topic Re: Cortex xdr agent distributed network scan in Cortex XDR Discussions

Cortex xdr agent distributed network scan

Vinothkumar_SBA — Fri, 04 Apr 2025 11:27:19 GMT

Hi Team,

We have enabled the Cortex XDR agent's distributed network scan, and we are getting successful results in the XDR Management Console. Our question is: Which port is used by the XDR agent to identify unmanaged assets

Re: Cortex xdr agent distributed network scan

aspatil — Fri, 04 Apr 2025 11:47:37 GMT

Hello @Vinothkumar_SBA ,

If you are using Nmap, in the first stage, Nmap performs a ping scan -PS -PA which by default will try to use port 80 but will try to use other ports if not available.
Its has no limits about the port numbers in use.
If the request is also for os detection it may scan also a large number of ports depending on the OS which is also not limited to specific port numbers.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: Cortex xdr agent distributed network scan

tlmarques — Tue, 29 Apr 2025 16:52:56 GMT

My question is: is it safe @aspatil ? Can the XDR itself perform these NMAP scans without putting the stability of the company's network at risk?

In a company with 5,000 devices, having all of them running NMAP could be dangerous. Or does the agent have some level of intelligence to run the scans gradually, in phases or at set intervals?

Re: Cortex xdr agent distributed network scan

aspatil — Wed, 30 Apr 2025 06:18:52 GMT

Hello @tlmarques ,

No, Cortex XDR agents do not run full Nmap scans across the network in the traditional sense. The Network Discovery feature in Cortex XDR uses controlled, lightweight probing that is intentionally designed to avoid network overload or disruption.

Regards,

Ashutosh

Re: Cortex xdr agent distributed network scan

tlmarques — Thu, 01 May 2025 09:51:42 GMT

Hi @aspatil ,

thanks for your mensage.
In this case , it's safe configure the agent nmap for all endpoints correct?