When your case queue contains IP address entities, how should you determine internal vs external and mark internal IPs during ingestion into SOAR?

• A. Indicate known internal CIDR ranges in Environment Networks list in settings.
• B. Modify connector logic with CMDB lookup.
• C. Configure a feed to ingest network enrichment and include fields in detection outcome.
• D. Custom action to ping IP via Remote Agent and mark internal if successful.

Answer: (A)

Use the built-in Environment Networks list to classify IPs as internal or external. In SOAR settings, you can specify internal CIDR ranges that represent your trusted networks. When IP addresses are ingested as entities, the system automatically checks them against those CIDR blocks and marks any matching IPs as internal. This centralized, config-driven approach ensures consistent tagging across cases and playbooks without needing extra lookups or active network probes.

Why this is the best fit: it leverages a native feature designed for this purpose, offering fast, scalable, and maintainable classification. It avoids the overhead and potential inaccuracies of external lookups (like CMDB queries), additional data feeds, or active probing. Pinging IPs or relying on enrichment feeds introduces delays, inconsistencies, or network exceptions, making them less reliable for deterministic ingestion tagging.

In short, maintaining internal CIDR ranges in the Environment Networks list provides a clean, effective way to distinguish internal from external IPs during ingestion.