runZero

The runZero connector allows you to retrieve asset discovery and network visibility data from your runZero instance.

Overview

The runZero connector enables you to collect the following information:

• Discovered asset inventory
• Exposed services and ports
• Unmanaged equipment

Prerequisites

• Access to a runZero instance
• runZero API token generated
• API access permissions configured

Information to provide in OverSOC

Configuration

Generate a runZero Export Token

1. Log in to your runZero instance.
2. Navigate to the Organizations page from the main menu.
3. Select the organization you want to integrate with OverSOC.
4. Click Edit organization.
5. Go to the Export tokens section.
6. Click Create a new export token.
7. Give it a descriptive name (e.g., OverSOC Connector).
8. Click Create.
9. Immediately copy the token value (it will only be displayed once). Export tokens have the format XT_... and are read-only.

Note: For OverSOC integration, Export Tokens are recommended as they provide read-only access to asset discovery data. Other token types (Organization API Token, Account API Token) are also available for different use cases.

Configure the connector in OverSOC

1. In OverSOC, go to Data Sources Settings > Sources.
2. Select runZero and click Configure.
3. Fill in the required fields:
   • API URL: https://api.runzero.com (or your instance URL)
   • API Key: Your Export Token
4. Click Save Configuration.

Reference: runZero API - Leveraging the API

Required Permissions

The API key must have the following minimum permissions:

• Read access to asset inventory
• Access to service and port information
• Access to network scan results