OS Fingerprinting feature in Distributed Network Scan (Pro version)

[PhyoWaiSoe]

Hi All,
We are using XDR Pro version with agent version 8.2. I am curious about this OS fingerprinting feature under Distributed Network scan setting in Agent profile. I have already configured Network Location Configuration and also configured other things as shown in the attached screenshot. I was hoping it would return the OS type/version of other systems the XDR agents discovered. But so far, it doesn't seem to be doing much. Am I missing something?

Distributed Network Scan
My network location configuration is set like this (actual DNS server name/IP address changed for the screenshot).
Network location

[nsinghvirk · Accepted solution]

Hello @PhyoWaiSoe 

Thanks for reaching out on LiveCommunity!

Apologies for late response. Information provided via screenshot looks correct. Below are the few key factors in network configuration that can affect scanning.

• Subnet mask settings and name service configuration influence the scanning
• Network Location configuration should be enabled
• Excluded IP address ranges will not be scanned
• At least 2 peers are required to be detected for the agent to be assigned the scanning task.
• This scan occurs at subnet level and it will not go over L3 boundary.

Below are the expected results from ping and NMAP scans.

• Ping:

• IP address
• Mac address
• Hostname
• Platform (Windows/Mac/Linux)

• NMap

• IP address
• Hostname
• Platform
• OS Version

If everything is configured as per the rules mentioned above than please raise a TAC case. This may require additional analysis.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[PhyoWaiSoe]

Hello @nsinghvirk ,

Thanks for the comprehensive reply. Because I am a total beginner when it comes to Cortex XDR, I am not clear about this sentence. Can you please explain a bit more? Thanks once again.

• At least 2 peers are required to be detected for the agent to be assigned the scanning task.

[nsinghvirk]

Hello @PhyoWaiSoe 

This statement means that at least two neighbour endpoints should be present within a subnet for agent to perform ping or NMAP scan. In other words, if there is only one endpoint present within a subnet then no other endpoint is available for it to do the scan.