>
    Strata Copilot
    Tag Management
    Focus
    Download PDF
    Focus
    1. Home
    2. Device Security
    3. Device Security Administration Guide
    4. Discover IoT Devices and Take Inventory
    5. Tag Management
    Download PDF
    Device Security

    Tag Management

    Table of Contents

    Tag Management

    Use device tags to organize the devices in your inventory efficiently.
    Where Can I Use This?What Do I Need?
    • Device Security (Managed by Strata Cloud Manager)
    • (Legacy) IoT Security (Standalone portal)
    One of the following subscriptions:
    • Device Security subscription for an advanced Device Security product (Enterprise, OT, or Medical)
    • Device Security X subscription
    The Tag Management page contains a list of all tags that you can apply to the devices in your inventory. There are two tabs on this page: System Tags with predefined system tags and Custom Tags with user-defined custom tags.
    You can create your own custom tags and use them to add meaningful labels to your devices. Device Security creates system-defined tags based on the types of devices detected in your environment. If manufacturing devices are found, for example, then it creates system tags for Purdue levels 1 through 5.

    Strata Cloud Manager

    Use device tags in Device Security in Strata Cloud Manager to organize the devices in your inventory efficiently.

    Create a Custom Tag and Apply It Automatically

    Create a Custom Tag and Apply It Automatically
    1. Define a tag.
      To create a custom tag, navigate to AssetsTag Management and click the + icon in the Custom Tags tab.
      The Create custom tag window opens with fields for a tag type and a tag value. The type is optional and the value is required.
      Optionally select or create a tag type, define a tag value, and then click Next: Tag rule.
    2. Optionally define a tag rule to apply the tag automatically.
      A tag rule defines a condition for applying a tag. When a device matches the filter or filters in a tag rule, Device Security automatically applies the specified tag. Device Security not only does this when you initially define a tag rule but it also applies the tag if it later finds new matching devices in the future. Conversely, if a device no longer match the filter, Device Security automatically removes the tag from it.
      If you want to apply the tag when a device matches a filter, choose a previously saved filter from the list. You can also add one or more filters to apply the tag to more devices. If there are multiple filters, Device Security applies a tag to a device if it matches any one of them.
      If you want to apply the tag manually to one or more devices on the Devices page or individually on the Device Details page instead of automatically through a tag rule, don’t select or add any filters.
      When done, Save the tag.
      You can create a maximum of 1000 unique tags and manually apply them to a maximum of 100,000 devices. A single device can have a maximum of 100 tags applied to it.

    Manually Apply Tags to One or More Devices

    Manually Apply Tags to One or More Devices
    There are two ways to apply tags to devices:
    • Manually apply tags to one or more devices on the Assets Inventory page or to an individual device on the Device Details page
    • Automatically apply tags through the use of special filters called tag rules on the AssetsTag Management page
    The quickest way to tag your devices is to do so manually through the Assets Inventory page.
    1. Filter the devices to tag.
      Open the AssetsInventory page and use the filter tool to refine the devices in the list.
      After the correct devices are listed, click the Tag icon (
      ) to tag the filtered devices. In fact, you’re not only tagging this set of filtered devices but you’re tagging the filter itself. If Device Security detects devices matching this filter in the future, it will tag them as well.
    2. Confirm the filtering parameters before applying tags.
      Check that the filters are the ones you want to use. If not, Cancel and modify the filters before tagging the devices.
      To include the global filters for site and device type at the top of the Devices page, select Include global filters for site and device type in this filter. Clear the check box to exclude the site and device type global filters.
      When done, click Next: Select tag.
    3. Select one or more tags and apply them.
      The Apply tags to this filter window opens with fields for a tag type and a tag value. The type is optional and the value is required.
      Optionally select or create a tag type, and select or create a tag value.
      To apply more than one tag, click + Add Tag.
      When done, Save and Apply.
      Device Security tags the filtered devices, and if it detects new devices that match your filters in the future, it will automatically tag them as well. Likewise, if any tagged devices no longer match filters, Device Security will automatically remove tags from them.
      The initial tagging process can take a few moments to complete, depending on how many devices Device Security must tag.

    Manually Apply Tags to an Individual Device

    Manually Apply Tags to an Individual Device
    In addition to tagging devices on the Assets Inventory page, you can tag an individual device from its Device Details page.
    1. Open the Manage Tags window for an individual device.
      From the Assets Inventory page, click a device name to open the Device Details page for this device.
      Click the Action menu icon (
      ) in the upper right of the page and then click Manage Tags.
    2. Apply one or more tags to the device.
      Optionally select or create a tag type and select or create a tag value.
      To apply additional tags, click + Add Tag. You can apply a maximum of 100 tags to a single device.
      When done, Save.

    Remove Manually Added Tags from Devices

    Remove Manually Added Tags from Devices
    It's possible to remove tags from individual devices. You can only remove manually applied tags from an individual device because Device Security would reassign any removed tags that are automatically assigned as a result of tag rules. To remove automatically assigned tags, you must remove them completely from the system.
    To remove a manually applied tag from an individual device:
    1. Navigate to the Device Details page.
    2. Click the Action menu icon (
      ) and then click Manage Tags.
    3. Click the X next to a tag entry to remove it and then Save.

    Remove a Tag from the Device Security System

    Remove a Tag from the Device Security System
    To remove a tag from the entire Device Security system:
    1. Select SettingsTag Management.
    2. Click the Action menu icon (
      ) in the far right column and then click Delete Tag.
      When you delete a tag on the Tag Management page, Device Security removes it from all devices. This operation cannot be undone, so remove tags with caution.

    (Legacy) IoT Security

    Use device tags in Device Security to organize the devices in your inventory efficiently.

    Create a Custom Tag and Apply It Automatically

    Create a Custom Tag and Apply It Automatically
    1. Define a tag.
      To create a custom tag, click the + icon in the upper right corner of the Custom Tags tab.
      The Create custom tag window opens with fields for a tag type and a tag value. The type is optional and the value is required.
      Optionally select or create a tag type, define a tag value, and then click Next: Tag rule.
    2. Optionally define a tag rule to apply the tag automatically.
      A tag rule defines a condition for applying a tag. When a device matches the filter or filters in a tag rule, Device Security automatically applies the specified tag. Device Security not only does this when you initially define a tag rule but it also applies the tag if it later finds new matching devices in the future. Conversely, if a device no longer match the filter, Device Security automatically removes the tag from it.
      If you want to apply the tag when a device matches a filter, choose a previously saved filter from the list. You can also add one or more filters to apply the tag to more devices. If there are multiple filters, Device Security applies a tag to a device if it matches any one of them.
      If you want to apply the tag manually to one or more devices on the Devices page or individually on the Device Details page instead of automatically through a tag rule, don’t select or add any filters.
      When done, Save the tag.
      You can create a maximum of 1000 unique tags and manually apply them to a maximum of 100,000 devices. A single device can have a maximum of 100 tags applied to it.

    Manually Apply Tags to One or More Devices

    Manually Apply Tags to One or More Devices
    There are two ways to apply tags to devices:
    • Manually apply tags to one or more devices on the Devices page or to an individual device on the Device Details page
    • Automatically apply tags through the use of special filters called tag rules on the SettingsTag Management page
    The quickest way to tag your devices is to do so manually through the device inventory on the Devices page.
    1. Filter the devices to tag.
      Open the AssetsDevices page and use the filter tool to refine the devices in the list.
      After the correct devices are listed, click the Tag icon (
      ) to tag the filtered devices. In fact, you’re not only tagging this set of filtered devices but you’re tagging the filter itself. If Device Security detects devices matching this filter in the future, it will tag them as well.
    2. Confirm the filtering parameters before applying tags.
      Check that the filters are the ones you want to use. If not, Cancel and modify the filters before tagging the devices.
      To include the global filters for site and device type at the top of the Devices page, select Include global filters for site and device type in this filter. Clear the check box to exclude the site and device type global filters.
      When done, click Next: Select tag.
    3. Select one or more tags and apply them.
      The Apply tags to this filter window opens with fields for a tag type and a tag value. The type is optional and the value is required.
      Optionally select or create a tag type, and select or create a tag value.
      To apply more than one tag, click + Add Tag.
      When done, Save and Apply.
      Device Security tags the filtered devices, and if it detects new devices that match your filters in the future, it will automatically tag them as well. Likewise, if any tagged devices no longer match filters, Device Security will automatically remove tags from them.
      The initial tagging process can take a few moments to complete, depending on how many devices Device Security must tag.

    Manually Apply Tags to an Individual Device

    Manually Apply Tags to an Individual Device
    In addition to tagging devices on the Devices page, you can tag an individual device from its Device Details page.
    1. Open the Manage Tags window for an individual device.
      From the Devices page, click a device name to open the Device Details page for this device.
      Click the Action menu icon (
      ) in the upper right of the page and then click Manage Tags.
    2. Apply one or more tags to the device.
      Optionally select or create a tag type and select or create a tag value.
      To apply additional tags, click + Add Tag. You can apply a maximum of 100 tags to a single device.
      When done, Save.

    Remove Manually Added Tags from Devices

    Remove Manually Added Tags from Devices
    It's possible to remove tags from individual devices. You can only remove manually applied tags from an individual device because Device Security would reassign any removed tags that are automatically assigned as a result of tag rules. To remove automatically assigned tags, you must remove them completely from the system.
    To remove a manually applied tag from an individual device:
    1. Navigate to the Device Details page.
    2. Click the Action menu icon (
      ) and then click Manage Tags.
    3. Click the X next to a tag entry to remove it and then Save.

    Remove a Tag from the Device Security System

    Remove a Tag from the Device Security System
    To remove a tag from the entire Device Security system:
    1. Select SettingsTag Management.
    2. Click the Action menu icon (
      ) in the far right column and then click Delete Tag.
      When you delete a tag on the Tag Management page, Device Security removes it from all devices. This operation cannot be undone, so remove tags with caution.

    © 2026 Palo Alto Networks, Inc. All rights reserved.