--- title: "Tag asset" slug: "tag-assets" updated: 2025-03-07T16:15:31Z published: 2025-03-07T16:15:31Z canonical: "docs.hunters.ai/tag-assets" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt > Use this file to discover all available pages before exploring further. # Tag assets 💡Before you start Learn more about asset tags and how they work [here](/v1/docs/about-asset-tags). 🚧Note Asset tagging will only be applied to new security events, and not retroactively. ## Working with asset tags ### Create a new asset tag 1. In the Hunters console, navigate to **Knowledge Center > Tags**. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/2023-06-05_11-26-59.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D) 2. Click **New Tag** at the top right corner. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/2023-06-05_11-24-15%20dd%281%29.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D)A new line opens. 3. Name your new asset tag and give it a short description. 4. Under **Identifier**, define which assets will be tagged by creating an identifying rule. Use the following identifier types: | Tag Identifier | Description | Examples | | --- | --- | --- | | Equals | An asset that will be tagged by the exact value. | `username = admin` will tag any attribute with the kind `username` and the value `admin`. It is important to note that `admin1` or `_admin` will **not** be tagged, since they do not match the condition. | | Like (case insensitive) | Tagging any assets with a similar naming pattern, used with the character `%` | `hostname = DC-%` will tag any attribute with the kind `hostname` with a value that begins with the wildcard character `DC-%`. | | CIDR | Entire network segments will be tagged with CIDR notation. Supports IPv6 as well as IPv4. | `192.168.1.0/24` `2001:0000:130F:0000:0000:09C0:876A:130B` | 📘 Note A single tag can have multiple identifiers, from multiple types. 5. Define the **Sensitivity** level that will be assigned to each asset with this tag (Critical/High/Neutral/Low). 6. Once done, click **Save**. 📘 Learn more You can create an asset tag straight from the lead, by clicking the arrow next to the lead attribute and then clicking **Add Asset Tag**. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/07198a3-Custom_Scoring_Dialog.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D) ### Assign an existing asset tag to an asset 1. When investigating a lead, find the asset you want to tag. 2. Click the arrow next to the lead attribute and then click **Add Asset Tag**. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/07198a3-Custom_Scoring_Dialog.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D) 3. From the radio button, select **Assign to an existing asset tag**. ![Assign asset tag](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Assign%20asset%20tag.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D) 4. Click **Assign** next to the relevant tag. ## Common Use-Cases ### High Profile Roles In many organizations, the compromise of a high profile employee may put the entire business at risk due to the level of access to confidential information this employee may have. Here are some recommended use-cases for asset tagging for high profile employees **Example: C-Level Employee** A common use case is tagging C-Level executives, as can be seen in the example below. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/clevel.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D) ### Crown Jewels Some common use cases are for applying asset tags on critical assets, either in the form of a hostname (using a pattern of the organizational naming convention for hosts) or through the use of a network subnet (e.g., a subnet critical application databases). **Example: Hostname** A common use case is tagging critical hosts by their hostname. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/hostname.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D) **Example: Network Subnet** An additional common use case is also tagging critical hosts by their subnet. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/2469f97-Critical_Subnet.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D) ### Attack Simulation Tools Just like the severity can be increased if a critical asset is involved in a lead, you can also use Asset Tagging to reduce the severity of a lead. A common use case is tagging BAS (Breach and Attack Simulation) tools in your environment, thereby helping your SOC focus on true positives rather than known testing activities. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/037d1f2-Simulation_Host.png?sv=2026-02-06&spr=https&st=2026-10-15T17%3A09%3A27Z&se=2026-10-15T18%3A09%3A27Z&sr=c&sp=r&sig=%2FFy8PP8Qn6eIq1KocwuYCZSRDtWp0zx6%2FMOemdUz6L4%3D)