runZero

Importer Data Types

• Asset Details Enrichment and Create New in Vantage

  RunZero supplies records including asset hostname, IPs, MAC, vendor, OS guess, product type, site, network organization and last-seen timestamp — to enrich existing Vantage assets and create new asset records for endpoints not yet observed on the OT network.

Joint Use Cases

• Correlating runZero signals with OT network alerts

  When Nozomi Vantage raises an anomaly alert for a device inside an OT segment, the analyst can pivot to the same asset's RunZero record in Vantage to review exposed services, certificate details and recent observation context, all without leaving the Vantage investigation workflow. This cross-layer correlation surfaces whether a network-layer anomaly coincides with activity observed by runZero, reducing the time needed to confirm or dismiss an incident.

• Closing asset inventory gaps across IT and OT

  Devices recorded by RunZero but not yet observed by Nozomi network sensors are automatically created as new asset records in Vantage, populated with external hostname, public IP, services and certificate metadata drawn from the runZero management plane. OT operations teams can audit the resulting unified inventory to identify unmonitored or underprotected assets in industrial and critical infrastructure zones, then prioritize sensor deployment accordingly.

• Reconciling internet-exposed assets with the OT-observed inventory

  Internet-facing assets discovered by RunZero are joined with the internal OT and IT inventory in Vantage, allowing security teams to identify exposure points that touch critical infrastructure and confirm whether each exposed asset is intentional, owned and patched.

Integration Prerequesites