Network topology: see the map behind the assets

Endpoints do not float in vacuum. Network topology in Dual-Strike XISEM visualizes how assets connect: sites, VLANs, gateways, VPN paths, and discovered neighbors — correlated with agent inventory and identity sessions.

Route: /network · Support wiki → Network topology & discovery

Evidence sources for topology

• XISEM agent — Local adapters, routes, DNS, peer discovery

• Network device Gateways — Fortinet, UniFi, Meraki-class integrations (per wiki)

• Identity location — Office / home / unknown classification

• Manual site tags — Client org site definitions

Platform layer interprets harvester and integration evidence — it does not scan the network independently of collectors.

Operator use cases

1. Incident scope — “What subnet was this laptop on when detection fired?”

2. Segmentation audit — server VLAN reachable from guest Wi-Fi?

3. Asset context — Asset modal shows network attachment alongside ASPIRE

4. Compliance — network boundary controls (NIST SC family, PCI segmentation)

MSP workflow

1. Deploy agents to representative sites (HQ, branch, remote)

2. Connect firewall/switch integration where client owns supported gear

3. Review topology graph for orphan nodes (discovered but not managed)

4. Align orphan list with Inventory onboarding campaign

Limitations (honest)

• Cloud-only workloads may appear as identity + SaaS signals rather than L2 map

• Remote workers often show home/unknown location class — pair with Browsing Insights

• Discovery depth depends on agent and integration coverage — not a replacement for dedicated NDR (roadmap items public on wiki)

Related: ASPIRE Environment pillar · CVE correlation post

---

No internal scan schedules or credential storage details — configure integrations in-console.