Modify the Business Unit for an IPv4 Range - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Business unit updates are often made in the context of an incident. Updating the business unit for one asset associated with an incident will not necessarily update the business unit for other assets associated with the same incident. You might have to update the business unit for each asset in the incident individually.

1. Navigate to Incident Response → Incidents.

2. Click on an incident in the incident list on the left.

   The incident details open in the right pane.

3. Select the Assets tab in the incident details.

   The assets, including IP ranges, associated with the incident are listed in the Asset Attribution Evidence section.

4. Click the edit icon next to Business Units for the IP range you want to update.

   The Edit Asset Business Unit Tags window will open.

5. Select one of the following options, and then click Next:

   • Edit Business Units for entire IP Range—modifies the BUs for the entire IP range.

   • Edit Business Units for a subset IP Range—modifies the BUs for a IP range that you define.

     Enter the Starting IP address and Ending IP address to define the custom range. You can also define the custom range in CIDR format.

   • Edit Business Units for single IP address—modifies the BUs for a specific IP address.

6. Add or remove business units by selecting or deselecting them in the list. Click Next.

7. Add a comment in the Change Reason box explaining why the change was made, then click Next.

8. Select how you want to handle conflicts with previously-defined ranges by choosing to Keep previously applied business units or Replace all previously-applied business units. If you choose to replace, confirm your choice by entering REPLACE in the dialog box.

   This step applies only if there are conflicts with previous-defined ranges with different BU assignments.

9. Review the final list of business units to be assigned to the range. Changes to business units may impact user access to related incidents, alerts, and services, so be sure to review the specific impacts this change will have on scope-based user access. Click Apply.

1. Navigate to Inventory → Owned IPv4 Ranges.

2. Click on the range in the table you want to update. The details panel for that range will open.

3. Click the edit icon next to Business Units in the details panel.

   The Edit Asset Business Unit Tags window will open.

4. Select one of the following options, and then click Next:

   • Edit Business Units for entire IP Range—modifies the BUs for the entire IP range.

   • Edit Business Units for a subset IP Range—modifies the BUs for a IP range that you define.

     Enter the Starting IP address and Ending IP address to define the custom range. You can also define the custom range in CIDR format.

5. Add or remove business units by selecting them in the list. Click Next.

6. Add a comment in the Change Reason box explaining why the change was made, then click Next.

7. Select how you want to handle conflicts with previously-defined ranges by choosing to Keep previously applied business units or Replace all previously-applied business units. If you choose to replace, confirm your choice by entering REPLACE in the dialog box.

   This step applies only if there are conflicts with previous-defined ranges with different BU assignments.