.
VMWare @vmware.vm.
GCP Load Balancer @gcp.lb.
GCP E2-Micro VM @gcp.vm.
GCP CloudSQL @gcp.cloudsql.
SentinelOne @sentinelone.dev.
Tenable.io & Nessus @tenable.dev.
Rapid7 Nexpose & InsightVM @rapid7.dev.
Qualys VMDR @qualys.dev.
Shodan @shodan.dev.
Azure AD azuread
Active Directory (LDAP) @ldap.computer.
Microsoft 365 Defender @ms365defender.dev.
Microsoft Intune @intune.dev.
Google Workspace ChromeOS @googleworkspace.chromeos.
Google Workspace Endpoint @googleworkspace.endpoint.
Google Workspace Mobile @googleworkspace.mobile. 
@aws.ec2.region:="us-east-2"

@crowdstrike.dev.agentVersion:="6.49.16201.0"

@googleworkspace.chromeos.model:="HP Chromebook"

Foreign attributes support semver-style comparison operators (>, >=, <, <=, =). Include at least the major and minor version number to use this comparison. Version comparison ignores any non-numerical text in the prefix or suffix.

@jamf.custom.osVersion:>6.0

Topology role

runZero builds a topology graph from layer-2 switch CAM tables and from sub-asset enumeration through protocol gateways. The keywords below filter assets based on that graph and work in Inventory → Assets, in any asset search box, and in the Network Map.

Keyword Matches
is:switch Asset is a layer-2 switch with one or more observed CAM-table entries (downstream ports).
is:gateway Asset is a protocol gateway fronting one or more enumerated sub-assets.
is:child Asset is a sub-asset enumerated through a protocol gateway.
gateway_kind:<proto> Asset is a gateway for the given protocol — bacnet, cip, modbus, s7comm, dnp3, profinet, ethercat, omronfins, melsecq, hartip, c37118, knxnet.
child_kind:<proto> Asset is a sub-asset behind a gateway of the given protocol (same vocabulary as gateway_kind).
downlink_count:<n> Number of downstream links (switch ports + OT gateway children). Supports comparisons: >10, <=0, >=1, ranges.
hops_from_public:<n> Minimum topology hops to a public-facing asset (0 = the asset itself is public-facing). Supports comparisons.
has:uplink Asset is connected to an upstream switch port (alias has:switch).
has:downlink Asset is a switch with at least one downstream port observed.

Examples:

is:gateway

gateway_kind:modbus

is:child AND child_kind:cip

is:switch AND downlink_count:>10

category:OT AND hops_from_public:<=2

Asset services

Service ports

Use port:<number> to search the TCP and UDP services associated with an asset by port number.

port:80

port:161

Service TCP ports

Use tcp:<number> to search the TCP services associated with an asset by port number.

tcp:443

Use service_ports_tcp:=<list> to find assets with a specific list of TCP ports open. List the values in ascending numerical order, separated by commas.

service_ports_tcp:=80,443

Service UDP ports

Use udp:<number> to search the UDP services associated with an asset by port number.

udp:53

Use service_ports_udp:=<list> to find assets with a specific list of UDP ports open. List the values in ascending numerical order, separated by commas.

service_ports_udp:=53,123

Service protocols

Use service_protocols:<term> (or protocol:<term> for short) to search the identified service protocols associated with an asset.

protocol:http

service_protocol:telnet

Use protocol_count:<number> to search the protocol count. This search term supports numerical comparison operators (>, >=, <, <=, =).

protocol_count:>1

Service products

Use service_products:<term> (or product:<term> for short) to search the identified service products associated with an asset.

product:openssh

service_products:nginx

Use product_count:<number> to search the product count. This search term supports numerical comparison operators (>, >=, <, <=, =).

product_count:>3

Service counts

Use the following keywords to search the number of services associated with an asset:

  • service_count_tcp:<number>
  • service_count_udp:<number>
  • service_count_icmp:<number>
  • service_count_arp:<number>

These keywords support numerical comparison operators (>, >=, <, <=, =).

Examples:

service_count_tcp:>=5

service_count_arp:0

service_count_udp:<=1

Asset tracking fields

Timestamps

Use the following keywords to search the asset timestamp fields (first_seen, last_seen, created_at, updated_at, os_eol, os_eol_extended):

  • first_seen:<term>
  • last_seen:<term>
  • created_at:<term>
  • updated_at:<term>
  • os_eol:<term>
  • os_eol_extended:<term>

The term supports the standard runZero time comparison syntax.

first_seen:<3days

first_seen:>2019-08-01

first_seen:>8/1/2019

last_seen:<1week

last_seen:<2months

last_seen:<1year

created_at:>2weeks

created_at:<30minutes

updated_at:>1year

updated_at:<12hours

os_eol:<now

os_eol:>4weeks

os_eol_extended:>now

os_eol_extended:>90days

Online status

Use online:<boolean>, or its inverse offline:<boolean>, to search the online status of an asset.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
online:t

online:1

offline:0

Operating system support status

Use os_eol_expired:<boolean> to find assets based on whether their operating systems are End of Life (EOL). This field evaluates both the os_eol and os_eol_extended values and returns only assets with expired coverage.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
os_eol_expired:t

os_eol_expired:1

os_eol_expired:no

Detection method

Use det:<term> or detected_by:<term> to search the detected-by attribute of an asset. The term is one of arp, icmp, <portnumber>-tcp, or <portnumber>-udp. With multiple detections, the priority is arp, then icmp, then the first detected service.

det:arp

detected_by:80-tcp

det:53-udp

Time to live (TTL) comparisons

Use ttl:<term> and lowest_ttl:<term> to search the lowest TTL of an asset. TTL is the estimated number of hops between the scan source and the asset.

This search term supports numerical comparison operators (>, >=, <, <=, =).

lowest_ttl:>3

Round trip time (RTT) comparisons

Use rtt:<term> and lowest_rtt:<term> to search the lowest RTT of an asset. RTT is the round-trip response time of a probe, measured in nanoseconds (1,000,000 == 1ms).

This search term supports numerical comparison operators (>, >=, <, <=, =).

lowest_rtt:>50000000

Multiple MAC address status

Use multi_mac:<boolean> to find assets with multiple MAC addresses.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
multi_mac:t

Any MAC address status

Use has_mac:<boolean> to find assets with any MAC address.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
has_mac:yes

has_mac:f

Multiple IP address status

Use multi_home:<boolean> to find assets with multiple IP addresses.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
multi_home:t

Multiple hostname status

Use multi_name:<boolean> to find assets with multiple hostnames.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
multi_name:yes

multi_name:false

Software installations

Use software:<term>> to find assets with associated software.

The term has three forms:

  • software:<product> finds assets with a software product that matches the term.
  • software:<product>/<version> finds assets with a software product and version that match the term exactly.
  • software:<vendor>/<product>/<version> finds assets with a software vendor, product, and version that match the term exactly.

All three forms accept % as a wildcard at the beginning, middle, or end of the term.

Version terms accept comparators to search for versions less than or greater than a specific version. For example, software:"Google/Google Chrome/>=135" returns all assets with Google Chrome version 135 or greater.

software:IIS

software:Microsoft/IIS/10.0

Certificate fields

Use the following keywords to search certificate-related fields.

Certificate ID

Use certificate_id:<uuid> to filter by certificate ID.

certificate_id:4e3a2b1c-5d6f-7a8b-9c0d-1e2f3a4b5c6d

Certificate type

Use certificate_type:<term> to search by certificate type.

certificate_type:"x509"

Certificate serial

Use certificate_serial:<term> to search by certificate serial number.

certificate_serial:"01A23B45C"

Certificate public key

Use certificate_public_key:<term> to search by certificate public key.

certificate_public_key:"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

Certificate public key algorithm

Use certificate_public_key_algorithm:<term> to search by certificate public key algorithm.

certificate_public_key_algorithm:"ecPublicKey"

Certificate signature

Use certificate_signature:<term> to search by certificate signature.

certificate_signature:"abcdef1234567890"

Certificate signature algorithm

Use certificate_signature_algorithm:<term> to search by certificate signature algorithm.

certificate_signature_algorithm:"rsaEncryption"

Certificate fingerprint (bkhash)

Use certificate_fp_bkhash:<term> to search by certificate fingerprint (bkhash).

certificate_fp_bkhash:"d2c7e8f9..."

Certificate fingerprint (SHA1)

Use certificate_fp_sha1:<term> to search by certificate SHA1 fingerprint.

certificate_fp_sha1:"349eb7db55bbad9d7deabc5effdfd5521ed984a0"

Certificate fingerprint (SHA256)

Use certificate_fp_sha256:<term> to search by certificate SHA256 fingerprint.

certificate_fp_sha256:"SHA256:Sc0pLUCvlNaGtu4Xy2fOTe1A6cC+KyU3x7xuN8+aLtA="

Certificate subject

Use certificate_subject:<term> to search by certificate subject.

certificate_subject:"CN=example.com,O=ExampleCorp,C=US"

Certificate common name (CN)

Use certificate_cn:<term> to search by certificate common name.

certificate_cn:"example.com"

Certificate issuer

Use certificate_issuer:<term> to search by certificate issuing authority.

certificate_issuer:"CN=Example CA,O=Example Corp,C=US"

Certificate subject key ID

Use certificate_subject_key_id:<term> to search by certificate subject key ID.

certificate_subject_key_id:"1234567890abcdef"

Certificate authority key ID

Use certificate_authority_key_id:<term> to search by certificate issuing authority key ID.

certificate_authority_key_id:"abcdef1234567890"
Updated