Infrastructure: Attribution

⇤ Infrastructure

Use the Attribution tab in the Infrastructure page to manage how infrastructure is attributed to your organization, including:

• Get asset attribution details.
• Set an end date for the association.

Attribution

A CIDR block is attributed to an organization by matching its name and/or the email address listed in the record with a legal entity.

Example: An RIR record listing “BITSIGHT” is attributed to the “Bitsight Technologies” legal entity.

This is done and maintained using the following processes:

• Collection: Custom tooling is used to search and identify email addresses in RIR databases that match domains curated for the organization.
• Curation: Human curators validate the collected assets. Curation is critical to assure accurate attribution of assets.
• Automation: After the initial mapping, automation tools continuously analyze asset evidence. Assets are automatically added to and removed from organizations based on definitive evidence. If the evidence gathered during collection is removed from an RIR record, the CIDR block is end-dated from the organization’s assets and new findings will no longer be associated with the organization.

Fields

Any noise is filtered so only the data that are indicative of the organization’s control of that asset are displayed.

Example: Border Gateway Protocol (BGP) advertisements of some CIDR might stop from time to time. It’s a quirk of BGP that’s not indicative of the control of that CIDR.

❖ Use the Customize Columns button to customize fields that are included in the table.

Field	Description	Filters
AS Number❖	Autonomous System Numbers (ASN) that are assigned to a company. Applicable only for IP Addresses/CIDRs.	No
Attributed To	The attributed entity.	Yes
CIDR Size	The number of IP addresses in the CIDR block.	No
Country	The location of the asset using an IP geolocation database. Hostnames are located at the location connected with the IP address that they resolve to. Depending upon the information available to the location service, some locations are precise, others are defaulted to the geographic center of a country.	Yes
End Date	The date when infrastructure is no longer attributed (inactive).	7 Days 1 Month 3 Months Custom
Is Active	= Active = Inactive	Yes
Source	The source used to associate the infrastructure with the company; The reason why an IP or CIDR has been attributed to your organization. If the source was not customer-provided or is a custom subnet, select the asset to view more details; such as the organization’s name or the email associated with registration. Applicable only for IP Addresses/CIDRs.	No Source Customer-Provided Registrar
Start Date	The date when infrastructure is first attributed (active).	7 Days 1 Month 3 Months Custom
Tags	Infrastructure tags. Use the Add button to tag an asset.	Public/private Tag name
Value	The associated asset (IP address, CIDR block, or domain). The User indicates an asset is company-provided.	Type: Hostname IP

Infrastructure Information

Select an asset to see the following infrastructure information: