topic Re: distributed network scan - Network Location Configuration - XDR Agent profile in Cortex XDR Discussions

distributed network scan - Network Location Configuration - XDR Agent profile

AvesterFahimipour — Mon, 15 Jul 2024 13:21:15 GMT

Hello everyone,

Under the prevention profiles XDR agent has the capability to scan your network and find assets not onboarded using ping or nmap.
This setting also requires that you enable network location configuration.

This is from the docs:

"When enabled, the Cortex XDR agent scans your network using Ping or Nmap to provide updated identifiers of your unmanaged network assets. Ping scans return the IP address, MAC address, Hostname, and Platform, whereas Nmap will scan the most common ports for the IP address, Hostname, Platform, and OS version."

The issue is that after many days the asset page has not found any information on the not onboarded assets like the MAC or hostname.

Unless this information is stored under a table in XQL?

Re: distributed network scan - Network Location Configuration - XDR Agent profile

aspatil — Tue, 16 Jul 2024 06:50:54 GMT

Hello @AvesterFahimipour ,

Thanks for reaching out on LiveCommunity!

If you have nmap is enabled it will return IP address, Hostname, Platform, and OS version. However, please check whether ping or nmap is allowed in your environment.

Ensure you have mentioned the DNS name and IP address of DNS server as well. If you need to troubleshoot it further, please open a TAC support case.

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

Re: distributed network scan - Network Location Configuration - XDR Agent profile

AvesterFahimipour — Tue, 16 Jul 2024 07:15:25 GMT

Is the ping only able to see the IP?

Re: distributed network scan - Network Location Configuration - XDR Agent profile

JPrezHidalgo — Wed, 04 Sep 2024 09:18:15 GMT

Hello, how many DNS servers can be configured, 1 per profile, in case of having more DNS servers?