runZero Services

RunZero Services

Overview

RunZero discovers services running on every asset -- open ports, protocols, software versions, and TLS configurations. Service data is critical for vulnerability assessment, compliance auditing, and attack surface management. This skill covers listing, filtering, and analyzing discovered services.

Anti-triggers

• CVE findings. runZero reports what is listening and which version answered — it does not score or track vulnerabilities. Patch prioritisation is sentinelone-vulnerabilities; cloud posture is sentinelone-misconfigurations.
• Firewall rules and port forwarding. An open port here was observed from the explorer's vantage point; the rule that permits it is meraki-security-appliance.
• The machine rather than the listener — use runzero-assets.

Key Concepts

Service Attributes

Each discovered service includes:

Common Protocols

Vulnerability Indicators

RunZero flags services with security concerns:

• Expired or self-signed TLS certificates
• Outdated software versions with known CVEs
• Insecure protocols (Telnet, FTP, SNMPv1)
• Default credentials detected
• Exposed management interfaces

API Patterns

List Services

runzero_services_list

Parameters:

• site_id -- Filter by site
• search -- RunZero query string
• count -- Results per page
• offset -- Pagination offset

Example response:

{
  "services": [
    {
      "id": "svc-uuid-123",
      "asset_id": "asset-uuid-456",
      "port": 3389,
      "transport": "tcp",
      "protocol": "rdp",
      "summary": "Microsoft Terminal Services",
      "software": "Windows RDP 10.0",
      "first_seen": "2026-01-15T10:00:00Z",
      "last_seen": "2026-03-27T08:30:00Z"
    }
  ]
}

Get Service Details

runzero_services_get

Parameters:

• service_id -- The specific service UUID

Export Services

runzero_services_export

Parameters:

• search -- RunZero query to filter services
• site_id -- Filter by site

Use for bulk service data retrieval.

Service Query Examples

protocol:rdp AND alive:true
port:445 AND NOT address:10.0.0.0/8
protocol:ssh AND software:OpenSSH AND software:<8
protocol:telnet
port:443 AND tls.version:TLSv1.0

Common Workflows

Exposed Service Audit

1. Search for high-risk services: protocol:rdp OR protocol:telnet OR protocol:ftp
2. Filter to externally-facing assets if possible
3. Flag services that should not be exposed
4. Generate remediation recommendations

TLS Certificate Audit

1. Search for HTTPS services: protocol:https
2. Check for expired certificates, weak TLS versions
3. Identify self-signed certificates
4. Generate certificate expiry report

Port Scan Summary

1. Export all services for a site
2. Aggregate by port and protocol
3. Count unique assets per service type
4. Identify unexpected or unauthorized services

Vulnerability Surface Analysis

1. Search for services with known vulnerable software versions
2. Cross-reference with CVE databases
3. Prioritize by severity and exposure
4. Generate actionable remediation report

SMB/RDP Exposure Check

1. Search: protocol:rdp OR protocol:smb
2. Identify assets exposing these services
3. Check if any are externally reachable
4. Recommend firewall rules or VPN-only access

Error Handling

Service Not Found

Cause: Invalid service UUID or service no longer detected Solution: Search by port/protocol on the asset instead

Large Result Sets

Cause: Broad queries returning thousands of services Solution: Add site or protocol filters; use the Export API

Best Practices

• Use the Export API for service inventories across large environments
• Focus security audits on high-risk protocols (RDP, SMB, Telnet, FTP)
• Monitor for new services appearing between scans
• Track TLS certificate expiry dates proactively
• Cross-reference discovered services with firewall rules
• Generate per-client service reports for security reviews

Related Skills

• api-patterns - Query language and pagination
• assets - Assets running the services
• sites - Sites containing the services
• tasks - Scans that discover services