RunZero Assets

Overview

RunZero discovers and inventories every asset on the network -- servers, workstations, IoT devices, OT systems, cloud instances, and more. Each asset includes OS fingerprinting, hardware details, network interfaces, open services, and a full attribute history. This skill covers searching, filtering, and inspecting assets.

Anti-triggers

• Live device state. runZero records what the last scan saw, so it cannot answer "is it up right now", "what is the CPU doing", or "which port is it plugged into". Continuous monitoring and topology are auvik-devices; up/down and remote access are domotz-devices; the switch or AP's own configuration is meraki-devices.
• Agent-managed endpoints. runZero is agentless and discovers from the network, so its record of a workstation is thinner than the sensor's. Agent health, OS build, and logged-in user come from sentinelone-inventory or threatlocker-computers.
• Launching or scheduling the scan that produces this data — use runzero-tasks.
• Ports, banners, and protocols rather than the machine itself — each is its own record; use runzero-services.

Key Concepts

Asset Types

RunZero classifies assets by type based on fingerprinting:

Type	Description
server	Server operating systems
workstation	Desktop/laptop endpoints
network	Routers, switches, firewalls
printer	Network printers and MFPs
iot	IoT devices (cameras, sensors, etc.)
ot	Operational technology / ICS
mobile	Mobile devices
virtual	Virtual machines and hypervisors

OS Fingerprinting

RunZero performs active and passive OS fingerprinting using multiple techniques:

• TCP/IP stack analysis
• Service banner matching
• SNMP sysDescr parsing
• HTTP server headers
• TLS certificate analysis
• MDNS/Bonjour responses

The result is a confidence-weighted OS identification with vendor, product, and version.

Asset Attributes

Each asset carries a rich set of attributes:

Attribute	Description
addresses	All discovered IP addresses
macs	MAC addresses
hostnames	All discovered hostnames
os	Operating system (fingerprinted)
os_vendor	OS vendor name
os_version	OS version string
hw	Hardware vendor/model
type	Asset type classification
first_seen	When the asset was first discovered
last_seen	When the asset was last seen
alive	Whether the asset responded to the last scan
site_id	The site this asset belongs to
tags	User-assigned tags

API Patterns

List Assets

runzero_assets_list

Parameters:

• site_id -- Filter by site
• search -- RunZero query string (e.g., os:Windows)
• count -- Number of results per page (default 100)
• offset -- Pagination offset

Example response:

{
  "assets": [
    {
      "id": "asset-uuid-123",
      "addresses": ["192.168.1.42"],
      "macs": ["00:1A:2B:3C:4D:5E"],
      "hostnames": ["ACME-DC01.acme.local"],
      "os": "Windows Server 2022",
      "os_vendor": "Microsoft",
      "type": "server",
      "alive": true,
      "first_seen": "2026-01-15T10:00:00Z",
      "last_seen": "2026-03-27T08:30:00Z",
      "site_id": "site-uuid-456"
    }
  ]
}

Search Assets

runzero_assets_search

Parameters:

• query -- RunZero query language string

Example queries:

os:Windows AND type:server
address:10.0.0.0/8 AND alive:true
hostname:DC AND os:Windows Server
type:printer AND last_seen:<30d
NOT os:Windows AND alive:true

Get Asset Details

runzero_assets_get

Parameters:

• asset_id -- The specific asset UUID

Returns full asset details including all attributes, services, network interfaces, and scan history.

Export Assets

runzero_assets_export

Parameters:

• search -- RunZero query string to filter exports
• site_id -- Filter by site

Use the Export API for bulk retrieval of asset data.

Common Workflows

Full Asset Inventory

1. Call runzero_assets_list for each site
2. Paginate through all results
3. Group by type and OS
4. Generate counts and distribution reports

Stale Asset Detection

1. Search for assets not seen recently: alive:false AND last_seen:<30d
2. Review for decommissioned or offline devices
3. Cross-reference with RMM agent inventory

OS Distribution Report

1. Export all assets via runzero_assets_export
2. Group by os_vendor and os fields
3. Identify unsupported or end-of-life operating systems
4. Generate per-site breakdown

Unmanaged Device Detection

1. Export all assets from RunZero
2. Compare against RMM/MDM agent lists
3. Identify assets with no management agent
4. Flag IoT and OT devices for security review

Error Handling

Asset Not Found

Cause: Invalid asset UUID or asset was merged/removed Solution: Verify the asset ID; search by IP or hostname instead

Empty Results

Cause: Query too restrictive or site has not been scanned Solution: Broaden the query; verify the site has completed scans

Best Practices

• Use the Export API for datasets larger than a few hundred assets
• Apply site filters to scope queries to specific clients
• Leverage the query language for precise searches
• Monitor last_seen to detect assets going offline
• Use type filtering to focus on specific device categories
• Cross-reference RunZero assets with PSA configuration items

Related Skills

• api-patterns - Query language and pagination
• services - Services running on assets
• sites - Site-based asset organization
• tasks - Scans that discover assets