Remove assets - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide

Product
Cortex XPANSE
Version
2
Creation date
2024-12-02
Last date published
2025-02-02
Category
User Guide
Solution
Cloud
Abstract

Remove assets from your inventory through the UI.

You can remove assets from your inventory by submitting an asset removal request, in the form of a CSV file, through the Cortex Xpanse UI. After you've submitted an asset removal request, the requested assets appear in the Asset Uploads/Removal table with the status Removed. Within 24 hours of submitting the request, Cortex Xpanse will remove the assets from the inventory and remove associated alerts, incidents, and services,

Guidelines and restrictions for asset removals

Before you submit an asset removal request, familiarize yourself with the following guidelines and restrictions:

  • You can remove domains (paid-level domains and subdomains), certificates, and IPv4 ranges. Removal of IPv6 ranges is not supported.

  • The asset removal request CSV file must be less than 2 MB.

  • You cannot remove an asset that was uploaded in a previous upload request. This will cause an error that must be fixed before you can submit the upload request.

  • When you remove a paid-level domain, related subdomains are also removed.

  • When you remove an IPv4 range, the individual IPv4 addresses in that range are also removed.

  • You can undo a removal request, which will result in the asset being added back to your inventory. See Undo an asset removal for more information.

  • Removing assets will not result in a reduction to your contract price. Contract pricing will be reevaluated at the time of contract renewal.

Note

If an asset removal request has an incorrectly formatted CSV or includes one or more invalid assets, the entire request will fail, and none of the assets will be removed. If this happens, Cortex Xpanse will display an error message indicating what caused the error, so you can fix the problem and resubmit if you choose.

How to submit an asset removal request

An asset removal request is a CSV file that lists all the assets you want to remove from your inventory. It is important that the data and formatting of the CSV file are correct, or the entire request might be rejected.

  1. Create and save a CSV file that lists the assets you want to remove from your inventory. Be sure to provide the correct asset information and follow the formatting requirements described in CSV format for removal requests.

  2. Navigate to SettingsConfigurationsAsset ManagementAsset Uploads/Removals.

  3. Click on the Asset Upload/Removal button and select Remove Asset(s).

  4. Drag and drop or browse to your CSV file to upload it to Cortex Xpanse.

    As soon as the file has been successfully uploaded, the assets will appear in the Asset Uploads/Removals table with the status Removed. Within 24 hours, the assets will be removed from the inventory and related incidents, alerts, and services will also be removed.

An asset removal request is a CSV file that lists the assets you want to remove from the inventory. It is important to format the CSV file to match the following requirements. Incorrect formatting or typos may cause the upload to fail.

Remove request example

This example shows the correct CSV format for an asset removal request, including the supported asset types and IP range notation. The headers in your CSV must match the headers shown here.

AssetType

Asset

Domain

example.com

Domain

example1.com

IPv4_Range

192.0.2.0/32

IPv4_Range

192.0.2.0-192.0.2.0

IPv4_Range

192.0.2.0-192.0.24

IPv4_Range

192.0.2.0/27

Remove request CSV details

The following table provides details about each field that is required in an asset removal request CSV file.

Field

Details

Asset Type

The header for this field must be written as AssetType.

Supported values are Domain, IPv4_Range, and Certificate. Use the IPv4 Range asset type to remove individual IP addresses.

Asset

This is the specific domain, certificate, or IPv4 range you want to add to your inventory.

IP ranges can be specified using the following types of notation:

  • CIDR notation

  • <First IP address>-<Last IP address>

Individual IP addresses can be specified using the following notation:

  • 192.0.2.0/32

  • 192.0.2.0-192.0.2.0