Skip to main content

Cyware Threat Intelligence eXchange

Tag Groups

Notice

This feature is available in Intel Exchange v3.7.5.0 onwards.

Tag Groups allow you to group related tags under a single parent tag. This helps organize and categorize threat data more efficiently, especially when working with large volumes from different sources.

When a tag group is applied to threat intel, it is automatically mapped to all matching tags included in the group. This enables consistent tagging, supports tag aliasing, and improves automation and rule execution.

You can create and manage tag groups that include the following tag types: System, Source, User, or Privileged Access.

Create Tag Group

BeforeyouStart

Your user group must have the following permissions to create a tag group:

  • View Tags and Create tags permissions.

  • Tag Categories Management Permission for the tag category of the tags you want to add to the Group Tag.

Steps

To create a new Tag group, follow these steps:

  1. Go to Administration > Tag Management > Tag Groups.

  2. Click Add Tag Group.

  3. Enter the following details:

    1. Tag Group Name: Provide a unique name for the tag group. The name must be unique across both tags and tag groups.

    2. Description (Optional): Add a brief description to define the purpose of the group.

    3. Select Tags: Search and select one or more existing tags to include as child tags. You can also create new tags during this step. Tags of all types (System, Source, User, and Privileged Access) can be added to a tag group.

  4. Click Create.

Note

  • A single tag group can include multiple child tags.

  • A tag can be associated with multiple tag groups.

Manage Tag Groups

You can view and manage existing tag groups from the Tag Groups tab in the Tag Management section.

To manage a tag group, click the ellipsis next to the tag group entry and choose from the available actions:

  • Edit: Modify the group name, description, or add/remove child tags.

  • Enable / Disable: Change the status of the tag group. Disabled groups will not be applied during ingestion or enrichment.

  • Clone: Create a duplicate of the tag group along with its associated child tags. The cloned group name follows the format original-tag-group-name-copy. You can edit the name and tag mappings before saving.

The listing view also supports filtering. By default, all the tag groups are displayed regardless of their status and are sorted by Last Modified Date.