Clean up Tags list

[VasilPetrov]

Hello All,

I want to clean up my tags list, because some of the old tags that we used are not needed any more.

We don't have active devices with tags that I want to remove.

Any idea from where i can do that?

Regards,

Vasil

[mavraham]

Hi @VasilPetrov, thank you for writing to Live Community.

To remove endpoint tags follow these steps:

Remove an Endpoint Tag

Depending on where you created your tag, Server or Agent, you can choose to edit or remove the tags.

• From the Cortex XDR agent:

  1. Navigate to the Cytool folder location and open the CLI as an administrator.

  2. Cytool Argument: cytool endpoint tags remove “tag1 [,tag2, ...,tagN]”.

From the Cortex XDR management console:

1. Navigate to Endpoints → All Endpoints → Tags field.

2. Select one or more endpoints, right-click, and select Endpoint Control → Remove Endpoint Tags.

3. Save the tag names you removed.

You can read more about managing endpoint tags here. 

[VasilPetrov]

Hello,

Sorry but probably i did a wrong explanation of my case. I want to clean up tags list from management portal.

When you want manually to assign a tag from management portal you receive a pop-up with all used tags. I want to clean up that list. Some of my tags were for test purposes and now I want to clean them. Example in the attachment. 

[PiyushKohli]

Hi @VasilPetrov

In your case wherein you would like to clean up tags from management portal, I'd recommend submitting a support case as from management portal you won't be able to do cleanup but support team could help you for the same. You can submit a support case here.

Hope this helps!

Thanks

[VasilPetrov]

@PiyushKohli 

I already did a case, but sadly this feature to clean up tags list is not available.

PA have been working to implement it, so we need to wait.

Regards,

Vasil

[Antony_Chan]

@VasilPetrov If your intention is to clean up the "suggestion" tags that is no longer needed, only support case could help. Specifically, you need to request the Product/backend engineer to have it remove. But there's a catch here, you need to ensure the tag is no longer using on any endpoint AND all the alerts/incidents associated to the tag purged.
Just an example here:

• An endpoint A was tagged with "Test_Tag"
• Somehow endpoint A was involved with a security incident, some alerts were generated.
• The security incident and alerts will involved the tag "Test_Tag"
• Then you have the tag "Test_Tag" untagged from endpoint A.
• Despite that the "Test_Tag" is not apply to any endpoints, the tag is still in used due to the association with the alerts/incidents.
• In this case, you'll need to wait after the retention period (6 months) of those alerts in order to remove the tag completely. 

Hope this help.

[Tim_Adelmann]

I have been looking for solution for the exact same thing as well.

It would be great if a cleanup feature for unnecessary tags would be added in a future release.

Regards,

Tim

[Thendral_Arasu]

Hello All,

I am also facing the same issue with the tag list. Currently, there seems to be no way to effectively clear or manage old tags' history, which is confusing while working with them.

If anyone has suggestions or solutions to address this issue, please share. Your assistance in resolving this would be greatly appreciated.

Thanks 

Thendral M