Make sure the security record matches the device on the LAN.
The useful question is not only whether an endpoint exists in Cortex XDR. Establish which device it represents, whether the information is current and which supported facts should influence access.
The published EasyNAC compatibility guide lists Cortex XDR Cloud. Confirm the connector and supported checks for your current EasyNAC and Cortex XDR releases.
Connect the supported endpoint-security integration and AD where your access design requires it. Default Auto Trust includes AD-joined and XDR-managed checks. Confirm the current management recognition, then validate any supported health requirements separately.
Connect the integration.
- Deploy the EasyNAC appliance or VM, configure its IP and review discovered devices.
- Prepare the Cortex XDR access URL, API Key ID and API Key. Set the query interval, test the connection and validate device matching against the returned information.
- Confirm the managed-device recognition used by default Auto Trust, then select any additional documented health conditions required by your access policy.
- Use a managed test endpoint and an unapproved test device to verify access, restrictions and recovery.
Check Cortex XDR agent and protection status.
EasyNAC queries Cortex XDR using the configured access URL, API Key ID and API Key. Hostname-based device matching is available in the connector. Its documented conditions cover:
- Devices running the Cortex XDR agent.
- Offline devices, disabled protection and devices reported as isolated.
- Devices that have not reported within a configured period.
- Devices whose Cortex XDR content has not updated within a configured period.
Use reported conditions to control access.
The connector applies tags when enabled conditions match the information reported by the source. EasyNAC uses those tags in Auto Trust and role-based access decisions. Managed-device recognition and additional health requirements serve different purposes: the resulting access follows the policy in use.
For example, distinguish a recognized endpoint with protection enabled from one reported with protection disabled or stale content. The isolated-device condition reads Cortex XDR isolation status; it should not be presented as a command that initiates Cortex XDR isolation.
Checks refresh on the configured query interval; they are not an instantaneous live assessment of every endpoint. After correcting a condition, confirm the source has reported the change and EasyNAC has refreshed its information before checking restored access.
Prove the access outcome.
| Pilot case | What to demonstrate |
|---|---|
| Agent recognition | Match the endpoint through the documented Cortex XDR agent condition. |
| Protection or isolation status | Verify the source-reported condition, resulting tag and intended access decision. |
| Freshness | Test the configured reporting-age or content-update-age threshold. |
| Recovery | Restore the condition and verify the refreshed tag, policy reason and access result. |
Record the source condition, EasyNAC tag, policy reason and access result in the Evaluation Kit scorecard. Agree the test and recovery procedure with your security team before changing endpoint conditions.
Keep the integration useful after deployment.
Review cloud API permissions, tenant selection, credential rotation and connector health. Include device renames, rebuilt endpoints and IP changes in testing so a historical record is not mistaken for a newly connected device.
Expand only after the first network’s device matching, access and recovery behavior is understood. Review EasyNAC appliances, remote Enforcer Sensors and optional CVM when planning branches or regions.
Common questions.
Which Cortex XDR conditions can EasyNAC use?
The documented conditions include agent presence, offline status, disabled protection, isolation, reporting age and content-update age.
Does the isolation-status check initiate a Cortex XDR isolation action?
The documented condition tags devices already reported as isolated. EasyNAC network access decisions are applied through its own access policy.
Sources and deployment scope.
Prepared by InfoExpress, Inc., the company behind EasyNAC. The connector checks described here were verified against the EasyNAC appliance help on 14 October 2026. Product API references provide source-platform background. Confirm availability for your connector version and source-product configuration.
Test it on your network.
Agree the requirements, connect a representative endpoint and record the actual result.