Modify the Business Unit for an IPv4 Range - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide

Product
Cortex XPANSE
Version
2
Creation date
2024-03-28
Last date published
2024-05-24
Category
User Guide
Solution
Cloud
Abstract

Update the BU assignment for an IPv4 address range.

You can modify the business unit (BU) assignment for an IPv4 range in the context of an incident or in the Inventory view. The following sections describe the steps.

Changes to business unit assignments may take up to an hour to appear in alerts and incidents. Review Business Unit Management for IP Ranges to learn more about how business unit assignments work for IP ranges.

How to modify the BU for an IP range in an incident

Business unit updates are often made in the context of an incident. Updating the business unit for one asset associated with an incident will not necessarily update the business unit for other assets associated with the same incident. You might have to update the business unit for each asset in the incident individually.

  1. Navigate to Incident ResponseIncidents.

  2. Click on an incident in the incident list on the left.

    The incident details open in the right pane.

  3. Select the Assets tab in the incident details.

    The assets, including IP ranges, associated with the incident are listed in the Asset Attribution Evidence section.

    incident-assets-bu.png
  4. Click the edit icon pencil-icon.png next to Business Units for the IP range you want to update.

    The Edit Asset Business Unit Tags window will open.

  5. Select one of the following options, and then click Next:

    • Edit Business Units for entire IP Range—modifies the BUs for the entire IP range.

    • Edit Business Units for a subset IP Range—modifies the BUs for a IP range that you define.

      Enter the Starting IP address and Ending IP address to define the custom range. You can also define the custom range in CIDR format.

    • Edit Business Units for single IP address—modifies the BUs for a specific IP address.

    edit-bu-range-incident.png
  6. Add or remove business units by selecting or deselecting them in the list. Click Next.

  7. Add a comment in the Change Reason box explaining why the change was made, then click Next.

  8. Select how you want to handle conflicts with previously-defined ranges by choosing to Keep previously applied business units or Replace all previously-applied business units. If you choose to replace, confirm your choice by entering REPLACE in the dialog box.

    This step applies only if there are conflicts with previous-defined ranges with different BU assignments.

    resolve-conflicting-ranges.png
  9. Review the final list of business units to be assigned to the range. Changes to business units may impact user access to related incidents, alerts, and services, so be sure to review the specific impacts this change will have on scope-based user access. Click Apply.

How to modify the BU for an IP range in the Inventory
  1. Navigate to InventoryOwned IPv4 Ranges.

  2. Click on the range in the table you want to update. The details panel for that range will open.

  3. Click the edit icon pencil-icon.png next to Business Units in the details panel.

    The Edit Asset Business Unit Tags window will open.

  4. Select one of the following options, and then click Next:

    • Edit Business Units for entire IP Range—modifies the BUs for the entire IP range.

    • Edit Business Units for a subset IP Range—modifies the BUs for a IP range that you define.

      Enter the Starting IP address and Ending IP address to define the custom range. You can also define the custom range in CIDR format.

  5. Add or remove business units by selecting them in the list. Click Next.

  6. Add a comment in the Change Reason box explaining why the change was made, then click Next.

  7. Select how you want to handle conflicts with previously-defined ranges by choosing to Keep previously applied business units or Replace all previously-applied business units. If you choose to replace, confirm your choice by entering REPLACE in the dialog box.

    This step applies only if there are conflicts with previous-defined ranges with different BU assignments.