Focus

AutoFocus™ Administrator’s Guide

Tag Status

Table of Contents

Tag Status

On the Tags page, view the status for a specific tag; optionally, select Sort by: Status to sort tags based on the status of the tag.

Tag Status	Description
Enabled	Enabled tags generate alerts when matched to traffic. Alerts based on enabled tags are displayed in the Alerts Log on the dashboard and, if configured, email and HTTP alerts are also sent for enabled tags.
Disabled	Disabled tags are tags that have been disabled automatically after reaching 100,000 hits. This is a quality control measure; tags that are matched to large numbers of samples are too general to be useful in identifying targeted threats. Disabled tags continue to display as a reference—you can continue to view the samples that were matched to that tag, search based on the disabled tag, and view the conditions defined for the tag. However, disabled tags are not applied to future samples.
Removing	The tag owner has deleted the tag, but the deletion is not complete. This status only displays for a short period of time—when the tag deletion completes, the tag is completely removed from the AutoFocus system.
Rescoping	The tag owner has modified the tag visibility to private, public, or anonymously public. This status only displays for a short period of time—as the new tag scope is processed and until the update to the tag scope is complete.