Table of Contents

Create a Tag

There are two ways to create a new AutoFocus tag: tag a sample or tag a set of search conditions.
The visibility of a new tag is set to Private by default.
  • Tag a sample.
    Create a tag for a sample hash to keep track of a sample that exhibits unique behavior or a sample that you need to refer back to later. You can then search for the sample by the tag name instead of its hash.
    1. Click a sample hash to view sample details, and click
      Add Tag
      You can only click the sample hash for a public sample or any of your private samples.
    2. Enter a name for the tag in the search field and click
      create new
    3. Hover over the new tag, and click the tag name.
    4. Edit
      the Tag Details to supply more information about the tagged sample.
  • Tag a search.
    Create a tag for a search condition (or a set of search conditions). You can use the tag to search for all samples that match the conditions. Review Tag Visibility for tagging guidelines.
    1. Work with the Search Editor to create a set of search conditions.
      You cannot create a tag for searches based on tag-related information (
      Tag Alias
      Tag Class
      Tag Scope
      , and
      Tag Source
      ) or the artifact
      Threat Name
    2. Click the
      icon to create a tag based on the defined search conditions:
    3. Provide a unique tag name and any other information that may be helpful for identifying the tag, and then
      Tag Results
  • Choose from the following next steps.
    • When a tag is created, all past and incoming samples that match the search conditions are tagged; Sample Details display the tags to which the sample is matched.
    • Learn more about how to Work with Tags.
    • Use the tag to Begin a new search. Search with the tag to view all AutoFocus samples that match the tag conditions.
    • Create Alerts to be notified when new samples match the tag.

Recommended For You