Poll devices on the network to learn their attributes.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
One of the following subscriptions:
Device Security subscription for an advanced
Device Security product (Enterprise Plus,
Industrial OT, or Medical)
Device Security X subscription
One of the following Cortex XSOAR setups:
A free, cohosted, limited-featured
Cortex XSOAR instance
AND
A free Cortex XSOAR Engine (on-premises integration)
A full-featured Cortex XSOAR server
|
To identify devices and detect vulnerabilities, Device Security must
first learn device attributes, such as the vendor, model, firmware, OS, and others.
It does this primarily by analyzing network traffic metadata in the logs it receives
from next-generation firewalls or from Prisma® Access and SD-WAN devices.
Device Security can optionally supplement this data with
more learned from third-party integrations.
However, Device Security can’t learn about all assets through firewall
traffic alone. Devices might generate traffic that does not reach a firewall
or Prisma device and there are no third-party systems with which to integrate and
import information. Some devices might generate so little traffic that
there simply isn’t enough for a thorough analysis. In particular, operational
technology (OT) devices are not always discoverable, especially when firewalls are
deployed on the network edge. For example, control devices and sensors communicate
predominantly with the devices they manage or monitor. To provide Device Security
with the data it needs to identify OT devices and assess their risk level, integrate
Device Security with Cortex XSOAR to poll devices to learn their
attributes. Device Security displays the attributes it learns through
polling on the following pages:
Assets Inventory
Device Details
IP Endpoints
When XSOAR learns attributes for assets that are already in the Device Security database, Device Security adds
whatever attributes it did not yet have for them. When it learns attributes for
assets that are not yet in its database, it creates new entries for them. If
Device Security learns the IP address and MAC address
of a new device, which it can learn when using SNMP to poll, it adds a new entry to
the Devices page. If it learns only an IP address, it adds a new entry to the IP
Endpoints page.
When polling DHCP clients, ensure that Device Security is getting
metadata from DHCP Traffic logs so that it can update the devices in its inventory
with changing DHCP-assigned IP addresses. This way, the IP address-to-device mapping
will be up to date and in sync with the attributes learned per IP address through
asset attribute polling.
For most device attributes, Device Security uses the latest value it
learns regardless of whether it’s discovered through network traffic or through an
integration. However, there are 10 attributes for which a value learned through
network traffic has priority even if Device Security later learns
of a different value through integration:
Model
Vendor
OS group
OS version
Firmware
Serial number
Wired or wireless
VLAN
Hostname
Active Directory domain
If Device Security learns a conflicting value for one of
these attributes, it prioritizes the value learned through network traffic first and
then through an integration (including asset attribute polling) second. The basic
logic is as follows:
Whatever new value is learned through network traffic replaces a
value learned previously by any means.
A new value learned through integration will replace a previously
learned value learned through the same type of integration. It won’t replace
a value learned through network traffic or through another type of
integration.
When using a cohosted, limited-featured Cortex XSOAR
instance, this integration requires an on-premises Cortex XSOAR engine. When using a
full-featured Cortex XSOAR server on premises,
a Cortex XSOAR engine is needed only if the network topology
requires an engine to reach a part of the network that the XSOAR server can’t. When
using a full-featured Cortex XSOAR server in the cloud, you
must configure an on-premises Cortex XSOAR engine.
Alternatively, you can use the free
Network Discovery plugin to do
protocol polling. You can download the plugin onto a supported firewall and
configure a polling job without needing to integrate with
Cortex XSOAR.
