Attack surface assets
Manage Cortex XSIAM attack surface assets and submit CSV requests to add or remove them.
The internet-facing assets that were discovered in an attack surface management (ASM) scan and attributed to your organization are available in the inventory on the Inventory → Assets → All Assets → External Surface pages. For information about External Surface assets, including domains, certificates, services, and websites, see External Surface assets.
To view your external IP address ranges in the inventory, navigate to Inventory → Assets → Network Configuration → IP Address Ranges → External IP Address Ranges. For information about external IP address ranges, see Configure your network parameters.
Upload or remove ASM assets
In Cortex XSIAM, you can upload assets or remove assets from your inventory through the UI. This feature simplifies inventory management by enabling you to make ad hoc inventory updates yourself as needed. To make large-scale scope changes to your inventory (for example, a merger with a new organization), contact your Customer Success Architect for assistance.
Upload assets
You can add assets to your inventory by submitting an asset upload request, in the form of a CSV file, through the Cortex XSIAM UI. After submitting an asset upload request, the requested assets will appear in the Asset Uploads/Removal table with the status Pending Review. Cortex XSIAM will respond to your upload request within five days of submission. The status of each asset will be updated in the Asset Uploads/Removal table to either Accepted, which indicates that the asset has been added to your inventory, or Rejected. Rejected assets will have an explanation for the rejection.
Guidelines and restrictions for asset uploads
Before you submit an asset upload request, familiarize yourself with the following guidelines and restrictions:
You can upload domains (paid-level domains and subdomains) and IPv4 ranges. You can upload a single IPv4 address, but it must be submitted as an IPv4 range asset type. Upload of certificates and IPv6 ranges is not yet supported.
An asset upload request can include up to 500 assets.
The asset upload request must follow the CSV formatting requirements described in the CSV format for upload requests section.
You cannot upload an asset that was added or rejected in a previous upload request. This will cause an error that must be fixed before you can submit the upload request.
You cannot upload an asset that was previously removed in an asset removal request. Instead, you can undo an asset removal request, which will result in the asset being added back to your inventory. See Remove assets for details.
Note
If an asset upload request has an invalid CSV or includes one or more invalid assets, the entire request will fail, and none of the assets will be uploaded. If this happens, Cortex XSIAM will display an error message indicating what caused the error, so you can fix the problem and resubmit if you choose.
How to submit an asset upload request
Create and save a CSV file that lists the assets you want to add to your inventory. It is important to format the CSV file correctly, or the upload might fail. Refer to CSV format for upload requests for an example and details about upload request CSV file formatting.
Navigate to Settings → Configurations → Asset Management → Asset Uploads/Removals.
Click the Asset Upload/Removal button and select Add Asset(s).
Drag and drop or browse to your CSV file to upload it to Cortex XSIAM.
The assets will be added to the Asset Uploads/Removals table with the status Pending,
Check the status of your asset upload request as needed on the Asset Uploads/Removals page.
Within five days of submitting your request, each asset will be Accepted and added to the inventory or Rejected. Assets that were rejected will include an explanation in the Decision Reason field.
Remove assets
You can remove assets from your inventory by submitting an asset removal request, in the form of a CSV file, through the Cortex XSIAM UI. After you've submitted an asset removal request, the requested assets appear in the Asset Uploads/Removal table with the status Removed. Within 24 hours of submitting the request, Cortex XSIAM will remove the assets from the inventory and remove associated alerts, incidents, and services,
Guidelines and restrictions for asset removals
Before you submit an asset removal request, familiarize yourself with the following guidelines and restrictions:
You can remove domains (paid-level domains and subdomains), certificates, and IPv4 ranges. Removal of IPv6 ranges is not supported.
The asset removal request CSV file must be less than 2 MB.
You cannot remove an asset that was uploaded in a previous upload request. This will cause an error that must be fixed before you can submit the upload request.
When you remove a paid-level domain, related subdomains are also removed.
When you remove an IPv4 range, the individual IPv4 addresses in that range are also removed.
You can undo a removal request, which will result in the asset being added back to your inventory. See Undo an asset removal for more information.
Removing assets will not result in a reduction to your contract price. Contract pricing will be reevaluated at the time of contract renewal.
Note
If an asset removal request has an incorrectly formatted CSV or includes one or more invalid assets, the entire request will fail, and none of the assets will be removed. If this happens, Cortex XSIAM will display an error message indicating what caused the error, so you can fix the problem and resubmit if you choose.
How to submit an asset removal request
An asset removal request is a CSV file that lists all the assets you want to remove from your inventory. It is important that the data and formatting of the CSV file are correct, or the entire request might be rejected.
Create and save a CSV file that lists the assets you want to remove from your inventory. Be sure to provide the correct asset information and follow the formatting requirements described in CSV format for removal requests.
Navigate to Settings → Configurations → Asset Management → Asset Uploads/Removals.
Click on the Asset Upload/Removal button and select Remove Asset(s).
Drag and drop or browse to your CSV file to upload it to Cortex XSIAM.
As soon as the file has been successfully uploaded, the assets will appear in the Asset Uploads/Removals table with the status Removed. Within 24 hours, the assets will be removed from the inventory and related incidents, alerts, and services will also be removed.
Last updated
Was this helpful?