A prize-winning community integration between runZero and Microsoft Sentinel

(updated ), by Pearce Barry
icon
Rumble, Inc. is now runZero!

Rumble Network Discovery is now runZero!

Josh Lucas, a cybersecurity engineer at Loop Secure, recently took first place in Microsoft’s Sentinel Hackathon for his submission, “[runZero]” Network Discovery solution for Microsoft Sentinel.” For his project, Josh was looking for a way to better enable security teams during incident response, so he designed his solution to include “information that isn’t readily available from other solutions.” Josh achieved this by supplementing Microsoft Sentinel with two key runZero strengths: asset discovery and custom integrations.

Microsoft’s Ann Johnson, Corporate Vice President of Security, Compliance & Identity (SCI) Business Development, shared the following on Josh’s win:

"Today’s threat landscape requires that customers deploy intelligent solutions at speed and scale. The [runZero] Network Discovery solution offers deep Microsoft Sentinel integration with rich analytics, providing customers with new capabilities and enabling them to realize value faster. Its completeness makes the solution a standout amongst the hackathon competition."

Here at runZero, we are very excited to hear of Josh’s winning submission! Congrats, Josh! Let’s take a look at the runZero capabilities he used (and a few other runZero capabilities, as well). Hopefully, you’ll find some inspiration for your next project or solution.

Design overview

Josh authored a very detailed writeup (and video), including a link to all the pieces you need to recreate his project. The following is a simplified diagram of his solution:

Microsoft Sentinel and runZero solution diagram

Illustrated above, Josh’s solution utilizes a custom integration with the runZero API and Rules Engine to send runZero asset and service inventory data to Microsoft Sentinel (via Azure Functions). In addition to custom integration support, runZero also offers a number of ready-to-use integrations.

Best-in-class asset discovery

The runZero Explorer is a lightweight scan engine that can be easily deployed and scheduled to perform network scans, including recurring scans. Network assets discovered via these scans will populate into the asset inventory, creating new entries for first-time-seen assets, updating existing entries for previously-seen assets, and marking assets no longer seen as “offline.” Each asset is fingerprinted to provide as much data and context as possible about a particular asset, including the type of asset, vendor, and operating system. Fingerprinting is also performed for each discovered service running on an asset, including protocol, product, and vendor.

Josh’s project relies on runZero for asset and service discovery, which feeds detailed inventory data into Microsoft Sentinel to “enrich hunting queries with contextual network information and provide insights.”

Pulling asset service inventory via the runZero API

The runZero REST API offers robust support for custom integrations. You can do things like pull asset and service data, manage scans, manage account settings, and much more. To see what you can do, check out all of the available runZero API endpoint details in our Swagger documentation.

For his project, Josh utilizes the runZero API to populate runZero-discovered asset and service inventory data into Sentinel (via Azure Functions).

Webhooks via rules

The runZero Rules Engine is a highly configurable feature. It provides the ability to automatically detect conditions and events, such as account logins, scan completions, and changes in inventory. Additionally, you can specify an action to automatically trigger based on certain conditions and events, like tagging certain assets following a scan or sending an alert if a high-value asset wasn’t found.

Josh’s project uses the runZero Rules Engine to determine when new assets have been discovered (“new-assets-found”) or existing assets have changed (“assets-changed”), and he automatically forwards appropriate details via webhook to Azure Functions, which updates Sentinel with the latest data.

But wait, there’s more!

Not ready to build your own custom integrations? Take a look at runZero’s ready-to-use integrations. runZero regularly adds new integrations, so keep checking back to see what’s new.

Working on an integration with runZero?

We’d love to hear from you. Reach out to us if you have questions or need help.

Contact us
Join our team

Similar Content

September 13, 2022

runZero 3.1: Sync Active Directory, import assets from Shodan, and launch integrations from Explorers

What’s new with runZero 3.1? Sync your Active Directory users, groups, and machines with runZero Import assets and external services from Shodan Launch integrations from Explorers Connect and sync Active Directory with runZero runZero Professional and Enterprise users …

Read More

August 8, 2022

runZero 3.0: Check out our new name, and sync assets, software, and vulnerability data from Qualys

Rumble Network Discovery is now runZero! What’s new with runZero 3.0? Meet our new brand: runZero! Sync assets, software, & vulnerability data from Qualys Introducing runZero Rumble is officially runZero! This name change reflects our growth as a product and as a …

Read More

July 12, 2022

Rumble 2.15: Sync assets, software, and vulnerability data from Rapid7, scan external domains from our cloud, and report on external assets and services

Rumble Network Discovery is now runZero! What’s new with Rumble 2.15? Sync assets, software, and vulnerability data from Rapid7 InsightVM and Nexpose Quickly identify and report externally exposed assets and services Navigate your inventory faster with an updated …

Read More