Skip to content
Cisco XDR Forensics Knowledge Base

Network Communication

How Do Assets Communicate with the Console?

Section titled “How Do Assets Communicate with the Console?”

All routine communication between assets and the XDR Forensics console is initiated by the assets—they do not receive incoming requests from external sources. Communication occurs through various protocols and channels:

Primary Communication Channels

Section titled “Primary Communication Channels”
  • HTTPS (TCP 443) – The main communication channel from assets to the console (e.g., <tenantname>.cisco-<region>.binalyze.io ).
  • WebSocket over HTTPS (TCP 443) – Used for interACT features.
  • NATS (TCP 4222) (Optional) – Supports real-time task pushes to assets. If this port is unavailable, XDR Forensics defaults to HTTP(S) polling for task retrieval.
  • DNS (UDP/TCP 53) – Required for name resolution services.

Task Result Uploads (SaaS)

Section titled “Task Result Uploads (SaaS)”

In SaaS deployments, responders upload task results (case.ppc and Drone.zip) through the XDR Forensics upload CDN instead of sending them to the console:

  • HTTPS (TCP 443) to *.binalyze.io – The console authorizes each upload, and the responder sends the file to the XDR Forensics upload CDN. Allow *.binalyze.io over TCP 443 so that assets can reach it.
  • The upload CDN hostname depends on your region (e.g. upload.cisco-<region>.binalyze.io).

  • Tenants with a customer-managed encryption key (CMEK) use a dedicated upload hostname instead of the regional one. This hostname is also under *.binalyze.io, so the same rule covers it. Allow it by hostname rather than IP address, because the CDN addresses can change. If no upload hostname is configured for the tenant, responders upload task results through the console.

  • The integrity of each uploaded file is verified on arrival.

  • If the upload CDN cannot be reached, the responder falls back to uploading the task result through the console.

External Communication

Section titled “External Communication”
  • HTTPS to <tenantname>.cisco-<region>.binalyze.io – Used for responder updates and installation packages. If the CDN is unavailable, the XDR Forensics console acts as a fallback source.

Evidence Repository Communication (When Configured)

Section titled “Evidence Repository Communication (When Configured)”
  • Cloud Storage: HTTPS communication to services like Amazon S3 and Azure.
  • Traditional Storage: Supported via SFTP, FTPS, or SMB.

Proxy Support

Section titled “Proxy Support”

If a proxy is configured in your environment, assets can communicate using:

  • HTTP
  • HTTPS
  • SOCKS5