rmvtag
Use the rmvtag operator to remove a tag or multiple tags to ThreatStream observables for the IOCs returned by an ioc or iocmatch lookup table search.
Syntax
|rmvtag <tagnames> [is_public=true|false]
<tagnames>
|
Comma-separated list of tag names to remove from the IOCs. |
[is_public]
|
Specify true to remove public tags or false to remove private tags. If this option is not specified, the implicit default is false. |
Usage
You can use the rmtag operator to remove a tag or multiple tags from ThreatStream observables for the IOCs returned by an ioc or iocmatch lookup table search. For example, you can perform a search on the ioc lookup table to
find indicators with a confidence score of less than 10, low severity, and that has not
been modified in the past 3 months; and then pipe this operator to remove a specific tag the organization uses to identify indicators that are of high concern and routinely sent to Integrator destinations.
In addition to removing the tag in ThreatStream, the operator adds a column to search results named tag_removed with the value True.
For information about ThreatStream observable tags, refer to ThreatStream online help.
Examples
Example 1
ioc|rmvtag "tag_name_1"Example 2
ioc|rmvtag "tag_name_1, tag_name_1" is_public=false