Skip to main content

​
The Tag Management page

At /settings/tags: Tag Management showing tags APAC, BYOD, EMEA, End-User, Mac, NA, Server, Stock, VM — each with a device count and Logic Engine link Each row is a tag with: Top-right buttons:
  • Coverage Explorer — visualise tag overlap and uncovered devices
  • + Create Tag — define a new tag from scratch

​
How the Logic Engine works

Click any tag’s Logic Engine ▸ to open the rule editor. The Logic Engine uses the same query language used everywhere else. A rule looks like:
Devices that match the rule get the tag; devices that don’t, don’t. No manual tagging at scale. Re-evaluation is continuous — typically within one sync window of any underlying change.

​
Creating a new tag

1

Click + Create Tag

Top-right.
2

Name and colour

Pick a short, memorable name. The colour is used throughout the product (dashboard, tag chips, coverage maps).
3

Define the device-side rule

Click Logic Engine ▸ on the device side. Build a query using fields like:
  • os — enum: Windows, MacOs, Linux
  • osVersion — operating system version string
  • location.country, location.city, location.countryCode
  • lastUser.email, lastUser.department, lastUser.jobTitle
  • tags — compose with other tags (e.g. tags:End-User AND NOT tags:Stock)
  • system.<integration>.deployed etc. — boolean Vitals state
Use autocomplete in the rule editor to discover the full field set — see Query Syntax for the canonical list.
4

(Optional) define user-side rule

For tags that should also apply to users (e.g. Executive, Phishing-Campaign-Q2), define a rule against user fields.
5

Validate via Coverage Explorer

After saving, open Coverage Explorer to confirm the device count looks plausible.

​
Coverage Explorer

The Coverage Explorer (top-right of the Tags page) shows two critical visualisations: After every tag-rule change, sanity-check the Coverage Explorer:
  • The total tagged-device count shouldn’t drop unexpectedly
  • The “zero tags” cohort shouldn’t balloon
  • Overlaps should match your mental model — End-User ∩ Server should be ≈ 0; End-User ∩ EMEA should be non-trivial

​
Best practices

Tag dimensions should be independent: device class × region × ownership × OS family × sensitivity. A device carries one tag per dimension. Bad: Mac-Laptop and Windows-Laptop and Linux-Laptop (compound). Good: Mac + Laptop, Windows + Laptop.
Vitals fire on required:true AND deployed:false. Brand-new devices should land in tags that don’t yet require the security controls (typically Stock) until deployment is complete. Move them out of Stock (via the Logic Engine, not manual) only after baseline is done.
Good: End-User, Executive, Production-Server. Bad: Has-CrowdStrike, Intune-Compliant — query those fields directly.
A VIP-EndUser tag can be defined as tags:End-User AND tags:VIP. Composition keeps the underlying rules small.
Deleting a tag breaks Vitals requirements, saved views, and Actions that reference it. Rename or deprecate; delete only after migrating references.

​
Cross-references

Tags & Logic Engine

Conceptual deep dive

Vitals Configuration

Tag-based requirements

Query Language

The grammar the Logic Engine uses