Tag-Based Scanning

You can use tags to define what a scan targets instead of listing individual IP addresses or hostnames. This topic explains the two tag-based target modes, when to use each, and the limitations that most often cause a tag-based scan to fail.

Scan Target Modes

When you use a tag as a scan target source, you choose one of two modes.

Mode How Targets Are Resolved Requires IPv4/IPv6?
Targets defined by tags Resolved dynamically from the tag's current membership each time the scan runs Yes
Existing tagged assets only Scans the fixed set of assets that carry the tag at the time you launch the scan No
Caution — Empty Targets Abort: If a tag resolves to assets that have only an FQDN and no IPv4 or IPv6 address, a scan set to Targets defined by tags aborts with an Empty Targets error. Switch the scan to Existing tagged assets only to scan FQDN-only assets by tag.

Choosing a Target Mode

  • Use Targets defined by tags when the tagged population is expected to change between scans and every asset in the tag has a resolvable IPv4 or IPv6 address.
  • Use Existing tagged assets only when the tag includes FQDN-only assets, or when you want the scan to target a stable snapshot of the tag's membership at launch time rather than whatever matches the tag when the scan actually runs.

Configure a Tag-Based Scan Target

Before You Begin

  • Confirm which assets the tag currently resolves to and whether they have resolvable IPv4/IPv6 addresses or are FQDN-only.

  • Decide whether the scan should track the tag's live membership or a fixed snapshot of it. This determines which target mode you select.

To configure a tag-based scan target:

  1. Create a new scan or open an existing scan for editing.

  2. In the Targets field, select Tags as the target source.

    The tag-based targeting options appear.

  3. Select Targets defined by tags or Existing tagged assets only.

  4. Select the tag or tags to use as the target source.

  5. Save or launch the scan.

    Tenable One Vulnerability Management resolves the scan targets according to the mode you selected.

What To Do Next

If the scan aborts with an Empty Targets error, see the caution above. If you nest a Tags filter inside a rule that also contains IP or FQDN conditions, see the limitation below before troubleshooting further.

Nested Tag Rules and Scan Targeting

Caution: If a dynamic tag's rule nests a Tags filter inside a rule that also contains IPv4, IPv6, or FQDN conditions, target resolution for scanning fails silently. When you plan to use a tag as a scan target, keep its rule limited to IP address and FQDN-type conditions only, and build any tag-based grouping logic into a separate, non-nested tag instead.

Tag-Based Scanning and Role-Based Access Control

A user role scoped to a tag controls which assets that user can view — it does not prevent the user from manually typing an out-of-scope IP address or hostname into a scan's target field and successfully scanning it. Tag-scoped permissions are a visibility control, not a scan-target control.

If you need to guarantee that users cannot scan outside their assigned tag scope, restrict scan target entry at the scan or scan policy level in addition to configuring tag-scoped roles. For the full clarification, see Frequently Asked Questions.