9.1. Tags Table

Tags are categorized by families, represented by three letters at the beginning of the tag, followed by an underscore and the specific characteristic. For instance, the tag “ROS_WINDOWS” stands for Root Operating System of the Windows type.

Find all the tags prefix with their descriptions and examples in the table below. For more information about a specific tag, refer to ON CMDB > Tags.

Prefix	Tag Name	Description	Examples
ADN	ATTRIBUTE DISTINGUISHED NAME	Tag based on the endpoint’s hostname	ADN_WIN_USER1, ADN_SRD4_V02
ARU	AGENT REPORTING URL	URL used by the Agent for reporting data	ARU_DC123-QA_OPENCLOUDFACTORY_COM
BDA	BLUETOOTH DEVICES AVAILABLE	Tag containing the list of available devices	BDA_PXC_550
BDC	BLUETOOTH DEVICE CONNECTED	Tag with the currently connected device	BDC_CAR
CAI	CA CERTIFICATE ISSUER	Tag indicating the issuer of a CA certificate	CAI_DIGICERT_ASSURED_ID_ROOT_CA
CBE	CHROME BROWSER EXTENSION	Tag containing a list of Chrome extensions	CBE_GMAIL_8.3, CBE_YOUTUBE_4.2.8
CDT	CUSTOMER DEFINED TAG	Custom user-defined tag	CDT_CORPORATE_DEVICE
CEP	CALCULATED END POINT	Calculated endpoint information	CEP*
CGF	COMPLIANCE GROUP TESTS FAILED	Tag used when a group test fails	CGF_SWITCH_INFO
CGP	COMPLIANCE GROUP TESTS PASSED	Tag used when a group test passes	CGP_LAN_PORTS
CNS	CERTIFICATE NAME SUBJECT	Tags used to display certificate name subjects	CNS_SETMEUP.ARUBANETWORKS.COM
COI	CERTIFICATE ORGANIZATION ISSUER	Tags that displays certificate organization issuers	COI_HEWLETT_PACKARD_ENTERPRISE
CPC	CISCO PRIME CLIENT	Tags used when Cisco Prime is available	CPC_APIP_180.125.149.139, CPC_APMAC_006BF1757160
CPM	CALCULATED PROFILING METHOD	Calculated profiling method	CPM*
CRF	COMPLIANCE RULE FAILED	Tag used if a rule is not compliant	CRF_IOS_PORT_SECURITY
CRP	COMPLIANCE RULE PASSED	Tag used if a rule is compliant	CRP_SWITCH_MAC
CTF	COMPLIANCE TEST FAILED	Tag used for network device compliance	CTF_IOS_ACL_PERMIT_CA
CTP	COMPLIANCE TEST PASSED	Tag used for network device compliance	CTP_IOS_ACL_PERMIT_CA
CVE	COMMON VULNERABILITIES AND EXPOSURES	Tag that indicates security vulnerabilities	CVE_2021_40449, CVE_2022_21849, CVE_2023_4352
CWF	CAPTIVE WORKFLOW	Tag that indicates the captive workflow	CWF_VPN_ACCESS
CWT	CAPTIVE WORKFLOW TEMPLATE	Tag that indicates the captive workflow template	CWT_PROFILE_GUEST_USERS
CYN	CYNERIO PLUGIN	Tags related to the Cynerio plugin execution (Healthcare Solutions)	CYN_USC_BEDSIDE, CYN_UTA_IV_PUMP, CYN_DOS_LINUX_12, CYN_USC_TELECOM
DAD	DATA AUDIT DATE	Data related to governance risk compliance tag	DAD_AAAAMMDD, DAD_20210717
DAG	DATA AVAILABILITY GRADE	Device related to governance risk compliance tag	DAG_LOW, DAG_MEDIUM, DAG_HIGH
DAL	DATA AUTHENTICITY LEVEL	Data related to governance risk compliance	DAL_LOW, DAC_MEDIUM, DAL_HIGH
DBW	DEVICE BROWSER	Tag indicating the device’s browser from an agent or captive portal	DBW_IE, DBW_FF
DCL	DATA CONFIDENTIALITY LEVEL	Tag related to governance risk compliance data	DCL_LOW, DCL_MEDIUM, DCL_HIGH
DCT	DATA CLASSIFICATION TYPE	Tag related to governance risk and compliance data	DCT_LOW, DCT_MEDIUM, DCT_HIGH
DDI	DEVICE DOMAIN INFO	Tag that displays Windows Domain information based on Agent payloads (Full, SessionChanges and Recover).	DDI_JOINED_DOMAIN, DDI_STATE_DOMAINJOINED, DDI_DOMAIN_NAME_ACME
DDP	DEVICE DESTINATION PORT	Ports to which the device is attempting to connect	DDP_TCP_80, DDP_TCP_22, DDP_UDP_53
DFP	DHCP FINGERPRINT	Fingerprint based on DHCP information	DFP_DESKTOP, DFP_PRINTER, DFP_MOBILE, DFP_APPLE
DFT	DISCOVERY FILTERED PORT	Filtered port information	DFT_TCP_80, DFT_UDP_53
DIL	DATA INTEGRITY LEVEL	Tag related to governance risk compliance data	DIL_LOW, DIL_MEDIUM, DIL_HIGH
DMO	DEVICE MOBILITY	Indicates device mobility	DMO_PORTABLE, DMO_STATIC
DNC	DEVICE NETWORK CDIR	CDIR of the device in the network	DNC_10.10.36.0_24
DNN	DEVICE NETWORK NAME	Device hostname	DNN_HEALTH_CLINIC
DNS	DNS QUERIES	DNS queries information	DNS_SLS.UPDATE.MICROSOFT.COM, DNS_LOGIN.LIVE.COM
DOP	DEVICE OPEN PORT	Open ports on devices	DOP_TCP_443, DOP_TCP53, DOP_TCP_80
DOS	DEVICE OPERATING SYSTEM	Device OS name	DOS_WINDOWS_10, DOS_WINDOWS_8
DPA	DEVICE PROFILING ACCURACY	Endpoint Type accuracy (number of matched rules)	DPA_1, DPA_3
DRG	DATA RISK GRADE	Device related governance risk compliance tag	DRG_LOW, DRG_MEDIUM, DRG_HIGH
DSC	DEVICE SYSTEM CATEGORIZATION	Tag calculated in User Devices tag policies	DSC_LOW, DSC_MEDIUM, DSC_HIGH
DSN	DEVICE SERIAL NUMBER	Device serial number	DSN_9S714D112050ZK80324266, DSN_9S714AF12050ZK8016
DTL	DATA TRACEABILITY LEVEL	Data related governance risk compliance tag	DTL_LOW, D
EBE	EDGE BROWSER EXTENSION	Tag containing a list of Edge extensions	EBE_MCAFEE_WEBADVISOR_4.1.0.0
EHI	END POINT HTTP INFO	Endpoint HTTP system information	EHI_PRINTER, EHI_VOIP
EPC	END POINT COMPLIANCE	Endpoint compliance status	EPC_FULL_COMPLIANCE, EPC_WIN_COMPLIANCE
EPT	END POINT TYPE	Type of end point	EPT_PC, EPT_VOIP, EPT_PRINTER, EPT_CAMERA, EPT_IOT
ESB	END POINT SERVICE BANNER	Type of end point	ESB_PRINTER, ESB_VOIP
ESI	END POINT SERVICE INFO	Type of end point	ESI_PRINTER, ESI_VOIP, ESI_MOBILE
FBE	FIREFOX BROWSER EXTENSION	Tag containing a list of Firefox extensions	FBE_WIKIPEDIA_EN_1.1, FBE_BING_1.3
HAD	HTTP USER AGENT DEVICE	Tag obtained from userDeviceProfiling plugin	HAD_GENERIC_FEATURE_PHONE, HAD_SMART_TV
HDT	HARDWARE DEVICE TYPE	Hardware type definition (physical or virtual)	HDT_VMGUEST, HDT_BAREMETAL. HDT_MACRANDOM
IAI	INTERNAL APPLICATION INSTALLATION	Device installed applications	IAI_EDGE, IAI_FIREFOX
IAS	INTERNAL APPLICATION STATUS	Device running applications	IAS_EDGE, IAS_FIREFOX
ICT	INTERNAL CACHE TAG	Internal tag with cache information	ICT_FGA_172.31.1.5
INV	INVENTORY	Inventory of a user device	INV_LOADED
IPT	IP ADDRESS TYPE	Tag with the IP address type	IPT_STATIC
IRP	IRON CHIP PLUGIN	Tag for Iron Chip plugin location	IRP_HOME_80, IRP_OFFICE_92, IRP_TRAIN_75
ISS	INTERNAL SECURITY STATUS	Device security status	ISS_AV_ENABLED, ISS_ACTIVE_ADMIN_USER, ISS_AV_PRODUCT_CROWDSTRIKE_FALCON_SENSOR, ISS_FW_PRODUCT_FIREWALL_DE_WINDOWS, ISS_WINDOWS_PENDING_UPDATES, ISS_SYSTEM_UPDATES_UNKNOWN, ISS_SYSTEM_UPDATES_ENABLED, ISS_SYSTEM_UPDATES_DISABLED, ISS_WINDOWS_UPDATED, ISS_BITLOCKER, ISS_BITLOCKER_DRIVE_C
KQC	KERBEROS QUERY CONNECTION	Kerberos query connection	KQC_ONDCVPNGW_ACME.LOCAL
LBD	LOCATION BUILDING	Tag for network device location	LBD_TORREAGBAR
LCI	LOCATION CITY	Tag for network device location	LCI_BARCELONA
LCO	LOCATION COUNTRY	Tag for network device location	LCO_SPAIN
LFL	LOCATION FLOOR	Tag for network device location	LFL_PLANTA4
LMI	LOCATION MISCELLANEOUS	Tag for network device location	LMI_AULA01, LMI_SALA7
MAC	MAC ADDRESS VENDOR	Type of end point	MAC_0001E6, MAC_4A4286
MCA	MACHINE CLUSTER ACCURACY	Accuracy for cluster machine learning	MCA_30, MCA_60, MCA_100
MDM	MOBILE DEVICE MANAGEMENT	Type of end point	MDM_AIRWATCH, MDM_MOBILE_IRON
MED	MEDIGATE	Information given from the Medigate API	MED_UCA_MEDICAL,MED_UTA_VITAL_SIGNS_MONITOR
MLA	MACHINE LEARNING ACCURACY	Accuracy for machine learning	MLA_30, MLA_60, MLA_100
MLC	MACHINE LEARNING CLUSTER	Cluster for machine learning	MLC_20220525_5674189, MLC_20220525_UNKNOWN
MLR	MACHINE LEARNING RESULT	Result for machine learning	MLR_MATCH, MLR_NO_MATCH
MLT	MACHINE LEARNING TYPE	Type for machine learning device	MLT_TAG_SERVER_PROXMOX, MLT_TAG_SERVER_ON_SENSOR
MME	MAX MAC EXCLUDE	Tag for maxMacConnected plugin	MME_SWITCH, MME_PORT_XX
NBI	NETWORK BEHAVIOR INSIDE	Tag for devices connected to a server with a public IP. The tag is suffixed by ICD (Internet Connection Detected).	NBI_ICD_FULL, NBI_ICD_ATTEMPT
NCA	NON COMPLIANCE APPLICATION	Applications under required version	NCA_ACROBAT_READER, NCA_TEAMVIEWER
NCS	NON COMPLIANCE SECURITY FEATURES	Security features non-compliant (not ISS)	NCS_AVUPDATE, NCS_FWUPDATE, NCS_BITLOCKER, NCS_BITLOCKER_DRIVE_D
NCW	MICROSOFT KNOWLEDGE BASE	Microsoft knowledge base	NCW_KB46576960, NCW_KB75757575
NDL	NETWORK DEVICE LOCATION	Network device location	NDL_BARCELONA
NDT	NETWORK DEVICE TYPE	Network device type	NDT_WIFI
NDW	NON COMPLIANCE WINDOWS UPDATES	Non-compliance Windows updates	NDW_WINDOWS_10_ADOBE_FLASH
ONC	OPENNAC TAGS	Tag defined by openNAC	ONC_AUTOLEARNED, ONC_AGENT, ONC_WIN_AGENT
PAF	PALO ALTO FIREWALL	Information about PA firewall devices	PAF_APP_DNS, PAF_APP_GOOGLE_BASE
PDP	PARENT DEVICE PROFILE	End point type parent profile	PDP_DESKTOP, PDP_CAMERA
PLE	PLUGIN EXECUTED	Asynchronous plugin execution tag	PLE_DISCOVER, PLE_USERDEVICEPROFILING
PMC	PREVIOUS MAC CHANGE	Tag with the previous MAC address	PMC_A400E2E9F400
POP	PASSIVE OPEN PORT	Device open ports by NMAP profiling	POP_TCP_80, POP_UDP_53
PP_	PARENT PROFILE	Parent profile with hierarchy level	PP2_DESKTOP_WINDOWS, PP1_PRINTER
RDI	RELEASE DATE ID	ID for the OS release date	RDI_LINUX_MINT_21_1_VERA, RDI_UBUNTU_22_04_3_LTS_JAMMY_JELLYFISH, RDI_MICROSOFT_WINDOWS_10_0_22623
ROS	ROOT OPERATING SYSTEM	Root device OS name	ROS_WINDOWS, ROS_MACOS, ROS_LINUX
RQC	RADIUS QUERY CONNECTION	RADIUS query connection	RQC_DOM_USR.LAB, RQC_HOST/WIN10X64_STD2.DOM.COM
SAM	SECURITY ALERT MESSAGE	Tags related to security alerts	SAM_THREAT_SCAN
SBP	SERVICE BEING PROVIDED	Tags related to the device providing different protocols	SPB_HTTP, SBP_KRB_TCP, SBP_SSL
SBC	SERVICE BEING CONSUMED	Tags related to the device consuming different protocols	SBC_DNS, SBC_HTTP, SBC_NTP
SHQ	SSL HOSTNAME QUERY	SSL hostname query	SHQ_WWW.GOOGLE.COM, SHQ_IMAP.GMAIL.COM
SNE	STATIC NETWORK EXCLUDE	Static network exclude	SNE_Anything
SNP	STATIC NETWORK PORT	Static network port	SNP_10.10.36.45_50006
SNV	STATIC NETWORK VIOLATION	Static network violation	SNV_10.10.36.45_50007
SPS	SWITCH PORT STATUS	Switch port status	SPS_TCP_10_OK
SQP	SNMP QUARANTINE PLUGIN	Tag with info generated by SNMP plugin	SQP_$SWIP_$SWPort, SQP_$UDMAC_$SWPort_$oldVlan
SRC	SOURCE	Identify request source	SRC_SENSOR, SRC_WIFI, SRC_HOTSPOT
SSC	SSH SERVER CONNECTION	SSH server connection	SSC_1.2.4.4
SSO	SNMP SYSTEM OBJECT	SNMP system object information	SSO_PRINTER, SSO_VOIP, SSO_TERMINAL
SVP	SET VLAN PLUGIN	Tag of network device two formats	SVP_$Port_$Vlan, SVP_GENERAL_$Vlan
TAR	TARGET APPLICATION REQUIRED	Application required version	TAR_TEAMVIEWER_12, TAR_ACROBAT_READER_20
UBD	USB BLOCKED DEVICE	USB blocked device	UBD_80EE_0030
UCA	USER DEVICE CATEGORY	Indicates the type of use that a device has	UCA_MEDICAL, UCA_LOGISTICS
UCD	USB CONNECTED DEVICE	USB connected device	UCD_80EE_0030
UCL	USER DEVICE CLASS	Indicate the equipment class	UCL_NONPATIENTRELATED, UCL_MISC
UDC	USER DEVICE CLIENT	Indicates the IP address and the service of a server to which the user device is connected.	UDC_PROTOCOL_SERVERIP, UDC_DNS_10.10.39.99
UDT	USER DEVICE TAG	Tag for user device	UDT_*
UFC	USER DEVICE FDA CLASS	Food and Drug Administration class	UFC_7
UID	DEVICE UNIQUE IDENTIFIER	Device UUID (STATID)	UID_6F0341D5_86CC_5B55_8F34_376B8AF1B9BB
UIP	UPDATE INSTALLATION PENDING	Pending updates	UIP_KB2267602
UIS	UPDATE INSTALL STATUS	Tags that indicate the update status of a system	UIS_AMOUNT_UPDATES_PENDING_2, UIS_OLDEST_UPDATE_PENDING_15, UIS_SEVERITY_UPDATES_PENDING_UNKNOWN, UIS_SEVERITY_UPDATES_PENDING_CRITICAL, UIS_SEVERITY_UPDATES_PENDING_IMPORTANT, UIS_SEVERITY_UPDATES_PENDING_MODERATE, UIS_SEVERITY_UPDATES_PENDING_LOW
UMA	USER DEVICE MANUFACTURER	Indicates the device manufacturer	UMA_ALCAD, UMA_CISCO
UMO	USER DEVICE MODEL	User device model	UMO_ACCURO, UMO_2530
UPL	USER DEVICE PURDUE LEVEL	Determine in which zone operates a device	UPL_LEVEL_4
USC	USER DEVICE SUB CATEGORY	Adds information to the user device category	USC_MEDICAL_IOT, USC_MEDICAL_COMMUNICATION
UTA	USER DEVICE TYPE	Type of the user device	UTA_VENTILATOR,UTA_GLUCOSE_METER
UTC	UNIQUE TAG CHANGE	Tag was replaced by a new one of the same type	UTC_EPT_IP_PHONE
VOS	VERSION OPERATING SYSTEM	Device version OS name	VOS_WINDOWS_10_PRO, VOS_WINDOWS_10_ENT
WCS	WIFI CURRENT SSID	Tag with the current connected SSID	WCS_CASA
WSA	WIFI SSID AVAILABLE	Tag with the list of SSID available	WSA_WLAN_3021