runZero 101 training

View as Markdown

This training introduces the core components of the runZero platform: how runZero gathers and structures asset data, how to explore your environment, and how to start identifying risks and trends. Each section includes a walkthrough and links to deeper documentation. runZero 201 covers advanced workflows, automation, and deployment planning.

Platform overview

Before you work with inventories, findings, reporting views, or dashboards, get to know the core concepts that shape how runZero organizes and processes data. They’re the mental model for everything else in the console. This section gives short introductions to:

  • How runZero structures data using Organizations and Sites
  • How runZero collects and updates data using Tasks
  • How runZero builds unified asset records using Sources and merging behavior

Organizations and Sites

runZero uses two levels of structure to organize data and control visibility.

Organizations

Organizations define data segmentation and RBAC boundaries. Each Organization maintains its own:

  • Assets
  • Findings
  • Dashboards
  • Queries
  • Integrations
  • Tasks

Use Organizations when you need clear separation between environments (e.g., subsidiaries, departments, or multi-tenant structures).

Sites

Sites represent network structure. A Site corresponds to one or more IP ranges and is used for:

  • Assigning assets to a network location
  • Generating scan scopes
  • Structuring reporting
  • Improving segmentation in queries and dashboards

Sites do not define access control. They provide context for how assets are grouped and discovered.

Learn more:

Tasks

Tasks are how data enters runZero. A Task performs every collection action in the platform.

Types of Tasks

  • Scan tasks (active discovery)
  • Integration tasks (data pulled from external systems)
  • Monitor tasks (passive discovery)

Each Task includes:

  • Status (success, partial, failure)
  • Start and end timestamps
  • Asset and service counts
  • Link to the associated Explorer (if applicable)

Task results drive inventory freshness, dashboard updates, findings, and search counts. If data looks out of date, check the Task history first.

Learn more:

Sources and merging

runZero unifies asset data from multiple origins: scans, integrations, and passive monitoring. An asset may carry attributes from several sources, and runZero automatically merges them into a single asset record.

Key concepts

  • Source indicators show where an attribute came from
  • A deterministic merge strategy resolves conflicting values
  • Merging reduces duplicates and consolidates metadata
  • source:<source-name> filters let you pivot quickly by origin system
  • Asset details show a breakdown of attributes by source

This merging lets runZero act as a single source of truth across your IT, OT, cloud, and security stack.

Learn more:

Inventory views

The primary inventory views in runZero are your foundation for exploring the environment. This section shows how to navigate and interpret them.

Asset Inventory

The Asset Inventory shows every asset known to runZero across all sources.

Common tasks include:

  • Filtering by IP, hostname, OS, software, or exposure
  • Identifying device types across IT, OT, IoT, and cloud
  • Reviewing asset context such as criticality, ownership, tags, and findings
  • Exporting subsets of data for analysis or reporting

Learn more:

Asset detail

The Asset detail page shows a complete, merged view of all metadata for an asset.

It includes:

  • Attributes from each source
  • Services
  • Vulnerabilities and findings
  • Certificates
  • Ownership and criticality
  • Historical changes

It’s the primary investigative view when you troubleshoot or review an asset.

Learn more:

Service Inventory

The Service Inventory lists every network service discovered through scanning or imported through integrations.

It helps you identify:

  • Exposed services
  • Protocol-level misconfigurations
  • Public-facing services
  • Administrative or remote access interfaces

Learn more:

Vulnerability and software inventories

These views consolidate vulnerability and software metadata across all sources.

Vulnerability Inventory

The Vulnerability Inventory shows vulnerabilities identified through:

  • Native findings
  • Enriched vulnerability data from integrations
  • KEV correlation (CISA KEV and VulnCheck)

Software Inventory

The Software Inventory shows discovered software packages and versions, which you can use for:

  • License tracking
  • Version drift analysis
  • Identifying outdated or insecure software

Learn more:

Findings

Findings identify exposures, misconfigurations, vulnerabilities, and security control gaps. This section introduces how Findings work and how to explore them.

Findings overview

Findings combine several signals (including scan data, integration data, KEV enrichment, and novel runZero detections) into a high-level view of risk across your environment.

Common categories include:

  • Vulnerabilities
  • Administrative access exposures
  • Network misconfigurations
  • Missing security controls (e.g., EDR, MDM, VM)
  • runZero novel findings (e.g., Widely Shared Private Keys)

Learn more:

Findings detail

The Findings Detail view shows:

  • Description and severity
  • Evidence from affected assets
  • Remediation guidance
  • Links to pivot into Asset Inventory, Service Inventory, or Vulnerabilities

Vulnerability detail

The Vulnerability Detail page merges CVE data from all sources and includes:

  • CVSS scores and vectors
  • CISA KEV and VulnCheck KEV metadata
  • Affected assets and services
  • Consolidated descriptions and references

Reporting

Reporting views visualize your network layout, segment boundaries, subnet coverage, and topology.

Switch Topology and Unmapped MACs reports

Switch Topology shows:

  • Switches and physical connections
  • Link relationships
  • Interface details

The Unmapped MACs report shows assets that are communicating on the network but not mapped to a switch port.

Learn more:

Subnet Utilization and RFC1918 Coverage reports

These reports help you validate scanning completeness and asset density across subnets:

  • Percentage of IP space scanned
  • Allocated vs. active subnets
  • Hinted assets discovered through passive observations

Learn more:

Network Bridges and Asset Route Pathing reports

These views help you understand blast radius and segmentation:

  • Network Bridges visualizes internal and external network connections
  • Route Pathing shows the traversal paths between assets

Learn more:

Custom asset and service attribute reports

These reports let you analyze:

  • Common OS families
  • Hardware vendor distribution
  • Service protocols
  • Certificate attributes
  • Custom attributes from integrations

Search, Goals, and custom dashboards

Search powers nearly every workflow in runZero. Goals and dashboards track trends over time and visualize the results that matter to you.

Query Library

The Query Library stores saved searches for:

  • Rapid Response
  • Gaps in controls
  • Common exposure profiles
  • Custom organization searches

Saved searches power:

  • Dashboards
  • Goals
  • Alerts
  • Automation via rules

Learn more:

Baseline Goals

Goals measure progress toward internal or external requirements. Examples include:

  • Reducing assets missing EDR
  • Lowering the count of public-facing services
  • Tracking vulnerability remediation progress

Learn more:

Custom dashboards

Dashboards consolidate searches and metrics. You can:

  • Build dashboards per team or use case
  • Add widgets from stock or custom searches
  • Share dashboards across Organizations
  • Recalculate on demand

Learn more:

Custom dashboard widgets

Widgets display data as:

  • Counts
  • Trend lines
  • Goal overviews

You can create a widget from any saved search.

Next steps

After this 101 training, continue with:

  • runZero 201 training builds on the foundations here with deeper coverage of deployment planning, Explorer strategies, advanced search techniques, automation, and workflow optimization. It suits admins and operators who maintain runZero at scale.
  • Use case library is a collection of short, outcome-focused guides to solving specific problems with runZero. Each use case includes example searches, Arcades, and recommended workflows for applying the platform to real scenarios.
  • Playbooks turn best practices into step-by-step procedures for repeatable security and IT tasks, such as achieving full RFC1918 coverage, finding gaps in endpoint protection, or preparing for compliance audits.
Updated