XSIAM Assets / Network Mapper - How to identify unknown assets

[MDovirak]

We configured network mapper in the BrokerVM settings and using multiple ports for network identification. Of course, on the firewalls we allow all traffic from them to make a full visibility internally. However, the scan doesn't resolve the hostname or open ports on the machine that can support with OS identification, like 22/ssh - potential Linux etc. Sometimes with manual scan using nmap we can see much more open ports and zero return from mapper.

Using network mapper, possible to resolve FQDN of the machine like with nmap ARP scan? How possible to identify or which process is the best to identify unknown assets in the network?

[afurze]

Hi MDovirak,

The Broker VM Network Mapper is only using a ping scan to identify interfaces on the network.  It is not doing nmap or any other method that would allow more detailed discovery.  You can ingest DHCP logs from Microsoft DHCP to provide additional enrichment of hostname for discovered IP addresses.