runZero

No entries match these filters. Clear filters

1. runZero 5.1.261103.0 (2026-11-03) Nov 3, 2026 · issue 130
   • Updated supported platform BACnet protocol attribute collection improvements
2. changelog Oct 29, 2026 · issue 124

   runZero adds LonTalkLonTalkA communication protocol developed by Echelon for control networks, used in building automation and industrial systems; cyber tools target it to audit or monitor devices on LON-based infrastructure. protocol support and now lets operators cap AI tool-call limits per turn via environment variables and the API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Cap how many AI tool calls the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. can make in a single turn on a self-hosted console to prevent runaway agentic queries.
   copy

   $ RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN=4 RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN=10 ./runzero-console

   Filter alert channels with more than five notifications to identify noisy rules during tuning.
   copy

   $ notification_count:>5

   • Configure AI tool-call limits per turn for self-hosted deployments via the RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN and RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN environment variables (defaults: 8 and 20), and set per-account or per-organization limits through the AI configuration pages or the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • runZero now supports the LonTalk protocol for asset discovery.
   • Improves the search operator across the asset, service, software, and vulnerability inventories: it is now case-insensitive, exact-match searches like domain:=corp.example.com now find assets that have that domain among others, and product:= and domain:= now match assets with no products or no domains.
   • Alert channel searches using settings:, notification_count:, and user_email: now work; settings: matches a channel's email recipients and notification_count: accepts numeric comparisons such as notification_count:>5.
   • Improves search in scan templates and external reports to support AND, OR, and NOT operators; in scan templates a plain word searches template names and descriptions, and an unsupported keyword is reported as an error.

   +2 more show less

   • Tag editing is now available directly in the asset details card on the Vulnerability details page.
   • The GET /api/v1.0/account/sites, GET /api/v1.0/account/orgs, and GET /api/v1.0/account/credentials APIs now return a 422 error naming the problem when a search cannot be parsed, rather than returning every record.
   • Configure AI tool-call limits per turn for self-hosted deployments via the RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN and RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN environment variables (defaults: 8 and 20), and set per-account or per-organization limits through the AI configuration pages or the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • runZero now supports the LonTalk protocol for asset discovery.

   5 more in Everything

3. runZero 5.1.261029.0 (2026-10-29) Oct 29, 2026 · issue 125

   runZero adds has_owner search to the vulnerability inventory and avoids probing Allen-Bradley/Rockwell 1785-ENET devices on identification.

   • Search the vulnerability inventory by asset owner using the new has_owner search term.
   • runZero now avoids sending traffic to Allen-Bradley/Rockwell 1785-ENET devices as soon as they are identified during scanning.

   2 details in Everything

   • New vulnerability check eMudhra compromised certificate vulnerability check
   • Updated detection Fingerprint improvements for Beckhoff Automation
   • Updated detection Fingerprint improvements for Siemens and Rockwell Automation
4. runZero 5.1.261027.1 (2026-10-27) Oct 27, 2026 · issue 123
   • Updated detection Fingerprint improvements for OT/network vendors
   • Updated detection Improved CIP protocol error detection and handling
5. runZero 5.1.261022.0 (2026-10-22) Oct 22, 2026 · issue 119

   Broad search operator expansion across inventories: notification_count: numerics, AND/OR/NOT for scan templates and external reports, case-insensitive domain: matching, and tag editing on the Vulnerability details page.

   • Alert channel searches now support notification_count: with numeric comparisons such as notification_count:>5, and settings: now matches a channel's email recipients.
   • Scan template searches now support AND, OR, and NOT operators; a plain word searches template names and descriptions, and an unsupported keyword is reported as an error.
   • External report searches now support AND, OR, and NOT operators.
   • The domain: search is now case-insensitive in the asset, service, software, and vulnerability inventories, and an exact match such as domain:=corp.example.com finds assets that have that domain among others.
   • The searches product:= and domain:= now match assets with no products or no domains in the asset, service, software, and vulnerability inventories.

   +2 more show less

   • Certificate search ocsp_stapling:false now matches certificates served over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. without OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. stapling, equivalent to has_ocsp_stapling:false.
   • Asset details card on the Vulnerability details page now offers inline tag editing.

   7 details in Everything

   • Updated integration Fingerprint improvements for FUJIFILM, Fortinet, DTEN, and printer device types in Azure AD integration
   • Updated supported platform IBM OS/400 device detection resilience improvement
6. docs update Oct 21, 2026 · issue 115

   Adds configurable AI tool-call limits via RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN and RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN env vars and the AI configuration API.

   • Adds RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN and RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN environment variables for self-hosted operators to set platform-wide AI tool-call limits (defaults: 8 and 20).
   • Exposes AI tool-call limit configuration through the AI configuration pages and API for accounts using their own AI provider.

   2 details in Everything

   • Updated integration Vulnerability validation for Tenable products
   • New supported platform LonTalk protocol support for asset discovery
   • Updated detection Fingerprint improvements for BrightSign, Mitel, Emerson DeltaV, OPC UA devices, Beckhoff Automation, and Loytec
7. changelog Oct 20, 2026 · issue 114
   • Updated detection Fingerprinting improvements for AcyMailing, Atlassian, JoomliC, JoomShaper, Widget Factory, and Zammad
8. runZero 5.1.261020.0 (2026-10-20) Oct 20, 2026 · issue 115

   AI tool-call limits are now configurable via env vars and API; LonTalkLonTalkA communication protocol developed by Echelon for control networks, used in building automation and industrial systems; cyber tools target it to audit or monitor devices on LON-based infrastructure. protocol added for asset discovery.

   • Adds RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN and RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN environment variables for self-hosted operators to set platform-wide AI tool-call limits (defaults: 8 and 20).
   • Exposes AI tool-call limits for accounts and organizations using their own AI provider via the AI configuration pages and through the API.
   • New supported platformAdds LonTalk protocol support for asset discovery.
   • Expands self-hosted console environment variable documentation to cover AI provider, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. session, access control, screenshot, and TLS trust settings.

   4 details in Everything

   • Updated detection Fingerprint improvements for BrightSign, Mitel, Emerson DeltaV, OPC UA, Beckhoff Automation, Cisco, and Loytec
   • Updated integration Vulnerability validation for Tenable products improved
9. docs update Oct 14, 2026 · issue 108
   • Updated detection Fingerprinting improvements for AcyMailing, Atlassian, JoomliC, JoomShaper, Widget Factory, and Zammad
10. runZero 5.1.261013.0 (2026-10-13) Oct 13, 2026 · issue 108
    • Updated detection Fingerprinting improvements for AcyMailing
    • Updated detection Fingerprinting improvements for Atlassian
    • Updated detection Fingerprinting improvements for JoomliC
    • Updated detection Fingerprinting improvements for JoomShaper
    • Updated detection Fingerprinting improvements for Widget Factory
    • Updated detection Fingerprinting improvements for Zammad
11. docs update Oct 10, 2026 · issue 100

    runZero adds @custom prefix for custom integration attribute searches and enforces a 1,000 req/min API key rate limit with burst support.

    • Adds @custom prefix support for asset inventory searches on custom integration attributes via the runZero search interface.
    • Enforces a 1,000 API key requests-per-minute rate limit (with bursts of up to 100 requests) on the runZero API; over-limit responses include a retry time and do not count toward daily usage limits.
    • Applies the same per-account API key rate limit to runZero MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server connections.

    3 details in Everything

    • Updated supported platform Fingerprint improvements for Ubiquiti, HPE, and Silver Peak
    • Updated supported platform Fingerprint improvements for Amazon Linux
    • Updated supported platform Fingerprint improvements for Cisco routers
    └──▷ BREAKING ON UPGRADE

    • !The runZero API now limits accounts to 1,000 API key requests per minute (bursts up to 100); automation or scripts that exceed this rate will receive over-limit responses. Self-hosted consoles are not limited by default.
12. docs update Oct 9, 2026 · issue 098

    runZero adds @custom prefix for searching custom integration attributes and enforces 1,000 req/min API rate limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports asset inventory searches using the @custom prefix for custom integration attributes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enforces a rate limit of 1,000 API key requests per minute on the runZero API, with short bursts of up to 100 requests; over-limit requests receive a retry time and are excluded from daily API usage limits. Self-hosted consoles are not limited by default.
    • Applies the same per-account API key request rate limit to runZero MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server connections.
    • Supports asset inventory searches using the @custom prefix for custom integration attributes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enforces a rate limit of 1,000 API key requests per minute on the runZero API, with short bursts of up to 100 requests; over-limit requests receive a retry time and are excluded from daily API usage limits. Self-hosted consoles are not limited by default.

    1 more in Everything

13. runZero 5.1.261009.0 (2026-10-09) Oct 9, 2026 · issue 100
    • Updated detection Fingerprint improvements for Ubiquiti, HPE, and Silver Peak
14. changelog Oct 5, 2026 · issue 095

    Adds asset merge history view from the Manage menu on the asset details screen.

    • Updated detection Fingerprint improvements for Cisco routers
    • Updated detection Fingerprint improvements for Arista, Cisco, Echelon, Schneider Electric, Wind River, FreeNAS, and TrueNAS
    • Updated integration Dragos integration performance improvement
15. changelog Oct 4, 2026 · issue 094

    Adds asset merge history view in the Manage menu on the asset details screen.

    • Updated supported platform Fingerprint improvements for Cisco routers
    • Updated supported platform Fingerprint improvements for Arista, Cisco, Echelon, Schneider Electric, Wind River, FreeNAS, and TrueNAS
    • Updated integration Dragos integration performance improvement
16. docs update Oct 2, 2026 · issue 092
    • Updated detection Fingerprint improvements for Cisco routers
17. Release notes Oct 1, 2026 · release notes

    runZero adds API v/suppress/vulnerabilities endpoint, custom roles for API keys, WS-Discovery hostname contribution, and dragos integration perf improvements

    └──▷ HOW TO FIND IT
    View merge history for a specific asset directly from the UI.
    📍Navigate to Assets › [Asset Name] › Manage › View Merge History
    • Enhances the Dragos integration performance to handle long-running requests.
    • Enables viewing merge history for an asset from the Manage menu in the asset details screen.
    • Contributing WS-Discovery XAddr endpoints as a source for asset hostnames.

    3 details in Everything

18. announced Sep 30, 2026 · issue 093

    runZero adds AI-assisted reporting under Reports > AI threads, with plain-language queries, built-in templates, and export to Markdown, HTML, PDF, CSV, and StarlarkStarlarkA Python-dialect scripting language designed by Google for deterministic, hermetic build and configuration scripts, giving cyber tools a safe, sandboxed way to express rules or policies without a full Python runtime..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Generate a prioritized critical-asset report with CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. context for an executive audience, without writing any query syntax.
    📍In the console, go to Reports › AI threads and enter: 'find critical assets anywhere in the world to understand immediate threats and present it in an actionable report'
    Instantly run a pre-built End-of-Life OS assessment across all sites when preparing a migration roadmap.
    📍In the console, go to Reports › AI threads, open the guided report gallery, and select End-of-Life OS analysis
    • Adds Reports > AI threads in the console, enabling plain-language queries against live inventory data to produce executive summaries, bar charts, and risk-ranked tables in minutes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exports AI-generated report artifacts to Markdown, HTML, PDF, CSV tables, and Starlark integration scripts.
    • Includes a guided report gallery with built-in templates: Critical systems & Blast radius, Deep outliers, End-of-Life OS analysis, Internet exposure, and Rogue & unmanaged assets.
    • Grounds every AI answer in live tool calls against actual inventory data, with an expandable work log showing every underlying query, tool call, and context token.
    • Proactively surfaces blind spots such as mislabeled assets and governance disconnects (e.g. critical-tagged hosts with zero exploit likelihood) without explicit prompting.

    +1 more show less

    • Preserves each AI-generated report, script, or visualization as a distinct private artifact, shareable across team members in the same organization or exported externally.

    6 details in Everything

19. docs update Sep 30, 2026 · issue 090
    • Updated detection Exposure Management queries library
20. runZero 5.1.260929.0 (2026-09-29) Sep 29, 2026 · issue 090

    Adds merge history view for assets via the Manage menu on the asset details screen.

    • Updated detection Fingerprint improvements for Arista, Cisco, Echelon, Schneider Electric, Wind River, FreeNAS, and TrueNAS
    • Updated integration Dragos integration performance improved for long-running requests
21. changelog Sep 26, 2026 · issue 086

    runZero: Software and Vulnerabilities collected from integrations are now retired when that integration data expires.

    └──▷ HOW TO FIND IT
    Download the Cryptographic Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk.) as a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON file to audit cryptographic assets across the inventory.
    📍In the console, go to Reports, select Cryptographic Bill of Materials (CBOM), and choose Export as CycloneDX JSON.
    • Issue owners now receive an email with a direct link when assigned an Issue.
    • AWS, Azure, and GCP imports now include additional asset types.
    • runZero optimized MAC merging so large scan jobs now process faster.
    • runZero now processes directory and device data concurrently, improving task performance.
    • Issue owners now receive an email with a direct link when assigned an Issue.

    3 more in Everything

22. changelog Sep 25, 2026 · issue 085

    runZero adds OCSF 1.9.0OCSF 1.9.0An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format for security telemetry so cyber tools can share and ingest logs without custom normalization. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. exports, API vulnerability suppression, OAuth for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., and custom-role API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds OCSF 1.9.0 export to the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events via the inventory export menu and the Export API; unmapped fields appear under the event's unmapped object.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Cryptographic Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (CBOM) export in CycloneDX JSON format along with a detailed report.
    • Adds API support for suppressing and unsuppressing vulnerabilities, vulnerability groups, and findings.
    • Adds OAuth support to the MCP service, including using Export Tokens and Organization Keys as OAuth Client Secrets in addition to API Clients.
    • Enables assigning custom roles to API keys, default user roles, group permissions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. defaults, and MCP connections.

    +17 more show less

    • Allows users to create API clients with custom permissions capped by their own access rights; account-level API clients now support granular authentication scopes in addition to roles.
    • Adds a configuration option on the scan page to toggle the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe.
    • Adds Mermaid-based charting and diagram support to the AI Threads feature.
    • Allows scripts to run in console instances in addition to Explorers and the CLI.
    • Allows authoring and testing of custom integration scripts in-product using an AI model of choice.
    • Scripts now support settings shared across protocols such as HTTP and TLS.
    • Users can now submit scripts for inclusion as native runZero sources.
    • Adds the Annotator role to the list of default roles selectable in SSO settings.
    • Adds the Dashboards column to the query library, showing how many personal dashboards use a saved query and whether it is also used on other dashboards.
    • Allows users to reprocess tasks directly from the user interface.
    • Allows users to close an Issue from the Issue Details page.
    • Users can now share standard reports through the External Reporting feature.
    • Users can now sort Findings by name.
    • Task summaries now indicate when a task involved more than 1,000 asset changes.
    • WS-Discovery XAddr endpoints now contribute to asset hostnames.
    • The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities.
    • runZero now labels AI Threads and AI Artifacts as AI-generated following EU guidance, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the label in exported reports, downloaded files, and generated custom-integration scripts.
    • Adds OCSF 1.9.0 export to the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events via the inventory export menu and the Export API; unmapped fields appear under the event's unmapped object.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Cryptographic Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (CBOM) export in CycloneDX JSON format along with a detailed report.
    • Adds API support for suppressing and unsuppressing vulnerabilities, vulnerability groups, and findings.
    • Adds OAuth support to the MCP service, including using Export Tokens and Organization Keys as OAuth Client Secrets in addition to API Clients.
    • Adds a configuration option on the scan page to toggle the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe.

    +6 more show less

    • Allows authoring and testing of custom integration scripts in-product using an AI model of choice.
    • Users can now submit scripts for inclusion as native runZero sources.
    • Allows users to reprocess tasks directly from the user interface.
    • Allows users to close an Issue from the Issue Details page.
    • Users can now share standard reports through the External Reporting feature.
    • runZero now labels AI Threads and AI Artifacts as AI-generated following EU guidance, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the label in exported reports, downloaded files, and generated custom-integration scripts.

    11 more in Everything

23. changelog Sep 24, 2026 · issue 084

    runZero: Custom integration script library now covers more than 100 products, available in the console with individual scripts modifiable or usable as templates.

    • Custom roles granting Saved queries read can now view the Queries page and table without inventory access; roles granting write or manage can create, edit, copy, import, and delete saved queries.
    • Scripts are now available to all administrators, even those with narrow access scopes.

    2 more in Everything

24. changelog Sep 23, 2026 · issue 083

    runZero: Custom roles granting Saved queries read can now view the Queries page and table without inventory access; write or manage roles can create, edit, copy, import, and delete saved queries.

    └──▷ HOW TO FIND IT
    Export the full asset inventory in OCSF 1.9.0OCSF 1.9.0An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format for security telemetry so cyber tools can share and ingest logs without custom normalization. format for ingestion into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or data lake that understands the Open Cybersecurity Schema Framework.
    📍In the runZero console, go to Inventory › Export and select OCSF 1.9.0; assets appear as Device Inventory Info events and services as Live Evidence Info events. Alternatively, call the Export API endpoint to automate the pull.
    • Software and Vulnerabilities collected from integrations are now retired when that integration data expires.
    • runZero now populates MAC vendor information for legacy MAC prefixes.
    • AWS, Azure, and GCP imports now include additional asset types.

    3 more in Everything

25. changelog Sep 22, 2026 · issue 082

    runZero adds vulnerability suppression API, OCSF 1.9.0OCSF 1.9.0An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format for security telemetry so cyber tools can share and ingest logs without custom normalization. export, CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON, OAuth for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., and custom API key roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Generate a Cryptographic Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. for an org to identify weak or deprecated algorithms across the asset inventory.
    📍In the runZero console, go to Reports, select Cryptographic Bill of Materials (CBOM), then choose Export as CycloneDX JSON to download the artifact.
    • Adds vulnerability suppression and unsuppression via the runZero API, covering vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an OCSF 1.9.0 export from the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events, available from the inventory export menu and the Export API; fields without an OCSF equivalent are preserved under the event's unmapped object.
    • Adds a Cryptographic Bill of Materials (CBOM) as a new CycloneDX JSON export and detailed report.
    • Adds OAuth support to the MCP service, including the ability to use Export Tokens and Organization Keys as OAuth Client Secrets, in addition to API Clients.
    • Supports assigning custom roles to API keys, default user roles, group permissions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. defaults, and MCP connections.

    +23 more show less

    • Enables creating API clients with custom permissions capped by the creating user's own access rights; account-level API clients can now use granular authentication scopes in addition to roles.
    • Adds a configuration option on the scan page to toggle the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe.
    • Adds Mermaid-based charting and diagram support to the AI Threads feature.
    • Enables running custom integration scripts on console instances in addition to Explorers and the CLI.
    • Adds an in-product script authoring and testing environment using the AI model of your choice.
    • Scripts now support settings shared across protocols like HTTP and TLS.
    • Allows users to submit scripts for inclusion as native runZero sources.
    • The reports page now displays a paginated, searchable list of all analysis task-based reports with delete support.
    • Adds a Dashboards column to the query library showing how many personal dashboards use a saved query and whether it appears on other dashboards.
    • The list of default roles selectable in SSO settings now includes the Annotator role.
    • WS-Discovery XAddr endpoints now contribute to asset hostnames.
    • Adds the ability to sort Findings by name.
    • Adds the ability to close an Issue directly from the Issue Details page.
    • Users can now reprocess tasks directly from the user interface.
    • Users can now share standard reports through the External Reporting feature.
    • Task summaries now indicate when a task involved more than 1,000 asset changes.
    • Issue owners now receive an email with a direct link when assigned an Issue.
    • runZero now labels AI Threads and AI Artifacts as AI-generated, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the label in exported reports, downloaded files, and generated custom-integration scripts.
    • Users can now re-invite an external user who already has access to the account.
    • runZero optimized MAC merging so large scan jobs now process faster.
    • runZero now processes directory and device data concurrently, improving task performance.
    • Vulnerability exports now run faster.
    • Background MCP connections no longer count against API usage.
    • Adds vulnerability suppression and unsuppression via the runZero API, covering vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an OCSF 1.9.0 export from the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events, available from the inventory export menu and the Export API; fields without an OCSF equivalent are preserved under the event's unmapped object.
    • Adds a Cryptographic Bill of Materials (CBOM) as a new CycloneDX JSON export and detailed report.
    • Adds OAuth support to the MCP service, including the ability to use Export Tokens and Organization Keys as OAuth Client Secrets, in addition to API Clients.
    • Adds a configuration option on the scan page to toggle the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe.

    +4 more show less

    • Adds an in-product script authoring and testing environment using the AI model of your choice.
    • Allows users to submit scripts for inclusion as native runZero sources.
    • Issue owners now receive an email with a direct link when assigned an Issue.
    • runZero now labels AI Threads and AI Artifacts as AI-generated, embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the label in exported reports, downloaded files, and generated custom-integration scripts.

    19 more in Everything

26. runZero 5.1.260922.0 (2026-09-22) Sep 22, 2026 · release notes

    runZero 5.1.260922 adds granular Saved Queries RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and auto-retires integration data; fixes VLAN/switch report bugs.

    • Enables Saved queries read permission to grant view-only access to the Queries page without inventory access
    • Expands Saved queries write/manage roles to allow creating, editing, copying, importing, and deleting saved queries
    • Automatically retires Software and Vulnerabilities collected from integrations when that integration data expires

    3 details in Everything

27. docs update Sep 18, 2026 · issue 078

    runZero adds Autonomous Discovery — a self-expanding scan loop that grows coverage from a seed scope across up to 12 waves and 150 distinct scopes per lineage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Launch an internal autonomous discovery scan from the scan form to map unknown private network segments starting from a known seed subnet.
    📍In the scan form, set the mode control to Autonomous › Internal, then click Fill to populate the scope with the site's default private IP scope. Set a recurring schedule and submit — runZero will queue follow-up scans automatically each wave.
    Enable AI-assisted wave analysis so the autonomous loop can recognize naming conventions and stop earlier when evidence is weak.
    📍Navigate to Account settings › AI configuration, enter your AI provider API key, and save — runZero validates the credential live. Then launch or re-run an autonomous scan; subsequent review waves will use the AI-assisted brain and fall back to rule-based if the budget is exhausted.
    • Adds Autonomous mode control in the scan form, with a Fill button to pre-populate scope from the site's default scope (internal) or the org's domain and public egress IP (external).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Autonomous Discovery — a scan mode that automatically queues follow-up scans based on evidence found in each completed scan (routing tables, ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. caches, traceroute hops, TLS certificates, DNS answers), repeating until no new targets remain.
    • Supports two autonomous expansion paths: Internal mode, which grows coverage of private networks from topology evidence (SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. routing tables, ARP caches, RIP routes, CDPCDPCisco Discovery Protocol, a Cisco-proprietary Layer 2 protocol that advertises device identity, capabilities, and topology between directly connected Cisco gear, giving cyber tools a passive way to map network infrastructure./LLDP management addresses, traceroute hops), and External mode, which expands from public IPs, ASNs, and domain names.
    • Enforces guardrails on every follow-up candidate: confidence score must be >= 0.30, internal candidates are never broader than a /24, site exclusions and already-scanned lineage targets are always respected, and credential IDs and sensitive scan options are stripped before each child task is created.
    • Loops up to 12 waves and 150 distinct scopes per lineage, converging automatically (and reporting convergence as a status) when no actionable candidates are found, novelty drops off, or limits are reached.

    +5 more show less

    • Adds an AI-assisted analysis path (BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. — bring your own key) configurable under Account settings > AI configuration, where the connected model proposes expansion candidates with reasoning; falls back to the rule-based brain if AI is unavailable.
    • Supports per-account and per-organization daily input and output token caps for AI-assisted waves, with per-wave token usage recorded.
    • Adds a lineage status card showing loop state (mode, state, wave number, assets discovered, novelty, vendor diversity), per-candidate outcomes (queued, skipped, deferred, duplicate, or stop signal), and — when AI was used — per-wave token usage.
    • Records an integration suggestion on the lineage card when scanned infrastructure (cloud accounts, virtualization hosts) cannot be further enumerated over the network.
    • Each organization can override the account-level AI provider credential or opt out of AI entirely from its own AI settings.

    10 details in Everything

28. docs update Sep 18, 2026 · issue 078

    runZero adds custom roles with granular area/verb permissions, assignable to users, groups, and API clients across organizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Verify what a specific user can actually do in each organization before changing their role assignments.
    📍In the console, open the user's details page and review the Effective access section, which lists permissions per organization split into direct user access, group access, and SSO group access.
    Build a Viewer plus inventory write custom role quickly by cloning the built-in Viewer row and adding only the inventory write verb.
    📍In the console, go to the Roles page, find the Viewer row, click Copy, add the inventory write permission, name the new role, then click Save.
    • Introduces custom roles — user-defined permission sets built from area/verb pairs — assignable as a user's default role, a per-organization role, or to groups and API clients, anywhere a built-in role can go.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Permissions union across all routes (default role, per-organization role, group default, group per-organization): the highest verb on each area wins, and custom roles can only add access on top of what a built-in role already grants.
    • Enforces permissions consistently across the console UI, API routes, and AI/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool surface — no surface skips a permission that another enforces.
    • Allows locking an API client to a custom role so the credential's access tracks future changes to that role.
    • Exposes a Roles page in the console navigator listing built-in roles as read-only rows alongside custom roles, showing permissions and the count of users, groups, and API clients holding each role; accessible to superusers and all-organization administrators.

    +6 more show less

    • Copying an existing role row starts a new role pre-populated with that role's permissions, enabling quick Viewer plus one thing configurations.
    • Editing a role takes effect immediately for all holders with no separate publish step.
    • Renaming a role rewrites every assignment (including SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enrollment defaults and API client locks) atomically; runZero refuses to rename onto a name that still has active assignments.
    • Deleting a role disables all its assignments immediately and shows No access in effective-access views; recreating a role with the same name re-enables every stored assignment that still refers to it.
    • Shows effective access per organization on the user details page, broken down into direct user access, group access, and SSO group access.
    • Records role changes as audit events, including which fields changed, previous name, previous permissions, and on delete, how many assignments were disabled.

    11 details in Everything

29. docs update Sep 18, 2026 · issue 078

    runZero adds granular data-retention controls: stale asset, offline asset, integration attribute, vulnerability, and scan data expiration per org and site.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enforce a short asset lifetime on a guest wireless org so stale DHCP entries are purged automatically every night.
    📍In the runZero console, go to Organization Settings, locate Stale asset expiration, and set the number of days to your desired threshold (e.g. 7). For site-level overrides, open the Site settings and set a lower value there — the lower of the two thresholds takes effect.
    Meet a cloud-data-retention policy by capping how long raw scan data is stored, and archive events that must be kept longer.
    📍In the runZero console, go to Organization Settings, set Scan data expiration to the number of days required by your policy (default is 365). For event records older than one year, use the API to export and archive them before they are automatically deleted.
    • Adds stale asset expiration, configurable at both Organization and Site levels, that automatically deletes assets not seen in a specified number of days (set to zero to disable); the lower of the two levels wins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds offline asset expiration that deletes offline assets not seen in a specified number of days while leaving online assets untouched; applies only to scan-backed assets, not connector/import-only assets.
    • Adds stale integration attribute expiration that removes integration-sourced attributes not reported within a configurable number of days, and also removes assets left with no remaining data sources.
    • Adds stale vulnerability expiration that automatically deletes vulnerability records not updated within a configurable number of days.
    • Adds scan data expiration controlling how long raw data and metadata for Scan and Import tasks are retained, defaulting to 365 days.

    +2 more show less

    • Supports a retention period of up to 3 years for active Platform subscriptions, up from the default 1-year maximum; Community Edition is capped at 30 days.
    • Account-level event records (under Alerts -> Events) are always retained for one year; longer retention requires exporting and archiving through the API.
    • Adds stale asset expiration, configurable at both Organization and Site levels, that automatically deletes assets not seen in a specified number of days (set to zero to disable); the lower of the two levels wins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds offline asset expiration that deletes offline assets not seen in a specified number of days while leaving online assets untouched; applies only to scan-backed assets, not connector/import-only assets.
    • Adds stale integration attribute expiration that removes integration-sourced attributes not reported within a configurable number of days, and also removes assets left with no remaining data sources.
    • Adds stale vulnerability expiration that automatically deletes vulnerability records not updated within a configurable number of days.
    • Adds scan data expiration controlling how long raw data and metadata for Scan and Import tasks are retained, defaulting to 365 days.

    +1 more show less

    • Account-level event records (under Alerts -> Events) are always retained for one year; longer retention requires exporting and archiving through the API.

    1 more in Everything

30. docs update Sep 18, 2026 · issue 078

    runZero self-hosted deployments now support high-availability mode with load balancers, shared PostgreSQL, S3/NFS storage, and AWS Secrets Manager integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Point HA nodes at a PostgreSQL writer and offload read traffic to a replica in an RDS Aurora cluster.
    /etc/runzero/runzero.conf copy

    DATABASE_URL=postgresql://user:pass@writer.cluster-xxxx.us-east-1.rds.amazonaws.com:5432/runzero
    DATABASE_REPLICA_URL=postgresql://user:pass@reader.cluster-ro-xxxx.us-east-1.rds.amazonaws.com:5432/runzero

    • Adds DATABASE_REPLICA_URL configuration variable to route read-only queries to a PostgreSQL replica (for RDS Aurora, set it to the read-only endpoint).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds AWS_ENDPOINT_URL_S3 configuration variable to support non-AWS S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. object storage backends alongside AWS_REGION override.
    • Adds a /health HTTP endpoint on runZero servers for load balancer health checks to enable automatic failover.
    • Supports high-availability self-hosted deployments: a load balancer (e.g. AWS ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy.) terminates TLS, forwards requests to multiple runZero console nodes sharing a PostgreSQL cluster and a common storage backend.
    • Supports AWS S3 as a shared storage backend for asset data, raw scan data, and reports across HA nodes, configured via AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, and bucket name variables in the configuration file.

    +1 more show less

    • Supports mounted NFS as a shared storage backend: mount a read-write share at /opt/runzero/storage and select local storage mode in the configuration file.

    6 details in Everything

31. docs update Sep 18, 2026 · issue 078

    runZero adds OCSF 1.9.0OCSF 1.9.0An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format for security telemetry so cyber tools can share and ingest logs without custom normalization. export, vulnerability suppression API, CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. export, OAuth for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., custom API key roles, and more⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds OCSF 1.9.0 export to the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events, with unmapped fields preserved under the event's unmapped object; available from the inventory export menu and the Export API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Cryptographic bill of materialsbill of materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (CBOM) export as a new CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON format with a detailed report.
    • Supports assigning custom roles to API keys, default user roles, group permissions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. defaults, and MCP connections.
    • Allows creation of API clients with custom permissions capped by the creating user's own access rights; account-level API clients can now use granular authentication scopes in addition to roles.
    • Adds OAuth support to the MCP service, including using Export Tokens and Organization Keys as OAuth Client Secrets, in addition to API Clients.

    +19 more show less

    • Adds a configuration option on the scan page to toggle the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe.
    • Adds charting and diagram support to AI Threads via Mermaid.
    • Adds the Annotator role to the list of selectable default roles in SSO settings.
    • Enables users to sort Findings by name.
    • Enables users to reprocess tasks directly from the user interface.
    • Enables users to close an Issue directly from the Issue Details page.
    • Enables users to share standard reports through the External Reporting feature.
    • Enables users to re-invite an external user who already has access to the account.
    • Scripts can now run in console instances in addition to Explorers and the CLI.
    • Scripts now support settings shared across protocols like HTTP and TLS.
    • Users can author and test custom integration scripts in-product using an AI model of choice.
    • The query library's Dashboards column now shows how many personal dashboards use a saved query and whether it is used on other dashboards.
    • Task summaries now indicate when a task involved more than 1,000 asset changes.
    • WS-Discovery XAddr endpoints now contribute to asset hostnames.
    • AWS, Azure, and GCP imports now include additional asset types.
    • runZero now labels AI Threads and AI Artifacts as AI-generated, with the label embedded in exported reports, downloaded files, and generated custom-integration scripts.
    • The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities.
    • Connected AWS accounts now skip task processing for disabled AWS regions.
    • Background MCP connections no longer count against API usage.
    • Adds OCSF 1.9.0 export to the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events, with unmapped fields preserved under the event's unmapped object; available from the inventory export menu and the Export API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Cryptographic bill of materialsbill of materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (CBOM) export as a new CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON format with a detailed report.
    • Adds a configuration option on the scan page to toggle the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe.
    • Enables users to reprocess tasks directly from the user interface.
    • Enables users to close an Issue directly from the Issue Details page.

    +4 more show less

    • Enables users to share standard reports through the External Reporting feature.
    • Enables users to re-invite an external user who already has access to the account.
    • Users can author and test custom integration scripts in-product using an AI model of choice.
    • runZero now labels AI Threads and AI Artifacts as AI-generated, with the label embedded in exported reports, downloaded files, and generated custom-integration scripts.

    15 more in Everything

32. runZero 5.1.260915.0 (2026-09-15) Sep 15, 2026 · issue 076

    runZero API gains endpoints to suppress and unsuppress vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

33. changelog Sep 14, 2026 · issue 074

    runZero: Makes MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connections compatible with Claude Desktop and similar tools, with background MCP connections no longer counting against API usage.

34. changelog Sep 13, 2026 · issue 073

    runZero adds custom roles for API keys and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connections, sub-asset visibility, and direct task reprocessing from the UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Enables account-level API clients to use granular authentication scopes in addition to roles, capped by the creator's own access rights.
    • Supports reprocessing tasks directly from the user interface.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Hostname discovery no longer falls back to NetBIOS domains — assets that previously resolved hostnames via NetBIOS domain fallback will no longer do so.
35. changelog Sep 12, 2026 · issue 072

    runZero adds custom roles for API keys and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connections, reprocessing tasks from the UI, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. certificate expiry warnings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Allows custom roles to be assigned to API keys, default user roles, group permissions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. defaults, and MCP connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables creation of API clients with custom permissions capped by the creator's own access rights, with support for granular authentication scopes on account-level API clients.
    • Tasks can now be reprocessed directly from the user interface.
    • Account administrators now receive email warnings before SAML certificates expire.
    • Recent assets now include sub-assets identified through protocol gateways.

    +5 more show less

    • WS-Discovery XAddr endpoints now contribute to asset hostnames.
    • MAC vendor information is now populated for legacy MAC prefixes.
    • AWS, Azure, and GCP cloud imports now include additional asset types.
    • Dragos and Wiz imports now apply more complete fingerprinting and OS CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. matching when available.
    • Task summaries now clearly indicate when a task involved more than 1,000 asset changes.
    • Allows custom roles to be assigned to API keys, default user roles, group permissions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. defaults, and MCP connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables creation of API clients with custom permissions capped by the creator's own access rights, with support for granular authentication scopes on account-level API clients.
    • Tasks can now be reprocessed directly from the user interface.
    • Account administrators now receive email warnings before SAML certificates expire.

    6 more in Everything

36. changelog Sep 11, 2026 · issue 071

    runZero: Enables creation of API clients with custom permissions capped by the creator's own access rights, with support for granular authentication scopes on account-level API clients.

    • Sub-assets identified through protocol gateways now appear in Recent Assets.

    1 more in Everything

37. docs update Sep 11, 2026 · issue 071

    runZero: WS-Discovery XAddr endpoints now contribute to asset hostnames, while hostname discovery no longer falls back to NetBIOS domains.

    • Cloud imports now better match directly imported cloud assets; AWS, Azure, and GCP imports include additional asset types.

    1 more in Everything

38. changelog Sep 10, 2026 · issue 070

    runZero: Enables account-level API clients to use granular authentication scopes in addition to roles, with permissions capped by the creating user's own access rights.

    • Background MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connections no longer count against API usage.

    1 more in Everything

39. docs update Sep 9, 2026 · issue 069

    runZero adds custom roles with fine-grained verb/area permissions assignable to users, groups, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enrollment, and API clients.

    └──▷ HOW TO FIND IT
    Create a SOC Analyst custom role that can read and annotate findings and inventory but cannot change scan configuration — scope exactly what the team needs without granting full User access.
    📍In the console, go to Account › Roles (console.runzero.com/account/roles), click Create role, set Name to SOC Analyst, set inventory to annotate, set findings to annotate, leave all other areas at no access, then click Save.
    Lock an API client to a least-privilege role that can only read inventory and download scan artifacts, then restrict further by keeping tokens out of the role to prevent the client from minting new credentials.
    📍In the console, go to Account › Roles (console.runzero.com/account/roles), click Create role, set Name to Read-Only API, set inventory to read and tasks to read, leave tokens at no access, Save — then edit the API client and lock it to the Read-Only API role.
    • Adds a Custom roles system at console.runzero.com/account/roles where superusers and all-organization administrators can define roles as any combination of read, annotate, write, or manage verbs across 16 permission areas (inventory, findings, tasks, events, alerts, explorers, sources, queries, directory, users, organizations, credentials, tokens, ai, reports, content).
    • Enables custom roles to be assigned as a user's default role, as a per-organization role override, as the SSO enrollment default via the Default role in any organization field on the SSO settings page, or locked to an API client.
    • Supports a tokens:manage permission to create, change, and revoke API keys, export tokens, and API clients, and to approve MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connections — kept separate from credentials:manage to prevent privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. paths.
    • Permissions enforce uniformly across the console UI, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and MCP tools — a role that cannot write inventory hides the relevant console buttons, refuses the matching API routes, and omits the MCP tools that would change inventory.
    • Deleting a custom role disables all assignments immediately but preserves the role name on those assignments; recreating a role with the same name at console.runzero.com/account/roles re-enables every stored assignment without requiring reassignment.

    5 details in Everything

40. docs update Sep 9, 2026 · issue 069

    runZero: Adds custom roles, definable on the Roles page, that grant exact permissions and can be assigned as a user's default role, a per-organization role, a group role, the SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enrollment default, or locked to an API client.

    • Adds account-bound API clients on the API clients page — credentials with an explicit set of permissions and organizations that are not tied to any user account.

    1 detail in Everything

41. docs update Sep 9, 2026 · issue 069

    runZero adds custom roles for API keys and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connections, reprocessing tasks from the UI, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. cert expiry warnings.

    └──▷ HOW TO FIND IT
    Reprocess a completed task to re-evaluate asset data without re-running the scan — useful after updating fingerprints or import configurations.
    📍In the runZero console, open the task inspection card for a completed task, then click Reprocess to trigger reprocessing directly from the UI.
    • Enables API clients to be created with custom permissions capped by the creator's own access rights, and account-level API clients can now use granular authentication scopes in addition to roles.
    • MCP connections now work smoothly with Claude Desktop and similar tools, and background MCP connections no longer count against API usage.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Hostname discovery no longer falls back to NetBIOS domains, which may change hostnames for assets previously resolved via NetBIOS.
42. runZero 5.1.260908.0 (2026-09-08) Sep 8, 2026 · issue 069

    runZero 5.1 adds custom roles for API keys and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connections, granular auth scopes for account-level API clients, and UI-driven task reprocessing.

    • Enables custom roles to be assigned to API keys, default user roles, group permissions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. defaults, and MCP connections.
    • Allows account-level API clients to use granular authentication scopes in addition to roles.
    • Lets users create API clients with custom permissions capped by their own access rights.
    • Background MCP connections no longer count against API usage, and the MCP experience works with Claude Desktop and similar tools.
    • Tasks can now be reprocessed directly from the user interface.

    +7 more show less

    • Account administrators now receive email warnings before SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. certificates expire.
    • Recent assets now include sub-assets identified through protocol gateways.
    • Task summaries now clearly indicate when a task involved more than 1,000 asset changes.
    • WS-Discovery XAddr endpoints now contribute to asset hostnames.
    • MAC vendor information is now populated for legacy MAC prefixes.
    • AWS, Azure, and GCP imports include additional asset types.
    • Dragos and Wiz imports now apply more complete fingerprinting and OS CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. matching when available.
    • Enables custom roles to be assigned to API keys, default user roles, group permissions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. defaults, and MCP connections.
    • Tasks can now be reprocessed directly from the user interface.
    • Account administrators now receive email warnings before SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. certificates expire.

    9 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Hostname discovery no longer falls back to NetBIOS domains — assets whose hostnames were previously derived from NetBIOS domains will have those hostnames removed.
43. 5.1.260908.0 Sep 8, 2026 · release notes

    runZero 5.1 adds custom API key roles, granular scopes for account clients, and reprocess tasks from UI

    • Adds custom role assignment to API keys, default user roles, group permissions, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. defaults, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connections
    • Adds ability to create API clients with custom permissions capped by creator's access rights; account-level API clients can now use granular authentication scopes in addition to roles
    • Enables reprocessing tasks directly from the user interface

    3 details in Everything

44. changelog Sep 2, 2026 · issue 062

    runZero adds MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials., CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. export, WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. scripting, Mermaid charting, and Issue lifecycle alert conditions

    └──▷ TRY IT
    Search Issue comments for a keyword to quickly surface relevant discussion on open Issues.
    copy

    $ comment:CVE-2025

    • Alert rules now support conditions for Issue lifecycle events, enabling automated responses to Issue state changes.
    • Large scan jobs process faster after optimization for MAC merging.

    2 details in Everything

45. docs update Sep 2, 2026 · issue 062

    runZero adds MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials., CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. Cyclone JSON export, Censys Platform v3, AI labelling, and major Custom Integration script expansion

    • The comment: search operator is now supported in the Issues inventory for searching Issue comments.
    • The number of personal dashboards a saved query is used on, and whether it appears on other dashboards, is now visible in the Dashboards column of the query library.

    2 details in Everything

46. changelog Sep 1, 2026 · issue 061

    runZero 5.1.260826.0 adds MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials., CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. Cyclone JSON export, Censys v3, and a 100+ script custom integration library

    • The MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. service now supports OAuth, including Export Token and Organization Key as OAuth Client Secrets, in addition to API Clients.
    • The Cryptographic Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (CBOM) is now exportable as a Cyclone JSON format and detailed report.
    • The Censys integration now supports the Censys Platform v3 API.
    • Custom Integration scripts now support WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. (WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS., SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., DCERPC) for deep Windows host collection.
    • Custom Integration scripts now support custom application protocols over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., and Unix streams.

    +15 more show less

    • Custom Integration scripts now support shared common settings for protocols like HTTP and TLS.
    • Custom Integration scripts can now define detailed credential fields and validation rules.
    • Custom Integration scripts now track a maturity mode (alpha, beta, stable) for filtering.
    • Scripts can now be run in console instances in addition to Explorers and the CLI.
    • Scripts can be authored and tested in-product using an AI model of choice.
    • The community custom integration script library now covers more than 100 products and is accessible directly in the console.
    • The AI Threads feature now supports charting and diagrams via Mermaid.
    • The AI Artifacts feature now supports full-page viewing.
    • AI-generated content (threads, artifacts, exported reports, downloaded files, and custom integration scripts) is now labelled as AI-generated, following EU guidance.
    • The MCP service and in-product AI Threads now share the same tools.
    • Scripts are now available to all administrators, even those with narrow access scopes.
    • Scripts can be submitted for inclusion as native runZero sources.
    • The Annotator role has been added to the list of default roles selectable in SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. settings.
    • Dashboard query library now shows how many personal dashboards each saved query is used on, and whether it is used on other dashboards, in a Dashboards column.
    • A configuration option has been added to the scan page to toggle the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe.

    20 details in Everything

47. runZero 5.1.260901.0 (2026-09-01) Sep 1, 2026 · issue 062

    runZero 5.1 adds External Reporting sharing for standard reports, alert rules for Issue lifecycle events, and comment: search in Issues inventory.

    └──▷ HOW TO FIND IT
    Find Issues that contain a specific term in their comments — useful for tracking discussion-driven triage without leaving the Issues inventory.
    📍In the Issues inventory search bar, enter: comment:<term>
    • Adds comment: keyword for searching Issue comments in the Issues inventory.
    • Alert rules now support conditions based on Issue lifecycle events.
    • Standard reports can now be shared via the External Reporting feature.

    3 details in Everything

48. 5.1.260827.1 Aug 27, 2026 · release notes

    runZero v5.1.260827.1 adds AI content labeling, Annotator SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. role, and custom integration script improvements.

    • AI labels are added to AI Threads and AI Artifacts in the console, exported reports, downloaded files, and custom-integration scripts
    • Annotator role is added to the list of default roles selectable in SSO settings
    • Custom integration scripts running on an Explorer can now connect to internal IP addresses
    • Personal dashboards using a saved query are now indicated in the query library's Dashboards column

    4 details in Everything

49. docs update Aug 26, 2026 · issue 057
    └──▷ HOW TO FIND IT
    Disable the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe for environments where broadcast traffic must be minimized.
    📍In the runZero console, go to the scan configuration page, locate the promiscuous ARP probe toggle, and switch it off before starting the scan.
50. runZero 5.1.260826.0 (2026-08-26) Aug 26, 2026 · release notes

    runZero 5.1.260826.0 adds AI script authoring, Mermaid charting in Threads, CBOMCBOMA structured inventory of cryptographic assets — algorithms, keys, certificates, and protocols — used in a system, modeled after the Software Bill of Materials concept to help teams audit and manage cryptographic risk. export, Censys v3 API, and custom protocol support in scripts.

    └──▷ HOW TO FIND IT
    Export the full cryptographic inventory in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. format for supply chain analysis.
    📍runZero -> Export -> CBOM (CycloneDX JSON)
    Configure the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. service to authenticate using an organization key as an OAuth Client Secret.
    text copy

    # MCP Configuration
    oauth_client_secret: <organization_key>
    # or
    oauth_client_secret: <export_token>

    Use the new Censys v3 API integration to enrich scan results.
    📍# In runZero Console, go to Integrations › Censys and select Censys Platform (v3 API)
    • Adds MCP service OAuth support with Export Tokens and Organization Keys as OAuth Client Secrets
    • Introduces AI Threads feature with extensive charting and diagrams via Mermaid
    • Adds full-page viewing for AI Artifacts
    • Exposes Cryptographic bill of materialsbill of materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (CBOM) as a new CycloneDX JSON export and detailed report
    • Updates Censys integration to support the Censys Platform (v3 API)

    +3 more show less

    • Enables in-product script authoring and testing using your AI model of choice
    • Expands custom Integration scripts to support WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk., custom TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./Unix protocols, and shared HTTP/TLS settings
    • Makes Custom Integration scripts available to all administrators regardless of access scope

    8 details in Everything

51. changelog Aug 25, 2026 · issue 056

    runZero adds OCSF 1.9.0OCSF 1.9.0An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format for security telemetry so cyber tools can share and ingest logs without custom normalization. asset inventory export as Device Inventory Info and Live Evidence Info events

    • Adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.9.0 export for the asset inventory, producing assets.ocsf.jsonl and assets.ocsf.json files from the inventory export menu and the Export API; assets export as Device Inventory Info events, observed services as Live Evidence Info events, with unmapped fields preserved under the event's unmapped object.
    • Organization overview report now shows total asset counts in the sites summary, consistent with the sites table in the runZero Console.

    2 details in Everything

52. runZero 5.1.260825.0 (2026-08-25) Aug 25, 2026 · issue 057

    runZero 5.1.260825.0 adds a toggle for the promiscuous ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. probe on the scan configuration page.

    └──▷ HOW TO FIND IT
    Disable the promiscuous ARP probe for scans where broadcast-level ARP traffic is undesirable or restricted.
    📍In the runZero console, go to your scan configuration page, locate the Promiscuous ARP probe toggle, and switch it off before saving the scan.
53. docs update Aug 19, 2026 · issue 050

    runZero self-hosted instances gain per-entitlement kill switches via RUNZERO_DISABLE_<ENTITLEMENT> environment variables

    └──▷ USE IT
    Disable autonomous (autoscan) discovery and AI features across an entire self-hosted runZero instance before a maintenance window.
    env copy

    RUNZERO_DISABLE_AUTOSCAN=true
    RUNZERO_DISABLE_AI=true

    Lock down all third-party integration imports (e.g. CrowdStrike, SentinelOne, Tenable) on a restricted self-hosted deployment.
    env copy

    RUNZERO_DISABLE_INT_CROWDSTRIKE=true
    RUNZERO_DISABLE_INT_SENTINELONE=true
    RUNZERO_DISABLE_INT_TENABLE=true
    RUNZERO_DISABLE_INT_QUALYS=true
    RUNZERO_DISABLE_INT_INSIGHTVM=true

    • Adds RUNZERO_DISABLE_<ENTITLEMENT> environment variables to force-disable any license entitlement instance-wide, overriding the license for every account and organization — supported variables include RUNZERO_DISABLE_AUTOSCAN, RUNZERO_DISABLE_AI, RUNZERO_DISABLE_PASSIVE_MONITORING, RUNZERO_DISABLE_API_ORG, RUNZERO_DISABLE_API_ACCOUNT, RUNZERO_DISABLE_DATA_RETENTION, RUNZERO_DISABLE_OFFLINE, RUNZERO_DISABLE_METAMIN, RUNZERO_DISABLE_FINDINGS, RUNZERO_DISABLE_ISSUES, RUNZERO_DISABLE_SUPPRESSION, RUNZERO_DISABLE_RISK_EVENTS, RUNZERO_DISABLE_RULES_BASIC, RUNZERO_DISABLE_REPORTS_BASIC, RUNZERO_DISABLE_REPORTS_ADVANCED, RUNZERO_DISABLE_CERTIFICATE_INVENTORY, and integration-specific variables such as RUNZERO_DISABLE_INT_CROWDSTRIKE, RUNZERO_DISABLE_INT_SENTINELONE, RUNZERO_DISABLE_INT_TENABLE, RUNZERO_DISABLE_INT_SPLUNK, RUNZERO_DISABLE_INT_SERVICENOW, RUNZERO_DISABLE_INT_QUALYS, RUNZERO_DISABLE_INT_INSIGHTVM, RUNZERO_DISABLE_INT_CLOUD, RUNZERO_DISABLE_INT_LDAP, RUNZERO_DISABLE_INT_AZURE_AD, RUNZERO_DISABLE_INT_INTUNE, RUNZERO_DISABLE_INT_WIZ, RUNZERO_DISABLE_INT_JIRA, RUNZERO_DISABLE_INT_PAN, and more.

    1 detail in Everything

54. docs update Aug 19, 2026 · issue 050

    runZero adds OCSF 1.9.0OCSF 1.9.0An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format for security telemetry so cyber tools can share and ingest logs without custom normalization. export for asset inventory, outputting Device Inventory Info and Live Evidence Info events.

    • Adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.9.0 export for the asset inventory, producing assets.ocsf.jsonl and assets.ocsf.json files — assets export as Device Inventory Info events and their observed services as Live Evidence Info events, with unmapped fields preserved under the event's unmapped object.
    • Exposes the OCSF 1.9.0 inventory export via the inventory export menu and the Export API, supporting both .jsonl.jsonlA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. and .json formats.

    2 details in Everything

55. changelog Aug 18, 2026 · issue 049

    runZero adds AWS Inspector findings for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware./Lambda, broader IPMI vulnerability detection, and improved geolocation and reporting.

    • The AWS integration now supports AWS Inspector findings for EC2 and Lambda assets.
    • The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities.
    • The scanner now detects a broader range of IPMI vulnerabilities.
    • Asset geolocation now uses location data from additional integration-sourced attributes.
    • Connector tasks now honor the configured attribute and vulnerability expiration thresholds during import.

    +3 more show less

    • The Refingerprint asset action now also re-evaluates service fingerprints for improved accuracy.
    • Custom integrations can now continue processing results even if a single device causes errors.
    • Directory and device data are now processed concurrently, improving task performance.

    8 details in Everything

56. runZero 5.1.260818.1 (2026-08-18) Aug 18, 2026 · issue 050

    runZero 5.1 adds OCSF 1.9.0OCSF 1.9.0An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format for security telemetry so cyber tools can share and ingest logs without custom normalization. export for asset inventory, surfacing assets and services as standardized events.

    • Adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.9.0 export for the asset inventory, producing assets.ocsf.jsonl and assets.ocsf.json files downloadable from the inventory export menu and the Export API.
    • Exports assets as Device Inventory Info events and their observed services as Live Evidence Info events under the OCSF schema.
    • Preserves fields without an OCSF equivalent under the event's unmapped object, ensuring no asset data is silently dropped on export.

    3 details in Everything

57. docs update Aug 14, 2026 · issue 045

    runZero AWS integration now ingests Inspector findings for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and Lambda; reports page gains pagination, search, and delete

    • The AWS integration now supports AWS Inspector findings for EC2 and Lambda assets.
    • The reports page now displays a paginated list of all analysis task-based reports and supports searching and deleting reports.

    2 details in Everything

58. runZero 5.1.260814.1 (2026-08-14) Aug 14, 2026 · issue 046

    runZero 5.1 expands IPMI vulnerability detection, improves asset geolocation, and re-evaluates service fingerprints via the Refingerprint action.

    • The Refingerprint asset action now also re-evaluates service fingerprints for improved accuracy.
    • Asset geolocation now uses location data from additional integration-sourced attributes.
    • The scanner detects a broader range of IPMI vulnerabilities.
    • Directory and device data are now processed concurrently, improving task performance.

    4 details in Everything

59. 5.1.260814.1 Aug 14, 2026 · release notes

    runZero 5.1.260814.1 adds concurrent processing for asset data and re-evaluation of service fingerprints in Refingerprint actions.

    • Asset geolocation now uses location data from additional integration-sourced attributes
    • The Refingerprint asset action now also re-evaluates service fingerprints for improved accuracy
    • Non-secret fields now appear when you edit a custom integration credential

    3 details in Everything

60. runZero 5.1.260813.0 (2026-08-13) Aug 13, 2026 · issue 045

    runZero 5.1 adds AWS Inspector findings for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and Lambda, plus a searchable paginated reports page.

    • Adds AWS Inspector findings support for EC2 and Lambda assets via the AWS integration.
    • The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities.
    • The AWS integration now skips linked organizational accounts that are closed.

    3 details in Everything

61. 5.1.260813.0 Aug 13, 2026 · release notes

    runZero 5.1.260813.0 adds AWS Inspector findings support and paginated report management.

    • Adds AWS Inspector findings to the AWS integration for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and Lambda assets
    • Adds search and delete capabilities for analysis task-based reports on the Reports page

    2 details in Everything

62. 5.1.260811.0 Aug 11, 2026 · release notes

    runZero 5.1.260811.0 adds connector error tolerance, vmatch version fix, and passive/active labeling clarity.

    • connector tasks now honor configured attribute and vulnerability expiration thresholds during import
    • Custom integrations can continue processing results even if a single device causes errors
    • Tasks that update directory groups run faster

    3 details in Everything

63. changelog Aug 2, 2026 · issue 033

    runZero 5.1 adds compliance-friendly AI workflows, autonomous discovery, Git Smart Protocol scanning, Jira owner sync, and Purdue-level inventory search.

    └──▷ HOW TO FIND IT
    Filter vulnerability inventory to assets at a specific Purdue level to prioritize OT remediation by network zone.
    📍In the vulnerability inventory search, enter: purdue_level:2
    View site subnet definitions for an organization without needing admin access.
    📍In the runZero console, navigate to Sites, then select a site to open the new site details page showing subnets and site configuration.
    • New site details page lets users with organization access view site details and subnet definitions.
    • Adds ability to sync issue owners with Jira.
    • Goals widget now includes a Pending metric showing baseline assets not matching the target query, with click-through to inventory.
    • Tanium integration now supports specifying multiple sensors.
    • Scanner now supports services using the Git Smart Protocol.

    +1 more show less

    • Software and vulnerability inventory now support purdue_level and lowest_purdue_level search terms.

    6 details in Everything

64. runZero 5.1.260731.2 (2026-07-31) Jul 31, 2026 · issue 032

    runZero 5.1 adds compliance-friendly AI workflows, autonomous discovery, enhanced integration framework, ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. remediation handoffs, and improved Dragos OT enrichment.

    • Adds compliance-friendly AI workflows for querying and surfacing asset data insights.
    • Introduces autonomous discovery mode for automated, continuous attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. intelligence.
    • Enhanced integration framework with refined merge logic to accelerate custom integrations.
    • Streamlined remediation handoffs available directly inside runZero or via ITSM integration.
    • Improved Dragos integration enriches OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. asset context and reduces data silos.

    +1 more show less

    • Connected AWS accounts now skip task processing for disabled AWS regions.

    6 details in Everything

65. 5.1.260731.2 Jul 31, 2026 · release notes

    runZero 5.1 adds compliance-friendly AI workflows, improved Dragos OT integration, and AWS region skip logic

    • Adds Compliance-friendly AI workflows to deliver data insights
    • Improves Dragos integration for enriched OT context

    2 details in Everything

66. docs update Jul 30, 2026 · issue 030

    runZero 5.0.260728.1 adds Jira issue-owner sync, Git Smart Protocol scanning, Purdue level search, and multi-sensor Tanium support.

    • New site details page lets users with organization access view site details and subnet definitions.
    • Adds ability to sync issue owners with Jira from runZero.
    • Goals widget now includes a Pending metric showing baseline assets that don't match the target query, with click-through to those assets in inventory.
    • Tanium integration now supports specifying multiple sensors.
    • Scanner now supports services using the Git Smart Protocol.

    +2 more show less

    • Software and vulnerability inventory now support purdue_level and lowest_purdue_level search terms.
    • Expanded active and passive data collection coverage for the AMQP protocol.

    7 details in Everything

67. 5.0.260730.0 Jul 30, 2026 · release notes

    runZero 5.0.260730.0 improves natural language inventory search and Office version vulnerability reporting

    • Natural language inventory search has improved.
    • Software version-based vulnerability reporting now suggests updates that match Microsoft Office versions.

    2 details in Everything

68. runZero 5.0.260728.1 (2026-07-29) Jul 29, 2026 · issue 030

    runZero 5.0 adds Jira issue-owner sync, Git Smart Protocol scanning, Purdue-level search terms, and multi-sensor Tanium support.

    └──▷ HOW TO FIND IT
    Filter software inventory to OT assets at Purdue Level 1 (field devices) to scope vulnerability reviews to critical control-layer systems.
    📍In the runZero console, go to Inventory › Software and enter purdue_level:1 in the search bar.
    Identify baseline assets not yet meeting a compliance goal so you can prioritize remediation work.
    📍In the runZero console, open a Goals widget and click the Pending metric to view the baseline assets that do not match the target query in inventory.
    • New site details page lets organization-level users view site details and subnet definitions.
    • Adds ability to sync issue owners with Jira.
    • Goals widget now includes a Pending metric showing baseline assets that don't match the target query, with click-through to those assets in inventory.
    • Tanium integration now supports specifying multiple sensors.
    • Scanner now supports services using the Git Smart Protocol.

    +3 more show less

    • Software inventory adds support for purdue_level and lowest_purdue_level search terms.
    • Vulnerability inventory adds support for purdue_level and lowest_purdue_level search terms.
    • Active and passive data collection for the AMQP protocol now offers improved coverage.

    8 details in Everything

69. 5.0.260728.1 Jul 29, 2026 · release notes

    runZero 5.0 adds Jira sync, site details page, Tanium multi-sensor support, and AMQP/Smart Protocol coverage

    • Adds site_details page for viewing site details and subnet definitions
    • Adds Jira sync for issue owners
    • Adds Pending metric to Goals widget with click-through to inventory assets
    • Adds multi-sensor specification support to Tanium integration
    • Adds Git Smart Protocol support to the scanner

    +2 more show less

    • Adds purdue_level and lowest_purdue_level search terms to software and vulnerability inventories
    • Adds broader active and passive data collection coverage for AMQP protocol

    7 details in Everything

70. docs update Jul 24, 2026 · issue 024

    runZero now displays Purdue levels for assets sourced or enriched from Dragos integration

71. docs update Jul 24, 2026 · docs issue 004

    runZero now displays Purdue levels for assets sourced or enriched from Dragos integration

72. runZero 5.0.260723.0 (2026-07-23) Jul 23, 2026 · issue 024

    runZero 5.0.260723.0 adds Purdue level visibility for Dragos-enriched OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. assets.

    • Displays Purdue Model levels for assets sourced or enriched from Dragos integration, enabling OT/ICS network segmentation visibility.

    1 detail in Everything

73. 5.0.260721.0 Jul 21, 2026 · release notes

    runZero v5.0.260721.0 removes the Bookmarks widget from dashboards.

74. runZero 5.0.260714.0 (2026-07-14) Jul 14, 2026 · issue 015

    runZero 5.0.260714.0 adds crown jewel status and Purdue level to the Dragos integration.

    • Adds crown jewel status and Purdue level fields to assets surfaced via the Dragos integration.
    • Vulnerability groups inventory now displays a meaningful error message when a search contains unsupported terms.

    2 details in Everything

75. 5.0.260714.0 Jul 14, 2026 · release notes

    runZero 5.0.260714.0 adds Dragos crown jewel and Purdue level to integrations with better error reporting.

    • Dragos integration now includes assets’ crown jewel status and Purdue level
    • Vulnerability groups inventory shows meaningful error message for unsupported search terms

    2 details in Everything

76. 5.0.260709.0 Jul 9, 2026 · release notes

    runZero v5.0.260709.0 adds CSV/JSON export for 3D Network Map reports and improves Dragos integration stability.

    • Adds CSV and JSON export options for 3D Network Map report results
    • Improves Dragos integration to handle full asset ingestion without failure

    2 details in Everything

77. 5.0.260709.1 Jul 9, 2026 · release notes

    runZero v5.0.260709.1 improves integration task configuration with a new Start time date picker.

78. runZero 5.0.260707.0 (2026-07-07) Jul 7, 2026 · issue 014

    runZero 5.0.260707.0 adds per-source stale threshold overrides and a software count drill-down link in asset inventory.

    └──▷ HOW TO FIND IT
    Set a tighter stale threshold for a high-churn integration source (e.g., a cloud connector) without affecting the global expiration policy for all other integrations.
    📍In the console, go to Organization Settings (or Account Settings) › Integrations, select the integration source, and set a stale threshold override value for that source.
    • Supports per-integration stale threshold overrides for the stale integration attribute expiration feature, configurable in organization and account settings; integrations without an override continue to use the global setting.
    • Software count column in the asset inventory now links directly to the software inventory for faster drill-down.

    2 details in Everything

79. 5.0.260707.0 Jul 7, 2026 · release notes

    runZero 5.0.260707.0 adds per-source stale threshold overrides and software inventory linking

    • Adds stale_threshold override support for individual integration sources in organization and account settings to control when assets expire based on source-specific rules rather than global defaults.
    • The software count column in the asset inventory now links directly to the software inventory view.

    2 details in Everything

80. runZero 5.0.260702.0 (2026-07-02) Jul 2, 2026 · issue 014

    Dragos integration gains serial-number-based asset matching with SentinelOne; suppressed vulnerabilities now count as Resolved in Issue status.

    • Dragos integration now matches assets with SentinelOne data using asset serial number (bidirectionally).

    1 detail in Everything

81. 5.0.260702.0 Jul 2, 2026 · release notes

    runZero 5.0.260702.0 adds Dragos-SentinelOne asset matching and suppression persistence.

    • Dragos integration now matches assets with SentinelOne data based on asset serial number
    • Vulnerability suppression status persists across imports

    2 details in Everything

82. runZero 5.0.260630.0 (2026-06-30) Jun 30, 2026 · issue 014

    runZero 5.0.260630.0 adds valueless tag search to asset inventory queries.

    └──▷ HOW TO FIND IT
    Find assets tagged test with no assigned value — useful for auditing incomplete or placeholder tags in the inventory.
    📍In the asset inventory search bar, enter: tag:test=
    • Supports searching for assets with a tag that has no value (e.g., tag:test=) to distinguish unvalued tags from valued ones like tag:test=example.

    1 detail in Everything

83. 5.0.260630.0 Jun 30, 2026 · release notes

    runZero 5.0.260630 adds tag valueless search and stops phantom asset creation

    • Adds support for searching assets with a tag that has no value (e.g., tag:test= matches assets with tag test but not test=example).
    • Improves detection of invalid assets.

    2 details in Everything

84. runZero 5.0.260625.0 (2026-06-25) Jun 25, 2026 · issue 014

    runZero 5.0.260625.0 adds AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Endpoint asset discovery and external issue sharing.

    • Adds AWS VPC Endpoint asset creation to the AWS integration, enabling visibility into VPC Endpoint resources.
    • Enables external sharing of issues directly from the issues datagrid.

    2 details in Everything

85. runZero 5.0.260625.0 - Detect, Prioritize, Remediate, Verify, Report (2026-06-25) Jun 25, 2026 · issue 014

    runZero 5.0 delivers end-to-end exposure management: remediation tracking, verified closure, recurring reports, and broader OT/IT vulnerability detection.

    └──▷ TRY IT
    Enable or disable version-based vulnerability matching for a specific organization via the public API to control Missing Patches rollup reporting.
    copy

    $ curl -X PATCH https://<your-runzero-instance>/api/v1.0/org/<org-id> \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"vmatch_enabled": true}'

    Schedule a recurring weekly vulnerability report for external stakeholders who need no runZero account to review findings.
    📍In the console, go to Reports, select a supported view (e.g., Vulnerability Groups), choose Schedule Report, set recurrence to Weekly, add recipient email addresses, and save — recipients receive an interactive HTML snapshot with CSV/JSON export options.
    Initiate a remediation workflow and link it to Jira directly from a prioritized exposure finding.
    📍In the console, open an exposure, finding, or vulnerability group, click Create Remediation Issue, confirm the auto-populated Name/Description/Remediation fields, select your Jira credential and project key, configure the state mapping, and click Push as External Ticket.
    • New Exposure Management dashboard as the default landing view, surfacing prioritized exposures with separation of OT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. streams, MTTR tracking, issue status totals, reopened-issue trends, vulnerability status trends by severity, and a Goals progress widget.
    • Adds Remediation Workflows: create a Remediation Issue in one click from an exposure, finding, or vulnerability group, with auto-populated fields and push-to-Jira integration including custom state-to-state mapping.
    • Enables verified remediation closure: runZero preserves a compressed snapshot of the original exposure state and compares it against live discovery on scheduled scans to confirm fixes, with automatic reopened-issue tracking.
    • Adds searchable, sortable Recurrences and Last Recurrence columns to the Issues inventory, and due-date alert rules that fire email or webhook notifications when a Remediation Issue exceeds a configured number of days past due.
    • Adds Recurring External Reporting: schedule weekly or monthly interactive HTML snapshot reports from supported dashboards and views, deliverable by email to recipients without a runZero account, with CSV, JSON Lines, JSON, and PNG export options.

    +6 more show less

    • New version-based vulnerability rollups match OS, hardware, and software versions against known advisories and report a consolidated Missing Patches for [Vendor] [Product] finding per asset, aggregating all affected CVEs with KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. signal promotion to High severity.
    • Adds out-of-band blind vulnerability detection using runZero-hosted services in US and EU regions, requiring no customer-side infrastructure.
    • Adds end-of-life and end-of-support detection for common network devices (Cisco, Juniper, HPE/Aruba) derived from existing discovery fingerprints without additional scanning or credentials.
    • Exposes version-based reporting control per organization via the public Account API using the vmatch_enabled setting.
    • Expands fingerprint coverage by approximately 1,100 fingerprints (649 added, 469 updated) across enterprise IT, industrial/OT platforms (Siemens, Schneider Electric, Rockwell Automation), and consumer IoT devices since version 4.9.
    • Adds an explicit archived filter to vulnerability search, preserving vulnerabilities referenced by active issues from stale-vulnerability cleanup.

    11 details in Everything

86. 5.0.260625.0 Jun 25, 2026 · release notes

    runZero v5.0.260625 adds VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Endpoint asset creation, external issue sharing via the issues datagrid, and accurate multi-site finding counts.

    • AWS integration can now create assets for VPC Endpoints
    • Issues datagrid allows sharing issues externally
    • Findings Overview widget now accurately counts findings appearing in multiple sites
    • Rapid7 InsightVM Cloud task runs no longer exclude non-critical vulnerabilities

    4 details in Everything

87. 5.0.260625.0 - Detect, Prioritize, Remediate, Verify, Report Jun 25, 2026 · release notes

    runZero 5.0 adds Exposure Management dashboard, Jira integration via External Tickets, and version-based patch rollups

    • Adds vmatch_enabled Account API setting to control version-based reporting at the account level.
    • Integrates with Jira as an External Ticket destination for Remediation Issues, supporting custom state-to-state mapping.
    • Introduces Missing Patches for [Vendor] [Product] rollups that aggregate CVEs by asset OS/software versions (on by default).
    • Adds Out-of-band testing for blind vulnerability classes using runZero-hosted services in US and EU regions.
    • Expands End-of-life detection to include Cisco, Juniper, and HPE/Aruba network devices from discovery fingerprints.

    5 details in Everything

88. 5.0.260622.0 Jun 22, 2026 · release notes

    runZero v5.0.260622 adds CVE recurrence tracking to Issues and MDE hostname sync via hyperv.host

    • Vulnerability recurrence tracking now works for the new Issues feature
    • The MDE integration can now set asset hostnames from the hyperv.host value

    2 details in Everything

89. runZero 5.0.260618.0 (2026-06-18) Jun 18, 2026 · issue 014

    runZero 5.0.260618.0 adds all-asset alert queries, on-demand alert runs, expanded GE-SRTP ports, ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. STLS metadata, and richer InsightVM integration.

    • Adds option in alert rule queries to cover all assets, not just live assets.
    • Enables on-demand execution of alert rules without waiting for a scheduled run.
    • Expands scanner coverage to additional default ports for the GE-SRTP protocol.
    • Captures metadata from ADB STLS service responses during scanning.
    • Includes asset hostnames in the Rapid7 InsightVM Cloud Integration.

    +1 more show less

    • Improves asset correlation to disallow extensively reused IPs (e.g., from VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. systems) as match criteria.

    6 details in Everything

90. 5.0.260618.0 Jun 18, 2026 · release notes

    runZero 5.0.260618.0 adds on-demand alert execution and global asset coverage in alert queries.

    • Alert rule queries now have an option to cover all assets instead of just live assets
    • You can now run an alert rule on demand.

    2 details in Everything

91. runZero 5.0.260617.0 (2026-06-17) Jun 17, 2026 · issue 014

    runZero 5.0.260617.0 adds issue type and external ticket link columns to the Issues table.

92. 5.0.260617.0 Jun 17, 2026 · release notes

    runZero 5.0.260617 adds Issue type and external ticket link to Issues table; fixes Users search.

93. 5.0.260614.0 Jun 14, 2026 · release notes

    Recurring tasks now pause with reason on inaccessible credentials; asset/vuln/cert queries run faster

    • Recurring tasks that reference an inaccessible credential after an ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. change now pause and indicate why.
    • Asset, vulnerability, and certificate queries now run faster.

    2 details in Everything

94. 5.0.260611.1 Jun 11, 2026 · release notes

    runZero v5.0.260611.1 adds vulnerability archival/deletion and Explorer group result uploads.

    • One-off tasks on Explorer groups now upload results
    • Vulnerability management allows archiving or deleting vulnerabilities

    2 details in Everything

95. 5.0.260610.1 Jun 10, 2026 · release notes

    runZero 5.0.260610.1 introduces Exposure Management dashboard, Jira sync, external reports, and Arista EOS EOL data

    • Adds the new Exposure Management dashboard for high-level internal, external, and cloud attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. overview.
    • Enables creation of Issues to track findings with optional third-party synchronization to Jira.
    • Allows generating and sharing externally visible reports for most dashboards and inventory tables.
    • Adds Operating System End of Life (EOL) information support for Arista EOS.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Explorer no longer merges assets by MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet..
96. 4.9.260604.0 Jun 4, 2026 · release notes

    runZero v4.9.260604.0 adds client-level defaults for stale integration attributes and vulnerability expiration settings, and enriches site-updated events.

    • Adds client-level defaults for stale integration attribute and vulnerability expiration settings, updatable by superusers
    • Enhances the site-updated event to include details about what changed on the site

    2 details in Everything

97. 4.9.260528.0 May 28, 2026 · release notes

    runZero 4.9 adds expiration_settings to org API; console allows blank defaults for expiry config.

    • Adds expiration_settings field to the account and organization API endpoints for creating and updating an organization
    • Allows leaving attribute and vulnerability expiration settings blank in the runZero console to use default values

    2 details in Everything

98. 4.9.260526.0 May 26, 2026 · release notes

    runZero 4.9.260526.0 introduces selective Shodan tag exclusion and integration-level control over asset metadata modification.

    • Adds the ability to configure which integrations can modify asset OS, hardware, and device type fields in the platform settings.

    1 detail in Everything

99. 4.9.260521.0 May 21, 2026 · release notes

    runZero 4.9.260521.0 adds VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoint enrichment, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. enrollment, and empty site removal.

    • Adds VPC endpoints data to AWS integration asset enrichment
    • Enables enrollment of TOTP tokens for authentication
    • Allows removal of empty sites from the inventory

    3 details in Everything

100. 4.9.260521.2 May 21, 2026 · release notes

     runZero 4.9.260521.2 adds default protocol-negotiation skip for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports 9042 and 9160

     • Skips protocol negotiation by default for TCP ports 9042 and 9160

     1 detail in Everything

101. 4.9.260519.0 May 19, 2026 · release notes

     runZero v4.9 adds asset deletion for Users role and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. asset processing in AWS integration.

     • Users with the User role can now delete individual assets
     • The AWS integration now processes VPC assets from connected accounts

     2 details in Everything

102. 4.9.260514.0 May 14, 2026 · release notes

     runZero 4.9.260514.0 adds DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. port scanning and fixes AWS ELB IP handling.

     • The scanner now scans additional DTLS ports (12346, 12366, 12386, 12406, 12426).
     • Multi-source AWS ELBs no longer keep old IP addresses.

     2 details in Everything

103. 4.9.260512.0 May 12, 2026 · release notes

     runZero 4.9.260512.0 adds Explorer log download, findings-with-instances risk filtering, and UI/UX fixes

     • Adds an option to download Explorer system logs from the Explorer details page
     • Enables risk filtering on findings-with-instances alert rules
     • Makes the Overview dashboard load in the My Organizations view

     3 details in Everything

104. 4.9.260511.0 May 11, 2026 · release notes

     runZero v4.9.260511.0 adds network disruption detection, NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. server version support, and expanded Query-Assets MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. exports

     • Adds automatic network disruption detection that lowers the scanner's send rate to prevent further congestion.
     • Extends the NetBox integration to support server versions 4.0 through 4.5.
     • Enables the Query-Assets MCP tool to export services, attributes, and foreign attributes.

     3 details in Everything

105. 4.9.260508.0 May 8, 2026 · release notes

     runZero 4.9.260508.0 adds larger InsightVM data objects, widget deltas, CLI warnings, and UI fixes

     • Supports larger data objects in the Rapid7 InsightVM Cloud integration

     1 detail in Everything

106. 4.9.260504.0 May 4, 2026 · release notes

     runZero 4.9 adds AWS FSx support, asset comments for Annotator role, PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. SSH handshakes, and randomized TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. scanning.

     • AWS integration now reports FSx assets
     • Annotator role users can add asset comments in addition to tags
     • Network Maps treat eol:true as the later of OS EOL or EOL Extended dates
     • Scanner randomizes TCP ports to reduce pressure on transparent proxies
     • Scanner handshakes PQC hybrid ciphers for SSH services

     +2 more show less

     • Scanner reports screenshots for non-NLA RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. (Windows) and no-auth VNC
     • Scanner reports application-layer data for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. 2.0 wrapped services

     7 details in Everything

107. 4.9.260430.0 Apr 30, 2026 · release notes

     runZero 4.9.260430 adds manual tag-based geolocation mapping, World Map links, and unmapped asset rendering.

     • Adds support for using tags to specify geolocations manually (e.g., geo.City=Austin/TX/USA) on assets
     • Assets with geolocation data now link to the World Map from the inventory icon fields
     • Network Maps (2D/3D) now render unmapped MACs and unscanned traceroute hops by default

     3 details in Everything

108. 4.8.260429.0 Apr 29, 2026 · release notes

     runZero adds MTConnect protocol support and allows enabling SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking. via scan config probes.

     • The scanner now uses the mtconnect protocol to collect default device information when available

     1 detail in Everything

109. 4.0.260426.0 Apr 26, 2026 · release notes

     runZero 4.0.260426 updates Organization Overview report and maps with fingerprint improvements

     • Updated the Organization Overview report with improved data presentation
     • Enhanced Network Map visualization capabilities
     • Enhanced World Map visualization capabilities
     • Improved device and service fingerprinting accuracy

     4 details in Everything

110. 4.0.260423.0 Apr 23, 2026 · release notes

     runZero 4.0.260423 adds native Rapid7 InsightVM Cloud integration and comma-delimited protocol search support

     • Supports comma-delimited values in the protocols keyword for assets and services inventory searches.

     1 detail in Everything

111. 4.0.260420.1 Apr 20, 2026 · release notes

     runZero 4.0.260420.1 adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. diagnostics to task data.

112. 4.0.26020.0 Apr 17, 2026 · release notes

     Fixes to Windows Explorer processing, email delivery rate limits, and unmerge actions.

     • Explorer processes on Windows no longer abort in two cases.
     • Unmerge actions now complete.

     2 details in Everything

113. 4.0.260416.0 Apr 16, 2026 · release notes

     runZero v4.0.260416.0 adds Classic, light, and dark theme switching to the console UI.

114. 4.0.260401.0 Apr 1, 2026 · release notes

     Version 4.0.260401.0 introduces overlapping subnet configuration and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. OT enumeration capabilities, while improving UI selection and fixing scan stability.

     • Configures overlapping site subnets via the site management UI
     • Adds Sub-asset enumeration support for IPv6 OT services
     • Enables Select All on the Software By Asset view in the console

     3 details in Everything

115. 4.0.260331.0 Mar 31, 2026 · release notes

     runZero 4.0.260331.0 enables software and services inventory queries and fixes UI tab loading.

     • Software queries now calculate results
     • Service queries now calculate results

     2 details in Everything

116. 4.0.260330.0 Mar 30, 2026 · release notes

     runZero 4.0 adds BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks./CIP/MODBUS/KNX gateway asset identification and automatic IT/OT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. categorization with function assignment.

     • network-reachable BACnet, CIP, MODBUS and KNXnet gateway devices now identified as assets
     • automatic Category (IT, OT, IoT) assignment for discovered assets
     • automatic Functions assignment for OT assets

     3 details in Everything

117. 4.0.260326.0 Mar 26, 2026 · release notes

     runZero 4.0.260326.0 adds API key IP allowlist configuration and asset tag imports for InsightVM.

     • Adds optional API key IP address allowlist configurable in Account Settings to restrict API access by source IP
     • Adds asset_tags import support in the InsightVM integration to sync asset tags from InsightVM to runZero
     • Improves Tanium integration by filtering additional invalid attribute values during data ingestion
     • Enhances Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. integration to include LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. search referral information in error messages when available

     4 details in Everything

118. 4.0.260323.0 Mar 23, 2026 · release notes

     runZero 4.0.260323 adds BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks. BBMD/FDT probe support and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. extension attributes.

     • Adds BACnet Broadcast Management Device (BBMD) and Foreign Device Table (FDT) data collection to the BACnet probe.
     • LDAP integration now includes extension attributes in its available data.

     2 details in Everything

119. 4.0.260318.0 Mar 18, 2026 · release notes

     runZero 4.0 adds asset view actions, Atlas Copco protocol support, and IPMI detail enhancements

     • Adds Unmerge and Export as task data options to the Manage menu in the asset view for bulk asset management.
     • Adds support for the Atlas Copco Open Protocol for device discovery in the scanner.
     • Adds additional detail reporting for the IPMI protocol during scanning.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The web console now requires Chrome 123 (March 2024) or newer as the minimum supported browser version.
120. 4.0.260311.0 Mar 11, 2026 · release notes

     runZero v4.0 adds BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks. port coverage, kevy:true search, SentinelOne timeout and Tanium/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. integration improvements

     • Covers additional default ports for the BACnet protocol during scanning
     • Allows querying for Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. directly using kev:true in vulnerability inventory queries instead of using the retired Kev finding
     • Improves asset matching accuracy in the Tanium integration
     • Speeds up directory group imports in the LDAP integration

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Known Exploited Vulnerability finding is retired; users must now use kev:true in vulnerability inventory queries to access this data
121. 4.0.260219.0 Feb 19, 2026 · release notes

     runZero 4.0.260219.0 adds vulnerability suppression filtering and increases asset vulnerability record limits.

     • Adds vulnerability suppression state as a filter option in the asset inventory search
     • Increases the supported limit on asset vulnerability records

     2 details in Everything

122. 4.0.260218.0 Feb 18, 2026 · release notes

     runZero 4.0.260218.0 adds non-default IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role paths to AWS integration and PAN API data to Layer-2 reports.

     • Adds support for IAM roles with non-default paths in the AWS integration (IAM Role credential type).

     1 detail in Everything

123. 4.0.260213.0 Feb 13, 2026 · release notes

     runZero v4.0.260213.0 improves UI performance and API defaults.

     • Scan creation page load performance improved

     1 detail in Everything

124. 4.0.260209.0 Feb 9, 2026 · release notes

     runZero 4.0.260209.0 enhances data extraction from CDPCDPCisco Discovery Protocol, a Cisco-proprietary Layer 2 protocol that advertises device identity, capabilities, and topology between directly connected Cisco gear, giving cyber tools a passive way to map network infrastructure. sources and adds the redact-secrets option for IPMI probes.

125. 4.0.260208.0 Feb 8, 2026 · release notes

     runZero v4.0.260208.0 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. protocol reporting, IPMI attribute detection, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. debug logging, and improved NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. normalization

     • Adds debug-scope option to the SNMP probe to record full diagnostic logs for a specified IP address or CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network..
     • Expands scanner output to report additional UDP protocols including echo, daytime, cldap, iec104, llmnr, qotd, stun, time, turn, and zebra.

     2 details in Everything

126. 4.0.260205.0 Feb 5, 2026 · release notes

     runZero v4.0.260205.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server version detection and improves NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. OS normalization with security scoping fixes.

     • Adds detailed version information reporting for exposed MCP servers in scan results
     • Improves NetBox connector to better normalize free-form operating system values

     2 details in Everything

127. 4.0.260203.0 Feb 3, 2026 · release notes

     runZero 4.0.260203.0 enhances MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. agent isolation and credential privacy with scoped access controls.

     • MCP agents are now restricted to accessing certificate information only within their authorized organization scope
     • Administrators are restricted to creating and updating users only within their authorized organization scope

     2 details in Everything

128. 4.0.260202.0 Feb 2, 2026 · release notes

     runZero 4.0.260202.0 adds on-demand Internet speed tests from Explorers and bulk asset refingerprinting.

     • Adds ability to request Internet speed tests from any deployed Explorer on demand or via recurring schedule
     • Adds Refingerprint assets action in the Asset Inventory Modify menu for bulk re-fingerprinting

     2 details in Everything

129. 4.0.260123.3 Jan 23, 2026 · release notes

     runZero 4.0 syncs NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. custom fields and fixes inventory query performance

     • New NetBox synchronization includes custom field values in inventory data.

     1 detail in Everything

130. 4.0.260120.1 Jan 20, 2026 · release notes

     runZero 4.0.260120.1 adds organization keyword to queries and improves fingerprinting

     • Adds the organization keyword to create, update, and import queries

     1 detail in Everything

131. 4.0.260118.0 Jan 18, 2026 · release notes

     runZero 4.0.260118.0 updates Wiz and NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. integrations; stops IMDSv2 ping outside AWS.

     • Wiz integration now merges similar vulnerability reports within the same system
     • NetBox integration now supports versions 4.3.0 and newer

     2 details in Everything

132. 4.0.260115.0 Jan 15, 2026 · release notes

     runZero 4.0.260115.0 enhances MECM connector with user data and fixes performance issues

     • Microsoft MECM connector tasks now include recent user data.
     • Hosted scans no longer use excessive memory when capturing screenshots.

     2 details in Everything

133. 4.0.260114.0 Jan 14, 2026 · release notes

     runZero 4.0.260114.0 introduces Chrome Debug Protocol for web screenshots, environment variable browser control, and JS object capture.

     • Scanner now uses the chrome debug protocol by default for capturing web screenshots
     • Adds support for Microsoft Edge on Windows for web screenshoting
     • Introduces environment variables to control the Chromium version used, including automatic installation
     • Scanner collects names of global JavaScript objects from the browser environment

     4 details in Everything

134. 4.0.260107.0 Jan 7, 2026 · release notes

     runZero 4.0.260107.0 adds MongoDB wire protocol detection and fingerprint improvements.

     • Scanner now detects recent versions of MongoDB’s wire protocol.

     1 detail in Everything

135. 4.0.260105.0 Jan 5, 2026 · release notes

     runZero 4.0.260105.0 adds task credential injection via API, detailed TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stats, and Azure GCC endpoint fix.

     • The hosted scanner no longer ignores assets with internal IPs.
     • The scanner now collects detailed statistics for every TCP connection.
     • The AWS integration now collects additional information for failed logins.
     • You can now specify task credentials within scan templates through the API.

     4 details in Everything

136. 4.0.251228.0 Dec 28, 2025 · release notes

     runZero 4.0.251228.0 improves asset status accuracy and fingerprinting.

     • Assets no longer marked offline if they are out-of-scope.
     • Improved fingerprint detection capabilities.

     2 details in Everything

137. 4.0.251222.0 Dec 22, 2025 · release notes

     runZero 4.0.251222.0 adds HTTPS_PROXY_AWS config and fixes passive sampling service clearing.

     • Passive sampling tasks no longer clear services from unmatched site assets.

     1 detail in Everything

138. 4.0.251217.0 Dec 17, 2025 · release notes

     runZero 4.0.251217.0 adds custom widget visibility in modal search and supports double-quote tag values.

     • Widget library modal search now shows custom widgets.
     • Can set and export tags with a value of a single double-quote character.

     2 details in Everything

139. 4.0.251212.0 Dec 12, 2025 · release notes

     runZero 4.0.251212 adds suppression support to findings and HTTP header access for custom integration scripts.

     • Findings, Vulnerability Groups, and Vulnerabilities now support suppressions
     • Custom Integration scripts can now read HTTP response headers using the http or requests modules, available as response.headers["Header-Name"]

     2 details in Everything

140. 4.0.251208.0 Dec 8, 2025 · release notes

     runZero 4.0.251208.0 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale.-based LLDP capture and fixes stale software counts.

     • The scanner captures LLDP attributes via SNMP.

     1 detail in Everything

141. 4.0.251206.1 Dec 6, 2025 · release notes

     runZero's Tenable integration adds support for importing WAS vulnerability data

     • Adds WAS to the list of vulnerability import types supported by the Tenable integration

     1 detail in Everything

142. 4.0.251126.2 Nov 26, 2025 · release notes

     runZero 4.0.251126.2 adds Go 1.25.0 TLS fingerprint flags and improves sync reliability.

     • TLS fingerprinting now specifically flags services using Go 1.25.0 or newer
     • Console tasks interrupted by lack of disk space now retry automatically

     2 details in Everything

143. 4.0.251121.0 Nov 21, 2025 · release notes

     Prisma integration expands asset coverage to three Azure types; fingerprinting receives general improvements.

     • Adds Azure Scale Set VM asset type support in the Prisma integration
     • Adds Azure SQL VM asset type support in the Prisma integration
     • Adds Azure SQL Database asset type support in the Prisma integration

     3 details in Everything

144. 4.0.251120.0 Nov 20, 2025 · release notes

     runZero 4.0.251120.0 adds risk keyword to certificate inventory search and allows Users to create integration tasks.

     • Users with the User role can now create integration tasks

     1 detail in Everything

145. 4.0.251118.0 Nov 18, 2025 · release notes

     runZero 4.0.251118.0 adds optional Tenable Agent exclusion, certificate risk tracking, and new OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists./name constraint search keywords.

     • Tenable integration can now optionally exclude Tenable Agent data via the integration configuration.
     • Certificates now track a risk field that you can override and search.
     • Certificate search now supports new keywords for OCSP stapling and name constraints.

     3 details in Everything

146. 4.0.251114.0 Nov 14, 2025 · release notes

     runZero 4.0.251114.0 adds NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. custom field overrides and TS date variants to the integration.

     • NetBox integration can now override asset information from custom fields.
     • NetBox integration now includes searchable TS variants of the Date and Date & Time fields.
     • runZero now merges third-party integration data into the most recently seen scanned asset.

     3 details in Everything

147. 4.0.251113.0 Nov 13, 2025 · release notes

     runZero 4.0.251113.0 adds full asset change logs, site:scope support in exclusions, and GCC Azure auth fixes.

     • defaults keyword is now supported in scan exclusions alongside site:scope to control which assets are omitted from scans
     • The task details page displays the full asset change log for auditing history
     • runZero now records task collection logs for debugging scan data gathering

     3 details in Everything

148. 4.0.251113.2 Nov 13, 2025 · release notes

     runZero 4.0.251113.2 fixes TLS enumeration to no longer abort early.

149. 4.0.251105.0 Nov 5, 2025 · release notes

     runZero 4.0.251105.0 adds certificate vulnerabilities count, validity_period attribute, and fixes baseline goal failures

     • Adds an associated vulnerabilities field to the certificates inventory that shows the count of certificate vulnerabilities related to the associated services
     • Adds a validity_period attribute to certificates in the Certificates Inventory that displays the certificate’s lifetime

     2 details in Everything

150. 4.0.251028.0 Oct 28, 2025 · release notes

     runZero v4.0.251028.0 introduces customizable asset ownership attribution, multi-account AWS imports via IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role, and enhanced certificate search capabilities.

     • Organization and account administrators can now modify and reorder the attribute list that determines default asset ownership, per organization or at the account level
     • The AWS integration can now import from multiple AWS accounts without AWS Organizations, using a new AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Role credential type
     • A new Certificate and TLS Service Risks finding groups the Certificates and TLS Services queries that contribute to Certificate Risk
     • You can now search services by all certificates in the certificate chain, using their sha256, sha1, or bk_hash attributes

     4 details in Everything

151. 4.0.251023.0 Oct 23, 2025 · release notes

     runZero v4.0.251023.0 adds @tanium.dev.lastLoggedInUser to ownership logic and a start_scan MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool

     • The runZero MCP service now includes the start_scan tool.
     • Software CSV exports now include ownership information.

     2 details in Everything

152. 4.0.251016.0 Oct 16, 2025 · release notes

     runZero 4.0.251016.0 adds certificate search and screenshot display

     • certificate_id is now a searchable field in the services inventory.
     • Shorthand search syntax (e.g., rsa_exponent:65537) is supported for certificate attribute queries.

     2 details in Everything

153. 4.0.251015.0 Oct 15, 2025 · release notes

     runZero 4.0.251015.0 adds Explorer group selection to task forms and passive scan support for unassigned IPs.

     • Adds Explorer groups selection in the task forms for NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment., Intune, Meraki, Miradore, Google Workspace, Censys, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., Shodan, and AzureAD integrations

     1 detail in Everything

154. 4.0.251008.0 Oct 8, 2025 · release notes

     runZero 4.0.251008.0 adds CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. disable config and fixes asset reports/merge

     • Adds a system configuration option to disable CSRF protection for self-hosted instances.

     1 detail in Everything

155. 4.0.251007.1 Oct 7, 2025 · release notes

     runZero v4.0.251007.1 adds cert signature filtering, MECM device collection filters, and AWS stale asset removal.

     • Adds certificate querying support for signature and public_key
     • MECM integration supports filtering by device collection ID
     • New task option to remove stale AWS assets
     • runZero now removes remediated vulnerabilities after scanning

     4 details in Everything

156. 4.0.251003.0 Oct 3, 2025 · release notes

     Custom integration scripts can set asset fingerprints via trust_device_type attributes; AWS static external ID support added.

     • Custom integration scripts can now use the trust_device_type, trust_os and trust_os_version attributes on the ImportAsset object to set an asset’s fingerprint, even if runZero’s fingerprint engine cannot normalize the custom values
     • AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. credentials configuration now supports a static external ID at the account level

     2 details in Everything

157. 4.0.250930.0 Sep 30, 2025 · release notes

     runZero 4.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools (list_sites, query_directory_group, query_wireless) and cert search in vulnerability inventory.

     • list_sites, query_directory_group, and query_wireless tools added to the MCP server
     • Vulnerability inventory now supports searching by certificate attributes (ID, type, serial, public key, signature, fingerprint, subject, issuer, key usage)

     2 details in Everything

158. 4.0.250926.0 Sep 26, 2025 · release notes

     runZero 4.0.250926.0 adds asset search by certificate attributes and expands Prisma integration scope.

     • Adds certificate.id, certificate.type, certificate.serial, certificate.public_key, certificate.signature, certificate.fingerprint, certificate.subject, certificate.issuer, and certificate.key_usage as searchable asset attributes
     • Extends Prisma integration to support Azure VMs, GCP VMs, Azure Load Balancers, Azure SQL Server, and Azure Cosmos DB

     2 details in Everything

159. 4.0.250924.0 Sep 24, 2025 · release notes

     runZero 4.0.250924.0 adds CVE record application to certificate queries and improves UI performance.

     • Certificate queries can now apply a vulnerability record to matching assets
     • The Findings list page and Findings detail pages no longer load slowly

     2 details in Everything

160. 4.0.250922.0 Sep 22, 2025 · release notes

     runZero 4.0.250922.0 adds subnet CSV import, MECM/Wiz attribute fields, Azure subscription filters, and public API disable config.

     └──▷ USE IT
     Disable all public API endpoints on a self-hosted instance.
     config copy

     /etc/runzero/config

     • Adds CSV import on the site configuration page to configure subnets
     • MECM integration imports lastSoftwarePatchTitle, lastSoftwarePatchArticleID, and lastSoftwarePatchTime attributes
     • Wiz integration adds @wiz.dev.resourceType and @wiz.dev.resourceApiType attributes and a task parameter for resource types
     • Azure Client Secret credentials support inclusion or exclusion of user-specified subscription IDs
     • Self-hosted customers can disable all public API endpoints by setting RUNZERO_DISABLE_PUBLIC_APIS=true in /etc/runzero/config

     5 details in Everything

161. 4.0.250917.0 Sep 17, 2025 · release notes

     runZero 4.0.250917.0 adds TLS thumbprint support for Dragos integration and corrects certificate query calculation logic.

     • The Dragos integration now accepts TLS thumbprints in the credential configuration
     • runZero now calculates certificate query matches

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Certificate queries no longer have the option to apply a vulnerability record to matching assets
162. 4.0.250910.0 Sep 10, 2025 · release notes

     runZero 4.0.250910.0 adds subnet filtering for Dragos, offline MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, and granular import controls for major integrations.

     • Adds exclude_assets_by_subnets filter to the Dragos integration task configuration
     • Replaces the Fingerprint Only toggle with separate import_software and import_vulnerabilities boolean options for CrowdStrike, MS365Defender, SentinelOne, Wiz, Tenable, Rapid7 InsightVM, and Qualys integrations
     • Increases the Organization overview report limit for top metrics from 10 to unlimited entries

     3 details in Everything

163. 4.0.250908.0 Sep 8, 2025 · release notes

     runZero 4.0 adds certificate field filtering, finding_code asset search, and script limit removal for hosted Explorers.

     • signature_algorithm_insecure, public_key_insecure, and nine other certificate fields are now filterable in saved queries via the query library.
     • Custom integrations on hosted Explorers no longer have a script size limit.
     • Assets can be searched by finding_code term on the Assets page and via the assets API.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Asset export APIs no longer include a finding_count attribute.
164. 4.0.250828.0 Aug 28, 2025 · release notes

     runZero 4.0.250828.0 adds empty SNMPv3 context support and certificate details viewing for missing subjects.

     • Adds ability to update SNMPv3 credentials with an empty context
     • Adds ability to view the details page of certificates that lack a subject
     • Recurring connector tasks running on the console now show their start times

     3 details in Everything

165. 4.0.250826.0 Aug 26, 2025 · release notes

     runZero 4.0.250826 adds AWS/Wiz unseen asset removal, Explorer concurrency API, and default critical vuln checks.

     • Adds automatic removal of unseen assets from AWS and Wiz integration tasks
     • runZero now respects a scan template’s Exclude Hosts configuration option when you change sites
     • Enforces permissions when custom integrations are removed from assets across tenants
     • Scans now include safe checks for many remotely exploitable critical vulnerabilities by default
     • Allows updating Explorer scan concurrency via the runZero Organization API

     5 details in Everything

166. 4.0.250820.0 Aug 20, 2025 · release notes

     runZero 4.0.250820.0 adds auto-org assignment for alerts, AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. external IDs, and AD integration scaling.

     • Adds automatic organization assignment for goals, alert rules, alert channels, and alert templates when the Automatically add new organizations option is selected
     • Enables creation of an external ID for AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role credentials

     2 details in Everything

167. 4.0.250818.0 Aug 18, 2025 · release notes

     runZero 4.0.250818.0 adds shared dashboard My organizations view and stops inventory search org keyword filtering.

     • Adds the ability to view shared dashboards in My organizations mode within the console UI.

     1 detail in Everything

168. 4.0.250808.0 Aug 8, 2025 · release notes

     runZero 4.0.250808 adds rapid-response and findings event rules for automated triggers.

     • Adds rapid-response-published event rule to trigger when Rapid Response queries are published, updated, or removed
     • Adds rapid-response-with-matches event rule to trigger when a Rapid Response query’s results change
     • Adds findings-with-instances event rule to trigger when findings instance counts are updated

     3 details in Everything

169. 4.0.250805.0 Aug 5, 2025 · release notes

     runZero 4.0.250805.0 adds hardware-based asset matching, configurable Qualys scan-age filters, cross-account AWS roles, and an experimental MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server.

     • Adds hardware information to the asset matching algorithm when available
     • Adds configurable time-period filter for the Qualys integration to exclude assets not scanned within that window
     • Adds support for cross-account AWS roles in the AWS integration for authentication
     • Enables an experimental MCP server extension to let users bring their own LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.

     4 details in Everything

170. 4.0.250731.1 Jul 31, 2025 · release notes

     runZero 4.0 adds insecure_check_verify to integration scripts; consolidates background tasks.

     • Adds the insecure_check_verify option to the http_post and Session custom integration script libraries
     • Combines Metrics, Query metrics, vulnerabilities, and findings background tasks into a single task

     2 details in Everything

171. 4.0.250729.0 Jul 29, 2025 · release notes

     runZero 4.0.250729.0 adds targeted AWS stale asset deletion, per-user notification emails, and Excludes in scan templates.

     • AWS integration tasks can now limit delete stale assets to the current task's accounts instead of all account associations
     • Adds a new Notification email field in user profiles for routing Email runZero users alerts without affecting account security emails
     • Scan templates can now save the Excludes parameter so exclusions persist across template reuse

     3 details in Everything

172. 4.0.250724.0 Jul 24, 2025 · release notes

     runZero 4.0.250724.0 adds scoped Baseline Goals and improved detection of exposed web panels.

     • Adds Baseline Goals capability to scope goals to specific inventory subsets
     • Defaults vulnerability check selection to detect and report exposed web panels
     • Enables selection of additional security check categories from the scan configuration page

     3 details in Everything

173. 4.0.250721.0 Jul 21, 2025 · release notes

     runZero adds organization/site filtering to software/vuln inventories and Splunk checkpoint override.

     • Adds organization: search term to filter software inventory by organization ID or name
     • Adds site: search term to filter software inventory by site ID or name
     • Adds organization: search term to filter vulnerability inventory by organization ID or name
     • Adds $checkpoint:ignore search filter for Splunk asset import to force full re-ingestion

     4 details in Everything

174. 4.0.250717.0 Jul 17, 2025 · release notes

     runZero v4.0.250717.0 adds generally available Email alert channel, site last-updated column, and improved goal/asset logic

     • Email runZero users alert channel type is now generally available for configuring email notifications to chosen users.
     • Sites list view now includes a last updated time column.

     2 details in Everything

175. 4.0.250709.0 Jul 9, 2025 · release notes

     runZero 4.0.250709.0 introduces task rescheduling on memory exhaustion.

     • Tasks that previously failed due to memory exhaustion are now automatically rescheduled.

     1 detail in Everything

176. 4.0.250708.0 Jul 8, 2025 · release notes

     runZero 4.0.250708.0 adds CrowdStrike memory efficiency, Wiz report compression, SQL Server TLS fingerprinting, and Community Licensed navigation rights.

     • Connectors now explicitly prefer merging devices into assets with a runZero source
     • Integration tasks now compress Wiz reports during upload
     • runZero now fingerprints TLS on Microsoft SQL Server endpoints correctly
     • Vulnerabilities detected via passive scanning no longer duplicate themselves during data processing
     • Community Licensed users can now navigate to the Organization Settings page

     5 details in Everything

177. 4.0.250627.0 Jun 27, 2025 · release notes

     runZero 4.0.250627.0 adds self-hosted EU region support and improves metrics calculation.

     • Adds the ability to download the self-hosted version of runZero in the EU region
     • Improves the metrics calculation process

     2 details in Everything

178. 4.0.250626.0 Jun 26, 2025 · release notes

     runZero v4.0.250626.0 improves JSON email alert attachments and Tenable.io integration filtering.

     • Email Alerts now support better JSON-formatted attachments
     • Tenable.io integration tasks no longer import INFO level vulnerabilities when configured to omit all vulnerabilities (i.e. fingerprint-only)

     2 details in Everything

179. 4.0.250620.0 Jun 20, 2025 · release notes

     NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. integration adds filtering by site names and CIDRs.

     • netbox integration now supports filtering by site_name and cidr parameters to scope discovered assets.

     1 detail in Everything

180. 4.0.250616.0 Jun 16, 2025 · release notes

     runZero v4.0.250616.0 adds goal management permissions for Users, revises global goal scope, and updates task stats UI.

     • Users with an inherited or explicit role of User or above within the selected organization can now manage goals
     • Goals previously configured as global now apply to all currently existing organizations and no longer attach to new or future organizations unless explicitly configured to
     • Task statistics now display the total count of software and vulnerability records created

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Goals previously configured as global now apply to all currently existing organizations and no longer attach to new or future organizations unless explicitly configured to
181. 4.0.250611.0 Jun 11, 2025 · release notes

     Per-site data retention, Wiz stale asset deletion, Tenable.io import toggles, and asset search filters for missing fields.

     • data_retention settings now configurable per site in UI to control local data lifespan
     • delete_stale_assets option added to Wiz integration tasks to remove orphaned assets after sync
     • disable_vuln_import and disable_software_import flags added to Tenable.io integration config

     3 details in Everything

182. 4.0.250606.0 Jun 6, 2025 · release notes

     runZero v4.0.250606 adds default login checks and AWS asset import for Prisma integration.

     • Prisma integration now supports importing assets from AWS
     • Scans can now check for default logins

     2 details in Everything

183. 4.0.250604.0 Jun 4, 2025 · release notes

     runZero 4.0.250604.0 adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and preserves site:scope in scan templates

     • Adds TOTP as an MFA option alongside existing WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. and PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.

     1 detail in Everything

184. 4.0.250530.0 May 30, 2025 · release notes

     runZero 4.0.250530.0 adds MAC Country column and search support to Asset Inventory.

     • Adds mac.mfgCountries and mac.mfgAddresses fields to Asset attributes.
     • Adds a MAC Countries column to the Asset Inventory view.
     • Enables filtering Asset Inventory by manufacturer country with the syntax mac.mfgCountries:US.

     3 details in Everything

185. 4.0.250529.1 May 29, 2025 · release notes

     runZero 4.0.250529.1 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. cert expiration banners and fixes PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. exclusion on Explorers.

     • Banners notify superusers when the SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. certificate used for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO) is expiring soon
     • PII attribute exclusion now works correctly when integrations are configured to run on an Explorer

     2 details in Everything

186. 4.0.250514.0 May 14, 2025 · release notes

     Custom integration scripts gain gzip support; alert rule editing and AWS asset import stability fixed.

     • Custom integration scripts can now use gzip compression and decompression
     • Risk level names are now capitalized on the Risk Management dashboard

     2 details in Everything

187. 4.0.250513.0 May 13, 2025 · release notes

     runZero 4.0.250513 adds role info to User API, MS365 avMode filtering, asset Network ID filtering, crypto/export scripting, and dashboard update footers.

     • User API endpoints now return default, assigned, and effective role information for users
     • Microsoft 365 Defender integration imports the avMode attribute and only sets the EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. name when avMode is Active
     • Qualys integration filters assets by Network IDs
     • Custom integration scripts can call sha256, sha512, sha1, and md5 crypto hashing functions
     • Custom integration scripts can export asset data to a json.gz file for import into a runZero organization

     5 details in Everything

188. 4.0.250508.0 May 8, 2025 · release notes

     runZero 4.0 adds Starlark autocomplete in custom integration editor and expands SentinelOne integration scope.

     • Adds autocomplete hints for Starlark and runZero-provided libraries in the custom integration script editor
     • SentinelOne integration no longer caps the number of applications it collects

     2 details in Everything

189. 4.0.250505.0 May 5, 2025 · release notes

     runZero 4.0.250505.0 adds PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. exclusion for integrations and new capabilities for custom integration scripts.

     • Adds configurable attributes to exclude from data collection in some integrations via excluding integration attributes
     • Allows custom integration scripts to treat a None return value as success instead of failure
     • Enables limited session-like functionality for making HTTP requests within custom integration scripts
     • Adds base64 encoding and decoding functions to the custom integration script environment

     4 details in Everything

190. 4.0.250428.0 Apr 28, 2025 · release notes

     runZero 4.0.250428.0 adds site:scope and site:exclusions keywords for scan configuration discovery/exclude scopes.

     • site:scope and site:exclusions can now be used in scan configuration discovery and exclude scope fields to automatically reference the default site scope or its configured exclusions

     1 detail in Everything

191. 4.0.250418.0 Apr 18, 2025 · release notes

     runZero 4.0.250418.0 adds vulnerability import from SentinelOne and directory linking for Google Workspace, Azure AD, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory..

     • The SentinelOne integration now supports importing vulnerabilities.
     • Directory users and groups are now linked for Google Workspace, Azure AD, and LDAP.

     2 details in Everything

192. 4.0.250415.0 Apr 15, 2025 · release notes

     runZero 4.0.250415.0 updates findings export fields and relaxes NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. integration filtering

     • Adds instance_count and risk_rank_value to CSV exports; removes vulnerability_count and risk_score. The risk_rank field now displays the risk label.
     • NetBox integration no longer filters out assets older than the Organization’s stale asset threshold.

     2 details in Everything

193. 4.0.250414.0 Apr 14, 2025 · release notes

     runZero 4.0.250414.0 adds version query operators to asset inventory, certificate search keywords, and group data in user APIs.

     • Asset inventory software searches now support less-than or greater-than version queries
     • You can now search the certificates inventory by the last_seen, valid_from, and valid_until keywords
     • The /account/users and /account/users/{user_id} API endpoints now include the names and IDs of the groups each user belongs to

     3 details in Everything

194. 4.0.250410.0 Apr 10, 2025 · release notes

     runZero 4.0.250410.0 adds filtering and skip options for Microsoft 365 Defender integration plus dashboards improvements

     • Adds task options to the Microsoft 365 Defender integration for filtering imported vulnerabilities by severity
     • Adds optional ability to skip importing software and vulnerabilities in the Microsoft 365 Defender integration
     • Improves Rapid Response dashboard widget to distinguish potentially impacted assets from those actually impacted
     • Changes risk display for assets with no vulnerabilities or findings from Info to None

     4 details in Everything

195. 4.0.250409.0 Apr 9, 2025 · release notes

     runZero 4.0.250409.0 adds NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. VM/interface/cluster support and alert rule channel/template visibility.

     • The NetBox integration now handles virtual machines, interfaces, and clusters more consistently.
     • The alert rules page data table now displays columns for channel and template.
     • The alert rule details page now displays the channel and template attributes.

     3 details in Everything

196. 4.0.250404.0 Apr 4, 2025 · release notes

     runZero 4.0 adds M365 Defender integration for software/vulns and new public APIs for findings/certificates inventories

     • Microsoft 365 Defender integration now supports pulling software and vulnerabilities

     1 detail in Everything

197. 4.0.250402.0 Apr 2, 2025 · release notes

     runZero NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. integration gains VM import and asset criticality support

     • NetBox integration now imports virtual machine assets
     • NetBox integration now imports asset criticality fields

     2 details in Everything

198. 4.0.250401.0 Apr 1, 2025 · release notes

     runZero 4.0.250401 adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. status to API users and improves scanner fingerprinting stability.

     • The scanner no longer fails to fingerprint services on sensitive ports

     1 detail in Everything

199. 4.0.250328.0 Mar 28, 2025 · release notes

     Custom markdown widgets for dashboards and linkable vulnerability detail pages

     • Adds custom widget creation to dashboards, allowing users to insert text rendered as Markdown/CommonMark
     • Displays vulnerability details on their own page with a linkable URL

     2 details in Everything

200. 4.0.250317.0 Mar 17, 2025 · release notes

     runZero 4.0.250317.0 adds custom integration HTTP methods, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. map attributes, and dashboard list page.

     • Adds timeout=<seconds> parameter to http.get and http.post in custom integration scripts
     • Adds support for HEAD, PATCH, PUT, and DELETE HTTP methods in custom integration scripts
     • Introduces a new dashboard list page showing all dashboards the current user can access
     • Enables timestamp-based search on Meraki firstSeen and lastSeen attributes
     • Adds snmp.interfaceAddrsMap, snmp.interfaceAliasesMap, snmp.interfaceNamesMap, and snmp.interfaceMacsMap SNMP attributes indexed by interface index

     5 details in Everything

201. 4.0.250226.0 Feb 26, 2025 · release notes

     runZero 4.0.250226.0 exposes organization vulnerability expiration via API and fixes stale data settings.

     • Adds API support for setting an organization’s vulnerability expiration parameters

     1 detail in Everything

202. 4.0.250213.0 Feb 13, 2025 · release notes

     runZero 4.0.250213.0 adds stale integration attribute update API, fuzzy asset search, and HTTP timeout config.

     • Adds integration attribute updates via the organization API to clear stale settings.
     • The type: asset search keyword now performs a fuzzy search by default.
     • The default HTTP timeout for custom integration script requests is increased to 5 minutes.

     3 details in Everything

203. 4.0.250213.1 Feb 13, 2025 · release notes

     runZero 4.0.250213.1 auto-redirects SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only self-hosted logins to the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.

     • SSO-only self-hosted installations now automatically redirect to the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. on login

     1 detail in Everything

204. 4.0.250207.0 Feb 7, 2025 · release notes

     runZero 4.0.250207.0 adds org-level stale data expiration thresholds and improved integration merge logic.

     • Organizations now support setting thresholds to automatically expire stale integration and vulnerability data.

     1 detail in Everything

205. 4.0.250129.0 Jan 29, 2025 · release notes

     runZero 4.0 adds multi-dashboard support with organizational sharing, profile-level preferences, and default dashboards for admins.

     • Adds ability to create multiple dashboards, share them to organizations where you have User privileges or higher, and set a preferred dashboard in profile settings
     • Adds organization-level setting allowing administrators to set a default dashboard per organization from shared or runZero managed dashboards
     • Updates dashboard query links to respect the Search live assets attribute
     • Makes the change report visible on the Task Details page

     4 details in Everything

206. 4.0.250127.0 Jan 27, 2025 · release notes

     runZero 4.0.250127.0 adds recurring task minute multiples and faster content updates for self-hosted instances.

     • Adds the ability to set recurring tasks to a multiple of minutes.
     • Self-hosted instances now check for updated content and queries every 5 minutes in online mode.

     2 details in Everything

207. 4.0.250124.0 Jan 24, 2025 · release notes

     runZero 4.0.250124 adds dynamic defaults scope for new scans and a resizable script editor.

     • Newly created scans now target the dynamic defaults scope when site subnets are defined
     • The custom integration script editor is now resizable

     2 details in Everything

208. 4.0.250122.0 Jan 22, 2025 · release notes

     runZero 4.0.250122.0 adds iSCSI asset discovery and displays system queries in custom dashboards for non-admins

     • Adds iSCSI protocol support for asset discovery
     • Enables display of system queries to non-admin users in custom dashboard widgets

     2 details in Everything

209. 4.0.250116.0 Jan 16, 2025 · release notes

     runZero 4.0 adds NO_PROXY support for self-hosted consoles and asset creation dates; Integ performance and Meraki pagination fixed

     • NO_PROXY environment variable is now honored by self-hosted runZero consoles to control proxy bypass behavior.
     • Asset details page now displays the date the asset record was created in the runZero database, with an optional column in the asset inventory view.

     2 details in Everything

210. 4.0.250113.0 Jan 13, 2025 · release notes

     runZero 4.0.250113.0 adds Matter IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. and SLP fingerprinting, MAC recording in Tenable integration, flatten_json module, and API role persistence

     • Matter IoT protocol support added for device fingerprinting.
     • SLP (Service Location Protocol) added for device probing.
     • Tenable integration now records MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. without associated IP addresses.
     • Asset details page groups unmapped MACs by interface in the Layer2 information section.
     • Custom integration scripts can import and use flatten_json module with its flatten method.

     +1 more show less

     • Organization roles are persisted when creating or updating a group via the API.

     6 details in Everything

211. 4.0.250106.0 Jan 6, 2025 · release notes

     Custom integration scripts run on Explorers and trigger via tasks; adds Inside Out ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. and shared key misuse vulnerability records.

     • Adds capability to execute custom integration scripts directly on runZero Explorers and trigger them via runZero tasks
     • Creates vulnerability records for inside-out attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management of internal assets
     • Creates vulnerability records for misuse of shared encryption keys

     3 details in Everything

212. 4.0.241219.2 Dec 19, 2024 · release notes

     runZero 4.0.241219.2 adds CLI access for all tiers, export task APIs, and scan duration limits.

     • Adds the runZero CLI to all license tiers
     • Adds Export APIs for export tasks
     • Enables optional scan duration limit for console-created scan tasks

     3 details in Everything

213. 4.0.241212.0 Dec 12, 2024 · release notes

     runZero 4.0.241212.0 adds Wiz project-scoped connector support and alert rule query preview

     • Adds a Preview Query button in Alert Rules for inventory query event types to validate configured queries against current inventory data.

     1 detail in Everything

214. 4.0.241210.0 Dec 10, 2024 · release notes

     runZero 4.0.241210.0 reveals event rule components and persists alert query conditions.

     • alert rules now persist the full query condition rather than dropping it on save
     • Event rules, channels, and templates are now visible in the UI instead of being hidden

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Deleting an organization no longer preserves its associated data: event templates, channels, and rules are also removed.
215. 4.0.241205.0 Dec 5, 2024 · release notes

     runZero 4.0.241205.0 adds Palo Alto ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. cache probing; Wiz integration now requires API URL

     • Scans now probe Palo Alto Networks firewalls for ARP cache information
     • Wiz integration configuration now requires an explicit API URL

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Wiz integration can no longer be configured without an API URL.
216. 4.0.241203.0 Dec 3, 2024 · release notes

     runZero 4.0.241203.0 improves Fortinet detection scope and fixes task/export stability issues.

     • Displays scan discovery scope on the task inspection card in the task overview page
     • Enables export of asset attribute reports for foreign attributes

     2 details in Everything

217. 4.0.241114.0 Nov 14, 2024 · release notes

     runZero 4.0 adds Hikvision SADP protocol support, reprocessing tasks, and API export logging fixes

     • Adds Hikvision SADP protocol support for device discovery.
     • Enables reprocessing of recent tasks to apply asset merge logic updates.

     2 details in Everything

218. 4.0.241106.0 Nov 6, 2024 · release notes

     runZero 4.0.241106.0 adds gzipped output and link4/link6 targets to CLI scanner; removes duplicate foreign data.

     • The --output-raw option now produces gzipped output and disables output directory creation
     • The CLI scanner now supports the link4 and link6 scan targets for local network ranges

     2 details in Everything

219. 4.0.241101.0 Nov 1, 2024 · release notes

     runZero 4.0.241101 adds event source/target links, Org column to events grid, Tanium custom tags, and full graph switch topology export.

     • Event details modal now displays clickable links to source and target objects for faster context switching
     • Events data grid page includes a new Organization column for filtering and grouping events by tenant
     • Tanium integration retrieves endpoints' Custom Tags when available, enriching asset context from Tanium data
     • Switch topology export options now support exporting the entire graph, enabling full network segment visualization

     4 details in Everything

220. 4.0.241101.2 Nov 1, 2024 · release notes

     runZero v4.0.241101.2 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. interface alias reporting and fixes TLS ECDH enumeration failures.

     • The scanner now reports SNMP interface aliases in addition to names.

     1 detail in Everything

221. 4.0.241029.0 Oct 29, 2024 · release notes

     runZero v4.0.241029.0 adds FortiGate FGFM protocol support and Comrol IO-Link device fingerprinting

     • Adds support for the FortiGate to FortiManager (FGFM) protocol for asset discovery
     • Adds fingerprinting support for Comtrol IO-Link devices

     2 details in Everything

222. 4.0.241023.0 Oct 23, 2024 · release notes

     runZero 4.0.241023.0 adds CIP/OT enumeration and Unicode CSV exports

     • runZero now supports backplane enumeration of OT devices using CIP over EtherNet/IP
     • CSV exports can now include Unicode characters

     2 details in Everything

223. 4.0.241022.0 Oct 22, 2024 · release notes

     runZero v4.0.241022.0 adds multiple export tokens with descriptions and improves asset tagging/merging logic.

     • Adds support for creating multiple export tokens that accept a description field
     • Renames the Summary column to Service response in the service inventory view
     • Enables asset tags to work correctly in alert templates and prevents them from being dropped from event rule data

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The old Rumble code signing certificate is retired; Windows binaries are now signed only with the runZero code signing certificate
224. 4.0.241016.0 Oct 16, 2024 · release notes

     runZero 4.0.241016.0 fixes UI link consistency, task card context, email invites, vulnerability exports, and fingerprinting logic.

     • Organization context is now preserved when opening links in the console
     • Task card on Explorer details page filters to current explorer, preventing leakage from other explorers with shared names
     • Email invitations now process correctly for users with punctuation characters in their names
     • Vulnerability export via UI supports filtering by site
     • Recurring task details view handles cases with no subtasks

     +1 more show less

     • Fingerprinting logic improved

     6 details in Everything

225. 4.0.241015.0 Oct 15, 2024 · release notes

     runZero 4.0.241015.0 adds NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. integration, asset refingerprinting, and dashboard metric recalculation.

     • Integrates with NetBox for asset data synchronization
     • Adds ability to refingerprint an individual asset from the asset details page using the latest fingerprint database
     • Adds Recalculate dashboard metrics option in the dashboard menu

     3 details in Everything

226. 4.0.241010.0 Oct 10, 2024 · release notes

     runZero 4.0.241010.0 enables SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with missing name fields and locks disabled project settings

     • SSO login now succeeds when the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. returns a blank or missing first or last name field.

     1 detail in Everything

227. 4.0.241001.0 Oct 1, 2024 · release notes

     runZero 4.0.241001.0 adds first_seen_task search keyword and refines queries on site/organization reports.

     • NOT and OR operators now work in queries on the site/organization report.
     • New first_seen_task search keyword finds assets first seen by a particular task.

     2 details in Everything

228. 4.0.240927.0 Sep 27, 2024 · release notes

     runZero 4.0 adds TLS config params, query library saves, and site-filtered vulnerability groups.

     • Adds TLS_VERSION_MIN and TLS_VERSION_MAX parameters to configure Explorer TLS settings
     • Enables saving Software and Vulnerability inventory queries to the query library
     • Allows searching vulnerability groups by site ID or site name

     3 details in Everything

229. 4.0.240926.0 Sep 26, 2024 · release notes

     runZero 4.0.240926 adds CUPS (IPP) Browser protocol probe on UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./631 and improves console error display for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. processes.

230. 4.0.240924.0 Sep 24, 2024 · release notes

     runZero 4.0 adds Oracle Solaris Service Tag discovery and OS CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. inventory display.

     • Asset inventory now displays the OS CPE value

     1 detail in Everything

231. 4.0.240923.0 Sep 23, 2024 · release notes

     runZero 4.0.240923.0 adds Tanium API Gateway integration and bulk remove API for custom sources.

     • Adds Tanium API Gateway as a supported integration target for asset discovery.
     • Enables bulk removal of a custom integration source from multiple assets via the API.

     2 details in Everything

232. 4.0.240918.0 Sep 18, 2024 · release notes

     runZero 4.0 adds support for the PCWORX protocol and resolves asset matching race conditions.

     • Adds support for the PCWORX protocol to enable discovery of associated assets.

     1 detail in Everything

233. 4.0.240917.1 Sep 17, 2024 · release notes

     runZero 4.0.240917.1 adds MECM integration, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Linux support, and CrowdStrike relative timestamp queries.

     • Self-hosted platform now supports ARM64 (aarch64) on Linux
     • CrowdStrike integration supports querying device last seen fields as relative timestamps

     2 details in Everything

234. 4.0.240904.0 Sep 4, 2024 · release notes

     runZero 4.0.240904 adds ATG asset identification and RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. scan options to reports page.

     • Automatic Tank Gauge protocol support for asset identification
     • RFC 1918 scan options accessible from the RFC 1918 reports page

     2 details in Everything

235. 4.0.240822.0 Aug 22, 2024 · release notes

     runZero 4.0.240822.0 adds foreign_attribute_count keyword support and auto performance profiling for self-hosted deployments.

     • The asset inventory now supports the foreign_attribute_count keyword.
     • Self-hosted installations now track performance profiles per task automatically.

     2 details in Everything

236. 4.0.240820.0 Aug 20, 2024 · release notes

     runZero 4.0.240820.0 adds EoL OS asset query, passive AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. detection, and Alerts UI redesign.

     • Adds system query for assets past OS Extended End of Life to the query library
     • Passive sampling tasks now identify Avast, Bitdefender, Carbon Black, ESET, Kaspersky, McAfee, SentinelOne, and Trellix AV/EDR products

     2 details in Everything

237. 4.0.240816.0 Aug 16, 2024 · release notes

     runZero 4.0.240816.0 adds custom install paths, restricted sudo support, and LOG_FORMAT=text logging.

     • Adds LOG_FORMAT=text configuration parameter for text-format logging in the self-hosted console.
     • Self-hosted installer now supports custom installation and temporary directory paths.
     • Self-hosted installer now supports systems with disabled or restricted sudo.

     3 details in Everything

238. 4.0.240814.0 Aug 14, 2024 · release notes

     runZero 4.0.240814.0 adds filtering to Meraki and Qualys integrations and updates directory CSV export fields

     • Adds organization name and ID filtering to the Meraki integration import process
     • Adds tag-based filtering to the Qualys integration asset import
     • Adds directory_group_user_count field to Directory group CSV exports

     3 details in Everything

239. 4.0.240811.0 Aug 11, 2024 · release notes

     runZero 4.0 supports wildcard prefix matching in software vendor searches and improves fingerprinting

     • Enables wildcard prefix searches for software vendors (e.g., Acme*)
     • Improves device fingerprinting accuracy

     2 details in Everything

240. 4.0.240809.0 Aug 9, 2024 · release notes

     runZero v4.0.240809.0 refreshes Alert Templates UI design and relaxes validation for JSON event rules.

     • Alert Templates page has a new, easier-to-use design
     • Valid JSON event rule templates are no longer rejected

     2 details in Everything

241. 4.0.240802.0 Aug 2, 2024 · release notes

     runZero 4.0.240802.0 adds date range filtering to trending dashboard widgets and fixes Tenable Security Center import.

     • Dashboard now supports filtering trending widgets by a customizable date range
     • Tenable Security Center integration no longer fails to import data

     2 details in Everything

242. 4.0.240729.0 Jul 29, 2024 · release notes

     runZero 4.0.240729.0 adds Meraki integration VLAN/SSID filtering and improves fingerprinting.

     • Improves fingerprint detection accuracy

     1 detail in Everything

243. 4.0.240729.1 Jul 29, 2024 · release notes

     runZero 4.0.240729.1 improves CrowdStrike integration stability and SSH field naming

     • The CrowdStrike integration no longer fails to run from an Explorer.
     • The matching engine for integration-sourced assets is now faster, more accurate, and better at merging related devices.
     • SSH enumeration now produces more consistently named fields.

     3 details in Everything

244. 4.0.240727.0 Jul 27, 2024 · release notes

     Vulnerability group exports now respect search filters; SSH enumeration adds host key and server extension capture.

     • Vulnerability group exports now apply the search filter
     • SSH enumeration now captures all host keys as well as server extensions

     2 details in Everything

245. 4.0.240725.0 Jul 25, 2024 · release notes

     runZero 4.0.240725 adds TwinCAT ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware. discovery and asset/vulnerability fields to Event templates.

     • Discovery: Added support for devices using the TwinCAT ADS protocol
     • Event templates: Added asset risk, vulnerability, and outlier fields

     2 details in Everything

246. 4.0.240718.0 Jul 18, 2024 · release notes

     runZero 4.0.240718.0 adds Goals Overview fixes, faster integrations, and CrowdStrike Discover API data

     • The Goals Overview dashboard widget now displays data for the selected timeframe rather than an incorrect number of days.
     • Network topology calculation is now faster and runs as part of the metrics analysis task rather than inline with normal task processing.
     • Additional CrowdStrike device data is now available for users with access to CrowdStrike’s Discover API.
     • The CrowdStrike, Intune, Tenable, and Wiz integrations now process large datasets faster.
     • The Asset ID and Organization ID now appear on their respective details pages.

     5 details in Everything

247. 4.0.240716.0 Jul 16, 2024 · release notes

     runZero 4.0.240716.0 adds --import-pcap CLI option and Meraki wired-MAC correlation.

     • runzero CLI scanner now supports the --import-pcap flag for importing packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files directly
     • Meraki connector assets now report the wired-side MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. to improve asset correlation

     2 details in Everything

248. 4.0.240707.0 Jul 7, 2024 · release notes

     New search dimension via VulnCheck KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. and richer CrowdStrike data retrieval.

249. 4.0.240628.0 Jun 28, 2024 · release notes

     runZero 4.0.240628.0 adds semantic sorting/filtering for version fields, Meraki network filtering, and Canon BJNP protocol support.

     • Adds > >= < <= = operators to filter version fields which now sort semantically
     • Adds the ability to filter the Meraki integration by specific network name or ID

     2 details in Everything

250. 4.0.240627.0 Jun 27, 2024 · release notes

     runZero 4.0.240627.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.-based vulnerability search, enhanced Asset Ownership report capacity, and performance improvements.

     • Adds epss_score keyword to vulnerability search queries
     • Increases Asset Ownership report limit to 15,000 owners
     • Displays CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. membership status in the vulnerability information page

     3 details in Everything

251. 4.0.240626.1 Jun 26, 2024 · release notes

     runZero 4.0.240626.1 adds Meraki switch topology integration and Intune device filtering.

     • The Meraki integration now populates the switch topology report.
     • The Intune integration now supports an optional filter for devices.

     2 details in Everything

252. 4.0.240621.0 Jun 21, 2024 · release notes

     runZero 4.0.240621 adds custom dashboard widgets and improves SQL Server discovery

     • Adds support for custom widgets based on queries in the Organization Overview dashboard
     • Improves Discovery and data collection from Microsoft SQL Server endpoints

     2 details in Everything

253. 4.0.240618.0 Jun 18, 2024 · release notes

     Version 4.0.240618 introduces JSON-based configuration for scan options and enhances syslog client detection accuracy.

     • Accepts scan options from a JSON formatted configuration file
     • Passive traffic sampling now detects syslog clients more accurately

     2 details in Everything

254. 4.0.240616.0 Jun 16, 2024 · release notes

     runZero Export API now supports POST with form-urlencoded params for larger queries.

     • Adds POST request support to Export API endpoints using application/x-www-form-urlencoded content type.

     1 detail in Everything

255. 4.0.240606.0 Jun 6, 2024 · release notes

     runZero v4.0.240606.0 adds 4-level org hierarchies, fixes npcap and connector stalls.

     • Supports organization hierarchies up to four levels deep for deeper tenant structuring
     • New Explorer installations on Windows no longer omit npcap driver by default

     2 details in Everything

256. 4.0.240605.0 Jun 5, 2024 · release notes

     runZero 4.0.240605.0 adds asset and vulnerability search by CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. membership.

     • Allows searching for assets and vulnerabilities filtered by CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. membership

     1 detail in Everything

257. 4.0.240603.0 Jun 3, 2024 · release notes

     runZero 4.0.240603.0 adds Defender asset filtering, Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. probe support, unlimited Events history, and credential validation

     • Adds the ability to filter assets that have not been fully onboarded in the Defender integration
     • Adds support for the Graph API filter parameter when running as a scanner probe
     • Removes the 30-day retention limit on the Events view history
     • Adds validation of Defender and Intune configuration when specifying a new Azure credential

     4 details in Everything

258. 4.0.240531.0 May 31, 2024 · release notes

     runZero adds XDMCP discovery and OS EoL data for Fortinet FortiOS

     • Adds support for discovering devices using the XDMCP protocol in network scans
     • Makes Operating System End of Life (EoL) information available for assets identified as running Fortinet FortiOS

     2 details in Everything

259. 4.0.240529.1 May 29, 2024 · release notes

     runZero 4.0.240529.1 adds Meraki integration for device sync and improves asset attribution accuracy

     • runZero now integrates with Meraki, syncing Devices and Clients to your inventory.
     • Fingerprint improvements.

     2 details in Everything

260. 4.0.240524.0 May 24, 2024 · release notes

     runZero 4.0.240524.0 adds dashboard theater/kiosk mode and a customizable bookmarks widget

     • Adds theater/kiosk mode and fullscreen display options to the dashboard
     • Adds a customizable bookmarks widget to the dashboard widget library for jumping to favorite reports, views, or external websites

     2 details in Everything

261. 4.0.240519.0 May 19, 2024 · release notes

     runZero 4.0.240519.0 adds API filtering to AzureAD connector, expands LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. field sync, and enhances Custom Integration SDK with new IP/MAC fields.

     • Adds $search and $filter parameters support for Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint. in the AzureAD (EntraID) connector
     • Adds employeeID, ms-Mcs-AdmPwdExpirationTime, and ms-LAPS-PasswordExpirationTime to LDAP connector field sync
     • Extends Custom Integration SDK to ingest ipAddresses, ipAddressesExtra, and macAddresses fields directly without a NetworkInterface structure

     3 details in Everything

262. 4.0.240423.0 Apr 23, 2024 · release notes

     runZero 4.0.240423 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. password setting and EoL data for SUSE/Apple.

     • Setting a password now works for SSO users when SSO is disabled at the runZero account level
     • Operating System End of Life (EoL) information is now available for SUSE Enterprise Linux and Apple tvOS

     2 details in Everything

263. 4.0.240411.0 Apr 11, 2024 · release notes

     runZero 4.0.240411.0 introduces a new Wiz integration to sync asset, software, and vulnerability data, alongside fingerprint improvements.

264. 4.0.240405.0 Apr 5, 2024 · release notes

     runZero v4.0 adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. token naming and profile settings redesign.

     • Adds the ability to name multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. tokens when enrolling them.
     • Renames UI section: The profile settings page has a new design.

     2 details in Everything

265. 4.0.240403.0 Apr 3, 2024 · release notes

     runZero 4.0.240403.0 improves Query Insights navigation and MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. matching for Fortinet devices.

     • The Query Insights dashboard widget now clicks through to the appropriate inventory view.
     • Matching of MAC addressesMAC addressesA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. for Fortinet firewall devices has improved.

     2 details in Everything

266. 4.0.240401.0 Apr 1, 2024 · release notes

     runZero 4.0 adds fully customizable dashboards and view export to CSV/PNG

     • Adds full customization of the runZero dashboard layout.
     • Adds export capability for dashboards/views in CSV and PNG formats.

     2 details in Everything

267. 4.0.240318.0 Mar 18, 2024 · release notes

     runZero v4.0.240318.0 exposes Task ID in UI and fixes connector progress calculation.

     • Task ID now displayed on the task overview page for quick reference and copy-paste.
     • Task ID is available in the task details page view for inspection during active scans.
     • Connector task mid-scan progress is calculated correctly, preventing stalled or inaccurate status reports.

     3 details in Everything

268. 4.0.240308.0 Mar 8, 2024 · release notes

     runZero v4.0.240308.0 adds autocomplete for short keywords, EtherNet/IP probing, and fixes Nmap XML export truncation.

     • Short keywords in the query builder now display autocomplete suggestions
     • Long fields in asset data Nmap XML exports are no longer truncated
     • Scanner gains support for probing devices with EtherNet/IP over UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.

     3 details in Everything

269. 4.0.240301.0 Mar 1, 2024 · release notes

     runZero 4.0.240301.0 adds serialNumbers column to asset CSV export

     • Adds serialNumbers column to asset CSV exports, including the protocol used for discovery

     1 detail in Everything

270. 4.0.240223.0 Feb 23, 2024 · release notes

     runZero 4.0.240223.0 adds Apple iOS/iPadOS and CentOS Stream EoL data with improved fingerprinting

     • Operating System End of Life (EoL) information is now available for Apple iOS and iPadOS as well as CentOS Stream.
     • Operating System Extended End of Life (EoL) generation has improved.
     • Fingerprint improvements.

     3 details in Everything

271. 4.0.240221.0 Feb 21, 2024 · release notes

     runZero 4.0.240221.0 adds BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. device fingerprinting to the vulnerability inventory.

272. 4.0.240216.0 Feb 16, 2024 · release notes

     runZero 4.0.240216.0 improves search autocomplete, adds parent org picker to create/edit pages, and enhances NTLMSSP/Qualys correlation.

     • Improves search query and query builder autocomplete results for shorter input
     • Improves correlation behavior for assets with information from NTLMSSP or Qualys
     • Improves fingerprinting

     3 details in Everything

273. 4.0.240213.0 Feb 13, 2024 · release notes

     runZero 4.0.240213.0 speeds up software inventory and renames environment variables for log configuration

     • Adds RUNZERO_LOG_FORMAT and RUNZERO_LOG_MAX_LENGTH environment variables to configure logging, replacing the deprecated LOG_FORMAT and LOG_MAX_LENGTH.
     • Improves performance of the Software Inventory module for large organizations.

     2 details in Everything

274. 4.0.240122.0 Jan 22, 2024 · release notes

     runZero v4.0.240122 adds recent/available query display in datagrid search bar and improves RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. fingerprinting.

     • Adds display of recent queries and available queries from the query library to the datagrid search bar
     • Improves fingerprinting accuracy for Red Hat Enterprise Linux and derivatives using Tenable product data

     2 details in Everything

275. 4.0.240112.0 Jan 12, 2024 · release notes

     runZero 4.0.240112.0 adds a Site column to task lists and improves fingerprinting.

     • All task lists in the task overview now include a Site column
     • Fingerprint improvements

     2 details in Everything

276. 4.0.231215.0 Dec 15, 2023 · release notes

     runZero 4.0.231215.0 adds self-hosted customJS execution on all pages and improves asset correlation.

     • Correlation for Tenable-sourced assets has improved.

     1 detail in Everything

277. 4.0.231207.0 Dec 7, 2023 · release notes

     runZero 4.0.231207.0 adds multi-key Secrets Manager loading via AWS_SECRET_ACCESS_KEY and fixes task/goal status reporting.

     • Self-hosted customers can now load configuration items from multiple Secrets Manager keys by separating the keys with commas in the AWS_SECRET_ACCESS_KEY variable.
     • Goals associated with vulnerability queries now report accurate progress.

     2 details in Everything

278. 4.0.231130.0 Nov 30, 2023 · release notes

     runZero v4.0.231130.0 adds S7 protocol asset discovery and fixes Azure AD user import.

     • Adds asset discovery using the S7 protocol
     • Improves passive detection of RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. authentication methods

     2 details in Everything

279. 4.0.231122.0 Nov 22, 2023 · release notes

     runZero v4.0.231122.0 corrects Linux OS EOL data and improves Fortinet device detection.

     • Improves the accuracy and coverage of Fortinet device detection via fingerprinting.

     1 detail in Everything

280. 4.0.231121.0 Nov 21, 2023 · release notes

     runZero 4.0.231121.0 adds credential editing and extended ownership data in asset JSON export

     • Editing credentials now works.
     • The asset JSON export now includes extended ownership data under the ownership field.

     2 details in Everything

281. 4.0.231120.0 Nov 20, 2023 · release notes

     runZero 4.0.231120.0 allows self-hosted S3 region/endpoint override and fixes datagrid UI bugs

     • Self-hosted users can now configure the S3 region and endpoint for storage backends

     1 detail in Everything

282. 4.0.231116.0 Nov 16, 2023 · release notes

     runZero 4.0.231116.0 adds granular datagrid column management and improved asset report performance.

     • Adds two new dropdown menus to all datagrids for granular control of column width and visibility
     • Datagrid column widths now persist across sessions after manual resizing

     2 details in Everything

283. 4.0.231108.0 Nov 8, 2023 · release notes

     runZero v4.0.231108.0 adds private IP configuration, new protocol detections (ThinPrint, ident), and dashboard chart fixes.

     • Adds private_ip_ranges configuration at the Account and Organization level to control which IP ranges are treated as private during scanning
     • Adds detection support for the ThinPrint protocol
     • Adds legacy identification protocol (ident) support in scanners

     3 details in Everything

284. 4.0.231108.1 Nov 8, 2023 · release notes

     runZero 4.0.231108.1 adds Azure AD inactive device filtering, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. group mapping DN support, and stale file cleanup in Explorer.

     • Adds ability to filter inactive devices in the Azure AD integration
     • Adds support for DNs containing commas in SSO group mapping rules
     • Enables runZero Explorer to clean up stale files in both legacy Rumble and runZero install locations

     3 details in Everything

285. 4.0.231101.0 Nov 1, 2023 · release notes

     runZero 4.0.231101.0 adds IGEL thin client protocol support and optimizes asset modification rule processing memory.

286. 4.0.231030.0 Oct 30, 2023 · release notes

     runZero 4.0.231030.0 adds Kasa IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. protocol support and Shodan-compatible favicon hashing in scanner output

     • Adds Kasa IoT protocol detection to the scanner and passive engine for identifying smart home devices
     • Enables reporting of Shodan-compatible Murmur3 32-bit hash for favicon files in scan results

     2 details in Everything

287. 4.0.231027.0 Oct 27, 2023 · release notes

     runZero 4.0.231027.0 adds asset criticality bulk update and SecuRemote fingerprinting

     • Adds API endpoints for setting asset criticality individually or in bulk.
     • Supports updating asset criticality via CSV import.
     • Enables fingerprinting devices based on the SecuRemote protocol.

     3 details in Everything

288. 4.0.231017.0 Oct 17, 2023 · release notes

     runZero v4.0.231017.0 adds single credential deletion and AWS merge accuracy improvements

     • Adds a delete button in the actions column for each row in the credentials list to remove single credentials directly from the UI.
     • Improves merge accuracy for externally scanned AWS assets reported by third-party sources through better fingerprinting logic.

     2 details in Everything

289. 4.0.231017.1 Oct 17, 2023 · release notes

     runZero v4.0.231017.1 fixes the type keyword in task search.

290. 4.0.231012.0 Oct 12, 2023 · release notes

     runZero 4.0.231012.0 adds vuln/software to custom integrations, asset_count search, and fixes alert triggers.

     • Custom integrations can now include vulnerability and software data
     • The asset inventory now supports the attribute_count search term

     2 details in Everything

291. 4.0.231006.0 Oct 6, 2023 · release notes

     runZero 4.0 adds Amazon Linux 2 support to self-hosted platform

292. 4.0.230927.0 Sep 27, 2023 · release notes

     runZero 4.0.230927.0 adds OMRON FINS protocol asset detection and faster Scan/Monitor pages.

     • Adds detection of assets using the OMRON FINS protocol
     • Scan and Monitor landing pages now load faster

     2 details in Everything

293. 4.0.230925.0 Sep 25, 2023 · release notes

     runZero Platform v4.0 GA release

     • runZero Platform version 4.0 is now available

     1 detail in Everything

294. 3.10.230920.0 Sep 20, 2023 · release notes

     runZero 3.10 adds template_name to task exports (CSV/JSON) and API responses; improves NetBIOS/SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. asset merging.

     • template_name is now included in tasks CSV export columns
     • site_name, agent_name, and template_name are now included in tasks JSON export columns and API responses

     2 details in Everything

295. 3.10.230917.0 Sep 17, 2023 · release notes

     Explorer reads .env files correctly; passive assets use source:sample and new runzeroctl command.

     • Explorer now reads the .env configuration file correctly
     • Passive traffic sampling tasks now set source:sample instead of source:passive for assets
     • Self-hosted console now uses the runzeroctl command by default

     3 details in Everything

296. 3.10.230913.0 Sep 13, 2023 · release notes

     runZero 3.10.230913.0 adds eSCL uscan scanner identification and an exclude unknown option for Custom Integrations.

     • Adds support for the eSCL uscan protocol to identify scanners

     1 detail in Everything

297. 3.10.230908.01 Sep 8, 2023 · release notes

     runZero adds Voice Services Discovery Protocol (VSDP) device fingerprinting in v3.10

     • Console and Explorers adopt <major>.<minor>.<yymmdd>.<revision> versioning scheme

     1 detail in Everything

298. 3.10.25 Sep 5, 2023 · release notes

     UI enhancements to the Integrate page and improved scan task logging for host responsiveness.

     • The Integrate page now shows active and suggested integrations for the current organization.

     1 detail in Everything

299. 3.10.21 Aug 29, 2023 · release notes

     runZero v3.10.21 adds MODBUS/TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. discovery and increases ownership type limit to 25

     • MODBUS/TCP device discovery is now supported

     1 detail in Everything

300. 3.10.19 Aug 23, 2023 · release notes

     runZero 3.10.19 adds EtherNet/IP asset discovery and corrects timestamp attributes for Azure AD, Google Workspace, and Microsoft Intune.

     • Adds EtherNet/IP probing to discover assets on the network.

     1 detail in Everything

301. 3.10.18 Aug 21, 2023 · release notes

     runZero 3.10.18 adds secret_updated_at field, Explorer event rule conditions, and user group management fixes.

     • The console and API now expose a secret_updated_at field for stored credentials rotation date.
     • Event rules now support conditions for Explorer and task type where relevant.
     • Users can now manage their users’ group membership.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !recurring tasks stop with an error if the task template is deleted
302. 3.10.17 Aug 16, 2023 · release notes

     runZero 3.10.17 adds MQTT scanner support and improves Azure AD fingerprinting.

     • The scanner now supports the MQTT protocol
     • Fingerprint improvements

     2 details in Everything

303. 3.10.15 Aug 10, 2023 · release notes

     Version 3.10.15 enhances the Tenable integration's reliability for vulnerability exports and refreshes the visual design of the Explorer and scanner download pages.

304. 3.10.14 Aug 9, 2023 · release notes

     runZero 3.10.14 adds scan.explorer_id to alert templates and a syn-reset-sessions scanner option.

     • Adds scan.explorer_id value population in alert templates
     • Scanner supports the new syn-reset-sessions option

     2 details in Everything

305. 3.10.9 Jul 26, 2023 · release notes

     runZero 3.10.9 allows editing task name/description after file import and speeds up large org deletion.

     • Adds ability to modify the name and description of tasks created via file imports
     • Improves deletion performance for large organizations, projects, or sites
     • Increases request timeout for Microsoft Intune and Azure AD integrations

     3 details in Everything

306. 3.10.8 Jul 24, 2023 · release notes

     runZero 3.10.8 adds timestamp differentiation in exports and improves task processing performance

     • Exports of task data now include timestamps that differentiate time spent acquiring data from time spent processing data.
     • Task processing times have improved.

     2 details in Everything

307. 3.10.5 Jul 19, 2023 · release notes

     runZero v3.10.5 adds pagination to asset details screens for assets with >30 services and fixes SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. credential handling in scan tasks.

     • Asset details screen now supports pagination when viewing an asset with more than 30 services.
     • Modifying or copying existing scan tasks no longer enables SNMP credentials.

     2 details in Everything

308. 3.10.2 Jul 17, 2023 · release notes

     runZero 3.10.2 adds license-based file import limits and improves UI clarity for roles and permissions.

     • Applies license-based size limits to file imports
     • Disables duplicate service warnings
     • Adds user permissions table to the User Details screen

     3 details in Everything

309. 3.10.0 Jul 10, 2023 · release notes

     runZero 3.10.0 introduces a new Integrations page for configuration and fixes UI tooltip discrepancies.

     • Adds an Integrations page to the UI to centralize visibility and simplify configuration of external integrations.

     1 detail in Everything

310. 3.9.9 Jul 6, 2023 · release notes

     runZero 3.9.9 adds Azure Gov OAuth support for Microsoft 365 Defender and improves asset data fidelity.

     • Adds Azure government environment support for Microsoft 365 Defender OAuth Client Credential tokens
     • Improves fingerprinting capabilities

     2 details in Everything

311. 3.9.7 Jul 3, 2023 · release notes

     runZero 3.9.7 enables dynamic alert rule actions to modify asset ownership and adds cache-control headers to dynamic content.

     • Alert rule actions can now modify asset ownership based on software, service, or vulnerability query results

     1 detail in Everything

312. 3.9.5 Jun 27, 2023 · release notes

     Performance enhancements for database operations including asset deletion and vulnerability processing.

313. 3.9.4 Jun 26, 2023 · release notes

     runZero 3.9.4 adds Custom Integrations for trial accounts and improves Palo Alto/SSDP fingerprinting

     • Trial accounts can now create Custom Integrations.
     • Operating system and hardware fingerprinting of Palo Alto Networks devices has improved.
     • Discovery of SSDP services has improved.

     3 details in Everything

314. 3.9.0 Jun 13, 2023 · release notes

     runZero 3.9.0 introduces Goals for security initiatives, saved queries for tasks, and source searchability.

     • Introduces runZero goals to create and monitor progress toward security initiatives
     • Adds ability to create saved queries for tasks
     • Makes source_count and custom_integration_count fields searchable

     3 details in Everything

315. 3.8.13 May 31, 2023 · release notes

     runZero 3.8.13 allows removing non-runZero asset sources from assets via UI pages, accepts equivalent emails for updates, and fixes the HTTP response codes returned by the metrics API.

     • Allows removing non-runZero asset sources from assets via the asset details or inventory pages.
     • Accepts equivalent emails for email updates.

     2 details in Everything

316. 3.8.12 May 24, 2023 · release notes

     runZero 3.8.12 adds Viewer access to the Sites page and Query-Goal attachment warnings.

     • Users with Viewer permission can now see and use the Sites page
     • runZero displays a warning if a Query is not attached to a Goal

     2 details in Everything

317. 3.8.10 May 22, 2023 · release notes

     runZero v3.8.10 improves asset merging and adds per-service AWS credential validation results.

     • Shows the results for each individual AWS service during credential validation, rather than a single aggregate status.

     1 detail in Everything

318. 3.8.2 May 12, 2023 · release notes

     runZero 3.8.2 adds legacy time-distribution protocol support and fixes Explorer config override.

     • Supports legacy Internet time-distribution and traffic testing protocols for asset discovery
     • RUMBLE_CONSOLE environment variable override in the Explorer configuration is now functional

     2 details in Everything

319. 3.8.0 May 9, 2023 · release notes

     runZero v3.8.0 adds asset criticality via integrations/rules, goal tracking, passwordless auth, GCC/DoD support, and hostname-based asset merging.

     • Allows assigning risk and criticality levels to assets through third-party integrations, the asset inventory, and custom rules
     • Adds built-in goals for asset ownership coverage or system queries in the runZero Preview Program, plus creation of custom query goals for Professional and Enterprise licenses
     • Enables creating vulnerability records using runZero system and custom queries
     • Introduces passwordless authentication via one-time email links as an alternative to SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
     • Adds support for Azure and Intune GCC, GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy., and DoD environments

     +9 more show less

     • Improves compatibility with WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. and Tailscale on macOS and *BSD
     • Enables searching software attributes
     • Allows configuring alert channels to accept more than one email address
     • Makes asset limit warnings clearer about whether or not scans will be affected
     • Merges assets based on hostname if no other match method succeeds, for hostnames from trusted sources (mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing., NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent., or NetBIOS)
     • Reassigns explorers to previous organizations so they pick up their assigned tasks
     • Ensures task-failed events respect site restrictions
     • Updates the displayed hostname via the hostname override tag
     • Allows clearing Insights from the dashboard

     14 details in Everything

320. 3.7.10 May 2, 2023 · release notes

     runZero 3.7.10 improves Azure credential submission reliability

     • Correctly submits Azure credentials for verification when using a subscription ID

     1 detail in Everything

321. 3.7.6 Apr 24, 2023 · release notes

     Improved asset correlation and fingerprinting accuracy in runZero.

322. 3.7.4 Apr 19, 2023 · release notes

     runZero 3.7.4 adds hosted zone support to public API endpoints for scan task management and view queries.

     • Extends scan task management API to accept a hosted zone selection argument

     1 detail in Everything

323. 3.7.2 Apr 13, 2023 · release notes

     runZero 3.7.2 adds self-hosted TLS validation toggle and fixes UI errors

     • Adds self-hosted install option to disable TLS validation between Explorers and the console application

     1 detail in Everything

324. 3.7.1 Apr 12, 2023 · release notes

     runZero 3.7.1 adds granular vulnerability filters for third-party integrations and new SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. probe parameters.

     • Adds disable-bulk and max-repetitions parameters to SNMP probes

     1 detail in Everything

325. 3.7.0 Apr 10, 2023 · release notes

     runZero 3.7.0 adds custom integration creation via Python SDK for Platform license customers.

326. 3.6.17 Apr 2, 2023 · release notes

     runZero 3.6.17 adds Steam In-Home Streaming discovery and faster API tagging

     • Adds Steam In-Home Streaming protocol support for asset discovery.
     • Improves API tag application performance.
     • Groups unique attribute report values by key.
     • Enables auto-complete suggestions for asset owner names.

     4 details in Everything

327. 3.6.13 Mar 29, 2023 · release notes

     runZero 3.6.13 adds query saving for software/vulns/screenshots, match counts display, and analysis improvements

     • Adds the ability to save queries for software, vulnerabilities, and screenshots.
     • Match counts now display on the queries page.
     • Improves Analysis queries for directory users and groups to run correctly.

     3 details in Everything

328. 3.6.16 Mar 29, 2023 · release notes

     runZero 3.6.16 resolves access to canned queries.

329. 3.6.12 Mar 28, 2023 · release notes

     runZero v3.6.12 adds configurable SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. walk timeout, increased result limits, and user-owned asset visibility.

     • Allows configuring the maximum time for an SNMP walk
     • The API response to a PUT request to /org/sites now includes the details of the new site
     • The user details page now lists the assets a runZero user owns

     3 details in Everything

330. 3.6.8 Mar 23, 2023 · release notes

     runZero 3.6.8 adds Exploit status to vulnerability inventory for import-only assessment.

     • Adds Exploit status field to the vulnerability inventory to indicate known exploitability.
     • Improves TLS stack fingerprinting accuracy and reliability.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Organizations with Parents set before 3.6 have their Parents reset in this release.
331. 3.6.6 Mar 22, 2023 · release notes

     runZero 3.6.6 adds software/vulnerability queries to alert rules and user/group references for asset ownership.

332. 3.6.3 Mar 20, 2023 · release notes

     runZero 3.6.3 adds faster attribute searches, task log downloads for failed scans, and probe selection for pings

     • assets-expired event now records the count of expired assets for daily expiration.
     • task-failed event now includes information about the associated Explorer.
     • Scans can specify which probes to use for Subnet and Host pings.
     • Added ability to download the task log for a failed scan.

     4 details in Everything

333. 3.6.2 Mar 16, 2023 · release notes

     runZero 3.6.2 enables /8 scan ranges and AWS GovCloud SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for enterprise users.

     • Enterprise customers can now scan all ports and up to a /8 at a time using the hosted scan engines
     • The AWS integration now supports the GovCloud partition for assumed roles

     2 details in Everything

334. 3.6.0 Mar 13, 2023 · release notes

     runZero 3.6.0 adds organizational hierarchies, asset rescan scope controls, and role-based license warning filtering

     • Adds organizational hierarchies where child organizations inherit permissions from a parent organization
     • Adds the ability to include or exclude extra addresses during asset rescans
     • Adds user role-based hiding of license warnings

     3 details in Everything

335. 3.5.8 Mar 7, 2023 · release notes

     runZero 3.5.8 adds site subnet tags to inventory pages and improves CrowdStrike asset correlation.

     • The Services, Screenshots, and Software inventory pages now include the associated site subnet tags.

     1 detail in Everything

336. 3.5.7 Mar 6, 2023 · release notes

     runZero 3.5.7 adds CrowdStrike Falcon Discover software import and dashboard navigation fixes

337. 3.5.5 Feb 28, 2023 · release notes

     runZero 3.5.5 adds VMware asset correlation across sites, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. version/auth tracking, and /32 subnet handling.

     • VMware asset correlation now merges assets across multiple sites for a unified view.
     • Assets now track SNMP protocol versions at the individual asset level in the inventory.
     • SNMP service records now include specific authentication methods and protocols used during discovery.
     • Site scopes containing /32 (IPv4) or /128 (IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.) subnets are now explicitly listed as CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. entries rather than single IPs.

     4 details in Everything

338. 3.5.3 Feb 21, 2023 · release notes

     runZero 3.5.3 adds canned query for OpenSSH 9.1 double-free vulnerability and improves integrations.

     • Adds a canned query that identifies OpenSSH 9.1 servers containing a memory double-free vulnerability
     • Improves performance of Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.), Azure AD, and Google Workspace integrations
     • Changes Tenable integration to treat reported IP addresses as primary IPs, matching Rapid7 and Qualys behavior

     3 details in Everything

339. 3.5.2 Feb 14, 2023 · release notes

     runZero 3.5.2 adds RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. auth method identification, ISAKMP/IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. decode, and OS fingerprinting over RDP

     • The scanner now identifies the RDP authentication methods, including legacy and NLA, that target hosts support.
     • The scanner can now decode ISAKMP/IKEv2 replies.
     • OS fingerprinting and information extraction over RDP now work.

     3 details in Everything

340. 3.5.1 Feb 13, 2023 · release notes

     runZero 3.5.1 adds automatic metric calculation completion and automatic removal of stale assets in task runs.

     • Automatic metric calculations now complete
     • runZero now removes stale assets automatically on subsequent task runs

     2 details in Everything

341. 3.4.23 Feb 7, 2023 · release notes

     runZero 3.4.23 adds CoAP protocol support to the scanner and fixes asset/reporting bugs.

     • Adds CoAP protocol scanning support over UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. to the scanner engine
     • Updates the Qualys integration to handle API rate limiting automatically

     2 details in Everything

342. 3.4.22 Feb 1, 2023 · release notes

     runZero 3.4.22 adds Minecraft Bedrock scanning, directory user/group export API, and UI column updates

     • GET endpoint to export directory users from the public API.
     • GET endpoint to export directory groups from the public API.
     • Support for the Minecraft Bedrock protocol in the scanner.

     3 details in Everything

343. 3.4.20 Jan 25, 2023 · release notes

     runZero 3.4.20 adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. cloud asset query, NDMP protocol support, and improved dashboard performance

     • New canned query surfaces cloud compute assets with GPU hardware

     1 detail in Everything

344. 3.4.18 Jan 18, 2023 · release notes

     runZero v3.4.18 adds Asset Ownership management and Munin protocol support via Preview Program

     • Asset Ownership feature lets you manage asset owners across your asset inventory
     • Scanner now supports the Munin protocol

     2 details in Everything

345. 3.4.16 Jan 11, 2023 · release notes

     runZero v3.4.16 adds live-only result limiting for queries and outlier highlighting on asset details pages.

     • Adds the ability to limit query results to only live assets.
     • Introduces visual highlighting of outlier attributes on the asset details page.

     2 details in Everything

346. 3.4.15 Jan 10, 2023 · release notes

     runZero 3.4.15 adds MySQL X protocol support and improves connector reliability and asset matching.

     • Adds MySQL X protocol support in the scanner for new database discovery capabilities

     1 detail in Everything

347. 3.4.11 Jan 5, 2023 · release notes

     runZero 3.4.11 adds credential editing/verification, L2TP support, subnet utilization enhancements, and multiple protocol detections

     • Adds ability to edit saved credentials after saving them
     • Adds credential verification against services to surface upstream configuration issues
     • Subnet utilization report now includes subnets by site and assets outside the scope of a defined site subnet
     • Asset inventory searches with the mac keyword now support Cisco MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. format and additional delimiter characters
     • Improved non-unique MAC address filtering for Fortinet virtual adapters, Juniper switches, and Project Calico virtual interfaces

     +1 more show less

     • runZero now supports L2TP, Dahua DHIP, KXNnet, Webmin, and Playstation UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. protocols

     6 details in Everything

348. 3.4.7 Dec 19, 2022 · release notes

     runZero 3.4.7 adds service_id to service exports and improves asset attribute import reporting.

     • Service exports now include a service_id field
     • Asset attribute imports now report all results

     2 details in Everything

349. 3.4.5 Dec 18, 2022 · release notes

     runZero v3.4.5: Save scans when license exceeded and improved Windows/Npcap support

     • Adds the ability to save new and recurring scans even when the current license is exceeded
     • Updates latest Windows Explorers to embed npcap

     2 details in Everything

350. 3.4.4 Dec 16, 2022 · release notes

     runZero 3.4.4 adds custom JS to UI, AWS account ID asset attribute, and better org filtering.

     • Adds the ability to include custom JavaScript in UI web pages for self-hosted installations
     • Adds Amazon Web Services account IDs to a new per-asset attribute
     • Adds filtering capability to organization and client switching dropdown menus when there are more than 5 organizations or clients

     3 details in Everything

351. 3.4.0 Dec 12, 2022 · release notes

     runZero 3.4.0 adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. API auth, asset removal automation, and task abort capabilities

     • Enables authentication to runZero APIs via OAuth 2.0 client credentials flow.
     • Adds an option in the AWS integration to automatically remove assets no longer reported by AWS.
     • Allows stopping tasks during the data gathering and processing phases.

     3 details in Everything

352. 3.3.6 Dec 7, 2022 · release notes

     runZero 3.3.6 adds health check endpoint, allows disabling integration-created assets, and improves import consistency.

     • CrowdStrike integration now imports vulnerabilities when Spotlight is enabled for the API key
     • New flag/option to disable creation of new assets from third-party integrations
     • Public API includes a new endpoint to check platform health
     • runZero now reports OS EOL dates for Windows 11
     • New canned query finds MegaRAC BMC firmware

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The DELETE API method for bulk asset deletion is now deprecated
353. 3.3.3 Nov 28, 2022 · release notes

     runZero 3.3.3 adds RUNZERO_CRUNCHER_INSTANCES for concurrency control and improves scheduling accuracy.

     • Scheduler now delays recurring tasks if the previously completed task has not yet started processing, preventing overlap.
     • Backend processes concurrent tasks for separate sites within the same organization when possible.

     2 details in Everything

354. 3.3.4 Nov 28, 2022 · release notes

     runZero 3.3.4 removes delays in concurrent task processing for faster scans.

355. 3.3.1 Nov 20, 2022 · release notes

     runZero 3.3.1 adds AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. stop-instance inclusion and improves Defender merging

     • Adds include_stopped_instances option to AWS EC2 integration to scan stopped assets
     • Merges Microsoft Defender assets more completely in the asset inventory
     • Improves performance of searching and sorting by first seen and last seen columns

     3 details in Everything

356. 3.3.0 Nov 14, 2022 · release notes

     runZero 3.3.0 adds Google Workspace sync for assets/users and refreshed UI tables.

     • Adds Google Workspace asset synchronization for runZero Professional and Enterprise customers
     • Adds Google Workspace user and group synchronization for runZero Platform customers
     • Updates the user interface tables for Organizations, Sites, Explorers, and Teams with a new design
     • Makes the All Organizations view available to restricted users with a filtered scope

     4 details in Everything

357. 3.2.11 Nov 8, 2022 · release notes

     runZero 3.2.11 adds site filtering to subnet utilization reports, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. scanner builds, and account API validation.

     • Adds site filter option to the subnet utilization report
     • CSV export of assets now includes hostname information from the inventory view
     • Provides up-to-date ARM64 builds for the standalone scanner

     3 details in Everything

358. 3.2.9 Nov 3, 2022 · release notes

     runZero 3.2.9 adds AWS asset cleanup, Qualys unscanned import, and Tanium EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. attribute mapping

     • Adds delete_unseen option to the AWS integration to remove assets not seen in the most recent import
     • Adds import_unscanned option (disabled by default) to the Qualys integration to bring in unscanned assets
     • Tanium agent detection now sets the edr.name attribute

     3 details in Everything

359. 3.2.7 Nov 1, 2022 · release notes

     runZero v3.2.7 adds tls.stack attribute to assets/services and an OpenSSL 3.0.x canned query.

     • Adds tls.stack attribute to asset and service objects for TLS software provider/version tracking
     • Adds a new canned query that finds OpenSSL 3.0.x with client certificate authentication

     2 details in Everything

360. 3.2.6 Oct 30, 2022 · release notes

     runZero 3.2.6 adds OpenSSL version reporting, Tanium asset detection, and GCP integration improvements

     • Adds OpenSSL version reporting via TLS fingerprinting to network scans
     • Enables detection of Tanium agent instances on the network
     • Improves SSLv3 service detail reporting in scan results
     • GCP integration now returns all assets instead of a subset

     4 details in Everything

361. 3.2.5 Oct 26, 2022 · release notes

     This release adds multi-project GCP credential support for asset import and fixes import reliability for Microsoft Intune and 365 Defender.

     • Adds the ability to configure GCP credentials for importing assets from multiple projects.

     1 detail in Everything

362. 3.2.2 Oct 20, 2022 · release notes

     runZero 3.2.2 adds has_os_eol search keywords to Asset and Vulnerability inventory pages.

     • has_os_eol and has_os_eol_extended search keywords added to Assets and Vulnerabilities inventory pages for filtering assets by operating system end-of-life status.

     1 detail in Everything

363. 3.2.0 Oct 17, 2022 · release notes

     runZero 3.2.0 adds M365/Intune sync, Azure AD optional filtering, and rumblectl diagnostics

     • Adds Microsoft 365 Defender asset sync for runZero Platform customers.
     • Adds Microsoft Intune asset sync for runZero Platform customers.
     • Adds optional import controls to the Azure AD integration for assets, users, and groups.
     • Adds a new diagnostics command to the rumblectl CLI utility.
     • Moves SNMPv2 configuration options to the Probes and SNMP tab in the UI.

     +1 more show less

     • Updates asset details pages to show recent users from Microsoft Intune, SentinelOne, and CrowdStrike.

     6 details in Everything

364. 3.1.13 Oct 11, 2022 · release notes

     runZero 3.1.13 adds all/none column visibility controls and Fortinet fingerprint improvements.

     • Adds all and none options to inventory page column visibility toggles

     1 detail in Everything

365. 3.1.12 Oct 7, 2022 · release notes

     runZero 3.1.12 adds configurable API URL and asset import to Tenable.io, optional AD asset import, and TLS 1.2 enforcement with downgrade support.

     • Adds a configurable api_url setting for the Tenable.io integration
     • Adds optional import of assets, users, and groups in the Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. integration
     • Enforces TLS 1.2 as the minimum for new Active Directory credentials, with a configurable option to support older versions

     3 details in Everything

366. 3.1.7 Sep 29, 2022 · release notes

     runZero 3.1.7 adds os_eol_expired asset search keyword, rumblectl superuser configuration, and fixes import/uptime issues.

     • Adds os_eol_expired as a searchable keyword in the Assets inventory
     • Introduces rumblectl command for self-hosted deployments to configure additional superusers
     • Enables reporting on changed assets via report.changed value in notification rule templates

     3 details in Everything

367. 3.1.6 Sep 27, 2022 · release notes

     runZero 3.1.6 adds email notifications for non-recurring Org Overview reports and negative relative time searches.

368. 3.1.5 Sep 22, 2022 · release notes

     runZero 3.1.5 adds directory user/group change tracking and stops importing Managed Service accounts as assets

     • The task change report schema now supports changes to directory users and groups
     • Shodan services no longer go missing
     • runZero no longer imports Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Managed Service accounts as assets

     3 details in Everything

369. 3.1.4 Sep 19, 2022 · release notes

     runZero 3.1.4 improves asset export performance and adds group_count to users search.

     • Asset exports with many subnets now perform better.

     1 detail in Everything

370. 3.1.1 Sep 13, 2022 · release notes

     runZero 3.1.1 improves inventory screen load times and adds group-based user filtering.

     • Users page supports the has_group search keyword for filtering users by group membership

     1 detail in Everything

371. 3.1.0 Sep 12, 2022 · release notes

     runZero 3.1.0 adds asset sync from Shodan, Azure AD, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., plus connector task offloading to Explorers.

     • Sync assets from Shodan for runZero Platform customers
     • Sync assets from Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. for runZero Platform customers
     • Sync assets from Microsoft Active Directory via LDAP for runZero Platform customers
     • Connector tasks can now optionally run from an Explorer on a customer’s network

     4 details in Everything

372. 3.0.20 Sep 7, 2022 · release notes

     runZero 3.0.20 introduces detection of previously skipped minimal assets.

     • runZero no longer skips minimal assets during discovery.

     1 detail in Everything

373. 3.0.15 Sep 1, 2022 · release notes

     runZero 3.0.15 improves organization token handling and fingerprinting.

     • Certain organization and export tokens now work.

     1 detail in Everything

374. 3.0.14 Aug 31, 2022 · release notes

     runZero 3.0.14 adds CrowdStrike filter, improves Qualys connector, and changes Alert/Password defaults

     • Adds optional filtering to the CrowdStrike connector
     • Improves performance of the Qualys connector

     2 details in Everything

375. 3.0.12 Aug 29, 2022 · release notes

     runZero 3.0.12 adds task stats to CSV exports, license-limit-exceeded event alerts, and ldap.notes service attribute

     • csv exports now include task statistics for asset counts
     • license-limit-exceeded event alerts when live asset count exceeds account license
     • ldap.notes service attribute provides user-friendly representations of discovered LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. OIDs

     3 details in Everything

376. 3.0.10 Aug 22, 2022 · release notes

     runZero 3.0.10 adds filtering logic to the Tenable integration for asset lifecycle management and corrects internal metric event generation.

     • The Tenable integration now excludes terminated and deleted assets from scans
     • Reports for specific asset attributes now work

     2 details in Everything

377. 3.0.9 Aug 19, 2022 · release notes

     Dashboard metrics now include unscanned assets from third-party integrations.

378. 3.0.5 Aug 12, 2022 · release notes

     runZero 3.0.5 improves Qualys integration timeout and stability for offline self-hosted deployments.

     • The Qualys connection task timeout increases from 60 seconds to 5 minutes
     • Offline self-hosted platform updates no longer fail

     2 details in Everything

379. 3.0.0 Aug 8, 2022 · release notes

     runZero 3.0 introduces Qualys VMDR sync, asset merging API, custom DrayTek detection, and performance improvements.

     • Adds Qualys VMDR synchronization for asset and vulnerability data to runZero Platform customers
     • Adds merge capability to the Organization API for asset merging
     • Adds a new custom query to detect DrayTek Vigor routers
     • Enables filtering Asset and Service attributes reports by Site

     4 details in Everything

380. 3.0.1 Aug 8, 2022 · release notes

     runZero 3.0.1 adds runZero as an inventory search asset source type

381. 2.15.7 Jul 26, 2022 · release notes

     runZero 2.15.7 adds software populating from Rapid7 imports, Censys service population, and improved NetBIOS Domain Controller detection.

     • Rapid7 imports now populate software inventories on assets
     • Censys data ingestion now populates the services field for discovered hosts
     • NetBIOS scans now detect and report Domain Controller roles
     • Vulnerability details are displayed directly in the Vulnerability Inventory screen

     4 details in Everything

382. 2.14.10 Jul 1, 2022 · release notes

     runZero 2.14.10 adds Nessus import API endpoint, boolean search in Vulnerabilities table, and date range queries on Tenable/Nessus attributes.

     • Adds GET /api/v1/nessus/import endpoint for importing Nessus scans via API
     • Enables boolean search terms in the Vulnerabilities table UI

     2 details in Everything

383. 2.14.7 Jun 24, 2022 · release notes

     runZero 2.14.7 introduces Rocky Linux support for self-hosted deployments and improves fingerprinting accuracy for Nokia SR OS and Cisco RV routers.

384. 2.14.6 Jun 23, 2022 · release notes

     runZero 2.14.6 adds Account API scan template management, new service discovery, and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. address filtering.

     • Adds scan_template resources to the Account API for programmatic scan configuration
     • Extends the scan engine to discover Elasticsearch, Logstash, and Prometheus services
     • Enables CIDR notation in Query address keywords

     3 details in Everything

385. 2.14.5 Jun 16, 2022 · release notes

     runZero 2.14.5 adds TLS cert attributes to scan engine results, faster Explorer startup with macOS org transfer fixes, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. setup simplification.

     • Adds additional TLS certificate attributes to scan engine results for deeper visibility
     • Skips IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-provided encryption certificates during SSO configuration to streamline setup
     • Improves Explorer initialization speed and eliminates startup timeouts for faster deployment

     3 details in Everything

386. 2.14.4 Jun 15, 2022 · release notes

     runZero 2.14.4 adds Tenable unscanned asset import, TLS self-signed cert flags, and new report types

     • Tenable integration now supports importing unscanned assets via a configurable option (disabled by default)
     • Scan engine now flags TLS services with self-signed certificates and untrusted CAs
     • New software and vulnerabilities reports are available in the UI

     3 details in Everything

387. 2.14.3 Jun 10, 2022 · release notes

     runZero 2.14.3 adds hosted zone inventory search and Explorer list to task config

     • Enables rumble customers to filter inventory by hosted zone for faster threat hunting in DNS-heavy environments.

     1 detail in Everything

388. 2.14.2 Jun 7, 2022 · release notes

     runZero v2.14.2 adds persistent asset column ordering, correct Tenable.io/Nessus import dates, and extended hosted scan duration.

     • Adds persistent column selection and ordering for asset inventory queries
     • Adds additional validation logic for Hosted scan targets and Tenable.io credentials

     2 details in Everything

389. 2.14.0 Jun 6, 2022 · release notes

     runZero 2.14 adds Rumble-hosted Explorer scans, Tenable.io sync, Azure Function Apps import, and ServiceNow subnet tag export.

     • Rumble-hosted Explorers are now available for Rumble Enterprise customers to execute scans from Rumble's infrastructure
     • New sync capabilities ingest asset, software, and vulnerability data from the Tenable.io API and upload Nessus scan files
     • Azure integration now imports Azure Function Apps assets
     • ServiceNow integration exports asset subnet tags

     4 details in Everything

390. 2.13.7 May 27, 2022 · release notes

     runZero 2.13.7 increases cloud scan size limit to 10GiB and improves software search.

391. 2.13.6 May 24, 2022 · release notes

     runZero v2.13.6 adds ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. and country exclusion fields to scans/locations and per-org non-global credential management.

     • asn4:<id> and country4:<2-letter ISO code> values now accepted in scan and site scope/exclusion fields
     • Single organization administrators can manage non-global credentials for their organization
     • Organization Overview report now includes asset tags when available

     3 details in Everything

392. 2.13.4 May 19, 2022 · release notes

     runZero 2.13.4 adds observed_at, extended_service_name, perspective_id, source_ip fields to Censys integration data.

393. 2.13.0 May 9, 2022 · release notes

     runZero 2.13 adds cross-org asset aggregation and expands AWS/Azure/GCP integration scopes.

     • Adds aggregate asset views across all organizations in the dashboard and asset inventory
     • Extends the AWS integration to import Lambda instances
     • Extends the Azure integration to import load balancers and AzureSQL instances
     • Extends the GCP integration to import load balancers and CloudSQL instances
     • Replaces system cronjobs with an in-process task scheduler for maintenance tasks in self-hosted installations

     5 details in Everything

394. 2.12.11 May 2, 2022 · release notes

     runZero 2.12.11 adds software inventory tracking for Rumble inventory and expands cloud integration coverage for AWS and Azure.

     • Rumble inventory now tracks software associated with assets.
     • Rumble Enterprise customers can sync asset and software data from the SentinelOne API.
     • The AWS integration now imports RDS instances.
     • The Azure integration now imports scale set virtual machines.
     • AWS credentials for STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. assume role workflows now require only a role name.

     +1 more show less

     • When creating a credential, you can now toggle whether all organizations can access it.

     6 details in Everything

395. 2.12.10 Apr 19, 2022 · release notes

     runZero 2.12.10 introduces bulk tag management capabilities through the API endpoint and significantly reduces load times for RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. coverage reporting.

     • Adds bulk apply, update, and delete operations for tags via the API
     • Improves performance of the RFC 1918 Coverage Report

     2 details in Everything

396. 2.12.9 Apr 18, 2022 · release notes

     runZero v2.12.9 adds geo/ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. tagging for external assets and enables CrowdStrike/Miradore integrations as scan probes.

     • Assets with external IP addresses now receive tags for their geographic location and ASN when available
     • The CrowdStrike and Miradore integrations can now run as scan probes from the console and scanner CLI

     2 details in Everything

397. 2.12.7 Apr 14, 2022 · release notes

     runZero 2.12.7 adds scheduled Organization Overview reports and effective access in the users table.

     • Organization Overview report now supports email delivery on a recurring schedule
     • Organization users table now displays effective_access for each user

     2 details in Everything

398. 2.12.6 Apr 12, 2022 · release notes

     runZero 2.12.6 adds CrowdStrike task data export and syslog truncation configuration.

     • The CrowdStrike integration now generates downloadable task data that you can use to import CrowdStrike assets.
     • You can now truncate syslog to a specified line length.

     2 details in Everything

399. 2.12.4 Apr 7, 2022 · release notes

     runZero 2.12.4 allows scanning from templates and fixes multi-site dashboard stats.

     └──▷ HOW TO FIND IT
     Initiate a new scan based on a previous configuration via CLI.
     📍rumblectl update
     • Scan menu adds option to start a new scan using an existing template
     • Reports for certain AWS attributes no longer show empty results
     • Stale SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. credentials are no longer associated with assets
     • rumblectl update command now applies content updates in self-hosted deployments

     4 details in Everything

400. 2.12.3 Apr 6, 2022 · release notes

     runZero 2.12.3 adds AWS account email tagging to connectors, exposes Organization Overview in Rumble Professional, and improves fingerprinting.

     • Adds AWS account email tag to each instance in the AWS connector
     • Makes the Organization Overview report visible in Rumble Professional

     2 details in Everything

401. 2.12.0 Apr 4, 2022 · release notes

     runZero 2.12.0 adds GCP integration, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. scanning, scan templates, and external user invites

     • Adds Google Cloud Platform integration for cloud asset discovery
     • Enables Kerberos and LDAP protocol support in the scan engine
     • Adds Scan Templates for reusable scan configurations
     • Allows inviting external users to the cloud console
     • Adds print-friendly Organization Overview report

     5 details in Everything

402. 2.11.16 Mar 29, 2022 · release notes

     runZero 2.11.16 introduces exact attribute matching for more precise scanning targets

     • Exact = attribute matches are now supported

     1 detail in Everything

403. 2.11.15 Mar 28, 2022 · release notes

     runZero 2.11.15 adds support for import scans larger than 4GiB.

     • Increases the maximum size of scan imports to more than 4GiB for self-hosted instances.

     1 detail in Everything

404. 2.11.10 Mar 19, 2022 · release notes

     runZero 2.11.10 adds fingerprint improvements to enhance asset identification capabilities

     • Enhances the tool's fingerprinting engine for better asset identification

     1 detail in Everything

405. 2.11.5 Mar 15, 2022 · release notes

     runZero 2.11.5 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login event recording and {{organization.name}} in alert templates.

     • The self-hosted CLI now supports setting the superuser role and resetting MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone..
     • You can now use {{organization.name}} in certain organization alert templates.
     • Login events now display in the Events view.

     3 details in Everything

406. 2.11.3 Mar 11, 2022 · release notes

     rumblectl set-role supports superuser, reset resets MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., and Asset CSV import width increases to 16,384 chars.

     • rumblectl set-role command now supports setting the superuser role for self-hosted servers.
     • rumblectl reset command now resets the MFA token for self-hosted servers.
     • Asset CSV import cell width limit increased to 16,384 characters.

     3 details in Everything

407. 2.11.4 Mar 11, 2022 · release notes

     runZero 2.11.4 expands alert rule queries to include integration-discovered assets and adds ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. spoofing protection

     • Alert rule queries now account for assets found through integrations

     1 detail in Everything

408. 2.11.2 Mar 10, 2022 · release notes

     runZero 2.11.2 adds Network Switch report launch, subnet tag hover descriptions, API performance boosts, and fixes SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. default behavior.

     • Adds ability to launch the Network Switch report directly from the reports page
     • Adds subnet tag descriptions visible on hover in the Asset inventory
     • Improves API response speed when exporting assets

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The SNMP probe no longer defaults to the community strings public,private when no communities are provided.
409. 2.11.0 Mar 7, 2022 · release notes

     runZero 2.11.0 adds Azure/AWS integration capabilities, Outlier tracking, JDWP detection, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. v1 support, and new Config/API surfaces.

     • Adds RUMBLE_CONSOLE environment variable to set the Explorer console URL
     • Introduces Outlier Summary and Specific Outlier reports for Enterprise Edition customers
     • Adds group management support to the Account API
     • Enables SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. attribute rule-based user-to-group mapping for Enterprise Edition
     • Supports session tokens in AWS integration configuration

     +10 more show less

     • Adds Azure integration running as a probe from the console, Explorer, or scanner
     • Creates a site per subscription ID in the Azure integration
     • Creates a site per account in the AWS integration (in addition to VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.)
     • Tracks clientID, tenantID, and subscriptionID as attributes for Azure assets
     • Adds support for full SNMP v1 enumeration using non-bulk lookups in the scan engine
     • Adds detection for Java Debug Wire Protocol (JDWP) in the scan engine
     • Adds support for Lantronix device discovery protocol in the scan engine
     • Uses Qualys Cloud Agent correlation IDs for asset correlation
     • Adds generate-certificate command to the self-hosted platform
     • Exports dashboard stats to CSV via new export links

     15 details in Everything

410. 2.10.6 Feb 24, 2022 · release notes

     runZero v2.10.6 adds CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. address support to the default site scan scope and improves fingerprinting.

     • Fingerprint improvements.

     1 detail in Everything

411. 2.10.4 Feb 17, 2022 · release notes

     runZero 2.10.4 adds OS EOL dates for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence., Fedora, and CentOS

412. 2.10.3 Feb 15, 2022 · release notes

     runZero v2.10.3 moves the asset route pathing report out of beta with fingerprint improvements.

413. 2.10.2 Feb 11, 2022 · release notes

     runZero 2.10.2 adds Account API group management endpoints and AWS session token support

     • Adds AWS integration support for provided session tokens
     • Adds search keywords for primary and secondary addresses in asset and service search

     2 details in Everything

414. 2.10.0 Feb 7, 2022 · release notes

     runZero 2.10.0 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. user groups, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. link-local discovery, AWS asset sync, and query export enhancements.

     • Adds user group support to the team page for managing permissions/roles across users
     • Enables IPv6 link-local asset discovery and PTR lookups for DNS/mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. probes
     • Allows syncing AWS assets from a standalone scanner or as a scan probe in the console, plus importing from previous AWS connector tasks
     • Adds an Updated column showing last-modified date and time to the queries page
     • Enables query execution across all assets regardless of alive status on the queries page

     +1 more show less

     • Includes asset subnet tags in JSON and XML asset exports

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Invited users no longer skip the initial SSO login when joining an organization that requires SSO
415. 2.10.1 Feb 7, 2022 · release notes

     runZero 2.10.1 updates HTTP scanner to capture images correctly

416. 2.9.14 Jan 28, 2022 · release notes

     runZero 2.9.14 enables asset Modify rules to update HW fields and displays services after third-party imports

     • Asset Modify rules can now update the HW field
     • Services now display after a third-party import

     2 details in Everything

417. 2.9.13 Jan 27, 2022 · release notes

     runZero 2.9.13 adds Censys Avro file conversion and fingerprinting improvements.

     • Adds the ability to convert Censys Avro files into a database format for faster lookups
     • Improves asset fingerprinting accuracy and coverage

     2 details in Everything

418. 2.9.8 Jan 14, 2022 · release notes

     runZero 2.9.8 adds selective asset export, recurring task hourly scheduling, and rule execution status in the UI.

     • Adds ability to export only selected assets, services, or wireless devices from the UI
     • Adds Every N Hours frequency option for recurring tasks
     • Adds autocomplete search for Organizations, Tasks, and Events
     • Adds last processed time, trigger status, and error details to Rules view
     • Adds site filter to the coverage report

     5 details in Everything

419. 2.9.7 Jan 10, 2022 · release notes

     runZero 2.9.7 adds SSH username and reverse DNS timeout configuration, scan tag support on imports, and CrowdStrike asset matching

     • scanner now accepts configuration for ssh_username and reverse DNS timeouts.
     • Scan import tasks now accept scan_tags.
     • JSON exports no longer include the closedPortsMap field (data reduction).

     3 details in Everything

420. 2.9.4 Dec 21, 2021 · release notes

     runZero 2.9.4 enhances query usability with persistent result counts and accelerates Censys data ingestion without altering core detection or integration capabilities.

     • Query search now supports result count selection and remembers the setting between views
     • Censys AVROAVROA row-oriented data serialization format maintained by Apache, using JSON-defined schemas bundled with the data so tools can read it without out-of-band schema management. importer is now 4 to 8 times faster

     2 details in Everything

421. 2.9.1 Dec 8, 2021 · release notes

     CrowdStrike integration switches to Scroll API for large orgs.

422. 2.9.0 Dec 6, 2021 · release notes

     runZero 2.9.0 adds Site Comparison reports, bulk user import on team page, and search filter to layer 2 topology.

     • Adds Site Comparison report showing asset differences between two sites (even across organizations).
     • Adds bulk user import and bulk permission management capabilities to the team page.

     2 details in Everything

423. 2.8.14 Dec 3, 2021 · release notes

     runZero scans now execute when non-loopback 127.x networks are present

     • Enables scan execution when non-loopback 127.x networks are detected in the environment

     1 detail in Everything

424. 2.8.11 Nov 19, 2021 · release notes

     runZero 2.8.11 introduces the annotator role and fingerprinting improvements.

     • The annotator role is now available for user assignment.

     1 detail in Everything

425. 2.8.10 Nov 18, 2021 · release notes

     runZero 2.8.10 adds self-hosted Azure connector mode and improves TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. traceroute accuracy.

426. 2.8.9 Nov 16, 2021 · release notes

     runZero 2.8.9 adds single IP/range credential configs and traceroute on open TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports

     • Allows configuring credentials for single IP addresses and IP ranges in addition to existing CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. support
     • Scan engine now performs a light traceroute when an open TCP port is found
     • Scan engine tests for IP forwarding during scans of link-local targets

     3 details in Everything

427. 2.8.8 Nov 12, 2021 · release notes

     runZero 2.8.8 adds custom CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. headers for external resources, expands tag handling, and enhances CrowdStrike integration.

     • Adds support for configuring custom Content-Security-Policy (CSP) headers for external resources in the self-hosted platform
     • Enhances tag processing so case-insensitive tags with key name are treated as additional hostnames
     • Ensures tags containing spaces consistently convert those spaces to underscores during processing
     • Updates CrowdStrike integration to track the last 10 recent logins per asset

     4 details in Everything

428. 2.8.6 Nov 6, 2021 · release notes

     runZero adds OS fingerprinting support for tvOS, homepodOS, and bridgeOS in v2.8.6

429. 2.7.10 Oct 24, 2021 · release notes

     runZero 2.7.10 adds VMware discovery, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. credential management, SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. TLS fingerprints, and a Credentials scan tab.

     • Adds VMware vCenter/ESXi virtual machine discovery (Enterprise)
     • Reports TLS fingerprints as SHA256 hashes (base64)
     • Enables global management of SNMP v2/v3 and VMware credentials
     • Adds a Credentials tab to scan configuration
     • Allows downloading detailed task logs

     5 details in Everything

430. 2.7.7 Oct 15, 2021 · release notes

     runZero 2.7.7 adds Debian 9 support for self-hosted platforms and detailed Azure credential logging.

     • The self-hosted platform now supports Debian 9.

     1 detail in Everything

431. 2.7.8 Oct 15, 2021 · release notes

     runZero 2.7.8 introduces RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. scan capabilities via the main menu and ensures Windows service auto-start.

     • Enables launching RFC 1918 scans directly from the main Scan menu
     • Explicitly sets the runZero Explorer on Windows to automatic start

     2 details in Everything

432. 2.7.4 Oct 8, 2021 · release notes

     runZero 2.7.4 adds Oracle Linux 7/8 support to self-hosted platform and fingerprint improvements

433. 2.7.0 Oct 5, 2021 · release notes

     runZero 2.7.0 adds multi-subscription Azure, ELB support, detailed TLS config, wildcard search, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. domain features.

     • Adds multi-subscription and multi-directory access for the Azure VM connector to import assets from multiple tenants
     • Adds ELB load balancer import capability to the AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. connector so they appear as discoverable assets
     • Enables automatic validation of connector credentials on save across all integrations to catch errors earlier
     • Allows self-hosted Splunk add-on consoles to be configured via custom endpoints instead of only cloud URLs
     • Adds optional import of asset services in the Splunk add-on to enrich imported inventory data

     +22 more show less

     • Improves CrowdStrike asset merging accuracy when correlating devices across scans
     • Includes Explorer and scanner binaries directly in the self-hosted installer package for easier deployment
     • Adds detailed TLS configuration options in the self-hosted console interface for granular security control
     • Runs the self-hosted console as an isolated subprocess to improve stability and resource management
     • Removes API rate limits enforced on the self-hosted console by default to allow unrestricted internal polling
     • Shows asset and service trend charts directly on the main dashboard for better visibility into network changes
     • Provides a simplified, redesigned interface for the Scan configuration view to reduce setup time
     • Tracks imported scans in the RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. coverage report to give complete visibility into private network usage
     • Supports new address-related search keywords in the Services inventory for more precise filtering
     • Adds wildcard hostname searches with anchored patterns in the Assets and Services inventories for flexible discovery
     • Converts standard SSO-authenticated accounts to SSO-only accounts upon login to enforce identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. control
     • Enables SSO configuration for multiple domains using IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. or SP initiated authentication methods
     • Adds a Retry button to the MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. challenge interface for Safari users requiring user interaction
     • Separates token and platform authentication modes in the MFA enrollment settings for clearer policy application
     • Allows Admin users to manually set first and last names for other users directly in the console
     • Signs Explorers, scanners, MSI wrapper, and verifier with a new EV certificate for enhanced trust
     • Includes subnet ping and host ping capabilities in the Professional tier scan configurations
     • Adds Windows 10 and APC firmware to OS EOL tracking alerts for lifecycle management
     • Enables range-based tracking for Windows 10 and Server 2019 OS versions instead of specific builds
     • Detects and reports an error when the Explorer or CLI scanner is run within WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host./WSL2WSL2A Microsoft-maintained compatibility layer in Windows 10/11 that runs a real Linux kernel inside a lightweight VM, letting cyber tools built for Linux execute natively on Windows without dual-booting or a full VM. environments
     • Adds the –force option to the CLI scanner upgrade command to bypass standard checks during updates
     • Adds detection for Bitdefender antivirus in remote scans to identify security software presence

     27 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Standard accounts that authenticate using SSO are now automatically converted to SSO-only accounts upon login.
434. 2.7.1 Oct 5, 2021 · release notes

     runZero 2.7.1 adds collapsible sidebar and AWS task updates

     • Adds collapsible sidebar controlled by chevron icon in UI navigation
     • Allows updating existing AWS tasks directly

     2 details in Everything

435. 2.6.3 Sep 16, 2021 · release notes

     runZero 2.6.3 adds WSMAN, ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control., and InfluxDB service detections.

     • Scan engine now detects WSMAN, ADB, and InfluxDB services.

     1 detail in Everything

436. 2.6.4 Sep 16, 2021 · release notes

     runZero 2.6.4 adds detection of Azure's OMI WSMAN implementation and improves fingerprinting.

437. 2.6.0 Sep 7, 2021 · release notes

     runZero v2.6.0 adds Azure VM sync, offline self-hosted mode, NFS/PPTP discovery, and OS EOL tracking

     • Adds Microsoft Azure cloud support for syncing virtual machine inventory in Rumble Enterprise
     • Enables offline mode and offline updates for the self-hosted version of Rumble
     • Adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 7 support for offline mode in the self-hosted version
     • Surfaces NFS exports via discovered mountd services in the scan engine
     • Returns details for discovered PPTP services in the scan engine

     +1 more show less

     • Tracks OS end-of-life dates for Windows, macOS, Ubuntu, Debian, and iLO assets

     6 details in Everything

438. 2.5.8 Aug 30, 2021 · release notes

     runZero 2.5.8 adds PPTP service detection, third-party asset expiration, and fingerprint improvements.

     • Scan engine now reports PPTP services
     • Stale asset expiration applies to third-party sourced assets

     2 details in Everything

439. 2.5.7 Aug 27, 2021 · release notes

     runZero 2.5.7 adds CrowdStrike connector merge logic and NFS export discovery.

     • Adds improved merging logic to the CrowdStrike connector to avoid duplicate assets
     • Enables the scan engine to report NFS exports during asset discovery

     2 details in Everything

440. 2.5.6 Aug 23, 2021 · release notes

     runZero adds Cisco L2 traceroute scanning, HTTP/2 asset reporting, and removes H.323 port from defaults in v2.5.6

     • Adds Cisco layer 2 traceroute protocol support to the scan engine for discovering network topology.
     • Reports HTTP/2 protocol detection at the asset level for more accurate service fingerprinting.

     2 details in Everything

441. 2.5.4 Aug 19, 2021 · release notes

     runZero 2.5.4 adds Windows arm64 support to Explorer and scanner, fixes DCERPC probe hangs.

442. 2.5.5 Aug 19, 2021 · release notes

     runZero 2.5.5 restores the service attribute report and adds SSH attribute collection.

     • The scan engine now collects and reports additional SSH attributes.

     1 detail in Everything

443. 2.5.3 Aug 18, 2021 · release notes

     runZero 2.5.3 adds third-party data attributes to exports and @source.type search syntax.

444. 2.5.2 Aug 12, 2021 · release notes

     runZero v2.5.2 expands automatic queries to Professional users, improves Windows/CrowdStrike asset accuracy and protocol detection.

     • Automatic queries are now available to Professional users as well as Enterprise
     • Scanner skips active protocol detection on port 9999
     • CrowdStrike assets are now matched more accurately against Rumble assets

     3 details in Everything

445. 2.5.0 Aug 3, 2021 · release notes

     runZero 2.5.0 adds AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. multi-account STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. sync, CrowdStrike Falcon asset ingestion, DCERPC detection, and Unmapped MAC report.

     • Adds AWS EC2 asset synchronization across accounts via STS roles for Rumble Enterprise customers
     • Adds asset data synchronization from the CrowdStrike Falcon API for Rumble Enterprise customers
     • Adds DCERPC-based detection for Windows workstation/server differentiation and multi-homed assets
     • Adds Unmapped MAC report showing unscanned assets by switch port
     • Adds dashboard stats scoped to all sites or a specific site

     5 details in Everything

446. 2.4.4 Jul 26, 2021 · release notes

     runZero 2.4.4 introduces the superuser default role for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and enhances scanning coverage by adding data gathering from the Windows DCERPC endpoint mapper.

     • Gathers data from the Windows DCERPC endpoint mapper to improve network fingerprinting accuracy.

     1 detail in Everything

447. 2.4.2 Jul 14, 2021 · release notes

     runZero 2.4.2 adds Fortinet ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. topology graphs and PNG export for Topology/Network Bridges views

     • Adds limited layer-2 topology graphs derived from ARP data for environments using Fortinet switches.
     • Enables exporting the Topology and Network Bridges graphs as PNG images.

     2 details in Everything

448. 2.4.0 Jul 13, 2021 · release notes

     runZero 2.4.0 adds AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and Miradore asset sync, self-hosting on RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence./CentOS, and account-level credential management.

     • Rumble Enterprise customers can now sync asset data from Amazon Web Services EC2 and Miradore MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. data sources.
     • Rumble Enterprise customers can now self-host the platform on RHEL and CentOS distributions.
     • Credentials are now managed at the account level with per-organization access.

     3 details in Everything

449. 2.3.5 Jul 4, 2021 · release notes

     runZero 2.3.5 improves Explorer performance and stability during active scans.

     • Subnet ping mode no longer misses subnets during large scans
     • Explorers no longer show as offline unexpectedly

     2 details in Everything

450. 2.3.2 Jun 16, 2021 · release notes

     runZero v2.3.2 adds date filtering to RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. report and search/sort/bulk actions on the Team page.

     • RFC 1918 coverage report now supports a starting date parameter to exclude older scans

     1 detail in Everything

451. 2.3.0 Jun 8, 2021 · release notes

     runZero 2.3.0 adds RFC 1918RFC 1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. coverage reporting and SNMPv3 per-VLAN enumeration for Cisco Catalyst switches.

     • Adds the new RFC 1918 coverage report showing unscanned address space and hinted ranges.
     • Enables SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. v3 enumeration of Cisco Catalyst switches to handle per-vlan port mappings.

     2 details in Everything

452. 2.2.3 May 17, 2021 · release notes

     runZero v2.2.3 adds multi-event triggers, agent fields in scan events, and new device detection.

     • Multiple notifications can now trigger from a single event
     • The scan-started event now includes agent fields
     • The scan engine now pulls layer-2 information from Force-10 switches
     • The scan engine now extracts hostnames from Zyxel switches

     4 details in Everything

453. 2.2.2 May 16, 2021 · release notes

     runZero 2.2.2 adds Zyxel switch info extraction and sorting/searching/tagging on the Explorers page

     • The scan engine now extracts additional information from Zyxel switches.

     1 detail in Everything

454. 2.2.1 May 14, 2021 · release notes

     runZero 2.2.1 adds SNMPv3 hash/encryption support and self-hosted user management CLI.

     • The scan confirmation dialog now warns when the scope mixes public and private IPs.
     • The SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. v3 probe now supports sha224, sha256, sha384, and sha512 authentication.
     • The SNMP v3 probe now supports aes192, aes256, aes192c, and aes256c encryption.
     • The self-hosted platform now includes a CLI to manage user accounts.

     4 details in Everything

455. 2.2.0 May 11, 2021 · release notes

     runZero 2.2.0 adds HP iLO hardware export, virtual machine vendor filtering, hostname tag support, RUMBLE_TLS_ADDITIONAL_ROOTCA env var, and Minecraft server detection.

     • Adds RUMBLE_TLS_ADDITIONAL_ROOTCA environment variable to configure additional CA roots for self-hosted Explorer instances
     • Allows setting a preferred hostname for any asset using the new Name tag
     • Enables search and filtering of virtual machines by their virtualization vendor in inventory views
     • Exports HP iLO hardware reports with serial numbers and physical details via the web console for enterprise customers
     • Adds identification and detection of Minecraft servers on the network

     5 details in Everything

456. 2.1.7 May 3, 2021 · release notes

     runZero 2.1.7 adds HP iLO warranty CSV export, VLAN tracking, and clickable tags in the web console.

     • Adds VLAN tracking on each asset where possible
     • Makes Tags clickable to open inventory searches directly from the asset view

     2 details in Everything

457. 2.1.5 Apr 27, 2021 · release notes

     runZero 2.1.5 adds HP iILO data collection in Explorer and CLI.

     • The runZero Explorer collects additional information from HP iLO nodes
     • The runZero CLI collects additional information from HP iLO nodes

     2 details in Everything

458. 2.1.3 Apr 23, 2021 · release notes

     runZero 2.1.3: SunRPC probe filtering, Pulse Secure fingerprinting fix, and dashboard onboarding guidance

     • runZero Explorer fingerprints the latest Pulse Secure VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. firmware correctly again.

     1 detail in Everything

459. 2.1.2 Apr 19, 2021 · release notes

     runZero 2.1.2 adds Minecraft service detection and requires typed confirmation for permanent actions.

     • runZero Explorer and runZero CLI now detect the Minecraft service
     • Confirmation dialogs require a typed response for permanent actions

     2 details in Everything

460. 2.1.0 Apr 13, 2021 · release notes

     runZero 2.1.0 adds JSON notifications, CSV/JSON task export, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port exclusion, and SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. community indexing

     • Adds text, html, and json formats for custom notification templates in the web console
     • Allows arbitrary HTTP headers in webhook notification channels for authentication
     • Enables exporting tasks as csv and json from the Recurring and Search tabs of the task view
     • Allows bulk removal of tags by specifying -tag in the inventory Tag dialog
     • Adds ability to exclude specific TCP ports in the scan configuration

     +2 more show less

     • Enables exporting device serial numbers in cisco smart net total care format for warranty checks
     • Adds automatic community indexing for snmp v2 enumeration of ports and vlan membership

     7 details in Everything

461. 2.0.11 Apr 1, 2021 · release notes

     runZero 2.0.11 improves fingerprinting accuracy for asset identification.

     • Improves fingerprint logic and data sources to increase accuracy of device identification.

     1 detail in Everything

462. 2.0.10 Mar 30, 2021 · release notes

     runZero 2.0.10 adds expanded Cisco SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. OIDs and Serial Number export availability.

     • Expands Cisco-specific SNMP OID collection in both the runZero Explorer and runZero CLI
     • Makes Cisco Serial Number export available for all licensed clients

     2 details in Everything

463. 2.0.8 Mar 29, 2021 · release notes

     runZero Explorer now auto-cleans temp files from interrupted scans and prefixes them with rumble-

     • The runZero Explorer now automatically cleans temporary files left by interrupted scans.
     • The runZero Explorer now prepends rumble- to all temporary files.

     2 details in Everything

464. 2.0.6 Mar 28, 2021 · release notes

     runZero 2.0.6 adds pre-scan disk space checks and more resilient error reporting for scans.

     • runZero Explorer performs a disk space check before running a new scan
     • Asset CSV imports now accept records with extra fields

     2 details in Everything

465. 2.0.3 Mar 23, 2021 · release notes

     runZero 2.0.3 adds agent-removed and task-failed event generation for agents in the web console.

     • The web console now generates agent-removed events for each agent, including for bulk actions
     • The web console now generates task-failed events for agent restarts and timeouts

     2 details in Everything

466. 2.0.0 Mar 16, 2021 · release notes

     runZero 2.0 adds Rules Engine, full self-hosting, expanded Account API, and ServiceNow integration endpoints.

     • Rules Engine enables advanced alerts and automated asset updates via the Web console
     • Full platform self-hosting is now supported for deployment
     • Organization-level Alerts are managed at the global level
     • The Explore menu item is renamed to Reports in the UI
     • Account API provides organization, user, and event management endpoints

     +1 more show less

     • Three new API endpoints support ServiceNow ITOM integration

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Explore menu item is renamed to Reports, changing UI navigation paths.
     • !Organization-level Alerts are now managed at the global level, altering alert scoping behavior.
467. 1.16.2 Feb 24, 2021 · release notes

     runZero 1.16.2 introduces explorer tagging for organization and ensures continuous event data from offline agents.

468. 1.16.1 Feb 21, 2021 · release notes

     runZero 1.16.1 adds Rumble scan engine controls for TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit., ping modes, port reporting, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. macOS support

     • Adds maximum Time-To-Live (TTL) configuration for Rumble scan traffic to control packet lifetime.
     • Introduces subnet ping and host ping modes in the Rumble scan engine for targeted network discovery.
     • Improves Rumble scan traffic distribution across subnets for more even load balancing.
     • Enables reporting and tracking of closed TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports in Rumble scan results for deeper visibility.
     • Adds additional ICMP field reporting in Rumble scans to provide richer host data.

     +2 more show less

     • Automatically scales Rumble scan group size dynamically to optimize performance.
     • Partially supports Apple macOS on ARM systems for broader platform coverage.

     7 details in Everything

469. 1.15.5 Jan 28, 2021 · release notes

     runZero 1.15.5 adds obsolete Npcap warning on Agents page and improves fingerprinting.

     • The Agents page now flags any Windows Agents with an obsolete version of Npcap installed.
     • Fingerprint improvements.

     2 details in Everything

470. 1.15.3 Jan 23, 2021 · release notes

     runZero 1.15.3 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. serial number discovery, TeamViewer/CheckMK detections, and gzip scan imports.

     • Adds snmp device serial number collection to the runZero CLI and Explorer for deeper asset visibility
     • Enables detection of the TeamViewer protocol in network scans to identify remote support software
     • Adds CheckMK service detection capabilities across the runZero CLI and Explorer
     • Allows import of gzip-compressed scan data files directly via the runZero CLI

     4 details in Everything

471. 1.15.2 Jan 19, 2021 · release notes

     runZero 1.15.2 adds dashboard top-5k asset links and per-account Rumble query saving

     • Adds dashboard links to the top 5,000 results for asset types and service details
     • Allows saving Rumble-provided queries as per-account copies that can be modified

     2 details in Everything

472. 1.14.2 Dec 17, 2020 · release notes

     runZero 1.14.2 adds custom probe configuration to site scan API and updates npcap runtime.

     • Site scan API now handles custom probe configurations
     • upgraded runtime used by runZero Explorer and runZero CLI
     • npcap 1.10 integrated into runZero Explorer and runZero CLI

     3 details in Everything

473. 1.14.1 Dec 14, 2020 · release notes

     runZero v1.14.1 introduces automatic agent-to-site assignment via the Manage menu and fixes API scan task probe handling.

     • Adds automatic agent-to-site assignment from the Manage menu to link agents to their connected sites without manual configuration

     1 detail in Everything

474. 1.14.0 Dec 8, 2020 · release notes

     runZero v1.14.0 prioritizes SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. System Description fingerprints for OS detection.

     • SNMP System Description fingerprints now take precedence over SSH-based OS matches.

     1 detail in Everything

475. 1.13.10 Dec 1, 2020 · release notes

     runZero 1.13.10 adds navigable breadcrumbs, standardizes agent-to-cloud hostname to console.rumble.run

     • Breadcrumbs are now navigable across the product user interface.
     • Agent to cloud communication now uses only the console.rumble.run hostname.

     2 details in Everything

476. 1.13.7 Nov 20, 2020 · release notes

     runZero 1.13.7 adds precise device fingerprinting via new mMDNS support for M1 Apple devices.

     • new Supports more precise device detection through the updated fingerprinting engine
     • new Adds mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. fingerprint support specifically for M1-based Apple devices

     2 details in Everything

477. 1.13.6 Nov 19, 2020 · release notes

     Task details page now displays scan speed in the upper left section.

478. 1.13.3 Nov 10, 2020 · release notes

     runZero 1.13.3 adds multi-port BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks. scanning and improved SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./BACnet fingerprinting consistency.

     • The BACnet probe now supports multiple ports per scan
     • Fingerprinting is now more consistent for assets with both SMB v1 and v2 enabled

     2 details in Everything

479. 1.13.2 Nov 8, 2020 · release notes

     runZero 1.13.2 adds configurable session/login timeouts and new Subnet Grid report color modes.

     • Adds configurable session and login timeouts from the Account Settings page

     1 detail in Everything

480. 1.13.1 Nov 5, 2020 · release notes

     runZero 1.13.1 adds an Account Settings page for enforcing MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and blocking support access

     • Adds Account Settings page to enforce multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. (MFA) for user accounts
     • Adds Account Settings page option to block Support access

     2 details in Everything

481. 1.12.9 Oct 25, 2020 · release notes

     runZero 1.12.9 adds automatic decompression of non-negotiated gzip responses for improved fingerprinting.

     • Enables automatic decompression of Content-Encoding: gzip responses that were previously rejected.

     1 detail in Everything

482. 1.12.7 Oct 24, 2020 · release notes

     runZero v1.12.7 adds an organization access tab on the Team page and per-org admin user management via UI

     • Adds an Organization Access tab to the Team page showing users with access to the active organization
     • Enables users with per-organization admin roles to manage user accounts

     2 details in Everything

483. 1.12.6 Oct 22, 2020 · release notes

     runZero 1.12.6 adds granular No Access account management and Billing role scoping

     • Users with the No Access permission can now manage their own account settings.
     • Users can now have a Billing role limited to license and entity management.

     2 details in Everything

484. 1.12.2 Oct 17, 2020 · release notes

     Polished the runZero CLI terminal UI and improved fingerprinting accuracy.

     • Adds a cleaner and more polished terminal user interface for the runZero CLI

     1 detail in Everything

485. 1.12.1 Oct 15, 2020 · release notes

     runZero 1.12.1 adds target range deduplication and fingerprint improvements.

     • The runZero CLI and runZero Explorer now deduplicate overlapping target network ranges.

     1 detail in Everything

486. 1.11.9 Oct 11, 2020 · release notes

     runZero 1.11.9 adds self-upgrade via CLI argument and static MSI installer for Explorer.

     • The runzero CLI now supports the upgrade argument to update itself
     • RunZero Explorer can be installed using a static MSI wrapper

     2 details in Everything

487. 1.11.6 Sep 23, 2020 · release notes

     runZero 1.11.6 adds Viewer role restrictions to specific screens and improves fingerprinting.

     • Restricts Viewer role access to only the Dashboard, Inventory, Explore, and Agents screens
     • Improves Fingerprint engine accuracy

     2 details in Everything

488. 1.11.2 Sep 11, 2020 · release notes

     runZero adds Organizations-to-Projects conversion and updated top-level org navigation in v1.11.2

     • Enables converting Organizations to Projects directly from the settings page.

     1 detail in Everything

489. 1.10.8 Sep 8, 2020 · release notes

     runZero 1.10.8 introduces Projects as temporary organizations and adds 10k+ SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. fingerprints.

     • Adds Projects — temporary, self-deleting organizations for one-off scans
     • Adds over 10,000 new SNMP fingerprints for network device identification

     2 details in Everything

490. 1.10.6 Aug 22, 2020 · release notes

     runZero 1.10.6 adds default compression for raw scan data and links Tasks to inventory search.

     • Raw scan data is now compressed by default in runZero Explorer, CLI, and Console
     • Scanner output file renamed from scan.rumble to scan.rumble.gz
     • Tasks view now links directly to the inventory search for each associated site

     3 details in Everything

491. 1.10.2 Aug 12, 2020 · release notes

     runZero 1.10.2 adds subnet data to site exports/imports and bulk asset updates via CSV import.

     • Site exports and imports now include the registered subnets
     • Update assets in bulk by importing a modified CSV export from the Inventory screen

     2 details in Everything

492. 1.10.0 Aug 4, 2020 · release notes

     runZero 1.10.0 adds console event logs and UI styling updates.

493. 1.9.10 Aug 3, 2020 · release notes

     runZero 1.9.10 adds Scan Tags display to configuration and protocol reporting for DNS/mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. probes

     • Scan Configuration form now shows Scan Tags
     • DNS and mDNS probes now always report the protocol field, even for error responses

     2 details in Everything

494. 1.9.5 Jul 20, 2020 · release notes

     runZero v1.9.5 enables continuous recurring scans on all paid plans with automatic agent upgrades

     • Adds Continuous recurring scans to all paid plans, allowing scans to run back-to-back for simplified monitoring

     1 detail in Everything

495. 1.9.4 Jul 18, 2020 · release notes

     runZero Explorer and CLI add TLS CA root bundle control to fix connectivity on older platforms

496. 1.9.3 Jul 16, 2020 · release notes

     runZero 1.9.3 adds ability to reassign Explorers between organizations and improves uninstall/cleanup.

     • Improves Chrome process cleanup in the web screenshot feature
     • Ensures all agent-related files are removed on uninstall

     2 details in Everything

497. 1.9.2 Jul 12, 2020 · release notes

     runZero 1.9.2 adds fields parameter to Export API for JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. exports.

     • Adds fields parameter to the Export API endpoint to control output columns
     • Supports selective field export for Assets, Services, Wireless, and Sites data

     2 details in Everything

498. 1.8.13 Jul 1, 2020 · release notes

     runZero v1.8.13 adds estimated scan runtime, /8 scanning for trials, SSH banner collection via env/config, and Explorer CLI SSH host key support.

     • Adds estimated_runtime confirmation dialog on the Scan Configuration page to preview job duration before launching a scan
     • Removes the /16 cap for trial accounts, allowing full /8 network scans
     • Enables log configuration in runZero Explorer via environment variables as documented in the linked docs
     • Extends SSH scanning to collect pre-auth banners and host keys in both runZero Explorer and runZero CLI

     4 details in Everything

499. 1.8.12 Jun 24, 2020 · release notes

     runZero 1.8.12 expands PPP link type support and refines fingerprinting logic.

     • Adds wider PPP-based link type handling for network discovery on Linux and macOS
     • Improves fingerprint accuracy by ignoring bogus Fortigate service responses on specific ports

     2 details in Everything

500. 1.8.8 Jun 18, 2020 · release notes

     runZero 1.8.8 adds IP header recording for ICMP Echo probes and favicon MD5 fingerprint database integration

     • ICMP Echo probes now record the IP header information from the response (useful for Ripple20/Treck detection).
     • Rumble contributed its favicon.ico MD5 fingerprint database to the Recog project.

     2 details in Everything

501. 1.8.7 Jun 16, 2020 · release notes

     runZero 1.8.7 adds cooked VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. interface support and enhanced Netgear router fingerprinting

     • The runZero CLI now supports cooked interface types for ppp-based VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.
     • The scan engine extracts additional information from Netgear routers

     2 details in Everything

502. 1.8.2 Jun 9, 2020 · release notes

     runZero 1.8.2 adds UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. to CLI CSV and standalone bridges.json for automation.

     • CLI CSV output now includes populated UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. values
     • CLI creates a standalone bridges.json file for third-party processing

     2 details in Everything

503. 1.7.13 Jun 8, 2020 · release notes

     runZero 1.7.13 adds registered subnet sites, favicon hashing, OpenBSD support, and CLI topology export.

     • Sites now support registered subnets, allowing queries via Site subnet tags
     • Tags can now have empty values for precise Inventory search querying
     • New fingerprinting of assets via favicon.ico hashes
     • The runZero CLI now creates a standalone topology.json file for third-party processing
     • Assets now store the MAC-to-IP relationship in the hidden _macs.ipmap attribute

     +1 more show less

     • runZero Explorer and runZero CLI add support for OpenBSD on x86 (64-bit)

     6 details in Everything

504. 1.7.10 Jun 2, 2020 · release notes

     runZero 1.7.10 adds FreeBSD/NetBSD/DragonFly BSD support, Linux arch expansion, standalone auto-updates, and CLI flags.

     • runZero Explorer and runZero CLI now run on FreeBSD, NetBSD, and DragonFly BSD (x86, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. v5/v6/v7 for FreeBSD/NetBSD; x86 64-bit for DragonFly).
     • runZero Explorer and runZero CLI support additional Linux architectures: x86 (32/64-bit), ARM v5-v7, ARM 64-bit (aarch64), MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. (BE/LE), MIPS64 (BE/LE), PowerPC64 (LE), and s390x.
     • runZero Explorer runs in standalone mode when no supported services backend is detected.
     • Automatic updates for runZero Explorer in standalone mode on non-Windows platforms.
     • New command-line flags -h, -v, -l for runZero Explorer to display usage information.

     5 details in Everything

505. 1.7.9 May 27, 2020 · release notes

     runZero v1.7.9 adds MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. fingerprints for IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure./OT devices, enhanced SQL Server version mapping, and asset confidence scoring.

     • Adds live MAC address fingerprinting for dozens of IoT and OT device manufacturers (Amazon, Google, Honeywell, etc.) as a fallback when other methods fail
     • Adds match.score attribute at the asset level to report OS matching confidence
     • Improves Chromecast fingerprinting to return wireless network service attributes and apply additional IP addresses from the web endpoint

     3 details in Everything