topic What part of the network did an alert generate from? in Cortex XSIAM Discussions

What part of the network did an alert generate from?

amcdonal363 — Wed, 11 Dec 2024 16:48:24 GMT

Within XSIAM, an enterprises' network asset ranges are defined at Assets > Network Configuration. On adding a network, you are able to assign the network a range name and and IP address range.

When an alert is generated within XSIAM, where is the range name found within the alert?

We want easily be able to see from which part of the enterprise network the alert is originating from.

Re: What part of the network did an alert generate from?

MDovirak — Mon, 16 Dec 2024 14:59:09 GMT

network conf purpose in XSIAM to show the active manage assets in each network zone and use this configuration for the BrokerVM Network Mapper.
If you want to display range name in the alerts, you should create a custom layout for the alert, create a custom field "Network Name' and make a playbook that will check the range and map correct name for this range. It could be as json list.
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Use-cases-JSON-lists