Modify the Business Unit for an Asset - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide

Product
Cortex XPANSE
Version
2
Creation date
2024-08-29
Last date published
2024-11-06
Category
User Guide
Solution
Cloud
Abstract

Update the business unit assignment for an asset in the context of an incident or in the Inventory.

You can modify the business unit (BU) assignment for an asset in the context of an incident or in the Inventory view. The following sections describe the steps.

The steps are slightly different for IPv4 ranges, so refer to Modify the Business Unit for an IPv4 Range for those details.

Changes to business unit assignments may take up to an hour to appear in alerts and incidents. Review Manage Business Units to learn more about how business unit assignments work.

How to modify the BU for an asset in an incident

Business unit updates are often made in the context of an incident. Updating the business unit for one asset associated with an incident will not necessarily update the business unit for other assets associated with the same incident. You might have to update the business unit for each asset in the incident individually.

  1. Navigate to Incident ResponseIncidents.

  2. Click on an incident in the incident list on the left.

    The incident details open in the right pane.

  3. Select the Assets tab in the incident details.

    Each asset associated with the incident is listed in the Asset Attribution Evidence section.

    incident-assets-bu.png
  4. Click the pencil icon pencil-icon.png next to Business Units for the asset you want to update.

    The Edit Asset Business Unit Tags window will open.

  5. Add or remove business units by selecting them in the list. If the asset is a parent domain, select Make changes to related subdomains if needed. Click Next.

    add-bu-screen.png
  6. Add a comment in the Change Reason box explaining why the change was made, then click Next.

  7. Review the final list of business units to be assigned to the asset. Also review the specific impacts this change will have on scope-based user access. Click Apply.

    Note that the change may impact user access to incidents, alerts, and services in addition to the asset.

How to modify the BU for an asset in the Inventory
  1. Navigate to Inventory and open the Unified Inventory or one of the asset type pages from the main menu.

  2. Click on the asset in the table you want to update. The details panel for that asset will open.

  3. Click the edit icon pencil-icon.png next to Business Units in the details panel.

    The Edit Asset Business Unit Tags window will open.

  4. Add or remove business units by selecting them in the list. If the asset is a parent domain, select Make changes to related subdomains if needed. Click Next.

  5. Add a comment in the Change Reason box explaining why the change was made, then click Next.

  6. Review the final list of business units to be assigned to the asset. Also review the specific impacts this change will have on scope-based user access. Click Apply.

    Note that the change may impact user access to incidents, alerts, and services in addition to the asset.