There are two ways to create a new AutoFocus
tag: tag a sample or tag a set of search conditions.
The visibility
of a new tag is set to Private by default.
Tag a sample.
Create a tag for a sample hash to keep track of a sample
that exhibits unique behavior or a sample that you need to refer
back to later. You can then search for the sample by the tag name
instead of its hash.
Click a sample hash to view sample details, and click
Add
Tag
.
You can only click the sample hash for a public sample
or any of your private samples.
Enter a name for the tag in the search field and click
create
new
.
Hover over the new tag, and click the tag name.
Edit
the Tag
Details to supply more information about the tagged sample.
Tag a search.
Create a tag for a search condition (or a set of search
conditions). You can use the tag to search for all samples that
match the conditions. Review Tag
Visibility for tagging guidelines.
You cannot create a tag for searches based on tag-related
information (
Tag
,
Tag Alias
,
Tag
Class
,
Tag Scope
, and
Tag
Source
) or the artifact
Threat Name
.
Click the
Tag
icon to create
a tag based on the defined search conditions:
Provide a unique tag name and any other information
that may be helpful for identifying the tag, and then
Tag Results
.
Choose from the following next steps.
When a tag is created, all past and incoming samples
that match the search conditions are tagged; Sample
Details display the tags to which the sample is matched.