RunZero Assets

Overview

RunZero discovers and inventories every asset on the network -- servers, workstations, IoT devices, OT systems, cloud instances, and more. Each asset includes OS fingerprinting, hardware details, network interfaces, open services, and a full attribute history. This skill covers searching, filtering, and inspecting assets.

Anti-triggers

• Live device state. runZero records what the last scan saw, so it

cannot answer "is it up right now", "what is the CPU doing", or "which port is it plugged into". Continuous monitoring and topology are auvik-devices; up/down and remote access are domotz-devices; the switch or AP's own configuration is meraki-devices.

• Agent-managed endpoints. runZero is agentless and discovers from

the network, so its record of a workstation is thinner than the sensor's. Agent health, OS build, and logged-in user come from sentinelone-inventory or threatlocker-computers.

• Launching or scheduling the scan that produces this data — use

runzero-tasks.

• Ports, banners, and protocols rather than the machine itself — each

is its own record; use runzero-services.

Key Concepts

Asset Types

RunZero classifies assets by type based on fingerprinting:

OS Fingerprinting

RunZero performs active and passive OS fingerprinting using multiple techniques:

• TCP/IP stack analysis
• Service banner matching
• SNMP sysDescr parsing
• HTTP server headers
• TLS certificate analysis
• MDNS/Bonjour responses

The result is a confidence-weighted OS identification with vendor, product, and version.

Asset Attributes

Each asset carries a rich set of attributes:

API Patterns

List Assets

runzero_assets_list

Parameters:

• site_id -- Filter by site
• search -- RunZero query string (e.g., os:Windows)
• count -- Number of results per page (default 100)
• offset -- Pagination offset

Example response:

{
  "assets": [
    {
      "id": "asset-uuid-123",
      "addresses": ["192.168.1.42"],
      "macs": ["00:1A:2B:3C:4D:5E"],
      "hostnames": ["ACME-DC01.acme.local"],
      "os": "Windows Server 2022",
      "os_vendor": "Microsoft",
      "type": "server",
      "alive": true,
      "first_seen": "2026-01-15T10:00:00Z",
      "last_seen": "2026-03-27T08:30:00Z",
      "site_id": "site-uuid-456"
    }
  ]
}

Search Assets

runzero_assets_search

Parameters:

• query -- RunZero query language string

Example queries:

os:Windows AND type:server
address:10.0.0.0/8 AND alive:true
hostname:DC AND os:Windows Server
type:printer AND last_seen:<30d
NOT os:Windows AND alive:true

Get Asset Details

runzero_assets_get

Parameters:

• asset_id -- The specific asset UUID

Returns full asset details including all attributes, services, network interfaces, and scan history.

Export Assets

runzero_assets_export

Parameters:

• search -- RunZero query string to filter exports
• site_id -- Filter by site

Use the Export API for bulk retrieval of asset data.

Common Workflows

Full Asset Inventory

1. Call runzero_assets_list for each site
2. Paginate through all results
3. Group by type and OS
4. Generate counts and distribution reports

Stale Asset Detection

1. Search for assets not seen recently: alive:false AND last_seen:<30d
2. Review for decommissioned or offline devices
3. Cross-reference with RMM agent inventory

OS Distribution Report

1. Export all assets via runzero_assets_export
2. Group by os_vendor and os fields
3. Identify unsupported or end-of-life operating systems
4. Generate per-site breakdown

Unmanaged Device Detection

1. Export all assets from RunZero
2. Compare against RMM/MDM agent lists
3. Identify assets with no management agent
4. Flag IoT and OT devices for security review

Error Handling

Asset Not Found

Cause: Invalid asset UUID or asset was merged/removed Solution: Verify the asset ID; search by IP or hostname instead

Empty Results

Cause: Query too restrictive or site has not been scanned Solution: Broaden the query; verify the site has completed scans

Best Practices

• Use the Export API for datasets larger than a few hundred assets
• Apply site filters to scope queries to specific clients
• Leverage the query language for precise searches
• Monitor last_seen to detect assets going offline
• Use type filtering to focus on specific device categories
• Cross-reference RunZero assets with PSA configuration items

Related Skills

• api-patterns - Query language and pagination
• services - Services running on assets
• sites - Site-based asset organization
• tasks - Scans that discover assets