topic Re: OS Fingerprinting feature in Distributed Network Scan (Pro version) in Cortex XDR Discussions

OS Fingerprinting feature in Distributed Network Scan (Pro version)

PhyoWaiSoe — Thu, 28 Dec 2023 15:39:05 GMT

Hi All,
We are using XDR Pro version with agent version 8.2. I am curious about this OS fingerprinting feature under Distributed Network scan setting in Agent profile. I have already configured Network Location Configuration and also configured other things as shown in the attached screenshot. I was hoping it would return the OS type/version of other systems the XDR agents discovered. But so far, it doesn't seem to be doing much. Am I missing something?

Distributed Network Scan
My network location configuration is set like this (actual DNS server name/IP address changed for the screenshot).
Network location

Re: OS Fingerprinting feature in Distributed Network Scan (Pro version)

nsinghvirk — Mon, 08 Jan 2024 12:48:10 GMT

Hello @PhyoWaiSoe

Thanks for reaching out on LiveCommunity!

Apologies for late response. Information provided via screenshot looks correct. Below are the few key factors in network configuration that can affect scanning.

Subnet mask settings and name service configuration influence the scanning
Network Location configuration should be enabled
Excluded IP address ranges will not be scanned
At least 2 peers are required to be detected for the agent to be assigned the scanning task.
This scan occurs at subnet level and it will not go over L3 boundary.

Below are the expected results from ping and NMAP scans.

Ping:

IP address
Mac address
Hostname
Platform (Windows/Mac/Linux)

NMap

IP address
Hostname
Platform
OS Version

If everything is configured as per the rules mentioned above than please raise a TAC case. This may require additional analysis.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: OS Fingerprinting feature in Distributed Network Scan (Pro version)

PhyoWaiSoe — Fri, 12 Jan 2024 03:35:34 GMT

Hello @nsinghvirk ,

Thanks for the comprehensive reply. Because I am a total beginner when it comes to Cortex XDR, I am not clear about this sentence. Can you please explain a bit more? Thanks once again.

At least 2 peers are required to be detected for the agent to be assigned the scanning task.

Re: OS Fingerprinting feature in Distributed Network Scan (Pro version)

nsinghvirk — Fri, 12 Jan 2024 14:27:56 GMT

Hello @PhyoWaiSoe

This statement means that at least two neighbour endpoints should be present within a subnet for agent to perform ping or NMAP scan. In other words, if there is only one endpoint present within a subnet then no other endpoint is available for it to do the scan.

Re: OS Fingerprinting feature in Distributed Network Scan (Pro version)

JPrezHidalgo — Wed, 04 Sep 2024 08:35:58 GMT

Hello, could you clarify where you dump the information you get from the scan, and what information do you dump? Hostname, OS, IP, agent installed?