Cortex Xpanse is an attack surface management scanner operated by Palo Alto Networks. It scans the global IPv4 address space and all 65,535 ports several times per day to discover internet-facing assets and exposed services on behalf of its customers. Palo Alto Networks publishes the source IP ranges used by the scanner and does not document a reverse-DNS verification method.

At a glance

Operator: Palo Alto Networks
Type: Security

How Centinel checks it

User agent: The request calls itself this crawler. Anyone can send the same string.

Cortex Xpanse publishes nothing Centinel can check a source against, so a match reports the name and leaves the source unconfirmed. The match tokens, verification domains, and address feeds are not published here.

Allowing or blocking it

The crawler object in the /validate response sets access_allowed to true only for a verified source that your tenant allowlists. A policy rule can allow or block this crawler by its category, Security.

Back to the crawler catalog