28. Network: discovery, topology map and exposure

The Network area builds one map of the estate from four sources: agent telemetry, scans run from the server, imported firewall configurations, and (when loaded) sandbox data. It shows which hosts exist, which have an agent, how they connect, how risky each is, and what the internet can reach.

Permissions:

28.1 What the Network page shows#

Path: Network. The page title is Network topology.

• Header actions: Exposure (28.5), "N scans running" while scans run, and Export topology (28.6).
• Tiles: Total nodes, Online, Managed (has agent), Unmanaged (known, no agent), Discovered (no agent, unconfirmed), Observed edges, Policy edges (firewall rules), and Demo when sandbox data exists.
• Source strip: how many nodes each source contributed. Internet endpoints the agents talked to are counted separately ("internet endpoints observed (not assets)").
• Distribution strip: Risk distribution, Node types, Zone breakdown.
• Topology map (28.2).
• Trigger server-side network scan (folded; 28.3).
• Discovery run history: Run, Target, Status, Started, Duration, Result (last 20).
• Node inventory: filter All, Managed, Unmanaged, Discovered (and Demo); columns IP address, Hostname, Device, Type, Role, Source, Confidence, Online.

If you see "N nodes created by an earlier version for internet endpoints your agents connected to are hidden from the map and counts", remove them (procedure below). They are not machines in your estate.

Procedure: remove the hidden internet endpoints#

Permission: Manage network. Four-eyes: no. Risk: none to hosts; only those hidden nodes are deleted from Lawliet. Rollback: none needed - they are not assets.

1. Open Network. The notice is shown only when such nodes exist.
2. Press Remove them. The button shows Removing....
3. What you see: the notice disappears and the counts stay the same (the nodes were already hidden). If it fails, the notice says "Cleanup failed." or the server's reason; try again.

Nodes are not deleted by hand#

The console has no button to delete or edit a network node in this release. A node stays as a record of what was seen. A host that is gone shows offline (dashed outline). Sandbox nodes are removed with the sandbox (39.9).

28.2 Using the topology map#

• Zones are drawn as areas: External, DMZ, Management, Internal, Unzoned.
• Find a host, address or vendor highlights matching nodes.
• Zoom in, Zoom out, Fit the map to the window. Scroll to zoom, drag to pan, double-click to reset to 100%.
• Hover or click a node to trace its links. A dashed outline means offline.
• Zone-to-zone flows lists the traffic between zones.

Click a node to open its detail panel:

Buttons in the panel:

• Rescan now (Manage network): probes this one host again and updates its ports, services and score (procedure below).
• Deploy an agent to this host: opens Environment > Hosts with the host's address filled in for deployment (chapter 13).

"Could not load the evidence trail. This is not a statement that none exists." means the request failed; refresh. "No evidence recorded" means the node predates evidence capture or was added by hand; rescan the range to populate it.

Procedure: rescan one host#

Permission: Manage network. Four-eyes: no. Risk: the server probes that one address (the same probes as 28.3). Rollback: not needed; only Lawliet's record is updated.

1. Open Network and click the node on the map (or its row in Node inventory).
2. In the detail panel, press Rescan now next to Risk. It shows Probing....
3. What you see: the panel's online state, open ports, services and risk score update.

If it fails: "The host could not be probed from this server." (or the server's reason). The server has no route to that address; deploy an agent on the host or scan from a server that can reach it.

28.3 Procedure: run a server-side discovery scan#

The server probes a private address range and records what answers. It uses ARP and ICMP, TCP connections to the chosen ports, service banners, TLS certificates, reverse DNS, mDNS, SSDP, NetBIOS, SNMP system descriptions, the route table and the MAC vendor prefix.

Permission: Manage network. Four-eyes: no.

Risk: active probing of a subnet. Intrusion detection systems may alert, and fragile devices (old printers, industrial controllers) can misbehave under probes. Agree the range and the time with the network owner. Rollback: a scan only adds or updates nodes in Lawliet; nothing changes on the probed hosts.

1. Open Network and expand Trigger server-side network scan.

2. Enter Target CIDR (private ranges only), for example 10.0.1.0/24. Only private (RFC 1918) ranges are accepted, up to a /16.

3. Choose the Port set: Minimal (3 ports), Common (12 ports) or Extended (30 ports).

4. First tick Dry run (plan only, no writes) and press Plan scope.

   What you see: "Dry run - nothing was written. N host(s) would be probed on <range> across M port(s)."

5. Untick Dry run and press Run scan.

   What you see: Probed, New, Updated, Services, any Gateways detected, and Discovery coverage (which techniques contributed). The run appears in Discovery run history and the nodes on the map.

If it fails:

Administrators can also start discovery from Operations (chapter 39). Agent heartbeats also feed the map, so hosts with an agent appear without a server scan.

28.4 Sandbox topology#

Seeding and clearing the whole sandbox dataset are done in Settings > Sandbox (chapter 39). Real and sandbox nodes can coexist; sandbox nodes are labelled and can be cleared on their own.

Sandbox (demo) accounts also see a Sandbox / Demo topology - Not real data panel under the map, for the network part only. Permission: Manage demo data; without it the server refuses and the panel shows the reason. Four-eyes: only if your policy turns on "Clear or seed demo data".

1. Open Network and scroll to Sandbox / Demo topology.
2. Press Seed sandbox topology (it shows Seeding...). The panel then says "Sandbox topology shown - N demo nodes in inventory."
3. To remove only the sandbox nodes, press Clear sandbox topology (shown when demo nodes exist). Real nodes are not touched.

If it fails: "Seed failed." or "Clear failed." (or the server's reason) under the buttons.

28.5 The Exposure page#

Path: Network > Exposure (button in the page header).

"What the internet can reach on each host, and how hardened that host is. Worst first."

Columns: Host, Reachable from the internet, Listening, not reachable, Hardening, Verdict. The verdict reads like "Reachable from the internet on 443, and fails 12 hardening controls (3 critical or high)."

• "Reachability unknown: no firewall rule set on file" - import or connect the perimeter firewall (chapter 29) so reachability can be worked out.
• "never scanned" - run a compliance scan on that host (chapter 22).

28.6 Procedure: export the topology#

Permission: View network.

The file contains hostnames, IP and MAC addresses, listening services and which hosts have agents. Treat it as sensitive.

1. Press Export topology in the Network page header.
2. Choose the Format:

3. Options: Redact addresses (masks host parts of IPs and MACs and replaces hostnames with stable placeholders), Include discovery provenance (how each host was found), Exclude sandbox data (shown only when sandbox data exists).
4. Press Download <FORMAT>.

If it fails: the dialog shows the server message; Cancel closes it.