distributed network scan - Network Location Configuration - XDR Agent profile

[AvesterFahimipour]

Hello everyone,

Under the prevention profiles XDR agent has the capability to scan your network and find assets not onboarded using ping or nmap.
This setting also requires that you enable network location configuration.

This is from the docs:

"When enabled, the Cortex XDR agent scans your network using Ping or Nmap to provide updated identifiers of your unmanaged network assets. Ping scans return the IP address, MAC address, Hostname, and Platform, whereas Nmap will scan the most common ports for the IP address, Hostname, Platform, and OS version."

The issue is that after many days the asset page has not found any information on the not onboarded assets like the MAC or hostname.

Unless this information is stored under a table in XQL?

[aspatil · Accepted solution]

Hello @AvesterFahimipour ,

Thanks for reaching out on LiveCommunity!

If you have nmap is enabled it will return  IP address, Hostname, Platform, and OS version. However, please check whether ping or nmap is allowed in your environment.

Ensure you have mentioned the DNS name and IP address of DNS server as well.  If you need to troubleshoot it further, please open a TAC support case.

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

[AvesterFahimipour]

Is the ping only able to see the IP?

[J.PrezHidalgo]

Hello, how many DNS servers can be configured, 1 per profile, in case of having more DNS servers?