Manage Your Network Assets

The
Assets
page provides a central location from which you can view and investigate information relating to assets in your network. Using your defined internal network configurations, Broker VM Network Mapper, Cortex XDR agent, EDR data collected from firewall logs, and logs from third-party vendors, Cortex XDR is able to aggregate and display a list of all the assets located within your network according to their IP address.
To easily investigate your assets:
  1. Navigate to
    Assets
    Asset Management
    Assets
    .
    assets-table.png
  2. Filter and review your assets.
    By default the
    Assets
    table is filtered according to unmanaged assets over the last 7 days. The following table describes both the default and optional fields in the table, and the network prerequisites required by Cortex XDR to retrieve the data:
    Field
    Description
    Prerequisites
    AGENT ID
    ID of the agent installed on the asset. Cortex XDR only displays agents that send EDR data captured in the firewall logs.
    AGENT INSTALLED
    Whether or not the asset has an agent installed.
    AGENT VERSION
    Version of the agent installed on the asset. Cortex XDR only displays agents that send EDR data captured in the firewall logs.
    COLLECTOR RUNNING
    Whether or not a Pathfinder Data Collector is currently running on the asset.
    FIRST TIME SEEN
    Timestamp of when the IP address was first seen in the logs.
    HOST NAME
    Host name of the asset, if available.
    The asset requires at least one of the following:
    • An installed Cortex XDR agent
    • A running Cortex XDR collector
    • A Global Protect client 9.1 or a later release, configured to send HIP Match logs
    • Associated DHCP logs covering this asset are sent to Cortex XDR
    IP ADDRESS
    IP address related to the last asset associated with it.
    LAST TIME SEEN
    Timestamp of when the IP address was last seen in the logs.
    MAC ADDRESS
    Mac address of the asset.
    The asset requires at least one of the following:
    • An installed Cortex XDR agent
    • A running Cortex XDR collector
    • For Mac endpoints, a Global Protect client 9.1 or a later release, configured to send HIP Match logs
    • Associated DHCP logs covering this asset are sent to Cortex XDR
    MAC ADDRESS VENDOR
    Vendor name of the Mac address of the asset.
    The asset requires at least one of the following:
    • An installed Cortex XDR agent
    • A running Cortex XDR collector
    • For Mac endpoints, a Global Protect client 9.1 or a later release, configured to send HIP Match logs
    • Associated DHCP logs covering this asset are sent to Cortex XDR
    PLATFORM
    Platform running on the asset.
    The asset requires at least one of the following:
    • An installed Cortex XDR agent
    • A running Cortex XDR collector
    • A Global Protect client 9.1 or a later release, configured to send HIP Match logs
    RANGE NAMES
    Name of the IP address range allocated to the IP address.
    You can export your filtered results to a TSV file.
  3. Investigate an asset.
    Locate an IP address, right-click and select to:
    • Open asset view
      —Pivot to the Asset View to view insights collected from an endpoint with an agent installed.
      Open IP View
      —Pivot to the IP Address View to view details of the associated IP address from an endpoint without an agent installed.
      The default filter in the table shows only non-agent assets.
    • View agent details
      —Pivot to the Endpoints table filtered according to the agent ID. Choose whether to open the view in a new tab or the same tab. This option is available only for assets with a Cortex XDR agent installed.
    • Open in Quick Launcher
      —Open the Quick Launcher search results for the IP address.
    • Remove Collector
      —Remove the Pathfinder Data Collector. Only available if a collector is status is
      In Process
      .

Recommended For You