What is runZero?

View as Markdown

runZero

runZero is an attack surface and exposure management platform that helps you see everything on your network, from managed IT systems to unmanaged OT, IoT, cloud, mobile, and remote assets. It combines high-speed active scanning, passive discovery, and API integrations to build a unified, continuously updated inventory you can trust.

You can run runZero as a hosted service (SaaS) or on-premise. The platform includes one or more Consoles, distributed Explorers that run as lightweight services at your points of presence, and a command-line tool for offline collection and automation. Teams can work through the web interface, automate through the API, and for self-hosted deployments, manage operations from the command line.

Data Sources

  • Active Scans: runZero’s best-in-class active scan engine is fast, accurate, and safe for all environments, with support for a massive number of protocols and applications.

  • Passive Traffic Sampling: runZero’s passive traffic sampling engine scales with available resources and works with broadcast traffic, SPAN ports, and encapsulated streams. Any runZero Explorer can be used for passive traffic sampling, regardless of location, configuration, or resources.

  • API Integrations: runZero supports inbound and outbound integrations with major Cloud, Endpoint, CMDB, and Endpoint providers. In addition to the native options, customers can create their own integrations using the Custom Integration API and Custom Integration Scripts.

Live Inventory

  • Assets: runZero tracks all assets across the environment; including cloud, mobile, endpoint, server, OT, IoT, and everything else in between. Assets are correlated and merged across data sources to provide a multi-perspective snapshot of all organization resources. The asset inventory supports deep search, configurable columns, and simple export.

  • Services: runZero tracks all identified network services, via active scans, passive discovery, and integrations (where applicable). The services inventory simplifies exposure management tasks and enables deep search and exports.

  • Screenshots: runZero takes a snapshot of each exposed web service included in active scans. The screenshot inventory allows security teams to visually inspect unknown devices and services.

  • Software: runZero identifies network-exposed software and imports software records from API integrations. The result is a software inventory that can be used to quickly identify specific packages and versions across the environment.

  • Vulnerabilities: runZero reports vulnerabilities based on identified exposures and imports vulnerability data from API integrations. The vulnerability inventory is provided as both a detailed, per-asset inventory, as well as a grouped view that simplifies investigation into specific issues.

  • Certificates: runZero identifies SSL/TLS certificates, including those that are expired or soon-to-expire. The certificate inventory includes all relevant metadata, such as issuer, expiration date, and certificate chain.

  • Wireless: runZero active scans also enumerate wireless access points within range of the Explorer running the task. This inventory includes the BSSID, SSID, encryption settings, and signal strength.

  • Users and Groups: runZero imports user and group information from directory services, including Active Directory, Azure Active Directory (Entra ID), and Google Workspace. The user and group inventories can be used to identify accounts with specific attributes, such as expired passwords and excessive group permissions.

Reports

runZero includes a comprehensive set of reports that cover everything from layer-2 topology maps to outliers and asset risk. In addition to pre-defined reports, most attributes within an asset or service can be used to create a grouped report with a single click. For deep customization, the runZero Export API provides CSV and JSON(L) formats with arbitrary search filters, which can be used to drive analytics platforms like Tableau and PowerBI.

Monitoring and Alerts

runZero provides monitoring and alert capabilities that can trigger based on changes to the inventory, new results for custom search queries, and any system-level event (of dozens). These alerts can be delivered either in-product, by email, or to a webhook destination, including Slack channels. In addition to alerts, rules, and custom queries, goals and custom dashboard widgets can be defined to track progress towards a specific outcome.

Updated