Create a Tag
There are two ways to create a new AutoFocus
tag: tag a sample or tag a set of search conditions.
The visibility
of a new tag is set to Private by default.
- Tag a sample.Create a tag for a sample hash to keep track of a sample that exhibits unique behavior or a sample that you need to refer back to later. You can then search for the sample by the tag name instead of its hash.
- Click a sample hash to view sample details, and clickAdd Tag.You can only click the sample hash for a public sample or any of your private samples.
- Enter a name for the tag in the search field and clickcreate new.
- Hover over the new tag, and click the tag name.
- Editthe Tag Details to supply more information about the tagged sample.
- Tag a search.Create a tag for a search condition (or a set of search conditions). You can use the tag to search for all samples that match the conditions. Review Tag Visibility for tagging guidelines.
- Work with the Search Editor to create a set of search conditions.You cannot create a tag for searches based on tag-related information (Tag,Tag Alias,Tag Class,Tag Scope, andTag Source) or the artifactThreat Name.
- Click theTagicon to create a tag based on the defined search conditions:
- Provide a unique tag name and any other information that may be helpful for identifying the tag, and thenTag Results.
- Choose from the following next steps.
- When a tag is created, all past and incoming samples that match the search conditions are tagged; Sample Details display the tags to which the sample is matched.
- Learn more about how to Work with Tags.
- Use the tag to Begin a new search. Search with the tag to view all AutoFocus samples that match the tag conditions.
- Create Alerts to be notified when new samples match the tag.
