Activate the Network Mapper

After you have configured and registered your broker VM, activate the Network Mapper application. Activating the Network Mapper requires a Cortex XDR Pro per Endpoint or Cortex XDR Pro per TB license.
The Network Mapper allows you to scan your network to detect and identify hosts in your environment according to defined IP address ranges. The Network Mapper results can be reviewed and investigated in the Assets table.
  1. In Cortex XDR, navigate to
    gear.png
    Settings
    Broker
    VMs
    table and locate your broker VM.
  2. Right-click and select
    Network Mapper
    Activate
    .
  3. In the
    Activate Network Mapper
    window, define the following parameters:
    activate-network-mapper.png
    • Scan Method
      —Select the either
      ICMP echo
      or
      TCP SYN
      scan method to identify your network hosts. When selecting TCP SYN you can enter single ports and ranges together, for example
      80-83, 443
      .
    • (
      Optional
      )
      Scan Requests per Second
      —Define the maximum rate of you want to scan per second on your network.
    • Scanning Scheduler
      —Define when you want to run the network mapper scan. You can select either daily, weekly, or monthly at a specific time.
    • Scanned Ranges
      —Select the IP address ranges to scan. Make sure to network-mapper-enter.png after each selection.
      IP address ranges are displayed according to what you defined in the asset Network Configuration.
  4. Activate
    your configurations.
    After a successful activation, the
    Apps
    field displays the
    Network Mapper- Active, Connected
    .
  5. In the
    Apps
    filed, select
    Network Mapper
    to view the following scan and applet metrics:
    • Scan Details
      • Connectivity Status
        —Whether the applet is connected to Cortex XDR.
      • Scan Status
        —State of the scan.
      • Scan Start Time
        —Timestamp of when the scan started.
      • Scan Duration
        —Period of time in minutes and seconds the scan is running.
      • Scan Progress
        —How much of the scan has been completed in percentage and IP address ratio.
      • Detected Hosts
        —Number of hosts identified from within the IP address ranges.
      • Scan Rate
        —Number of IP addresses scanned per second.
    • Applet Metrics
      • Resources
        —Displays the amount of
        CPU
        ,
        Memory
        , and
        Disk
        space the applet is using.
    network-mapper-metrics.png
  6. Manage the Network Mapper.
    After the network mapper has been activated, right-click you broker VM and select:
    • Network Mapper
      Configure
      to redefine the network mapper configurations.
    • Network Mapper
      Scan Now
      to initiate a scan.
    • Network Mapper
      Deactivate
      to disable the network mapper.

Recommended For You