Enabled tags generate alerts when matched to traffic. Alerts based on enabled tags are displayed in the Alerts Log on the dashboard and, if configured, email and HTTP alerts are also sent for enabled tags.

Disabled tags are tags that have been disabled automatically after reaching 100,000 hits. This is a quality control measure; tags that are matched to large numbers of samples are too general to be useful in identifying targeted threats. Disabled tags continue to display as a reference—you can continue to view the samples that were matched to that tag, search based on the disabled tag, and view the conditions defined for the tag. However, disabled tags are not applied to future samples.

The tag owner has deleted the tag, but the deletion is not complete. This status only displays for a short period of time—when the tag deletion completes, the tag is completely removed from the AutoFocus system.