Create Inventory Tag Rules - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide
Product
Cortex XPANSE
Version
2
Creation date
2024-12-02
Last date published
2025-02-02
Category
User Guide
Solution
Cloud
Abstract

Define inventory tag rules to apply tags automatically to assets that match your rule criteria, including any new assets that are attributed to your organization.

You can define inventory tag rules that apply tags automatically to assets that match your rule criteria, including any new assets that are attributed to your organization. Tag rules can be created for IPv4 addresses, certificates, domains, and Prisma Cloud resources.

Keep in mind the following guidelines when creating inventory tag rules:

  • Rules-based tags use the tag designation TR. You can only use rules-based tags (TR) in inventory tag rules. You cannot use asset tags (AT) or IP range tags (IPR).

  • Each inventory tag rule applies to one asset type.

  • If you define an inventory tag rule by specifying an IP address range, the rule will apply the tag to any responsive IPs in that range, not to the range itself. You can use one of the following formats to identify the range in the rule criteria:

    • x.x.x.*

    • x.x.x.1–x.x.x.2

    • x.x.x.x/24

  • Use the wildcard special character (*) to search text fields in the UI, for example you could search for test.*.example.com to find related subdomains.

How to create an inventory tag rule

  1. Navigate to Rules → Inventory Tag Rules.

  2. Click + Add New Rule.

  3. Add a unique name for the rule and, optionally, a description.

  4. Define the rule criteria using the filter. Assets matching the rule criteria will be tagged with the rules-based tag.

    The list of matching assets is displayed below the rule criteria.

  5. Select the tags to be applied to the matching assets. Choose from the list of existing tags or Add a new tag by entering a tag name and clicking + Add Tag. You can only use Rules-Based Tags (TR) in tag rules.

  6. Click Submit.

Edit or Delete Inventory Tag Rules

  1. Navigate to Rules → Inventory Tag Rules.

    A list of the existing inventory tag rules will be displayed.

  2. Delete a tag rule by right-clicking in the row for the rule, and selecting Delete rule.

    Deleting a tag rule will remove the tag from the assets and associated services, alerts, and incidents.

  3. Edit a tag rule by right-clicking in the row for the rule, and selecting Edit rule.

    When you are finished editing the rule, click Submit to save the changes.