External facing IPS on discovery scan.

Hi everyone, I need some help.

We have scheduled weekly discovery scans, and our external domain is scanned by an external scanner. Every week, the number of active servers fluctuates up and down. I confirmed with the firewall team that all servers are active during the scan. If I perform an on-demand scan during my hours, they come back normal.

In one asset group, about 15 servers were decommissioned three months ago, but these assets are still showing up. One week they are added, and the next week they are removed, even though they don't exist anymore.

I tried contacting support, but their responses are vague. They say that the scheduled discovery scans on domains cause these removed assets to show as active. This explanation doesn’t make sense to me. When I ask for clarification, they just repeat the same answer.

Any ideas on how to resolve this issue?

Posted Aug 2, 2024, 3:13 AM UTC

55
Loading comments…