Manage Endpoint Tags

Segment your endpoints according to dynamic tags.
Endpoint tags enable multiple layers of segmentation to your endpoints. An endpoint tag is a dynamic entity that is created and assigned to one or more endpoints. The assigned endpoint tags can then be used to create Endpoint Groups, Policies, and Actions.
To manage your endpoint tags:
The following uses Windows operating system installation parameters and Cytool argument examples.
  1. Create an endpoint tag.
    As of
    Cortex XDR agent version 7.7.1 and up
    , you can create endpoint tags on either the:
    • Cortex
      XDR
      management console (
      Server
      )
    • Machine where the
      Cortex
      XDR agent (
      Agent
      ) is installed by running a:
    • From the
      Cortex
      XDR
      agent:
      1. Navigate to the Cytool folder location and open the CLI as an administrator.
      2. Installer parameter - run
        msiexec /i ... ENDPOINT_TAGS="Name1, Name 2, Name3"
        .
        Cytool argument - run
        cytool endpoint tags add “tag1 [,tag2, ...,tagN]”
        .
        Tag names are case sensitive and can contain spaces.
    • From the
      Cortex
      XDR
      management console:
      1. Navigate to
        Endpoints
        All Endpoints
        Tags
        field.
      2. Select one or more endpoints, right-click, and select
        Endpoint Control
        Assign Endpoint Tags
        .
      3. Select
        Add tag...
        and choose one ore more tags from the list of existing tags or begin to type a new tag name to
        Create tag
        .
        Tag names are case sensitive and can contain spaces.
      4. Save
        the tag names you selected.
  2. Remove an endpoint tag.
    Depending on where you created your tag,
    Server
    or
    Agent
    , you can choose to edit or remove the tags.
    • From the
      Cortex
      XDR
      agent:
      1. Navigate to the Cytool folder location and open the CLI as an administrator.
      2. Cytool Argument - run
        cytool endpoint tags remove “tag1 [,tag2, ...,tagN]”
        .
    • From the
      Cortex
      XDR
      management console:
      1. Navigate to
        Endpoints
        All Endpoints
        Tags
        field.
      2. Select one or more endpoints, right-click, and select
        Endpoint Control
        Remove Endpoint Tags
        .
      3. Save
        the tag names you removed.
  3. Track your endpoint tags.
    • From the
      Cortex
      XDR agent:
      1. Navigate to the Cytool folder location and open the CLI as an administrator.
      2. For Cytool, run
        cytool endpoint tags list
        .
    • From the
      Cortex
      XDR
      management console:
      1. Navigate to
        Endpoints
        All Endpoints
        Tags
        field.
        All
        Server
        and
        Agent
        tags associated with the specific endpoint are displayed. Tags created in the
        Cortex
        XDR agent are displayed with a shield icon.
      2. Filter and search the
        Tags
        field for the endpoint tags you created and assigned.

Recommended For You