topic Re: Clean up Tags list in Cortex XDR Discussions

Clean up Tags list

VasilPetrov — Tue, 16 May 2023 10:38:21 GMT

Hello All,

I want to clean up my tags list, because some of the old tags that we used are not needed any more.

We don't have active devices with tags that I want to remove.

Any idea from where i can do that?

Regards,

Vasil

Re: Clean up Tags list

mavraham — Tue, 16 May 2023 12:37:40 GMT

Hi @VasilPetrov, thank you for writing to Live Community.

To remove endpoint tags follow these steps:

Remove an Endpoint Tag

Depending on where you created your tag, Server or Agent, you can choose to edit or remove the tags.

From the Cortex XDR agent:
1. Navigate to the Cytool folder location and open the CLI as an administrator.
2. Cytool Argument: cytool endpoint tags remove “tag1 [,tag2, ...,tagN]”.

From the Cortex XDR management console:

Navigate to Endpoints → All Endpoints → Tags field.
Select one or more endpoints, right-click, and select Endpoint Control → Remove Endpoint Tags.
Save the tag names you removed.

You can read more about managing endpoint tags here.

Re: Clean up Tags list

VasilPetrov — Wed, 17 May 2023 12:32:24 GMT

Hello,

Sorry but probably i did a wrong explanation of my case. I want to clean up tags list from management portal.

When you want manually to assign a tag from management portal you receive a pop-up with all used tags. I want to clean up that list. Some of my tags were for test purposes and now I want to clean them. Example in the attachment.

Re: Clean up Tags list

PiyushKohli — Wed, 24 May 2023 05:52:07 GMT

Hi @VasilPetrov

In your case wherein you would like to clean up tags from management portal, I'd recommend submitting a support case as from management portal you won't be able to do cleanup but support team could help you for the same. You can submit a support case here.

Hope this helps!

Thanks

Re: Clean up Tags list

VasilPetrov — Thu, 25 May 2023 07:27:42 GMT

@PiyushKohli

I already did a case, but sadly this feature to clean up tags list is not available.

PA have been working to implement it, so we need to wait.

Regards,

Vasil

Re: Clean up Tags list

Antony_Chan — Fri, 02 Jun 2023 09:21:28 GMT

@VasilPetrov If your intention is to clean up the "suggestion" tags that is no longer needed, only support case could help. Specifically, you need to request the Product/backend engineer to have it remove. But there's a catch here, you need to ensure the tag is no longer using on any endpoint AND all the alerts/incidents associated to the tag purged.
Just an example here:

An endpoint A was tagged with "Test_Tag"
Somehow endpoint A was involved with a security incident, some alerts were generated.
The security incident and alerts will involved the tag "Test_Tag"
Then you have the tag "Test_Tag" untagged from endpoint A.
Despite that the "Test_Tag" is not apply to any endpoints, the tag is still in used due to the association with the alerts/incidents.
In this case, you'll need to wait after the retention period (6 months) of those alerts in order to remove the tag completely.

Hope this help.

Re: Clean up Tags list

Tim_Adelmann — Tue, 01 Aug 2023 07:43:28 GMT

I have been looking for solution for the exact same thing as well.

It would be great if a cleanup feature for unnecessary tags would be added in a future release.

Regards,

Tim

Re: Clean up Tags list

Thendral_Arasu — Tue, 23 Jul 2024 06:19:41 GMT

Hello All,

I am also facing the same issue with the tag list. Currently, there seems to be no way to effectively clear or manage old tags' history, which is confusing while working with them.

If anyone has suggestions or solutions to address this issue, please share. Your assistance in resolving this would be greatly appreciated.

Thanks

Thendral M

Re: Clean up Tags list

Venkatesh_Konar — Wed, 05 Mar 2025 11:06:02 GMT

Hell All ,

1. Same i am facing with issues as , we have created multiple tags and Cortex XDR Team has not provided separate Tag section were we can add / remove the unused tags.

2. I dont understand why cortex xdr alerts/incidents section are totally based on tag as we are facing issues where Operating system based column are not presents . Filtering out the alerts / incidents based solely on tag is not effective approrach.

3. Cortex XDR team need to provide seprate section of Tags so that user can manage Tag very well in order to avoid confusions.