After you have configured and registered your
broker VM, activate the Network Mapper application. Activating the
Network Mapper requires a Cortex XDR Pro per Endpoint or Cortex
XDR Pro per TB license.
The Network Mapper allows you to scan
your network to detect and identify hosts in your environment according
to defined IP address ranges. The Network Mapper results can be
reviewed and investigated in the Assets table.
In Cortex XDR, navigate to
and locate your broker VM.
Right-click and select
Activate Network Mapper
define the following parameters:
—Select the either
scan method to identify your network hosts. When
selecting TCP SYN you can enter single ports and ranges together,
Scan Requests per Second
the maximum rate of you want to scan per second on your network.
—Define when you
want to run the network mapper scan. You can select either daily,
weekly, or monthly at a specific time.
—Select the IP address
ranges to scan. Make sure to
IP address ranges are displayed according
to what you defined in the asset Network Configuration.
After a successful activation, the
Network Mapper- Active, Connected
to view the following scan and applet metrics:
—Whether the applet is connected to Cortex XDR.
—State of the scan.
Scan Start Time
—Timestamp of when
the scan started.
—Period of time in minutes
and seconds the scan is running.
—How much of the scan
has been completed in percentage and IP address ratio.
—Number of hosts identified
from within the IP address ranges.
—Number of IP addresses scanned
the amount of
space the applet is using.
Manage the Network Mapper.
After the network mapper has been activated, right-click
you broker VM and select: