Add a network - Administrator Guide - Cortex XDR - Cortex - Security Operations

When performing scans, Cortex Network Scanner primarily operates at the IP level, identifying assets as IP hosts. This means it recognizes and interacts with devices based on their unique IP addresses within the scanned network.

In certain environments, you might encounter overlapping or duplicate private IP ranges. For example, your New York and London branch offices could both be using the private network 172.16.1.0/20. If both offices are located behind Network Address Translation (NAT), a server in London and an employee's laptop in New York can legitimately have the same IP address (e.g., 172.16.1.100) without causing conflicts in their respective local networks. This is because NAT translates these private IP addresses to unique public IP addresses when they communicate outside their local network, effectively isolating the private IP spaces.

However, the scan results from the scans are being aggregated at the asset level, taking into the account that the same host can have multiple IP addresses or change the IP address during the asset’s lifecycle. To avoid confusion and mixing up the scan results at the asset level, you can configure a separate network for each location.

You can also add networks for better scan organization.

After you've added a network, you can specify that network when configuring a scan.