Infrastructure: Attribution

The Attribution tab in the Infrastructure page [ Attack Surface ➔ Infrastructure ➔ Attribution] shows how infrastructure is attributed to your organization. It is the record-keeping system that tracks which assets each organization is responsible for.

How come the Assets tab is more extensive than the Attribution tab?

The Attribution tab aggregates infrastructure using CIDR blocks (IP ranges) and tracks domains at a higher level compared to the Assets tab. While a CIDR block has a large range of IP addresses, subdomains may be listed individually in Assets based on their observed activity.

• Get asset attribution details, including evidence used to make connections as a way to review what infrastructure belongs to an organization.
• Set an end date for the association.

Actions

Assign Tags

Assign an infrastructure tag to an asset. Multiple tags can be assigned to an asset.

Apply Infrastructure Tags

Instructions:

1. Hover over the asset.
2. Select Tag Infrastructure (, , or ).
3. Select tags from the Select Tags dropdown.
4. Select Confirm Changes.
5. Select Save Changes.

Bulk Actions

Complete an action in bulk, including tagging and removing infrastructure.

1. Select assets to edit with the Checkmark on the left.
2. Select the action to apply to the selected assets.

Customize Infrastructure

Create custom infrastructure.

1. Hover over the asset.
2. Select Create Custom Infrastructure.

Customize the Included Data

Select Customize columns at the top-right of the table.

Download Attribution Data (.csv)

Select Download CSV at the top-right of the table.

Filter the Attribution Data

Use the filters on the left.

Remove Infrastructure

Remove infrastructure.

1. Hover over the asset.
2. Select Request Removal.
3. Enter verification details into the Company Details.
4. Select Confirm Request Removal.

Fields

Any noise is filtered so only the data that are indicative of the organization’s control of that asset are displayed.

Example: Border Gateway Protocol (BGP) advertisements of some CIDR might stop from time to time. It’s a quirk of BGP that’s not indicative of the control of that CIDR.

❖ Select Customize Columns at the top-right of the table to include this field.

AS Number❖

Autonomous System Numbers (ASN) that are assigned to a company.

Applicable only for IP Addresses/CIDRs.

Attributed To

The organization or subsidiary attributed to this asset.

CIDR Size

The number of IP addresses in the CIDR block.

Applicable only for IP addresses/CIDRS.

Country

The location of the asset using an IP geolocation database, as listed int he registration.

Hostnames are located at the location connected with the IP address that they resolve to. Depending upon the information available to the location service, some locations are precise, others are defaulted to the geographic center of a country.

End Date

Either the date when this infrastructure was no longer valid (not attributed) or is still active.

Grace Period

There is a 60-day grace period when company-provided assets are added to infrastructure. The findings from the added infrastructure do not impact grading.

Grace Period End Date

The date the grace period for the infrastructure ends.

Is Active

The status within the Bitsight inventory.

Source

The source used to associate the infrastructure with the company; The reason why an IP or CIDR has been attributed to your organization.

If the source was not customer-provided or is custom infrastructure, select the asset to view more details; such as the organization’s name or the email associated with registration.

Applicable only for IP Addresses/CIDRs.

Start Date

The date when infrastructure is first attributed (active).

Tags

Infrastructure tags. that provide context for findings as they arise.

Value

The associated asset (IP address, CIDR block, or domain). The User indicates an asset is customer-provided.

Filters

Attributed To

Filter the attributed company.

Filter Values: Your My Company or My Subsidiary.

Country

Filter by the country listed in the registration.

• Country Name
• No Country

[Date] Start Date

Filter by when infrastructure was first attributed.

Filter Values: First attributed in the past...

• 7d (7 days)
• 1m (1 month)
• 3m (3 months)
• Custom

[Date] End Date

Filter by when infrastructure was end-dated.

Filter Values: Attribution was end-dated in the past...

• 7d (7 days)
• 1m (1 month)
• 3m (3 months)
• Custom

Grace Period

Filter by Impacts Risk Vector Grade with a No: Grace Period status.

Filter Values:

• Yes
• No

Grace Period End Date

Filter by grace period end dates within a specified date range.

Filter Values:

• Start Date
• End Date

Is Active

Filter values by active or inactive infrastructure.

• Only Active
• Only Inactive

Source

Filter by infrastructure data source.

Filter Values:

See sources.

Tags

Filter by infrastructure tag availability or visibility.

Filter Values:

• Public
• Private
• No Tags

Type

Filter by asset type.

Filter Values:

• IP Address
• Domain

Infrastructure Information

Select an asset to see the following infrastructure information:

Attribution

Attribution reasons of a Bitsight-curated asset.

Attribution Info

The attribution reason.

CIDR

The CIDR range if the asset is an IP address.

DNS Hostname

The DNS hostname if the asset is an IP address.

Information Link

The WHOIS record in the registry if the asset is a domain.

Tags

Infrastructure tags assigned to the asset.