topic Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed in Cortex XDR Discussions

Best way to detect endpoints that do not yet have Cortex XDR Agent installed

DKasabji — Thu, 21 Jan 2021 09:24:02 GMT

Hey guys,

I am curious about if there is a way to find out which Endpoints in certain environment do not yet have XDR Agent installed.

I still two options, but had no practical experience in testing it:

1. Directory Sync with Cortex XDR. Would it detect endpoints (which are in AD) that do not have XDR Agent yet installed?
2. Pathfinder. Would Pathfinder be something useful to detect such cases, even for those that are not in AD?

Any other option?

Thanks.

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

dfalcon — Thu, 21 Jan 2021 12:35:54 GMT

Hi @DKasabji-

Are you using Prevent or Pro?

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

DKasabji — Thu, 21 Jan 2021 12:55:19 GMT

Hey @dfalcon ,

I am inquiring about Pro. We are PAN partners and I am responsible for Cortex XDR POCs etc. and it often comes this question, how to detect endpoints that do not yet have installed XDR Agent in their environment.

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

dfalcon — Thu, 21 Jan 2021 13:23:19 GMT

Hi @DKasabji-

Please see the bottom of this post: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/directory-sync-usage/td-p/376055

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

DKasabji — Thu, 21 Jan 2021 13:52:39 GMT

Yep, aware about this one. However, this only works if all endpoints are joined into to the Domain (AD). It cannot detect endpoints that are not part of the domain.

Was hopping Cortex would have some sort of passive scanner with Pathfinder to detect endpoints in environment and then populate them in Endpoint Administration console and mark them if they do not have agent installed (similarly like Directory Sync does).

Best,

Was hopping there was some sort of passive scanner that would di

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

dfalcon — Thu, 21 Jan 2021 14:04:55 GMT

Hi @DKasabji

Cortex XDR does use more than Directory Sync -- the key is Asset Management. Please see this doc on how assets are discovered.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/asset-management/about-asset-management.html

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

DKasabji — Thu, 21 Jan 2021 14:08:27 GMT

This look like a solution I was looking for David, thanks. I will give it a read.

I have to see what else it requires to gain such visibility (Network Mapper, Pathfinder, Directory Sync, etc.).

Thanks.

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

ESJosephPrinz — Thu, 28 Oct 2021 15:10:46 GMT

Has anyone come up with a solution for this? I have been going round and round with cortex engineers and nothing. Pathfinder, after being told would do this, will not. I recently exported all the assets reported as no cortex agent, ran them through a reverse dns scripts and found hundreds and hundreds of PCs that were false negatives. It seems to me Palo has not solution for this which seems very very fundamental. Looks like we will need to develop our own. FYI we are all palo alto firewall, I dont know why the logs from the firewalls are not providing the names of the devices.

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

ESJosephPrinz — Thu, 28 Oct 2021 15:11:56 GMT

This is not a solution unless names can be provided. Anyone have names in their asset manager? Platform even?

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

P.Jacob — Thu, 28 Oct 2021 19:38:00 GMT

This stinks that it is for pro only. This should be available to all regardless of license pro or prevent. having the cortex agent loaded is the best way to have the product and your customers most successful.

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

WRoodhooft — Fri, 17 Dec 2021 06:57:50 GMT

I am also a bit of a loss at this... I checked the asset managment, but indeed, it does not detect the agent on the assets where it is on..

I used lansweeper for now but that seems a bit...

Would be great to have a solution for this!

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

fmoixsante — Fri, 17 Dec 2021 07:21:27 GMT

Another alternative is to use the Network Mapper applet from the BrokerVM. You do need Pro per endpoint or TB though.

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

WRoodhooft — Fri, 17 Dec 2021 07:26:34 GMT

Have the network mapper applet from the BrokerVM , have XDR pro, it detects all the end points, it just doesn't detect in asset managment witch ones have an agent on them...

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

eluis — Fri, 17 Dec 2021 09:20:41 GMT

Hi @WRoodhooft

Im not sure of what do you want to detect or discover.

If you want to see the endpoints where you have installed the agent, you can use the management console. You will find your endpoints with xdr agents installed under the Endpoint administration option.

For the ones that you dont have an agent installed on, you can use as @fmoixsante recommended the network mapper which seems you have on your setup

KR,

Luis

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

WRoodhooft — Fri, 17 Dec 2021 09:36:58 GMT

As said before by someone up in the thread... the network mapper detects indeed all assets on your network. but not if they have an agent installed or not... I tested this with some pc's it found (where the agent said: no) but they all had the agent installed and were all visible in the endpoints section.... I want to see only the ones where it is not installed... I fixed this with Lansweeper for now, but this product should be able to do so itself..?

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

ESJosephPrinz — Fri, 17 Dec 2021 13:28:55 GMT

@WRoodhooft You would be correct. I have spent 4 months working on this. Started with the broker, net mapper and then when that didnt work, pathfinder per cortex support. They were incorrect. Then tried the new 7.5 agent network discovery feature.. could not get that to work (nothing reported to asset manager). Now on dhcp Log collector. The dhcp log collector is the closest we have gotten. However; while it is currently providing the name of the hosts to asset manager, the mac address is not in sync when hosts move from wlan to lan and visa versa so it is reporting false negatives. Currently working with cortex engineers to see if we can correct this but I suspect that the Cortex XDR agent is delaying the network adapter change so the mac addresses wont align and I dont know if that is going to be correctable. AT LEAST we have something actionable.. we have thousands of nameless IP's in the asset manager and this allows us to spot check what does show up.. BUT I have some concerns because thus far, DHCP log collector has not provided a single host name where XDR is installed (3 days now).. so something doesnt smell right.

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

Rashele-Shoun — Thu, 25 Jul 2024 21:05:27 GMT

Really good information here! Thank you!

Re: Best way to detect endpoints that do not yet have Cortex XDR Agent installed

SecNaterr — Thu, 20 Feb 2025 20:23:28 GMT

Any new updates on this thread? Investigating similar solutions for asset discovery.