Which setting should you configure to automatically identify internal CIDR ranges for IP addresses during ingestion into SecOps?

• A. Indicate known internal CIDR ranges in Environment Networks list in settings.
• B. Modify the ingestion pipeline to tag internal IPs.
• C. Use a dynamic lookup to classify IPs at runtime.
• D. Create a manual override for internal IPs per case.

Answer: (A)

Automatically identifying internal IPs during ingestion is done by listing the known internal CIDR ranges in the Environment Networks settings. This creates a centralized reference of what counts as “internal,” so as IP addresses are ingested into SecOps, the system can automatically compare them against that list and label them appropriately without any extra work.

This approach is best because it makes the classification automatic and consistent across all data sources. Once the internal ranges are defined, every incoming event with an IP address will be evaluated against the list, ensuring uniform labeling and reducing manual effort or per-case decisions.

Other options add complexity or potential gaps. Modifying the ingestion pipeline to tag internal IPs requires changing each data flow, which is maintenance-heavy and prone to missed sources. A dynamic lookup at runtime could work but adds latency and a dependency on an external service that must be reliable and kept up-to-date. Creating manual overrides per case defeats automation and is not scalable for large environments.