Tag Types, Format, and Application

An asset tag is primarily composed of a Category:Value pair. For example, if you want to group your assets by location, create a Location category with the value Headquarters.

Note: If you want to create tags without individual categories, Tenable recommends that you add the generic category Category, which you can use for all your tags.

Static Tags vs. Dynamic Tags

When you create a tag, you can choose between the following tag types:

  • static — You must manually apply the tag to individual assets. Alternatively, you can manually apply a dynamic tag to additional assets that may not meet the rules criteria for that tag.

  • dynamic — Tenable Exposure Management automatically applies the tag to the assets on your instance that match the tag rules. When you create an automatic tag, Tenable Exposure Managementapplies that tag to all your current assets and any new assets added to your organization's account. Tenable Exposure Management also regularly reviews your assets for changes to their attributes and adds or removes automatic tags accordingly.

    Note: When you create or edit a dynamic tag, Tenable Exposure Management may take some time to apply the tag to existing assets, depending on the system load and the number of matching assets. Additionally, it can take up to 24 hours to see tag data on the Dashboards page.

See the following examples for clarification:

Scenarios Tag Type
You create a tag with Location:Headquarters as the Category:Value pair, but you do not add any tag rules. Later, you add the tag to assets located at your headquarters. static
You create a tag with Location:Headquarters as the Category:Value pair, and you specify an IP address range in the tag rules. Tenable Exposure Management then automatically applies the tag to all existing or new assets within that IP address range. dynamic
Important! You cannot edit a tag category once a tag value has been saved to it.

Tag Types in Tenable Exposure Management

Tenable One Tags

Tenable One tags allow you to categorize and organize assets across your entire attack surface. You can create and manage these tags within the Tagging workspace in Tenable One. Unlike legacy tagging systems, Tenable One tags apply to all data types, providing a unified way to group assets.

You can use these tags to perform the following actions:

  • Filter Inventories — Narrow your search results in the Inventory views.

  • Configure Exposure View Cards — Define the scope of data displayed in your exposure cards.

  • Filter Dashboards — Apply tags to dashboards to view specific subsets of your security posture.

  • Define Access Control — Use tags as object permission scopes within Role-Based Access Control (RBAC) to manage which assets specific users can view or edit.

Tenable Vulnerability Management Tags

You create and manage Tenable Vulnerability Management tags within the Tenable Vulnerability Management interface. These tags utilize the Explore querying system to organize your assets. While you can view Tenable Vulnerability Management tags in the Tenable One Tagging workspace, they are read-only within that interface. You must perform all edits within the Tenable Vulnerability Management tag settings workflow.

You can use these tags to perform the following actions:

  • Filter Inventories — Narrow your search results in the Inventory views.

  • Configure Exposure View Cards — Define the scope of data displayed in your exposure cards.

  • Define Access Control — Use tags as object permission scopes within Role-Based Access Control (RBAC) to manage which assets specific users can view or edit.

External Tags

External Tags serve as a comprehensive mapping for all tags ingested from other Tenable sensors and third-party data sources. These include tags from Tenable Cloud Security, Tenable Identity Exposure, and external integrations.

Unlike platform-native tags, Tenable Exposure Management does not maintain a centralized list of all available external tag values within a container. However, you can view the specific External Tags applied to an individual asset on its Asset Details page.

While you cannot manage these tags directly, you can use them as metadata to build more permanent groupings:

  • Search and Filter — Search for specific external tag values within the Inventory views.

  • Tag Creation — Use external tags as parameters or filters when you create dynamic tags in Tenable Exposure Management.

Tag Type Application and Usage in Tenable Exposure Management

The following table highlights how each type of tag can be used across the Tenable Exposure Management application:

Feature / Capability Tenable One Tag Tenable Vulnerability Management Tag External Tag
Source Tenable Exposure Management Tenable Vulnerability Management Other Sensors / Third Party
View on Tags page Yes Yes No
Edit Tag Yes No No
Inventory Search Yes Yes Yes
Create Exposure Card Yes Yes No
RBAC Scope Yes Yes No
Filter Dashboards Yes No No