Tags in Tenable One Vulnerability Management

Tag Structure and Limits

Tags are managed under Settings → Tagging. The Tagging page has two tabs:

  • Categories — groups of related tag values (maximum 100 categories per instance)
  • Values — individual tags in Category:Value format (maximum 100,000 values per category)

The Values tab shows, per tag: the creator, when it was last processed, whether it was applied manually or automatically, the current assessment status, and the number of assets currently carrying that tag.

Note: Tag names cannot contain commas and are limited to 50 characters.
Note: The # of Assets column on the Tags page may show a higher count than a tag-based search in the Assets inventory. The tag count includes deleted assets that have not yet aged out of the license count. This is expected behavior.

Manual vs. Automatic Tags

When you create a tag, you choose whether it is manual or automatic:

  • Manual tags have no rules. You explicitly apply them to individual assets. They persist until you remove them and do not respond to changes in asset attributes.
  • Automatic tags include one or more tag rules. Tenable One Vulnerability Management evaluates assets against those rules continuously and applies or removes the tag as assets change.

Create a Tag

Create a tag when you need to add business context to one or more assets, either by applying it manually or by defining rules that apply it automatically.

Before You Begin

  • Confirm your user account has the Scan Manager or Administrator role.

  • Decide whether the tag belongs in an existing Category or requires a new one.

To create a tag:

  1. In the left navigation bar, click the Settings icon.

    The Settings page appears.

  2. On the Settings page, click the Tagging tile.

    The Tagging page appears, showing the Categories and Values tabs.

  3. In the upper-right corner, click Create Tag.

    The Create Tag pane appears.

  4. In the Category field, select an existing category or create a new one.

  5. In the Value field, enter a value for the tag.

  6. Optionally, in the Category Description and Value Description fields, enter descriptive text.

  7. Do one of the following:

    • To save the tag as a manual tag, click Save.

    • To save the tag as an automatic tag, configure at least one tag rule, then click Save.

    Tenable One Vulnerability Management adds the tag to the Values tab.

Tip: You can also create a dynamic tag directly from the Assets page. Filter the asset inventory to the exact set of assets you want, then click Take Action → Create Dynamic Tag. Tenable One Vulnerability Management converts your active filters into the tag rule automatically.

What To Do Next

Apply the tag to assets, or, if you created an automatic tag, monitor the Assessment column on the Values tab until it shows Completed. If assets you expect to see are missing, see Troubleshoot Tags.

Tag Rules

Tag rules are the logic that powers automatic tags. Each rule is composed of one or more filter-value conditions combined with AND (Match All) or OR (Match Any) logic. When an asset satisfies all the conditions in at least one rule, Tenable One Vulnerability Management applies the tag.

Rule Limits

  • Maximum boolean filter conditions per rule: 40
  • Maximum values per filter property: 1,024 (for example, a single IP Address filter can list up to 1,024 addresses)
Note: If your tag fails to apply, the rule may be returning too many assets for Tenable One Vulnerability Management to process. Reduce the scope by adding stricter conditions or splitting the rule across two tags joined by a nested tag filter. For other common causes of tags not applying, see Troubleshoot Tags.

Tag Rule Filters Reference

The following table lists the most commonly used rule filters. A complete list is available in the Tagging UI under Settings → Tagging → Create Tag → Rules.

Filter Category Example Filters License Required
Network Identifiers IPv4 Address (CIDR supported), IPv6 Address, MAC Address, DNS (FQDN), Hostname, NetBIOS Name, Open Ports Base
Asset Metadata Operating System, System Type, Installed Software (CPE 2.3), Name, Record Type, Source Base
Scan Timing First Seen, Last Seen, Last Authenticated Scan, Last Licensed Scan, Created Date, Updated Date Base
Cloud — AWS AWS Region, AWS VPC ID, AWS EC2 Instance ID, AWS Security Group, AWS Owner ID, ARN Base
Cloud — Azure Azure Resource Group, Azure VM ID, Azure Subscription ID, Azure Resource Type Base
Cloud — GCP Google Cloud Instance ID, Google Cloud Project ID, Google Cloud Zone Base
Cloud Native Tags Resource Tags (By Key), Resource Tags (By Value), Cloud Provider, Hosting Provider Base
Risk Scores ACR, ACR Severity, AES, AES Severity Tenable One
Status Flags Licensed, Deleted, Terminated, Public, Assessed vs. Discovered, Has Plugin Results Base
Third-Party ServiceNow Sys ID, Custom Attribute (key-value pairs) Base (integration required)
Tags (nested) Tags — filter assets that already carry a specific tag (case-sensitive; maximum 100 tags per rule) Base

Tag Rule Operators

Operators define how a filter value is matched against an asset attribute. Available operators depend on the data type of the filter.

Data Type Available Operators
String is equal to, is not equal to, contains, does not contain, matches (wildcards supported), does not match, exists, does not exist
Date / Time is equal to, is greater than, is less than, between, older than, newer than, within last
Numeric / Score =, !=, >, >=, <, <=
Caution — Wildcard Performance: The asterisk (*) wildcard is supported in matches and does not match operators. Avoid leading wildcards (for example, *linux). Leading wildcards force a full-index scan and can cause search timeouts or prevent tags from applying. Use trailing wildcards (for example, linux*) or the contains operator instead.

Managing Tags — Quick Reference

Task Required Role Location
View tags Read-Only or higher Settings → Tagging → Categories or Values tab
Create a tag Scan Manager or Administrator Settings → Tagging → Create Tag button
Create a dynamic tag from an asset filter Administrator Explore → Assets → filter → Take Action → Create Dynamic Tag
Apply a tag to a single asset Basic User or higher Asset Details page → Tags section → + button
Apply a tag to multiple assets Basic User or higher Explore → Assets → select checkboxes → Add Tags
Remove a tag from assets Basic User or higher Explore → Assets → select checkboxes → More → Remove Tags
Edit a tag or category Scan Manager or Administrator Settings → Tagging → click the tag or category row
Export tags (CSV or JSON) Scan Manager or Administrator Settings → Tagging → select tags → Export
Delete a tag or category Scan Manager or Administrator Settings → Tagging → Actions → Delete
Search assets by tag Scan Operator or higher Settings → Tagging → Values → Actions → Search by Tag
Note: The roles in this table control who can create, edit, or delete tags. They are separate from access group permissions, which use tags to scope which assets a user can view or edit. Access group permissions do not restrict which IP addresses or hostnames a user can manually enter as scan targets. For more information, see Frequently Asked Questions and Tag-Based Scanning.
Caution: Deleting a tag category removes it and all associated tag values from every asset in the system immediately. This action cannot be undone from the UI. Export the tag library before making major changes.

Additional Resources

For complete tagging documentation, see Tags in the Tenable One Vulnerability Management User Guide.