RunZero

About

The RunZero NetoFuse module provides enriched asset context to Netography Fusion from the RunZero Cyber Asset Attack Surface Management platform. It connects to the RunZero API to retrieve asset information and then uploads it as Context Labels to the Netography Fusion API.

☁️NetoFuse Modules: Cloud deployment vs. On-Prem deployment

This page documents how to add and configure the NetoFuse module for an on-prem deployment with a container or Python package. If you want to use the cloud deployment model and have this integration run in the Netography Fusion SaaS, you can add it as a context integration in the Netography Fusion Portal instead by consulting the Context Integrations documentation.

API Configuration Parameters

All the fields required for this integration are listed here, along with the corresponding environment variable name used to set that field in the NetoFuse module.

RunZero Field	Required	NetoFuse Environment Variable	Description
Organization ID	Yes	NETO__RUNZERO__CREDENTIALS__ORG_UUID	RunZero Organization ID
Client ID	Yes	NETO__RUNZERO__CREDENTIALS__CLIENT_ID	RunZero API client ID
Client Secret	Yes	NETO__RUNZERO__CREDENTIALS__SECRET	RunZero API client secret

RunZero Configuration

1. Register an API client in the RunZero console

Register an API client in the RunZero console to obtain the Client ID and Client Secret for authentication to the API.

2. Obtain the RunZero Organization ID to use

A list of all organization IDs for your RunZero account can be retrieved via the RunZero API.

This can be done using RunZero's Swagger API documentation site by going to the API page here:

https://app.swaggerhub.com/apis/runZero/runZero/4.0.231027.0#/Account/getAccountOrganizations

1. Click the Authorize button to open the Available Authorizations window.

2. Scroll down to oauthDefaults (OAuth2, clientCredentials) section and enter a client ID and client Secretthat you generated in the RunZero console by registering an API client.

3. Click Authorize to make the authentication call and receive an API bearer token.

4. Next to the GET /account/orgs API documentation, click the Try it out button.

5. Click the Execute button that appears below the parameters.

6. Scroll down to the response and identify the Organization ID to use.

runzero NetoFuse Module Configuration

Advanced Configuration Options

Field Configuration

Pre-transform field filtering can be achieved by adding the field parameter to the configuration file containing a comma separated list of fields. Supported fields are linked below. If the fields parameter is not provided, all fields will be pulled. Note that the Netography API does not currently support integer fields.

https://www.runzero.com/docs/data-formats/#asset-data

default runzero module configuration

YAML

  runzero:
    credentials:
      organization_uuid:
      client_id:
      secret:
    transform:
      addresses:
        context: ip
      os:
      - context: osver
      - context: os
        function:
          function: transform_os