Skip to main content
{ Asset Inventory / Reporting and Compliance }

runZero Asset Posture Report

Delivers a weekly report on runZero coverage, with new and vanished assets, explorer and scan task health, integration sync health, risky services on the internal network, and anything that needs attention.

What this agent does

This read-only agent checks the health of a runZero organization every week. It counts the assets by site and type and lists the assets that appeared and vanished since last week. It checks that every explorer is online, every scheduled scan task ran, and every integration synced. It lists the sites with no scan in the window and the network ranges that no site covers. It summarizes the risky services on the internal network, such as remote access and database services on workstations. It flags anything that needs an admin.

The challenge

runZero only sees what its explorers scan and what its integrations sync. An explorer goes offline when a server is rebuilt and a whole site stops updating. A scan task fails for a month and the inventory ages without anyone noticing. A new office network has no site. The inventory looks complete until someone needs it during an incident.

The solution

The agent checks assets, explorers, tasks, integrations, and sites in one pass each week and compares them with the previous week. It lists what changed and what someone needs to act on, with the fix for each item. Provides a weekly briefing an asset owner reads in a few minutes.

Workflow

  1. 01

    Check assets

    Count the assets by site and type, and list the assets first seen and last seen since last week.

  2. 02

    Check collection

    Check each explorer's status, each scheduled scan task's last run and result, and each integration's last sync.

  3. 03

    Check coverage

    List the sites with no completed scan in the window and the network ranges I supply that no site covers.

  4. 04

    Check services

    Summarize the remote access, database, and management services runZero sees on workstations and on sites I mark as sensitive.

  5. 05

    Report

    Publish what changed and what needs action, with the fix for each item.

Agent template 

# runZero Asset Posture Report

## Measurable outcomes

Every week, the asset owner knows which sites runZero is scanning, which explorers and tasks failed, what appeared and vanished, and which risky services sit on the internal network. Track the asset count, the stale site count, and the open action items on every run.

## Procedure

Once a week, count the assets in the runZero organization by site and by type. List the assets first seen since last week and the assets not seen since last week that were seen the week before, grouped by site and type. Check each explorer and flag any that is offline or more than one version behind. Check each scheduled scan task and flag any whose last run failed, was cancelled, or did not run within a day of its schedule. Check each integration and flag any whose last sync is older than 24 hours or reported an error. List the sites with no completed scan in the last 7 days, unless I set another window. Compare the network ranges I supply with the site scopes and list each range that no site covers. Summarize the services runZero sees on the internal network that match remote desktop, remote shell, database, file sharing, and management protocols, by site, and flag each one on a workstation or on a site I mark as sensitive. Compare everything with last week's report, and lead with what changed. Give every action item the specific fix, such as restart the explorer, fix the task's credentials, or add a site. Report a check it cannot run as not checked, never as fine.

## Requirements

It needs a runZero API client with read-only permissions to assets, services, sites, explorers, tasks, and integrations, and nothing more. It never starts a scan or changes a site, task, explorer, integration, or asset. Reports show sites, device types, service types, and counts. Hostnames and addresses appear as stable pseudonyms in the summary and in full in the ticket for each action item.