Frequently Asked Questions

This topic answers common conceptual questions about how tagging behaves across Tenable products. If a tag isn't applying, filtering, or scanning the way you expect, see Troubleshoot Tags instead.

My dynamic tag was created but no assets are showing up. What's wrong?

Check the Assessment column on the Values tab (Settings → Tagging → Values). If it shows anything other than Completed, the rules engine is still processing or has encountered an error.

This is the most common tagging support issue, and it almost always traces back to one of three causes: an overly broad rule, a recently scanned asset that hasn't been re-evaluated yet, or an asset sitting on the tag's Excluded Assets list. See Troubleshoot Tags for the full diagnostic steps.

The # of Assets on the Tags page is higher than what I see in the Assets view. Why?

The tag count includes deleted assets that have not yet aged out of the license count. Tenable One Vulnerability Management retains deleted asset records until they age out, and the tag engine counts them. The Assets inventory filters out deleted records by default. This is expected behavior and not a bug.

I manually applied a tag that has rules. Will the engine remove the tag if the asset no longer matches?

No. When you manually apply a tag to an asset — even one configured with automatic rules — Tenable One Vulnerability Management excludes that asset from future rule evaluation for that tag. The tag persists until you explicitly remove it, regardless of whether the asset would pass or fail the rule criteria.

This is by design: manual overrides are intentional. If you want the asset to re-enter rule-based evaluation, remove the manually applied tag. The engine will then reassess the asset on its next scheduled run. For how this interacts with the Excluded Assets list, see Troubleshoot Tags.

How long does it take for a new tag rule to apply to all assets?

Processing time depends on system load and the number of assets. In small environments, application is typically complete within minutes. In large environments (hundreds of thousands of assets), it can take longer. Monitor the Last Processed and Assessment columns on the Values tab to track progress. Do not assume the tag has failed simply because it hasn't completed immediately. For the exact triggers that cause tag membership to recalculate, see Troubleshoot Tags.

Can I use tags to restrict what assets a user can see?

Yes. Tenable One Vulnerability Management's Access Control system uses tags to define access groups. You can grant users Can View or Can Edit permissions scoped to specific tag values, which restricts their asset visibility to only assets carrying that tag. Configure this under Settings → Access Control → Permissions.

When a tag is created, Tenable One Vulnerability Management automatically grants the creating user Can Use and Can Edit permissions for that tag. Administrators can extend those permissions to other users or groups.

Note — Permission Scope Clarification: Tag-scoped access control restricts which assets a user can view or edit. It does not restrict what a user can manually type into a scan target field. A user whose access is scoped to a specific tag can still successfully launch a scan against a manually entered IP address or hostname that falls outside that tag's scope. If you need to prevent out-of-scope scanning, combine tag-scoped permissions with scan-level target restrictions. See Tag-Based Scanning for more information.
Note: Tenable One Web App Scanning does not handle permissions that rely on a tag. Access group restrictions based on tags do not apply to Tenable One Web App Scanning assets.

Do Tenable Security Center Asset Tags sync to Tenable One?

Partially, and only if configured. Tenable Security Center is on-premises and does not synchronize with Tenable One by default. If your organization holds a Tenable Lumin or Tenable One license, you can enable Tenable One Synchronization to send IPv4 addresses within Static and Dynamic Asset Tags into Tenable One Vulnerability Management as tags, which then appear as Business Context in Tenable One dashboards the same way native tags do. DNS Name List, LDAP Query, Combination, and Import Asset Tags are not eligible, and Tenable Security Center's separate free-form Labels never sync regardless of configuration. See Tags in Tenable Security Center for setup requirements. If your organization runs a hybrid deployment without Tenable One Synchronization enabled, plan separate tagging strategies for each platform.

I deleted a tag category and now some dashboards are broken. Can I recover?

Deleting a category removes it and all associated tag values from every asset in the system — this cannot be undone from the UI.

If you exported the tag library to CSV or JSON before the deletion, you can re-create the categories and values by importing them via the Tenable API or by manually recreating them in the UI and then re-tagging assets either manually or by recreating the rules.

To prevent this situation in the future: always export the tag library before major changes, and communicate planned deletions to dashboard and report owners in advance.

My tag rule includes a CIDR range but assets outside that range are still tagged. What's happening?

Check whether those assets were manually tagged at some point, or whether they were previously removed from the tag and are now sitting on its Excluded Assets list. Both cases exempt an asset from rule evaluation. See Troubleshoot Tags for how to identify and clear each case.

Also verify that your CIDR notation is correct and that no IP address value ends with a period. A /0 mask is not supported and will return a 400 Bad Request error.

Can I tag Web Application assets the same way as host assets?

Partially. Tags apply to all asset types in Tenable One Vulnerability Management, including Web Application assets. However, some rule filters behave differently:

  • For Web Application assets, use the Name filter — not DNS/FQDN — to match by hostname.
  • Tenable One Web App Scanning does not honor permissions that rely on tags, so access group restrictions do not apply to Tenable One Web App Scanning assets.

What is the maximum number of tags I can create?

Tenable One Vulnerability Management supports:

  • Up to 100 tag categories per instance
  • Up to 100,000 tag values per category

For most organizations, this far exceeds what's needed. However, it is worth planning your taxonomy carefully so you do not exhaust the 100-category limit as your program matures — categories cannot currently be merged after they are created.

I created a tag rule based on Asset Criticality Rating but assets with a high Asset Criticality Rating are not being tagged. Why?

Asset Criticality Rating values are recalculated every 24 hours. If the assets were recently scanned for the first time, their Asset Criticality Rating may not yet have been calculated. Allow up to 24 hours after scanning for Asset Criticality Rating values to appear, and then the tag rule will evaluate those values on its next processing cycle (either on data import or during the 12-hour background sweep).

Also confirm that your Tenable One Vulnerability Management instance has an active Tenable One license — Asset Criticality Rating and Asset Exposure Score are not available as tag rule filters without this license.