Poll devices on the network to learn their attributes.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
One of the following subscriptions:
Device Security subscription for an advanced
Device Security product (Enterprise Plus,
Industrial OT, or Medical)
Device Security X subscription
One of the following Cortex XSOAR setups:
A free, cohosted, limited-featured
Cortex XSOAR instance
AND
A free Cortex XSOAR Engine (on-premises integration)
A full-featured Cortex XSOAR server
|
To identify devices and detect vulnerabilities, Device Security must first learn
device attributes, such as the vendor, model, firmware, OS, and others. It does this
primarily by analyzing network traffic metadata in the logs it receives from
next-generation firewalls or from Prisma® Access and SD-WAN devices.
Device Security can optionally supplement this data with more learned from
third-party integrations.
However, Device Security can't learn about all assets through firewall traffic
alone. Devices might generate traffic that does not reach a firewall or Prisma device
and there are no third-party systems with which to integrate and import information.
Some devices might generate so little traffic that there simply isn't enough for a
thorough analysis. In particular, operational technology (OT) devices are not always
discoverable, especially when firewalls are deployed on the network edge. For
example, control devices and sensors communicate predominantly with the devices they
manage or monitor. To provide Device Security with the data it needs to identify
OT devices and assess their risk level, integrate Device Security with
Cortex XSOAR to poll devices to learn their attributes. Device Security
displays the attributes it learns through polling on the following pages:
Assets Inventory
Device Details
IP Endpoints
When XSOAR learns attributes for assets that are already in the
Device Security database, Device Security adds whatever attributes it did
not yet have for them. When it learns attributes for assets that are not yet in
its database, it creates new entries for them. If Device Security learns the
IP address and MAC address of a new device, which it can learn when using SNMP
to poll, it adds a new entry to the Devices page. If it learns only an IP
address, it adds a new entry to the IP Endpoints page.
When polling DHCP clients, ensure that Device Security is getting metadata from
DHCP Traffic logs so that it can update the devices in its inventory with changing
DHCP-assigned IP addresses. This way, the IP address-to-device mapping will be up
to date and in sync with the attributes learned per IP address through asset
attribute polling.
For most device attributes, Device Security uses the latest value it learns
regardless of whether it's discovered through network traffic or through an
integration. However, there are 10 attributes for which a value learned through
network traffic has priority even if Device Security later learns of a different
value through integration:
Model
Vendor
OS group
OS version
Firmware
Serial number
Wired or wireless
VLAN
Hostname
Active Directory domain
If Device Security learns a conflicting value for one of these attributes, it
prioritizes the value learned through network traffic first and then through an
integration (including asset attribute polling) second. The basic logic is as
follows:
Whatever new value is learned through network traffic replaces a value
learned previously by any means.
A new value learned through integration will replace a previously learned
value learned through the same type of integration. It won't replace a value
learned through network traffic or through another type of integration.
When using a cohosted, limited-featured Cortex XSOAR instance, this
integration requires an on-premises Cortex XSOAR engine. When using a
full-featured Cortex XSOAR server on premises, a Cortex XSOAR engine
is needed only if the network topology requires an engine to reach a part of the
network that the XSOAR server can't. When using a full-featured
Cortex XSOAR server in the cloud, you must configure an on-premises
Cortex XSOAR engine.
Alternatively, you can use the free
Network Discovery plugin to do protocol
polling. You can download the plugin onto a supported firewall and configure a
polling job without needing to integrate with
Cortex XSOAR.
