Troubleshoot Tags

This topic covers the most common reasons a tag doesn't behave as expected in Tenable One Vulnerability Management, and how to resolve each one. For general conceptual questions about tag behavior, see Frequently Asked Questions.

Tags Are Not Applying to Expected Assets

If a dynamic tag was created or updated but one or more assets you expect to see are missing, work through the following checks in order.

Check the Excluded Assets List

When you manually remove a rule-based tag from an asset, Tenable One Vulnerability Management adds that asset to the tag's Excluded Assets list. From that point on, the asset is silently exempt from every future rule evaluation for that tag — even if the asset matches the rule again later. Nothing in the standard Assets view distinguishes an excluded asset from one that simply doesn't match the rule, which makes this one of the most frequently missed causes of "my dynamic tag isn't picking up an asset it should."

To check whether an asset is excluded:

  1. Call GET /tags/exclusions (see Tagging via API) to list the assets currently excluded from a given tag, or inspect the tag icon on the asset — a static (non-dynamic) icon () indicates a manual override.

    The response returns the asset UUIDs currently excluded from rule evaluation for that tag.

  2. To let the rules engine re-evaluate the asset, remove the manually applied tag from it.

    Tenable One Vulnerability Management re-enters the asset into rule-based evaluation on the tag's next processing cycle.

Note: Excluding an asset after a manual removal is expected behavior, not a bug — it exists so that an intentional manual change to a rule-based tag isn't immediately overwritten by the next rule evaluation. See Core Concepts for how manual overrides interact with automatic tags.

Check the Recalculation Schedule

Tenable One Vulnerability Management re-evaluates automatic tag membership only when one of the following occurs:

  • You create or edit the tag or its rules (and save).
  • A scan or connector import completes and new data is available.
  • The 12-hour background sweep runs.

An asset from a scan that completed moments ago may not be tagged yet simply because none of these triggers has run for it. Before assuming a rule is broken, check the Last Processed and Assessment columns on the Values tab, and allow time for the next scheduled trigger.

Check Whether the Rule Is Too Broad

A rule that matches an extremely large number of assets can fail silently instead of returning an error. See Tags in Tenable One Vulnerability Management for rule limits and guidance on splitting an overly broad rule into two tags joined by a nested tag filter, and avoid leading wildcards, which force a full-index scan.

Tags Filter Assets, Not Findings

Note — Known Limitation: Tags filter the Assets view. They do not filter the Findings view. There is currently no workaround. If you need to correlate findings with a tagged asset population, filter the Assets view by tag to get the asset list, then cross-reference that list against Findings manually or through the API.

Filtering by Multiple Tags Has a Practical Limit

Note — Known Limitation: Filtering assets by several tags at the same time can produce inconsistent results once the number of tags in the filter grows large. This is a known engineering limitation. If a multi-tag filter returns unexpected results, reduce the number of tags in a single filter and combine the results manually, or use a nested Tags rule condition on a dynamic tag instead of a live multi-tag view filter.

Scan Aborts with "Empty Targets"

If a scan configured to use tags as its target source aborts with an Empty Targets error, the tag most likely resolves to assets that have no IPv4 or IPv6 address (for example, FQDN-only assets) and the scan is set to the wrong target mode. See Tag-Based Scanning for the two target modes and which one to use.

Nested Tag Rules Fail Silently in Scan Targeting

A tag rule that nests a Tags filter inside a rule that also contains IPv4, IPv6, or FQDN conditions does not work reliably as a scan target source. See Tag-Based Scanning for the supported rule structure.

API Tag Filters Don't Match the UI

If you're building dynamic tag rules through the API and a filter type you use in the UI (such as a cloud resource tag filter) doesn't appear in the API's filter list, this is a known V1 API limitation. See the note in Tagging via API.