Tags in Tenable One Attack Surface Management

Overview

Tenable One Attack Surface Management uses a tagging model that differs from Tenable One Vulnerability Management and Tenable Exposure Management. Tenable One Attack Surface Management tags have a name and a value type — they are not structured as Category:Value pairs. Tags are stored in a global tag store for your Tenable One Attack Surface Management inventory, and you assign them to assets individually or in bulk.

Tenable One Attack Surface Management tags help you organize external attack surface assets — domains, IP addresses, web applications, cloud services, and other internet-facing resources — into meaningful groups for tracking, reporting, and prioritization.

Tag Structure

Each Tenable One Attack Surface Management tag consists of two parts:

• Name — a text label that identifies the tag (for example, Business Unit, Priority, Owner).
• Value Type — determines what kind of value, if any, the tag carries when assigned to an asset.

Available value types:

Value Type	Description	Example
No Value	A presence/absence flag — the tag either exists on an asset or it doesn't	Reviewed, Accepted Risk
Keyword	A free-form text string value	Owner: platform-team
Number	An integer or decimal value	Risk Score: 8
Cost	A monetary value (currency-neutral)	Annual Cost: 12000
Percentage	A percentage value (0–100)	Coverage: 85
Boolean	True or false	In Scope: true

Required Roles

Tag management in Tenable One Attack Surface Management requires one of the following roles:

• Active User
• Cloud Connector Manager
• Business Administrator

Users with read-only roles can view tags assigned to assets but cannot create, edit, or delete tags.

Create a Tag

Create a tag before you can assign it to assets in your inventory.

Before You Begin

Confirm your user account has the Active User, Cloud Connector Manager, or Business Administrator role.

To create a tag:

1. In Tenable One Attack Surface Management, navigate to Inventory.

   The inventory appears.

2. In the left panel, click Tags.

   The tag store opens.

3. Click Add Tag.

   The Add Tag dialog appears.

4. Enter a Tag Name.

5. Select a Value Type from the drop-down box.

6. Click Save.

   Tenable One Attack Surface Management adds the tag to the tag store.

What To Do Next

Assign the tag to one or more assets. See Tags in Tenable One Attack Surface Management below.

Assign Tags to Assets

You can assign tags to assets in two ways.

From the Inventory View (Bulk Assignment)

To assign tags from the Inventory view:

1. Navigate to Inventory.

   The inventory appears.

2. Apply filters to isolate the assets you want to tag.

3. Select one or more assets using the checkboxes, or select all filtered results.

4. Click the Actions menu, then click Add Tag.

   The tag selection dialog appears.

5. Select the tag from the list. If the value type requires a value (Keyword, Number, Cost, Percentage, or Boolean), enter the value.

6. Click Apply.

   Tenable One Attack Surface Management applies the tag to the selected assets.

From the Asset Details Panel (Individual Asset)

To assign a tag from the asset details panel:

1. In the Inventory, click an asset to open its detail panel.

   The asset detail panel opens.

2. Scroll to the Tags section.

3. Click Add Tag.

   The Add Tag dialog appears.

4. Select the tag and supply a value if required.

5. Click Save.

   Tenable One Attack Surface Management applies the tag to the asset.

Removing Tags from Assets

To remove a tag from an asset, open the asset's detail panel, locate the tag in the Tags section, and click the remove icon () next to it.

To remove a tag from multiple assets at once, filter the inventory, select the relevant assets, and choose the Actions menu, then click Remove Tag.

Delete a Tag

To delete a tag:

1. Navigate to Inventory → Tags.

   The tag store appears.

2. Locate the tag in the list.

3. Click the button.

4. Confirm the deletion.

   Tenable One Attack Surface Management removes the tag from the tag store and from every asset that carried it.

Common Use Cases

Tenable One Attack Surface Management tags are particularly well suited for classifying external attack surface assets that may not appear in internal vulnerability management programs:

• Ownership tracking — Use a Keyword tag (Owner) to attribute internet-facing assets to a specific team or business unit for accountability.
• Scope marking — Use a Boolean tag (In Scope) to mark assets that are part of a scheduled penetration test or Tenable One Attack Surface Management review.
• Priority tiering — Use a Number or Keyword tag (Priority) to stratify which external assets require immediate remediation attention.
• Acceptance records — Use a No Value tag (Risk Accepted) as a presence flag on assets where risk has been formally accepted.
• Cost allocation — Use a Cost tag (Annual Cost) to assign a monetary value to external services for budget reporting.

Limitations and Considerations

• Tenable One Attack Surface Management tags do not support automation rules. All tag assignments are manual or via the API.
• Tenable One Attack Surface Management tags cannot be structured as Category:Value pairs — each tag has a single name and a single value type.
• Tags are scoped to a single Tenable One Attack Surface Management inventory. If you maintain multiple inventories, tags must be created separately in each one.
• Tenable One Attack Surface Management tags do not flow into Tenable One Vulnerability Management, Tenable One, or Tenable Exposure Management.
• There is no bulk export of the Tenable One Attack Surface Management tag library from the UI; use the Tagging via API for programmatic export.

Additional Resources

For complete tag documentation, see Asset Tags in the Tenable One Attack Surface Management User Guide.