addtag
Use the tag operator to add a tag or multiple tags to ThreatStream observables for the IOCs returned by an ioc or iocmatch lookup table search.
Syntax
|addtag <tagnames> [is_public=true|false]
<tagnames>
|
Required. Specify a comma-separated list of tag names to add to the IOCs. |
is_public
|
Optional. Specify true to set the added tag public setting to true. If this option is not specified, the implicit default is false: the tag is not publicly visible. |
Usage
You can use the addtag operator to add a tag or multiple tags to ThreatStream observables for the IOCs returned by an ioc or iocmatch lookup table search. For example, you can perform a search on the ioc lookup table to
find indicators with a confidence score of greater than 80 and high severity; and then pipe this operator to add a specific tag the organization uses to identify indicators that are of high concern and routinely sent to Integrator destinations.
In addition to adding the tag in ThreatStream, the operator adds to search results a column named tag_added with the value True.
For information about ThreatStream observable tags, refer to ThreatStream online help.
Examples
Example 1: Add a single tag to observables.
|addtag "tag_name_1"Example 2: Add multiple tags to observables.
|addtag "tag_name_1, tag_name_1"Example 3: Add a public tag to observables.
|addtag "tag_name_1" is_public=trueExample 4: Tag filtered IOCs from a lookup table based on confidence score.
iocmatch |where not feed_name contains "OSINT" and confidence >80 and ioc_type!="md5" and indicator startswith "50"|dedup id |fields id, indicator, feed_name, tags |addtag "ioctag_test"