If an Element is selected and then added to a Collection, it has direct membership in that Collection.

For example, if a CIDR is added to a Collection, that particular CIDR is a direct member of the Collection. This means it can be added or removed from the Collection via the Rule page.

It is important to note that all of the IPs and FQDNs that are part of that CIDR are added to the Collection when a CIDR is added, but they are considered inherited members of that Collection.

This means that these Elements may not be added to or removed from the Collection. The only way to remove inherited members is by removing the direct member/Element they belong to.

An Element Being Added to a Collection

Inherited elements may cause the collection element count to be greater than expected because they are automatically added to the collection under the direct member they belong to.

Because Inherited elements are automatically added to the collection, they will also appear in the elements table, even though they were not directly selected to be part of the Collection.

This is especially important to remember when importing Elements Owners, ASNs, and CIDRs from CSV.

Threats appear in collections because they are associated with elements in the collection. If a threat is associated with an IP or FQDN in the selected collection, it appears on the threats list.

Related Content