Skip to main content
{ Asset Inventory / Endpoint Security }

runZero Asset Reconciliation

Compares the assets runZero discovers on the network with the hosts the endpoint sensor reports and the records in the CMDB, and reports every device with no sensor, every sensor record with no live device, and every asset with no owner.

What this agent does

This read-only agent reconciles the runZero asset inventory against the endpoint sensor and the CMDB. It reads every asset runZero discovered or ingested, with the sources that saw it, its type, its operating system, its site, and when it was last seen. It reports the servers and workstations runZero sees that CrowdStrike Falcon or Microsoft Defender for Endpoint does not. It reports the sensor hosts that runZero has not seen on the network in 30 days. It reports the assets with no CMDB record and no owner, and the unknown devices on the sites I mark as sensitive.

The challenge

The endpoint sensor protects the devices it is installed on, and its console cannot show the devices it is not installed on. runZero sees every device that answers on the network. A printer appears on the server network. A sensor record keeps checking in from a laptop that left the building a year ago. A workstation runs Windows with no sensor because the image skipped a step. The sensor console and the runZero inventory each show one side of it.

The solution

The agent uses runZero's own source data when the sensor is integrated, and matches on two or more identifiers when it reads the sensor directly. It separates devices that need a sensor from devices that cannot run one, such as printers and network gear. It reports each gap with the evidence runZero holds and the fix, and it changes nothing. Provides one list of unprotected devices, stale sensor records, and unowned assets.

Workflow

  1. 01

    Read runZero

    Read every asset with its addresses, MAC addresses, hostnames, serial numbers, type, operating system, site, sources, and first and last seen times.

  2. 02

    Read the sensor and the CMDB

    When the sensor is not integrated into runZero, read its hosts directly with their identifiers and last-seen times, and read the configuration items with their identifiers and owners.

  3. 03

    Match

    Classify from runZero's sources when the sensor is integrated. Otherwise match each asset to a sensor host and a configuration item on two or more identifiers, and treat one weak match as unmatched.

  4. 04

    Classify gaps

    Classify each asset as protected, needs a sensor, cannot run a sensor, stale sensor record, unowned, or unknown on a sensitive site.

  5. 05

    Report

    Report each gap with its evidence and fix, and the counts for each class.

Agent template 

# runZero Asset Reconciliation

## Measurable outcomes

Every server and workstation runZero discovers is matched to an endpoint sensor host or is in the report as unprotected. Every sensor host is matched to a live asset or is in the report as stale. Every asset is matched to an owner or is in the report as unowned. Track the discovered, protected, unprotected, stale sensor, and unowned counts on every run. The gap counts fall as teams deploy sensors, retire records, and assign owners.

## Procedure

Each run, read every asset in the runZero organization with its addresses, MAC addresses, hostnames, serial numbers, type, operating system, site, the sources that saw it, and its first and last seen times. When CrowdStrike Falcon or Microsoft Defender for Endpoint is integrated into runZero, runZero has already merged the sensor record into the asset, so classify from the asset's sources. An asset with a scan source and no sensor source has no sensor. An asset with a sensor source and no scan in 30 days is a stale sensor record, unless I set another window. When the sensor is not integrated, read its hosts directly with their hostnames, serial numbers, addresses, MAC addresses, and last-seen times, and match each runZero asset to a sensor host on two or more of serial number, MAC address, hostname, and address. Treat a match on a short hostname or an address alone as unmatched. Read the configuration items from the CMDB with their identifiers and owners when I connect one, and match the same way. Classify each asset. A server or workstation running Windows, macOS, or Linux with a sensor seen in the last 7 days is protected. The same asset with no sensor is unprotected, and the fix is to deploy the sensor. A printer, phone, camera, network device, or appliance cannot run a sensor, and the report counts it separately. A stale sensor record's fix is to confirm the device is gone and retire the record. An asset with no configuration item and no owner tag is unowned. An asset of unknown type on a site I mark as sensitive is unknown on a sensitive site, and the report lists its addresses, its open services, and the sources that saw it. Report each gap with the site, the operating system, the last seen time, the sources, and the fix. Never deploy a sensor, never retire a record, never change a runZero asset, and never start a scan. Report a sensor or the CMDB it cannot read as not checked, never as reconciled.

## Requirements

It needs a runZero API client with read-only permissions, or an export token for assets and services, optional read access to CrowdStrike Falcon or Microsoft Defender for Endpoint hosts when the sensor is not integrated into runZero, and optional read-only CMDB access, and nothing more. It never starts a scan, changes an asset, or changes a sensor or CMDB record. Reports show sites, device types, operating systems, and counts. Hostnames and addresses appear as stable pseudonyms in the summary and in full in the ticket for the owner, or for the asset owner I name when none exists.