Domains - User Guide - 1.0 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse gets its domains and DNS data from a combination of active and passive global collection techniques. For DNS scanning, Cortex Xpanse sends a BIND version query as the payload. This approach still identifies DNS servers that are not BIND compliant as their response informs Cortex Xpanse of a DNS server’s existence.

Users find domain information in multiple locations in the Cortex Xpanse user interface. For example, the hostname on the IP modal for many exposures indicates the domain. Also, the cloud domain assets view displays domains.