Manage endpoint tags - Administrator Guide - Cortex XSIAM - Cortex

Manage endpoint tags - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-10-07

Note

The following explanations use Windows operating system installation parameters and Cytool argument examples.

Create an endpoint tag

An endpoint tag can be created during installation of the Cortex XDR agent.

An endpoint tag can be created after installation either from the Cortex XDR agent or from the Cortex XSIAM management console.

Installer parameter: run msiexec /i ... ENDPOINT_TAGS="Name1, Name 2, Name3".

Cytool argument: cytool endpoint_tags add "tag1 [,tag2,...,tagN]".

Note

Tag names are case sensitive.

In Windows and Mac, a tag name can contain spaces.

Linux does not support tag names with spaces as command line arguments to the shell installer. Instead, tags can be set in the /etc/panw/cortex.conf configuration file, which supports all Linux installers.

From the machine where the Cortex XDR agent is installed:
1. Navigate to the Cytool folder location and open the CLI as an administrator.
2. Cytool argument: cytool endpoint_tags add "tag1 [,tag2, ...,tagN]".
  Note
  Tag names are case sensitive and can contain spaces.
From the Cortex XSIAM management console (Server)
1. Navigate to Endpoints → All Endpoints → Tags field.
2. Select one or more endpoints, right-click, and select Endpoint Control → Assign Endpoint Tags.
3. Select Add tag... and choose one or more tags from the list of existing tags or begin to type a new tag name to Create tag.
  Note
  Tag names are case sensitive and can contain spaces.
4. (This step requires administrator permissions) To assign the tag to users or user groups, select Add selected tags to Users or Groups, and select the relevant Users and/or User Groups.
  Note
  When SBAC is enabled, assigning tags may impact user permissions.
5. Save the tag names you selected.

Remove an endpoint tag

Depending on where you created your tag, Server or Agent, you can choose to edit or remove the tags.

Note

If you remove the tag and there are assigned users or user groups with scope settings, this can impact user permissions in the system.

Note

Create an endpoint tag

Note

Note

Note

Note

Remove an endpoint tag

Note

Track your endpoint tags