Asset Tagging provides a flexible and scalable way to automatically discover and organize the assets in your environment and ensures that your scans and reports are always synchronized with your dynamic business environment.
Asset Tagging is available only when the Asset Tagging feature has been added to your subscription by an account manager or support. Also a Manager must enable Asset Tagging by opting in to the New Data Security Model. A Manager can do this by going to Users > Setup > Security. Once properly set up, you'll notice the AV (AssetView) application appears in your application picker.
The service creates some tags based on the existing objects in your account. The tags you start with are not assigned to assets. Using the AssetView application you can assign these tags to assets manually. You can also edit the tags to add dynamic tagging rules so assets matching the tagging rules are applied automatically by the service. Learn moreLearn more
The service automatically creates these tags:
Business Units. The service creates a Business Units tag and a sub-tag for each of the business units defined in your subscription. For the Unassigned business unit the tag name is "Global". For a custom business unit the tag name corresponds to the business unit title. For example, if your business units are called EU and US, you'll have a tag called Business Units, which will have sub-tags called Global, EU and US.
Asset Groups. The service creates an Asset Groups tag and a sub-tag for each of the asset groups defined in your subscription. For example, if you have asset groups called Unix and Windows, you'll have a tag called Asset Groups, which will sub-tags called Unix and Windows.
Asset Tagging enables you to create tags and assign them to your assets. The most powerful use of tags is accomplished by creating a dynamic tag. Using a dynamic tag, the service automatically assigns tags to assets based on search criteria in a dynamic tagging rule.
Create dynamic tags using Asset TaggingCreate dynamic tags using Asset Tagging
One way to create a dynamic tag is to edit an existing tag using the AssetView application and build a dynamic tagging rule. There are multiple rule engines and asset properties to choose from.
Create dynamic tags using Asset SearchCreate dynamic tags using Asset Search
Another way to create a dynamic tag is to use the Asset Search. Asset search criteria can be saved as a dynamic tagging rule.
Go to Assets > Asset Search. Specify the host attributes to search for. For example, you can define a search for hosts with a particular tracking method, operating system, port number, service and/or detected vulnerability. When you've defined your attributes, click Create Tag, enter a name for your new tag and click OK. You can also create the tag from the search results. Click Create Tag at the top of the Asset Search Report window.
What Happens Next: The service creates the tag with a dynamic tagging rule based on your search criteria. Within the AssetView application, the new tag appears in your tag tree as a sub-tag below the "Asset Search Tags" parent tag. The new tag is automatically assigned to all scanned assets in your account that match your search criteria.
Create and assign static tagsCreate and assign static tags
You can create static tags and directly assign them to assets in the AssetView application.
All users can see all tags in the subscription and can choose tags for their scans and reports. You'll only see assets for tags that are in your scope (as defined by your All group).
By default, Managers, Auditors, Unit Managers and Scanners have permission to manage asset tags (create, update, delete). Readers may or may not have this permission. This depends on when the subscription was created.
Depending on when a customer has subscribed with Qualys, a user with Reader role may or may not have tagging permissions (Create User Tag, Edit User Tag, Delete User Tag) assigned.
- Subscribed to Qualys before Cloud Platform 3.7 release: By default, a user with Reader role will have tagging permissions (Create User Tag, Edit User Tag, Delete User Tag). You can remove the permissions by altering the tagging permissions in Admin utility.
- Subscribed to Qualys after Cloud Platform 3.7 release: By default, a user with Reader role does not have tagging permissions (Create User Tag, Edit User Tag, Delete User Tag). You need to explicitly assign the permissions to them.
1) In the Administration utility, go to Role Management tab, select the user to which you want to assign the permissions and click Edit.
2) In the Edit window, go to Permissions tab in the left pane and choose Tagging from the Modules drop-down.
3) Click Change to modify the permissions and assign the required permissions.
4) Click Save and the user permissions are assigned to the required user.