Gathering data
runZero can gather asset data through unauthenticated active scanning, passive traffic sampling, and inbound integrations.
Active scanning
The runZero Explorer and scanner perform unauthenticated active scanning of your specified networks based on the configurations you set. They leverage various network protocols to discover and fingerprint assets connected to the network.
Active scans can be configured to run once or on a schedule. Scan templates can also be used to ensure consistency across multiple scan tasks.
Traffic sampling
Explorers can be configured to perform passive traffic sampling in your environment in order to identify assets communicating across your networks. Traffic sampling is configured on a per-Explorer basis on the Explorer details page. Explorers will automatically pause traffic sampling activities in order to handle scan tasks, continuing to parse sniffed traffic once the scan completes.
The traffic sampling feature can also ingest a PCAP file to glean useful asset data.
Inbound integrations
Inbound integrations for many different platforms can be configured to enrich your runZero asset context and provide important insights into coverage and capabilities. Integrations can be configured either as connectors or scan tasks.