Define tags in cases

Tags are assigned to cases by Google Security Operations based on predefined rules and can be used to classify cases or find specific cases faster. You can manually add tags to a case from the Cases page. These tags can be removed from the case, but can't be completely removed from the system.

You might want to import tags in the following situations, such as moving from a staging to a production environment, or for backup purposes.

Import tags

To import a tag, follow these steps:

1. Go to SOAR Settings > Case Data > Tags.
2. Click vertical_align_bottom Download template. The CSV file shows the required tag import structure.
3. Enter the tag information.
4. Click login Import; the tags are displayed in the platform.

Add a new tag

To add a new tag, follow these steps:

1. Go to SOAR Settings > Case Data > Tags.
2. Click add Add Tag.
3. Enter a name in the Tag name field.
4. Select one of the choices in Entities, Product, Rule Generator and Vendor.
5. From the menu, select one of the following qualifiers: contains, exact, starts with, ends with. Choose the qualifier that best fits your needs.
6. Select the entity from the menu, and enter Property and Value if necessary. Alternatively, select the Product, Rule Generator, or Vendor.
7. Select the priority for the tag. Note that Google SecOps merges priority with other alerts and entities and events so that the priority here is not an absolute.
8. Select Can be a case name if required. When selected, the tag is assigned as the title of the case if it meets the conditions.
9. Click Save.