3 Replies Latest reply on May 23, 2019 3:24 AM by Andrew Waters

Discovery Report Query Unique List of Active IP Addresses

David Blackburn May 22, 2019 1:09 PM

Share This:

I am looking for a Query that shows a list of all IP addresses that have responded to the ping sweep.

There are a couple of options under advanced query related to IP addresses, but I cannot get them to report all IP addresses that have responded to a ping.

I have a manual process where nMap is used to see what IPs are active on every network. I would like to use a Discovery report, and eventually the API to do the same thing.

1. Re: Discovery Report Query Unique List of Active IP Addresses

Jesse Richardson May 22, 2019 6:43 PM (in response to David Blackburn)

Successfully moved to Discovery so product experts can help
1 of 1 people found this helpful
Like Show 0 Likes(0)

Actions
2. Re: Discovery Report Query Unique List of Active IP Addresses

Brice-Emmanuel Loiseaux May 23, 2019 1:44 AM (in response to David Blackburn)

This community post should help you to define the query you need - Re: How do I filter the results of a sweep scan for only newly discovered endpoints?
2 of 2 people found this helpful
Like Show 0 Likes(0)

Actions
3. Re: Discovery Report Query Unique List of Active IP Addresses

Andrew Waters May 23, 2019 3:24 AM (in response to Brice-Emmanuel Loiseaux)

That is not correct. It is reporting recognised devices which is not the same as things which are responding. For example, if you have no credentials but nmap does an OS fingerprint because something responded you wold get NoAccess.

In general, dark space is no longer causes generation of DiscoveryAccess nodes (though an endpoint that used to respond will, for a period of time depending upon device ageing, create NoResponse DAs). The search
SEARCH DiscoveryAccess
WHERE _last_marker AND end_state <> 'NoResponse'
is the easy way to find all IPs which did not respond. If you have excluded IPs you would need
SEARCH DiscoveryAccess
WHERE _last_marker AND end_state not in ['NoResponse', 'Excluded']
3 of 3 people found this helpful
Like Show 2 Likes(2)

Actions