All Asset Total Number-Cortext XDR

[PaloAltorrr]

Hello,

I have added 5 endpoints to Cortex XDR. On the All Assets page, I can clearly see these 5 endpoints listed with their respective names and categorized as General Devices.

However, I’m seeing over 200 additional assets that:

• Have no names

• Are categorized as Device

• Have a type listed as Generic Device

I did not add these assets manually, and there are no records showing that any devices were removed.

Could you please clarify where these unnamed assets are coming from and why they are appearing in the asset list?

example:in this tenant , only 1 enpoint is added, what are those 5 more?

Cortex XDR 

[eluis]

Hi PaloAltorr

Broker VM (not sure if you have it on your infra, and if possitive, did you enabled the network discovery?) and agents can perform network discovery so those endpoints discovered unnamed and unmanaged can be any device with an IP or endpoint without XDR agent installed on them. 

If on your network location configuration at the agent settings profiles, you gave data on your DNS, network ranges etc...

And on your agent settings you configure the network discovery using nmap instead of icmp, you might see more information like the hostname of those devices. Even sometimes the OS discovered. 

Agent profiles

check point 8, there is a table describing distributed network scan as I mentioned above

Check point 15 for Network location configuration 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Set-up-agent-sett...

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis