Clean up Tags list

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Clean up Tags list

L1 Bithead

Hello All,

I want to clean up my tags list, because some of the old tags that we used are not needed any more.

We don't have active devices with tags that I want to remove.

Any idea from where i can do that?





L4 Transporter

Hi @VasilPetrov, thank you for writing to Live Community.

To remove endpoint tags follow these steps:

Remove an Endpoint Tag

Depending on where you created your tag, Server or Agent, you can choose to edit or remove the tags.

  • From the Cortex XDR agent:

    1. Navigate to the Cytool folder location and open the CLI as an administrator.

    2. Cytool Argument: cytool endpoint tags remove “tag1 [,tag2, ...,tagN]”.

From the Cortex XDR management console:

  1. Navigate to Endpoints  All Endpoints  Tags field.

  2. Select one or more endpoints, right-click, and select Endpoint Control  Remove Endpoint Tags.

  3. Save the tag names you removed.

You can read more about managing endpoint tags here. 


Visit our Cortex XDR Customer Corner on Live Community to access resources for your product journey, engage in discussions with community members and subject matter experts, and register for upcoming events: Cortex XDR Customer Corner

L1 Bithead


Sorry but probably i did a wrong explanation of my case. I want to clean up tags list from management portal.

When you want manually to assign a tag from management portal you receive a pop-up with all used tags. I want to clean up that list. Some of my tags were for test purposes and now I want to clean them. Example in the attachment. 

Hi @VasilPetrov


In your case wherein you would like to clean up tags from management portal, I'd recommend submitting a support case as from management portal you won't be able to do cleanup but support team could help you for the same. You can submit a support case here.


Hope this helps!



L1 Bithead


I already did a case, but sadly this feature to clean up tags list is not available.

PA have been working to implement it, so we need to wait.





L2 Linker

@VasilPetrov If your intention is to clean up the "suggestion" tags that is no longer needed, only support case could help. Specifically, you need to request the Product/backend engineer to have it remove. But there's a catch here, you need to ensure the tag is no longer using on any endpoint AND all the alerts/incidents associated to the tag purged.
Just an example here:

  • An endpoint A was tagged with "Test_Tag"
  • Somehow endpoint A was involved with a security incident, some alerts were generated.
  • The security incident and alerts will involved the tag "Test_Tag"
  • Then you have the tag "Test_Tag" untagged from endpoint A.
  • Despite that the "Test_Tag" is not apply to any endpoints, the tag is still in used due to the association with the alerts/incidents.
  • In this case, you'll need to wait after the retention period (6 months) of those alerts in order to remove the tag completely. 

Hope this help.


L1 Bithead

I have been looking for solution for the exact same thing as well.

It would be great if a cleanup feature for unnecessary tags would be added in a future release.




Hello All,

I am also facing the same issue with the tag list. Currently, there seems to be no way to effectively clear or manage old tags' history, which is confusing while working with them.

If anyone has suggestions or solutions to address this issue, please share. Your assistance in resolving this would be greatly appreciated.


Thendral M

Thendral M
  • 7 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!