🧩 Overview
Liongard has temporarily removed the NMAP component from the Liongard Agent beginning with version 5.1.1. This change directly affects the Network Discovery (ND) inspector, which depends on NMAP for device discovery.
This KB outlines why the change was necessary, what impact it has on Network Discovery functionality, how to restore ND if needed, and what Liongard is building as a long-term solution.
🔍 What’s Changing in Agent 5.1.1
NMAP has been removed from the Agent installation directory.
This means:
Network Discovery inspectors will fail after the Agent upgrades to 5.1.1.
Other inspectors and core Agent functionality remain unaffected.
False positive “hack tool” alerts from antivirus/EDR solutions related to NMAP will stop.
This behavior is expected and intentional.
⚠️ Why NMAP Was Removed
Multiple antivirus and EDR platforms have recently begun detecting NMAP as a “hack tool” when packaged inside the Liongard Agent. Although NMAP is a legitimate tool, its dual-use nature caused:
False positive threat detections
Quarantining of the NMAP component
Agent instability on affected endpoints
In some cases, automated network isolation triggered by the security product
To protect partner environments and prevent service disruption, Liongard removed NMAP from the Agent in version 5.1.1.
🛑 Impact to Network Discovery Inspectors
The Network Discovery inspector relies on NMAP to scan devices and generate discovery results.
Because NMAP is no longer bundled with the Agent:
Network Discovery inspectors will fail
Discovery results will not populate or update
Any existing Network Discovery data will not refresh
This is the only inspector affected.
🛠 Temporary Workaround (Optional)
If your organization needs to continue using Network Discovery during this temporary removal period, you can restore functionality with a simple workaround:
✔️ Install NMAP manually
Install the official NMAP application directly on the device where the Network Discovery inspector is assigned.
After installation:
The Liongard Agent will detect the local NMAP installation
Network Discovery scans will resume normal operation
This is an interim solution and completely optional.
🚀 Long-Term Solution in Development
Liongard is currently working on a permanent fix that will re-enable Network Discovery without introducing AV/EDR risk.
Coming Soon: Digitally-Signed Embedded NMAP
Liongard will ship a new version of the Agent that includes:
A secure, digitally-signed NMAP binary signed by Liongard.
A version of NMAP that cannot be manually invoked or misused
Controlled execution that only accepts commands from:
The Liongard Agent
The Network Discovery inspector
Automatic removal of NMAP when the Agent is uninstalled
This approach:
Removes the need for standalone installation
Eliminates false positives
Prevents security products from isolating endpoints
Restores seamless Network Discovery functionality