topic Re: Feature Request – LLDP/CDP Support for Network-Based Endpoint Discovery in Cortex XDR Discussions

Feature Request – LLDP/CDP Support for Network-Based Endpoint Discovery

WMartini — Thu, 20 Mar 2025 23:17:54 GMT

I would like to request a new feature for Cortex XDR that enables it to collect network information using the Link Layer Discovery Protocol (LLDP) and Cisco Discovery Protocol (CDP).

By capturing LLDP/CDP packets directly from the endpoint's network interface, Cortex XDR can accurately identify the switch and port to which a device is connected.
This would eliminate the need for external tools or network administrators to manually correlate endpoint location data, streamlining incident response and forensics.

CrowdStrike already provides this functionality, making it a valuable addition to the Cortex XDR feature set.
Since LLDP and CDP are transmitted in clear text, this feature can be implemented without additional components, simply by passively capturing network traffic on the endpoint’s interface.

The feature could be an optional setting within Cortex XDR, allowing organizations to enable or disable LLDP/CDP collection based on security policies.
The captured network metadata could be displayed in the XDR console under endpoint details, aiding security teams in network mapping and incident triage.
This feature would significantly improve endpoint visibility and security response capabilities in enterprise environments. I appreciate your consideration and look forward to any feedback on feasibility or implementation timelines.