--- title: "Applying Tags | ThreatConnect" slug: "applying-tags" description: "This article provides best practices for naming and administrating Tags in ThreatConnect. It also describes how to view a Tag’s details and manage Tags for Indicators, Groups, and Victims." tags: ["Enriching Data", "Best Practices"] updated: 2024-06-12T14:33:02Z published: 2024-06-12T14:33:02Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Applying Tags ## Overview Tags are data objects in ThreatConnect® that you can apply to [Indicators, Groups](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model), [Victims](https://knowledge.threatconnect.com/docs/create#creating-a-victim), and [Workflow Cases](https://knowledge.threatconnect.com/docs/workflow-cases). They create associations between the data they are applied to, as well as a path from one intelligence item to another. Tagging is a powerful and easy way to add metadata to an object, allowing you to quickly identify or follow associated activities of a particular interest within your [ThreatConnect owners](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect). Currently, there are two types of Tags you can apply to objects: standard Tags and [ATT&CK® Tags](https://knowledge.threatconnect.com/docs/attack-tags). This article describes how to manage Tags for Indicators, Groups, and Victims. For instructions on managing Tags for Cases, see the [“Tags” section of *Case Details*](https://knowledge.threatconnect.com/docs/case-details#tags). ## Before You Start ### User Roles - To manage Tags for Indicators, Groups, and Victims in an Organization, your user account must have an [Organization role](https://knowledge.threatconnect.com/docs/organization-roles) of Standard User, Sharing User, Organization Administrator, or App Developer. - To manage Tags for Indicators, Groups, and Victims in a Community or Source, your user account must have a [Community role](https://knowledge.threatconnect.com/docs/community-roles) of Contributor, Editor, or Director for that Community or Source. ### Prerequisites - To display the **Tags Across Owners**card on the **Details**screen for Indicators, turn on the **multiSourceViewEnabled**system setting (must be a System Administrator to perform this action). ## Best Practices Each [owner in ThreatConnect](/v1/docs/ownership-in-threatconnect) has different concerns and therefore different uses for Tags. Creating and following a tagging policy for all objects within an owner enables you to categorize, connect, and identify data more efficiently. This section provides some best practices for creating a tagging policy. - Create well-thought-out Tags that meet an agreed-upon standard within the owner. - Add a [description](https://knowledge.threatconnect.com/docs/the-description-attribute#tags-and-tracks) to all Tags, unless the Tags are self-explanatory. - Create Tags that are clear and concise, with no grammatical or spelling errors. - Review all Tags to ensure uniqueness. - Define when the use of acronyms is allowed (e.g., **APT** vs. **Advanced Persistent Threat**), particularly for words that have commonly used acronyms. - Capitalize all Tags that are acronyms (e.g., **APT** instead of **apt**). - Use the proper case in all Tags (e.g., **Trojan RAT** instead of **trojan rat**). - Make sure that Tags that have been shared between owners or that are applied to objects that have been shared between owners have matching configurations. - Keep Tags updated to reflect analytical or context changes. Maintenance of Tags is key to keeping data accurate and relevant. - Configure [Tag normalization rules](https://knowledge.threatconnect.com/docs/tag-normalization) to convert Tags using “like terms” to a single main Tag. For instance, creating a Tag normalization rule that converts Tags named **APT-28**, **Fancy Bear**, and **Threat Group-4127** to a main Tag named **APT28** helps ensure all analysts are tagging data related to APT28 uniformly. - Use ATT&CK Tags to identify [techniques](https://attack.mitre.org/techniques/enterprise/) and sub-techniques used by a particular adversary or threat actor, and leverage [ATT&CK Tag conversion rules](https://knowledge.threatconnect.com/docs/attack-tags#converting-standard-tags-to-attck-tags) to convert standard Tags into ATT&CK Tags based on whether they exactly or approximately match a specific ATT&CK Tag. ## Viewing Tag Details On the **Browse** screen, you can [view and filter Tags](https://knowledge.threatconnect.com/docs/the-browse-screen#tags-filter) by selecting **Tags**in the menu on the left side of the screen. You can also access a Tag’s **[](https://knowledge.threatconnect.com/docs/the-details-drawer)** [](https://knowledge.threatconnect.com/docs/the-details-drawer)[**Details** drawer](https://knowledge.threatconnect.com/docs/the-details-drawer) [](https://knowledge.threatconnect.com/docs/the-details-drawer)**[](https://knowledge.threatconnect.com/docs/the-details-drawer)** or [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy), both of which display the Indicators, Groups, and Victims to which the Tag is applied and provide the ability to [view the Tag in Threat Graph](https://knowledge.threatconnect.com/docs/accessing-an-objects-graph#indicators-groups-and-tags). ImportantOnly the legacy **Details**screen is available for Tags. ## Applying Tags to an Object NoteIf you create a new Tag that matches a synonymous Tag listed in a [Tag normalization rule](https://knowledge.threatconnect.com/docs/tag-normalization) when applying Tags, the Tag will be converted to the main Tag listed in the rule. Similarly, if you create a new Tag that [matches an ATT&CK Tag](https://knowledge.threatconnect.com/docs/attack-tags#converting-standard-tags-to-attck-tags) when applying Tags, the Tag will be converted to that ATT&CK Tag.NoteBy default, any new Tag that exactly matches an ATT&CK Tag will be converted to that ATT&CK Tag. If a Tag’s owner is added to the **Approximate Match**ATT&CK Tag conversion rule, any new Tag created in that owner that exactly or approximately matches an ATT&CK Tag will be converted to that ATT&CK Tag. ### New Details Screen On the [new **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen) for Groups, you can apply Tags to a Group on the **Details**card. On the new **Details**screen for Indicators, you can apply Tags to an Indicator on either the **Tags Across Owners**card (if the **multiSourceViewEnabled**system setting is turned on) or the **Details**card (if the **multiSourceViewEnabled**system setting is turned off). #### Tags Across Owners Card The **Tags Across Owners** card shows all Tags applied to the Indicator you are viewing in all of the Indicator’s [owners](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect) to which you have access, letting you quickly contextualize an Indicator without having to open the Indicator’s **Details** screen or drawer in each owner. To use this feature, your System Administrator must turn on the **multiSourceViewEnabled**system setting. Otherwise, the Tags applied to the Indicator will be displayed on the **Details**card, and they will be the Tags applied to the Indicator only in the owner listed at the top left of the **Details**screen. ImportantAs of ThreatConnect 7.6, the **Tags Across Owners**card is a beta feature. The following steps describe how to apply Tags to an Indicator on the **Tags Across Owners**card of the new **Details**screen. This card is available on the **Overview**tab, and it can be added to the **[](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)**[](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)[**Indicator: Custom View**tab](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)[](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)**[](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)**. 1. [Navigate to the **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen#viewing-the-details-screen) for an Indicator. 2. Click**Edit![Edit button_Details card_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20button_Details%20card_Details%20screen.png)**to the right of an owner’s name, or click on the list of Tags under an owner’s name, on the **Tags Across Owners**card. The Tags applied to the Indicator in the selected owner will now be editable (Figure 1). Depending on the number of owners the Indicator exists in, you may need to click **Show More**at the bottom of the **Tags Across Owners**card to display all of the Indicator’s owners on the card. ![Figure 1_Applying Tags_7.6.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Applying%20Tags_7.6.0.png) NoteTags without an icon to the left of their name are standard Tags that have not been [normalized to a main Tag through a Tag normalization rule](https://knowledge.threatconnect.com/docs/tag-normalization#creating-and-enabling-tag-normalization-rules). Tags with the![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Main%20Tag%20icon_Details%20Screen.png)icon are [main Tags](https://knowledge.threatconnect.com/docs/tag-normalization#viewing-main-tag-details)–that is, standard Tags for which a normalization rule has been enabled so that Tags defined as synonymous to the main Tag are converted to the main Tag when applied to an object. Tags with the![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/ATT&CK%20Tag%20icon.png)icon are [ATT&CK Tags](https://knowledge.threatconnect.com/docs/attack-tags). 3. Begin entering text into an owner’s**Tags**text box on the **Tags Across Owners**card. As you type, one of the following menus will be displayed: - If there are existing standard Tags or ATT&CK Tags that match part or all of the entered text, a menu containing those Tags listed under **Standard Tags**and **ATT&CK Tags**headings, respectively, will be displayed. Select a Tag from the menu to add it to the text box. - If there are no existing Tags that match the entered text, a menu with the **+ Add “**” as a new tag**option will be displayed. Select this option to create a new Tag that matches the entered text and add it to the text box. 4. Click **Confirm**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Confirm%20icon_Details%20screen.png)to the right of an owner’s name on the **Tags Across Owners**card to apply Tags to the Indicator in that owner. #### Details Card The following steps describe how to apply Tags to a Group or Indicator on the **Details**card of the new **Details**screen. This card is available on the **Overview**tab, and it can be added to a **[](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)**[](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)[**Custom View**tab](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)[](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)**[](https://knowledge.threatconnect.com/docs/the-details-screen-custom-view)**. NoteFor Indicators, the Tags applied to the Indicator in the owner listed at the top left of the **Details**screen will be displayed on the **Details**card only if the **multiSourceViewEnabled**system setting is turned off. Otherwise, the Tags applied to the Indicator will be displayed on the **Tags Across Owners**card, and they will be the Tags applied to the Indicator across all of the Indicator’s owners to which you have access. 1. [Navigate to the **Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen#viewing-the-details-screen)for an Indicator or Group.ImportantThe new **Details** screen is not currently available for Email, Signature, and Task Groups and for Victims. As such, you can apply Tags to these object types on the legacy **Details** screen only. 2. Click **Edit![Edit button_Details card_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20button_Details%20card_Details%20screen.png)**at the lower-right corner of the **Details**card, or click on the list of Tags on the **Details**card. The object’s Tags will now be editable (Figure 2). ![Figure 1_Applying Tags_7.2.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Applying%20Tags_7.6.0.png) NoteTags without an icon to the left of their name are standard Tags that have not been [normalized to a main Tag through a Tag normalization rule](https://knowledge.threatconnect.com/docs/tag-normalization#creating-and-enabling-tag-normalization-rules). Tags with the![Main Tag icon_Details Screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Main%20Tag%20icon_Details%20Screen.png)icon are [main Tags](https://knowledge.threatconnect.com/docs/tag-normalization#viewing-main-tag-details)–that is, standard Tags for which a normalization rule has been enabled so that Tags defined as synonymous to the main Tag are converted to the main Tag when applied to an object. Tags with the![ATT&CK Tag icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/ATT&CK%20Tag%20icon.png)icon are [ATT&CK Tags](https://knowledge.threatconnect.com/docs/attack-tags). 3. Begin entering text into the******Tags**text box on the **Details**card. As you type, one of the following menus will be displayed: - If there are existing standard Tags or ATT&CK Tags that match part or all of the entered text, a menu containing those Tags listed under **Standard Tags**and **ATT&CK Tags**headings, respectively, will be displayed. Select a Tag from the menu to add it to the text box. - If there are no existing Tags that match the entered text, a menu with the **+ Add “<*entered text*>” as a new tag**option will be displayed. Select this option to create a new Tag that matches the entered text and add it to the text box. 4. Click **Confirm![Confirm icon_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Confirm%20icon_Details%20screen.png)**to the right of the **Tags** text box on the **Details**card. ### Legacy Details Screen The following steps describe how to apply Tags to a Group, Indicator, or Victim on the **Tags**card of the legacy **Details**screen. 1. [Navigate to the legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy#viewing-the-legacy-details-screen) for an Indicator, Group, or Victim. 2. Scroll down to the **Tags**card on the right side of the screen (Figure 3). ![Figure 2_Applying Tags_7.2.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Applying%20Tags_7.6.0.png) 3. Begin entering text into the text box. If there are existing Tags that match part or all of the entered text, a menu with those Tags will be displayed. Select a Tag from the menu to apply it to the object. If there are no existing Tags that match the entered text, click **Add![Add Tag button](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Add%20Tag%20button.png)**or press **Enter**on your keyboard to create a new Tag and apply it to the object. 4. (Optional) Click **Recent Tags…**to display a list of recently used Tags (Figure 4). Tags displayed in this list are sized and ordered according to how recently or how often they were used. If desired, select a Tag from the list to apply it to the object. ![Figure 3_Applying Tags_7.2.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Applying%20Tags_7.6.0.png) ## Removing Tags From an Object ### New Details Screen #### Tags Across Owners Card If an Indicator’s **Details**screen includes the **Tags Across Owners**card, you can remove Tags from the Indicator while the Tags applied to the Indicator in a given owner are editable (Figure 1). To remove a Tag, click **Remove![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Remove%20Tag%20icon_New%20Details%20Screen.png)**to the right of the Tag, and then click **Confirm**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Confirm%20icon_Details%20screen.png)to the right of the owner’s name on the **Tags Across Owners**card. #### Details Card You can remove Tags from an object when the **Tags**section of the **Details**card is editable (Figure 2). To remove a Tag, click **Remove![Remove Tag icon_New Details Screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Remove%20Tag%20icon_New%20Details%20Screen.png)**to the right of the Tag, and then click **Confirm**![Confirm icon_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Confirm%20icon_Details%20screen.png)to the right of the **Tags**text box on the **Details**card. ### Legacy Details Screen Tags applied to an object are displayed on the right side of the **Tags** card (Figure 3). To remove a Tag from an object, click **Remove**![Remove Tag icon_Legacy Details Screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Remove%20Tag%20icon_Legacy%20Details%20Screen.png)to the right of the Tag, and then click **YES** on the **Remove Tag**window. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* *MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.* 20024-01 v.11.A ## Related - [The Details Screen](/the-details-screen.md) - [The Details Drawer](/the-details-drawer.md)