Labels & auto-labels¶

Labels are curated, colour-coded chips drawn from a per-tenant catalogue — a lightweight triage and workflow layer over your entities. Where tags are free-form strings, labels are a small, deliberate vocabulary (blocked, under-review, in-progress, resolved …) that you and your automation use to track what is being done about an entity at a glance. You assign them by hand, or have TrackMe apply them automatically with auto-label rules.

Important

Labels are not tags. Labels come from a curated, colour-coded catalogue, are cross-component, and can be applied by rules. Tags are free-form strings, scoped per component. This is the single most common point of confusion in this part — if you asked for “a label” and got a tag, this is why.

The catalogue, assignments, and rules¶

A tenant’s labels have three pieces:

Piece	What it is
Catalogue	The curated set of label definitions for a tenant — each with a name, colour, description, and display order. You can only assign labels that exist in the catalogue.
Assignment	Attaching one or more catalogue labels to an entity. Labels are per tenant but cross-component — one catalogue, assignable to entities of any component. Every assignment records who changed it and when.
Rules (auto-labels)	Rules that assign labels automatically, evaluated by the scheduled decision maker (see below).

All three live in the Manage Labels modal — an Assign tab to label the entities you have selected, a Manage tab to curate the catalogue, and an Automated tab for the rules.

The Manage Labels modal — Assign tab, with the catalogue chips

The Manage Labels modal — Manage tab, curating the label catalogue

A tenant is seeded with eight default labels — blocked, under-review, in-progress, resolved, maintenance, acknowledged, noise, decommissioned — which already form a ready-made triage workflow. All are fully editable and deletable.

Warning

Deleting a catalogue label is destructive — it removes that label from every entity assignment, across all components, with no soft-delete. Audit before bulk deletions.

Automatic label assignment¶

Auto-label rules (the Automated tab) apply labels for you, evaluated by the scheduled decision maker. Each rule fires on one of four triggers:

Trigger	Fires when…
discovered	The entity first appears (once per entity).
enters_alert	The entity transitions green → red/orange.
recovers	The entity transitions red/orange → green.
custom_filter	The entity matches a filter expression (once per entity).

A rule can be further gated by a priority filter and/or a filter expression. Each rule has a removal mode:

manual — additive: the label is added and then left alone. Non-edge triggers fire once per entity, so a label you manually remove is not resurrected next cycle.
auto — reconcile: the label is present while its condition holds and removed when it clears. Auto rules only ever touch the labels they own — never your manual labels or another rule’s labels.

The Manage Labels modal — Automated tab, editing an auto-label rule

Note

recovers + auto is a useful pattern: it latches a “recovered” badge on the recovery edge, holds it while the entity stays green, and retracts it when the entity re-enters alert. An always-green entity never gets the badge.

Auto-labels run only on the scheduled (write) path — loading the UI never changes assignments. The Automated tab is power/admin only.

Where labels are used¶

Like priority and tags, labels are classification, not scoring — they never change an entity’s score or state. Their value is what you do with them:

Triage & filtering: labels is a column on the entity table, a Group by: Labels pivot, and a first-class filter axis (labels=blocked, labels IN(under-review, in-progress)) — so an analyst can instantly pull up “everything blocked” or “everything someone is already working on”.

The entity table with a Labels column showing coloured chips

A workflow vocabulary: The default labels describe what is being done about an entity — under-review → in-progress → resolved for an investigation, blocked for something needing attention, noise for a known low-value source, decommissioned for one being retired. Apply them by hand, or let auto-labels apply them on the right transition.

Important

Labels are signals, not triggers. They are purely descriptive — no label has a functional side effect. In particular the acknowledged and maintenance labels do not perform acknowledgment or maintenance, and noise does not suppress alerting; those are separate systems (Alerting, Operations & Administration, and the blocklist). A label records a decision; it does not take an action.

Grouping & Virtual Groups: A virtual group can scope its members with a filter expression that uses labels — for example a single card of everything currently blocked across tenants.
Automation scoping: Labels are a field in the shared filter language, so you can scope AI Advisor automated actions and ML outlier detection by label — for instance, let autonomous tuning run only on entities that are not under-review. (Labels are used for scoping here; they are not an ML feature input.)
Bulk operations: Select many entities and bulk add or remove labels across the whole selection — the fast way to move a batch of entities through a workflow step.
Alerting & notable events: An entity’s labels are carried onto its notable events as context, so your Enterprise Security or correlation searches can act on them. (Labels are not carried on stateful-alert records.)