# RunZero

## About <a href="#about" id="about"></a>

The RunZero NetoFuse module provides enriched asset context to Netography Fusion from the RunZero Cyber Asset Attack Surface Management platform. It connects to the RunZero API to retrieve asset information and then uploads it as [Context Labels](https://docs.netography.com/enrich-traffic-with-context/labels) to the Netography Fusion API.

{% hint style="info" %}
**☁️NetoFuse Modules: Cloud deployment vs. On-Prem deployment**

This page documents how to add and configure the NetoFuse module for an on-prem deployment with a container or Python package. If you want to use the cloud deployment model and have this integration run in the Netography Fusion SaaS, you can add it as a context integration in the Netography Fusion Portal instead by consulting the [Context Integrations](https://docs.netography.com/enrich-traffic-with-context/configure-context-integrations) documentation.
{% endhint %}

## API Configuration Parameters <a href="#api-configuration-parameters" id="api-configuration-parameters"></a>

All the fields required for this integration are listed here, along with the corresponding environment variable name used to set that field in the NetoFuse module.

| RunZero Field   | Required | NetoFuse Environment Variable           | Description               |
| --------------- | -------- | --------------------------------------- | ------------------------- |
| Organization ID | Yes      | `NETO__RUNZERO__CREDENTIALS__ORG_UUID`  | RunZero Organization ID   |
| `Client ID`     | Yes      | `NETO__RUNZERO__CREDENTIALS__CLIENT_ID` | RunZero API client ID     |
| `Client Secret` | Yes      | `NETO__RUNZERO__CREDENTIALS__SECRET`    | RunZero API client secret |

## RunZero Configuration <a href="#runzero-configuration" id="runzero-configuration"></a>

### 1. Register an API client in the RunZero console <a href="#id-1-register-an-api-client-in-the-runzero-console" id="id-1-register-an-api-client-in-the-runzero-console"></a>

Register an API client in the RunZero console to obtain the Client ID and Client Secret for authentication to the API.

### 2. Obtain the RunZero Organization ID to use <a href="#id-2-obtain-the-runzero-organization-id-to-use" id="id-2-obtain-the-runzero-organization-id-to-use"></a>

A list of all organization IDs for your RunZero account can be retrieved via the RunZero API.

This can be done using RunZero's Swagger API documentation site by going to the API page here:

<https://app.swaggerhub.com/apis/runZero/runZero/4.0.231027.0#/Account/getAccountOrganizations>

1. Click the **Authorize** button to open the **Available Authorizations** window.
2. Scroll down to `oauthDefaults (OAuth2, clientCredentials)` section and enter a `client ID` and `client Secret`that you generated in the RunZero console by registering an API client.
3. Click **Authorize** to make the authentication call and receive an API bearer token.
4. Next to the GET `/account/orgs` API documentation, click the **Try it out** button.
5. Click the **Execute** button that appears below the parameters.
6. Scroll down to the response and identify the **Organization ID** to use.

### `runzero` NetoFuse Module Configuration <a href="#runzero-netofuse-module-configuration" id="runzero-netofuse-module-configuration"></a>

#### Advanced Configuration Options <a href="#advanced-configuration-options" id="advanced-configuration-options"></a>

## Field Configuration <a href="#field-configuration" id="field-configuration"></a>

Pre-transform field filtering can be achieved by adding the `field` parameter to the configuration file containing a comma separated list of fields. Supported fields are linked below. If the fields parameter is not provided, all fields will be pulled. Note that the Netography API does not currently support integer fields.

<https://www.runzero.com/docs/data-formats/#asset-data>

**default `runzero` module configuration**

{% tabs %}
{% tab title="YAML" %}

```
  runzero:
    credentials:
      organization_uuid:
      client_id:
      secret:
    transform:
      addresses:
        context: ip
      os:
      - context: osver
      - context: os
        function:
          function: transform_os
```

{% endtab %}
{% endtabs %}