Cortex xdr agent distributed network scan

[Vinothkumar_SBA]

Hi Team,

We have enabled the Cortex XDR agent's distributed network scan, and we are getting successful results in the XDR Management Console. Our question is: Which port is used by the XDR agent to identify unmanaged assets

[aspatil]

Hello @Vinothkumar_SBA ,

If you are using Nmap, in the first stage, Nmap performs a ping scan -PS -PA which by default will try to use port 80 but will try to use other ports if not available.
Its has no limits about the port numbers in use.
If the request is also for os detection it may scan also a large number of ports depending on the OS which is also not limited to specific port numbers.

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[tlmarques]

My question is: is it safe @aspatil ?  Can the XDR itself perform these NMAP scans without putting the stability of the company's network at risk?

In a company with 5,000 devices, having all of them running NMAP could be dangerous. Or does the agent have some level of intelligence to run the scans gradually, in phases or at set intervals?

[aspatil]

Hello @tlmarques ,

No, Cortex XDR agents do not run full Nmap scans across the network in the traditional sense. The Network Discovery feature in Cortex XDR uses controlled, lightweight probing that is intentionally designed to avoid network overload or disruption.

Regards,

Ashutosh

[tlmarques]

Hi @aspatil ,

thanks for your mensage.
In this case , it's safe configure the agent nmap for all endpoints correct?