Configure Cortex XSIAM network parameters - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-05-22
Category
Administrator Guide
Abstract

Define the IP address ranges and domain names used by Cortex XSIAM to identify your network assets.

Define your internal IP address ranges and domain names to enable Cortex XSIAM to identify, track, and analyze network assets.

Define internal IP address ranges

The IP Address Ranges page displays the address ranges that Cortex XSIAM  - Analytics monitors. Addresses are pre-populated with the default IPv4 and IPv6 address spaces. The names you define will appear when investigating the network-related events in Cortex XSIAM.

You can add a new IP address range manually or upload IP address ranges from a CSV file.

How to define internal IP address ranges
  1. Select AssetsNetwork ConfigurationInternal IP Address Ranges.

  2. Do one of the following:

    To

    Do this

    Add a new IP address manually

    1. Click Add New RangeCreate New, and then enter the IP address name and IP address range or CIDR values.

      By default, Cortex XSIAM creates Private Network ranges that specify reserved industry-approved ranges. Private Network ranges are marked with a assets-private-network.png icon and you can only edit the name.

      Note

      You can add a range that is fully contained in an existing range, however, you cannot add a new range that partially intersects with another range.

    2. Click Save.

    Upload IP address ranges from a CSV file

    1. Select AssetsNetwork ConfigurationInternal IP Address Ranges.

    2. Click Add New RangeUpload from File.

    3. Locate the CSV file you want to upload, and then click Add.

Define internal domain names
  1. Select AssetsNetwork ConfigurationInternal Domain Suffixes.

  2. Type the domain suffix you want to include as part of your internal network, for example, acme.com.

  3. Select network-mapper-enter.png to add the suffix to the Domains List.