Views:
Server & Workload Protection enables you to create tags that you can use to identify and sort events. For example, you might use tags to separate events that are benign from those that require further investigation. You can use tags to create customized dashboards and reports.
Although you can use event tagging for a variety of purposes, it was designed to ease the burden of event management. After you have analyzed an event and determined that it is benign, you can look through the event logs of the computer (and any other similarly configured and tasked computers) to find similar events and apply the same label to them, eliminating the need to analyze each event individually.
To view tags that are currently in use, go to Policies → Common Objects → Other → Tags.
Note
Note
Tags do not alter the data in the events themselves, nor do they allow users to delete events. They are simply extra attributes provided by Server & Workload Protection.
You can perform tagging the following ways:
Note
Note
An important difference between standard tagging and trusted source tagging is that "Run on Existing Events Now" can only be done with standard event tagging.

Manual tagging Parent topic

Procedure

  1. Go to Events & Reports → Events and select an event list. Right-click the event (or select multiple events and right-click) and select Add Tag(s).
  2. Type a name for the tag. Server & Workload Protection will suggest matching names of existing tags as you type.
  3. Select The Selected [Event Type] Event. Click Next.
  4. Enter some optional comments and click Finish.

Next steps

In the events list, you can see your tag in the TAG(S) column.

Delete a tag Parent topic

Procedure

  1. In an events list, right-click the events with the tag you want to delete, and select Remove Tag(s).
  2. Select the tag you'd like to remove. Choose to remove the tag from The Selected [Event Type] Event or to Apply to selected similar [Event Type] Events. Click Next.
  3. Enter some optional comments and click Finish.

Next steps