Tags

In the Tags screen, you have the option to add, modify and delete tags. Tags are assigned to cases by Siemplify based on predefined rules and can be used to classify cases or find specific cases faster. Note that you can manually add tags to a case from the Case screen. These tags can be removed from the case, but NOT removed entirely from the system.

You might want to import tags in the following situations. For example, moving from staging to production environment or for backup purposes.

To import tags:

1. Click on the Download template icon. The excel chart shows the exact structure of how the imported tags should be layed out.
2. Enter in the tag information.
3. Click the Import icon and import in the filled excel chart.
   

*The relationship between Assigned Tag and Search Name is many-to-many. That is, more than one Assigned Tag can be associated with one Search Name, and more than one Search Name can be associated with one Assigned Tag. For example, Siemplify assigns the same tag “DLP” to alerts the SIEM tags as “Data Exfiltration” or “Symantec DLP – Financial Information – Network”.

To add a new tag:

1. Click on the plus icon on the top right of the screen.
2. In Tag Condition, choose between Entities, Product, Rule Generator or Vendor. Note that you can select Other and add in your own option thereby creating a new tag.
3. Where required, add in the value of the above.
4. After selecting one of the options, you will see a drop down with the following qualifiers, contains, exact, starts with, ends with. Choose the qualifier that best fits your needs.
5. Select the priority for the tag. Note that Siemplify merges priority with other alerts and entities and events so that the priority here is not an absolute.
6. Select the Can be a case name if required. When checked, the tag will be assigned as the title of the Case if it meets the conditions.
   
7. Click Save.