Define Tags in Cases (Admin)

Tags are assigned to cases by Google Security Operations based on predefined rules and can be used to classify cases or find specific cases faster. Note that you can manually add tags to a case from the Cases page. These tags can be removed from the case, but NOT removed entirely from the system.

You might want to import tags in the following situations. For example, moving from staging to production environment or for backup purposes.

To import tags:

1. Navigate to Settings > Case Data > Tags.
2. Click vertical_align_bottom Download template. The CSV chart shows the exact structure of how the imported tags should be laid out.
3. Enter in the tag information.
4. Click Import and the tags are displayed in the platform.

Note: The relationship between Assigned Tag and Search Name is many-to-many. That is, more than one Assigned Tag can be associated with one Search Name, and more than one Search Name can be associated with one Assigned Tag. For example, Google Security Operations assigns the same tag "DLP" to alerts that the SIEM tags as "Data Exfiltration" or "Symantec DLP – Financial Information – Network".

To add a new tag:

1. Click add Add on the top right of the page.
2. Enter a tag name.
3. Then choose between Entities, Product, Rule Generator or Vendor.
4. Select from the menu one of the following qualifiers: contains, exact, starts with, ends with. Choose the qualifier that best fits your needs.
5. Select the Entity from the menu, and enter Property and Value if necessary. Alternatively, select the Product, Rule Generator, or Vendor.
6. Select the priority for the tag. Note that Google Security Operations merges priority with other alerts and entities and events so that the priority here is not an absolute.
7. Select Can be a case name if required. When checked, the tag will be assigned as the title of the case if it meets the conditions.
8. Click Save.