Tagging

Intelligent tagging is a process of either suggesting or assigning tags to an asset based on the asset characteristics. An intelligent tagging rule is a configuration that assigns terms to an asset based on the asset metadata, field values or data collected from the asset endpoint. Intelligent tagging is triggered at the various stages of the asset's lifecycle such as asset creation, updating, bulk tagging or importing.

An intelligent tagging rule contains a selection clause and the set of tags to apply to the asset that matches the rule selection clause. For example, a rule might prescribe to assign tags [Component :: Server :: Windows] and [Component :: Database] terms to the asset with the host name MSSQL-NA03 based on the fact that the host name contains MSSQL.

Intelligent tagging is a useful tool to automatically assign terms to assets based on the known data. Intelligent tagging rules could be created to follow naming conventions used in the organization, IP locations of the groups of endpoints, device vendor or version information.

Creating Tagging Rules

The tagging rule selection clause is constructed from several conditions combined using an AND or OR conditions predicate designated by a rule designer. Each condition contains several criteria using an AND or OR criteria predicate also chosen by a rule designer. Such flexibility allows the designer to construct simple queries that contain a single condition with a single criteria as well as complex queries with multiple AND and OR predicates connecting groups of queries. As an example, consider a query selecting an asset with the host name either SQL OR Postgres AND a Windows kernel.

Tagging rule criteria contains criteria Type, Match and the Query to match the data selected by type. Simple example of the criteria is: Host contains SQL where Host is the type prescribing to select the asset's host field, contain is a match and SQL is the query.

To create a tagging rule:

Log in with an Administrator or Intelligent Tagging Manager account.
Navigate to Management > Tagging and click the Add button to create a new tagging rule.
Click on the parameter name for details about each or follow the guidance provided here:
- Name: Enter a unique and recognizable name for the tagging rule. This rule name is often reported during intelligent tagging suggestion generation to identify the rule generating the terms for tagging.
- Conditions Predicate: The conditions predicate prescribes whether multiple conditions in the tagging rule selection clause should be combined using an AND or OR predicate. This parameter is disabled until two or more conditions are included.
  - Condition 1 AND Condition 2 AND Condition 3, ...
  - Condition 1 OR Condition 2 OR Condition 3, ...
- Condition: A condition contains one or more criteria combined with an AND or OR predicate used to construct a query.
  - Criteria Predicate: Criteria predicate prescribes whether multiple criteria in the tagging rule condition should be combined using an AND or OR predicate. This parameter is disabled until two or more criteria are included in the condition.
    - Criteria A AND Criteria B AND Criteria C, ...
    - Criteria A OR Criteria B OR Criteria C, ...
  - Type: Select the type of criteria from the following options:
    - Host is the asset host field
    - Container is any container name in the path where the asset is located
    - IP is the IP address or an IP range the asset host is resolved to
    - Source is the targeted data source that triggers the tagging rule. If a Source type is not included in the criteria, it will be evaluated against all data sources. Available data sources are:
      - GUI - targets assets created or edited using the software's WEB GUI or REST API.
      - Mass - targets assets updated using the Mass Tagging option.
      - CSV - targets assets imported to the asset database using a CSV file
      - LDAP - targets assets imported to the asset database from an LDAP compatible MS Active Directory source.
      - VMWare - targets assets imported to the asset database from a VMWare source.
      - AWS - targets assets imported to the asset database from an AWS source.
    - Asset Type is the asset type name
    - Kernel is the OS kernel collected from the asset endpoint
    - Host Name is the host name collected from the asset endpoint
    - Service Port is the port of one of the services detected on the asset endpoint
    - Service Process is the process name of one of the services detected on the asset endpoint
  - Match: Match types are used to validate the query matches the selected piece of metadata selected by the criteria Type. Select from the following options:
    - Equals means that the query should equal the metadata field
    - Contains means that the metadata field should contain the query
    - RegEx means that the metadata field should contain the patterns given by the regular expression in the query
  - Query: Enter the case insensitive value used by the Type and Match to identify the asset.
  - Actions: Use the Add button to add the criteria to the condition or use the Remove button to remove this selected criteria from the condition. Note that a condition must contain at least one criteria.
- Taxonomy: The tagging rule taxonomy that is used as a source of the tagging rule terms.
- Tags: The list of terms that will be applied to the asset in case the rule selection clause matches the asset's characteristics.
- Enabled: An indicator that the tagging rule is enabled and is used in the intelligent tagging process.
Click the Save button to complete the operation.

Managing Tagging Rules

To update existing tagging rules you can use this same Management > Tagging page. To manage a tagging rule:

Log in with an Administrator or Intelligent Tagging Manager account.
Navigate to Management > Tagging, locate the tagging rule to be updated and use the Actions menu to select:
- Show Details: Click the expansion arrow to see a summary of this tagging rule.
- Edit: Use edit to open this tagging rule to make changes. Once complete, click the Save button to save these changes.
- Delete: Use the delete option to delete this tagging rule. Note that a delete operation cannot be undone.

To export all Tagging Rules to an external file, deselect all tagging rules and use the Export > CSV or Export > PDF option.

To export some Tagging Rules to an external file, select the rules to be exported by clicking on their selection box and then using the Export Selected > CSV or Export Selected > PDF option.

Applying Tagging Rules

After one or more tagging rules have been enabled, they can then be used to start intelligently tagging new or existing assets.

Applying Intelligent Tags Using Asset Add or Edit

Intelligent tags can be applied when manually creating new assets (Add Asset page) or by updating existing assets (Edit Asset page) by accounts with the space Administrator or Intelligent Tagging Manager role and Asset Editor or higher on the asset to be tagged.

On the asset's form, Add Asset or Edit Asset page, click the Intelligent Tagging icon on the Tags field. This action will evaluate all the enabled tagging rules against the values provided in this asset.

If matches are found and new term suggestions are available, the results will be presented in the format of [Term 1 (Rule Name), Term 2 (Rule Name), ...] and these new tags are applied for each match.

If no matches are found or all suggested terms are already present on the asset, the response will indicate this result.

Tip

You may add, edit or remove intelligently tagged tags using the available controls.

Click the Save button to complete the operation.

Applying Intelligent Tags Using Bulk Tag (or Untag)

Intelligent Tags suggestions and general Tags can be added in bulk using the Tag action and existing Tags can be removed using the Untag action.

To apply Tags or Intelligent Tag suggestions to one or more assets:

From the Asset page, select all the assets to be tagged by clicking the checkbox next to each of them. Requires Asset Role: Manager or Asset Role: Owner on the container or Space Role: Asset Manager or Space Role: Administrator permission perform this bulk operation.
Use the Actions > Tag option to initiate the operation.
On the Select Terms to Add page:
1. Select the parent Taxonomy using the Taxonomy parameter
2. Pick one or more tags to assign using the Tags parameter. You may leave this parameter empty if you only want to apply Intelligent Tag suggestions.
3. If you wish to include Intelligent Tag suggestions, enable the Suggestions parameter.
4. Click the Select button to begin the tagging operation.

While processing, the Tag operation will append the chosen Tags to each selected asset and if enabled, will also append all Intelligent Tag suggestions, if not already present, as new tags.

Note

When the tag operation updates an asset, a new minor version of that asset is created.

To remove Tags on one or more assets:

From the Asset page, select all the assets to be untagged by clicking the checkbox next to each of them. Requires Asset Role: Manager or Asset Role: Owner on the container or Space Role: Asset Manager or Space Role: Administrator permission perform this bulk operation.
Use the Actions > Untag option to initiate the operation.
On the Select Terms to Remove page:
1. Select the parent Taxonomy using the Taxonomy parameter
2. Pick one or more tags to remove using the Tags parameter
3. Click the Select button to begin the untagging operation.

While processing, the Untag operation will remove only the chosen Tags from each selected asset. If additional Tags are present on the asset and were not included in the Untag selection, they will remain assigned to the asset. If no Tags or no chosen Tags are present on a selected asset, no updates to this asset will be performed.

Note

When the untag operation updates an asset, a new minor version of that asset is created.

Example Tagging Rules

Example 1: Single Condition

If the asset is located in a container (or its parent) that equals "Production" AND in a container (or its parent) that equals "Databases" AND the host field value contains 'sql' then intelligently tag it with the terms Component :: Server :: Windows, Component :: Database and Environment :: Production.

The asset must reside in a folder path that contains a folder whose name equals Production AND Databases AND its host must contain sql to receive the tag suggestions.

Tagging Rule:

Asset with Intelligent Tags applied:

Example 2: Multiple Conditions using RegEx

If the asset container contains Windows Servers AND its host name satisfies the Regex ^[A-Z]\d{8}.+$ OR its asset type equals "Windows Host" AND its host name satisfies the Regex ^[A-Z]\d{8}.+$ then intelligently tag it with term Component :: Server :: Windows and Component :: Server :: WEB Server.

The asset must reside in a container (or hierarchy) whose name contains "Windows Server" AND its host name must satisfy the RegEx expression where the first character is an uppercase letter and the next 8 characters are digits, OR
The asset must be use the asset type equal to "Windows Host" AND its host name must satisfy the RegEx expression where the first character is an uppercase letter and the next 8 characters are digits to receive the tag suggestions.

The asset must reside in a Windows Server container or use the asset type Windows Host, while both conditions must have a host name that is in compliance with the defined RegEx expression.

Tagging Rule:

Asset with Intelligent Tag applied due to its Container AND Host value (non-matching OR Asset Type criteria):

Another asset with Intelligent Tag applied due to its Asset Type AND Host value (non-matching OR Container criteria):

Final asset without Intelligent Tag applied due to Host name not satisfying the RegEx (while using the Windows Host asset type OR in a container named Windows Servers):