Sites

Every organization has at least one site and may have several. A site is a distinct network segment, usually defined by addressing or accessibility. Sites in runZero do not have to match physical sites or locations. They represent distinct networks that may have overlapping address space. Multiple sites can use the same RFC1918 space, which is common in retail, and their assets stay distinguishable in the inventory.

By default, your account has a single organization, which contains a single site, named Primary. If you delete the only site in an organization, runZero creates a replacement automatically, and it does the same if you remove the last organization. You can rename organizations and sites at any time.

Because sites represent separate networks, scanning the same devices from two sites gives you two copies of the resulting assets, one set for each site’s network.

All analysis in runZero happens at the site level. The Network Map, for example, builds its topology from a single site’s devices, so you’ll likely want to avoid splitting routers and non-router assets into separate sites unless they are truly on separate, disconnected networks.

Use cases for sites

For flat networks, where every IP address can reach any other address on the network, a single site is usually enough, and it keeps you from accidentally creating duplicate assets by scanning the same devices from multiple sites. Sites are recommended for complicated, sprawling, and highly-segmented environments.

Two situations can call for multiple sites:

• With overlapping IP space, sites let you distinguish identical IPs that belong to different machines.
• In a highly complex network, you can use sites as an organizational tool, though they are not required.

Creating sites

Site creation must be enabled on your account before you can add new sites. If you do not see a New Site button, email support@runzero.com to have it enabled.

To create a site, click the New Site button at the top of the sites page.

Site configurations

• Name is the name of your site.
• Description can help identify the purpose of the site.
• Default scan scope is pre-populated when you create scans for this site.
• Default scan exclusions are pre-populated when you create scans for this site.
• Registered subnets can automatically tag assets, services, screenshots, and software that fall within each subnet.

Subnet tagging

Tagging by subnet works a little differently from tagging assets directly or through a task.

When a subnet carries a specific tag, only assets in that subnet get it. runZero removes the tag from any asset outside the subnet, even if a task or a user set it.

Importing subnets

You can create or update site subnets by importing a CSV file as part of the site configuration. A sample CSV for import:

cidr,tags,description
192.168.0.0/16,purpose=endpoints,"Headquarters endpoint subnet ""quoted text"""
10.0.0.0/24,purpose=wifi,"Headquarters wireless subnet, with comma"
2001:db8::/32,"foo=bar,foobar",ipv6 subnet
1.2.3.4/16,,

Importing and exporting sites

You can create or update site configurations by importing a CSV file. Import your CSV from the sites page. The CSV format should include these columns:

name,description,scope,exclusion,subnet_ranges,subnet_tags,subnet_descriptions

You can also export your site configurations as a CSV from the sites page.

Sites and Explorers

You can tie sites to specific Explorers, which can help limit traffic between low-bandwidth segments. The site configuration lets you define a default scan scope and an optional list of excluded scan scopes. Scans of the site can use these fields as their scope.

To tie an Explorer to a site, go to the Explorers page, click the Explorer you want, and then click configure. A dropdown with your site options appears. For more on Explorers, see Managing Explorers.