Infrastructure: Attribution

The Attribution tab in the Infrastructure page [ Attack Surface ➔ Infrastructure] shows how infrastructure is attributed to your organization.

• Get asset attribution details.
• Set an end date for the association.

Assets are attributed to an organization by matching names and/or the email addresses associated in the record with a legal entity. This is done and maintained using the following processes:

• Collection: Custom tooling is used to search and identify email addresses in RIR databases that match domains curated for the organization.
• Curation: Human curators validate the collected assets. Curation is critical to assure accurate attribution of assets.
• Automation: After the initial mapping, automation tools continuously analyze asset evidence. Assets are automatically added to and removed from organizations based on definitive evidence. If the evidence gathered during collection is removed from an RIR record, the CIDR block is end-dated from the organization’s assets and new findings will no longer be associated with the organization.

Example: An RIR record listing “BITSIGHT” is attributed to the “Bitsight Technologies” legal entity.

Bitsight API: GET /v1/companies/company_guid/infrastructure/reasons

Actions

Action	Instructions
Apply infrastructure tags:	Hover over the asset. Select Tag Infrastructure (, , or ). Select tags from the Select Tags dropdown. Select Confirm Changes. Select Save Changes.
Bulk actions: Tag Remove	Select assets to edit with the Checkmark on the left. Select the action to apply to the selected assets.
Create custom infrastructure:	Hover over the asset. Select Create Custom Infrastructure.
Customize the included data:	Select Customize columns at the top-right of the table.
Download attribution data (.csv):	Select Download CSV at the top-right of the table.
Filter the data:	Use the filters on the left.
Remove infrastructure:	Hover over the asset. Select Request Removal. Enter verification details into the Company Details. Select Confirm Request Removal.

Fields

Any noise is filtered so only the data that are indicative of the organization’s control of that asset are displayed.

Example: Border Gateway Protocol (BGP) advertisements of some CIDR might stop from time to time. It’s a quirk of BGP that’s not indicative of the control of that CIDR.

❖ Use the Customize Columns button to customize fields that are included in the table.

Field	Description
AS Number❖	Autonomous System Numbers (ASN) that are assigned to a company. Applicable only for IP Addresses/CIDRs.
Attributed To	The attributed entity.
CIDR Size	The number of IP addresses in the CIDR block.
Country	The location of the asset using an IP geolocation database. Hostnames are located at the location connected with the IP address that they resolve to. Depending upon the information available to the location service, some locations are precise, others are defaulted to the geographic center of a country.
End Date	The date when infrastructure is no longer attributed (inactive).
Is Active	The status within the Bitsight inventory.
Source	The source used to associate the infrastructure with the company; The reason why an IP or CIDR has been attributed to your organization. If the source was not customer-provided or is custom infrastructure, select the asset to view more details; such as the organization’s name or the email associated with registration. Applicable only for IP Addresses/CIDRs.
Start Date	The date when infrastructure is first attributed (active).
Tags	Infrastructure tags. Use the Add button to tag an asset.
Value	The associated asset (IP address, CIDR block, or domain). The User indicates an asset is customer-provided.

Filters

Infrastructure Information

Select an asset to see the following infrastructure information: