Tags

Tags are free-form string metadata you attach to entities. They are the workhorse of triage, filtering, grouping, and automation in TrackMe — a lightweight way to say “this entity belongs to that team / environment / domain / regulation” and then act on it everywhere. You can set them by hand or assign them automatically with tag policies.

What tags are

• Free-form, flat strings — no hierarchy and no enforced namespace. Adopt a naming convention (team:auth, env:prod, owner:alice, domain:network) to give them structure.

• An entity can carry many tags. Its effective tags are the union of policy-assigned tags and manually-set tags.

Common uses: team and ownership attribution (team:payments, owner:alice), environment segmentation (env:prod / env:staging), domain grouping (domain:network), and regulatory scope (pci, gdpr).

Note

Tags are resolved in lowercase and matched case-insensitively, so team:Auth and team:auth are the same tag — but still pick one convention, or tag sprawl will erode their value.

Setting tags

• Manually, per entity — manual tags are flagged and are not removed by policies.

• By policy — tag policies use the same three methods as priority (regex, lookup, SPL) and are per component (see Tag policies).

When both apply, manual and policy tags are merged. And when several tag policies match, their tags merge too (a union) — unlike priority, a second matching policy adds its tags rather than overriding. Removing a policy cleans only the tags that policy contributed; other policies’ tags and your manual tags remain.

Important

Tags are not labels. Tags are free-form, per-component, filterable strings. Labels are curated, colour-coded chips drawn from a per-tenant catalogue. Rule of thumb: a free-form filterable string is a tag; a curated coloured chip is a label.

Where tags are used

Like priority, tags are classification, not scoring — they never change an entity’s score or state. Their value is everything you can do with them:

Triage & filtering in the UI

tags is a first-class filter and search axis on every entity table — type tags=cloud or tags IN(env:prod, env:staging) to narrow the view — and you can group the entity list by tag, turning a flat list into team- or domain-shaped sections. This is the fastest way to triage “show me everything for the network team”.

Grouping & Virtual Groups

A virtual group can scope its members with a filter expression that uses tags (for example tags IN("cloud")), so you can build a cross-tenant NOC view per domain or team — “all of the network estate”, “everything tagged pci” — without any new monitoring.

Automation

Tags are a field in TrackMe’s shared filter language (operators = and IN(…) with * / ? wildcards, combined with AND / OR / NOT and parentheses, case-insensitive). That one language lets tags scope auto-label rules, ML outlier detection, and AI Advisor automated actions — so, for example, autonomous tuning only runs on tags=team:payments.

Bulk operations

Filter the entity table by tag, select the matches, and bulk add, remove, or replace manual tags across the whole selection — the practical way to retag at scale.

Alerting & notable events

An entity’s tags are carried onto its stateful alerts and notable events as context, so your Enterprise Security or correlation searches can route, group, and prioritise on them.

Note

TrackMe has no built-in “tag → email recipient” routing — recipients are set on the alert action. Tags enable routing downstream: they ride along on the alert and notable so your own ES correlation searches or automation can act on them. Tags also live on the entity record (they are not a metric dimension), so “report by tag” means filtering entities, not an mstats … by tags split.

Tag policies

A tag policy assigns tags automatically, matching entities by regex, a Splunk lookup, or an SPL search, per component. Policies suggest; manual tags always survive; and removing a policy auto-cleans only the tags it added.

See also

• Tags — in depth — the regex/lookup tag-policy procedures, the REST apply endpoint, KV Store internals, and troubleshooting.

• Labels & auto-labels — the curated chip feature, and how it differs from tags.

• Priority and SLA policies — the sibling policy types.

• Virtual Groups — virtual groups can filter on tags.