Populate the company subnet directory

You can incorporate location data from your company into Exposure Analytics if you have a subnet listing. The company subnet directory enriches asset entities with fields like location, environment, business unit provider, and priority. Populating a company subnet directory is optional, but it's especially useful for identifying asset locations and enriching entities.

To populate the company subnet directory, complete the following steps:

  1. In Exposure Analytics, select Configure then All configurations.

  2. In the Exposure analytics section, select Inventory enrichment.

  3. Update the subnet listing by uploading a CSV file, entering a Splunk search, or manually entering the subnet fields. Follow the steps for your preferred method:
Method Steps
Upload a CSV file
  1. Select the upload icon ( upload ). The CSV file you upload must contain the required subnet listing fields. See Required subnet listing fields.
  2. Using the drop-down list, select whether you want to Merge or Overwrite any existing data.
  3. Select Upload.
Note: The maximum upload size limit is 5mb. Upload larger files or files containing fields with different names using the Splunk lookup functionality.
Populate using a Splunk search
  1. Select the three dot icon.
  2. Enter your search using the Search Processing Language (SPL). The search must return the required subnet listing fields. See Required subnet listing fields. For example, the end of a search looks like the following:
    CODE 
    | table subnet, location_id, city, state, country, region, provider, type, vlan, description, zone
  3. Select Merge or Overwrite for the Search mode. You can choose to overwrite any existing subnets with the search, or you can merge the search with existing subnets, including entries that have already been manually added.
  4. (Optional) If you want to run the search immediately, select Run search. Selecting this option runs the search before the designated cron schedule.
  5. (Optional) Preview your search results by selecting Preview search.
  6. Select Save.
Manually enter the subnet fields
  1. Select + Add.
  2. Enter a value for each subnet field.
  3. Select Add.

After you populate the company subnet directory, you can manually add more entries by selecting + Add. You can edit, clone, or remove entries using the Actions icons.

Required subnet listing fields

The subnet listing must contain the following fields:

Field Value
subnet Subnet and mask. For example, 10.10.10.10/24.
cim_entity_zone Entity zone used by entity discovery processing to look up the subnet for a matching zone. This does not enrich discovered entities with zone.
location_id Any location ID used by the business.
bunit Business unit of the subnet.
environment Environment of the subnet. For example, "dev" or "test".
description Description of the subnet entry.
provider Name of a provider. For example, AWS.
city City name for the entry.
state 2-digit U.S. state or Canadian province. For example, "ON".
country 2-digit country code. For example, "US".
region Region. For example, "AMER" or "EMEA".
type Subnet type of the entry.
priority Priority of the subnet. For example, "Critical" or "Low".
vlan Subnet virtual LAN of the entry.
Note: Some fields can have null values, but the fields must be included in the lookup table header. Don't change null values to "unknown" or something similar.