On the Tags page, view the status for a specific tag;
Sort by: Status
tags based on the status of the tag.
Enabled tags generate alerts when matched
to traffic. Alerts based on enabled tags are displayed in the Alerts
Log on the dashboard and, if configured, email and HTTP alerts are
also sent for enabled tags.
Disabled tags are tags that have been disabled
automatically after reaching 100,000 hits. This is a quality control
measure; tags that are matched to large numbers of samples are too
general to be useful in identifying targeted threats. Disabled tags
continue to display as a reference—you can continue to view the
samples that were matched to that tag, search based on the disabled
tag, and view the conditions defined for the tag. However, disabled
tags are not applied to future samples.
The tag owner has deleted the tag, but the
deletion is not complete. This status only displays for a short
period of time—when the tag deletion completes, the tag is completely
removed from the AutoFocus system.
The tag owner has modified the tag visibility
to private, public, or anonymously public. This status only displays
for a short period of time—as the new tag scope is processed and
until the update to the tag scope is complete.