How are assets attributed to your organization? - 1.0 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Assess User Guide

Creation date
Last date published
User Guide

All assets include an attribution reason in the top section of the asset details section. The attribution section describes the reason Cortex Xpanse attributed that asset to your company.

Cortex Xpanse uses a variety of methods to attribute IP range assets to organizations. These reasons include:

  • IP Registration—The IP range’s registry information mentions information about your organization. Cortex Xpanse pulls from all regional internet registry databases, including ARIN, RIPE, APNIC, LACNIC, and AFRINIC. Registry information in your Cortex Xpanse instance is updated approximately biweekly.

  • ASN Advertisement—An autonomous system number (ASN) assigned to you advertises the IP range as a BGP prefix.

  • Certificate—That IP range advertised one of your certificates.

  • DNS—A DNS record points to an IP in that IP range. Cortex Xpanse gets its domains and DNS data from a combination of active and passive global collection techniques.

  • Self-Provided—The asset was on an IP address list provided to Cortex Xpanse by your organization or by Xpanse for a reason other than those listed above.