> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/external-surface-attribution-evidence.md). # External Surface attribution evidence Cortex XSIAM provides attribution information about each asset in your External Surface inventory, so you know at-a-glance why we believe an asset belongs to your organization. **Inventory Origin field** Explains whether an asset was **Discovered** by Cortex XSIAM or **Provided** by your organization. This field is included on the Certificates, Domains, and External IP Address Ranges pages in your inventory. **Attribution Reason field** Indicates whether an asset was attributed to your organization because it is **Registered to You** or **Has Your Content**. This field is included on the **External IP Address Ranges** page in your inventory. **Asset Attribution Evidence** To review more detailed attribution evidence for an asset, click on an asset in the External Surface inventory to display the asset details and find the **Asset Attribution Evidence** section. For each asset, Cortex XSIAM provides the seed term that was used to attribute the asset to your organization and the specific piece of scan data that we matched to the seed term. A seed term is a text string that our research team generated and associated with your organization. For example, seed terms for Cortex Xpanse might include: Xpanse, Cortex, Cortex Xpanse, Palo Alto Networks, PANW, PAN, etc. We use machine learning models as well as manual research to match the seed terms with our scan data to attribute assets to your organization. Depending on the asset type and scan data, most assets will have one or more pieces of attribution evidence. Assets that don't have attribution evidence do not have a seed term match. The following are reasons we may not have a seed term match: * The domain or IP range is provided by the customer and cannot be externally validated using public data. * The domain registration information is redacted, blank, or private. We attribute these through manual routing. * The domain is attributed by an associated website (e.g. example.com is attributed to Example Corp because the website at [www.example.com](http://www.example.com) shows clear evidence of belonging to Example Corp). * The domain is attributed based on a DNS record. If you have questions about a specific asset, reach out to Customer Success. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/external-surface-attribution-evidence.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.