Tags

The Tag Manager lets you create and manage custom tags and update pre-configured tags within AME.

info

See Role Overview for permissions needed to manage tags.

Managing Tags

The Tag Manager UI is shown below:

info

Users need the AME Power User Role for at least one tenant to access this page.

Custom Tags

Use these buttons to manage custom tags:

Button	Function
	Add custom tag
	Edit custom tag

• Search: Filter tags by name using the search field.
• Dropdown: Filter tags by tenant using the dropdown menu.

Creating a Custom Tag

To create a new custom tag:

1. Click the Add custom tag button at the top.
2. Enter a unique tag name (lowercase only).
3. Optionally, add a URL for more information.
4. Add a description explaining the tag’s purpose.
5. Click Save in the lower-right corner of the tag modal.

note

Custom tags must be lowercase. Uppercase tags are reserved internally. Tags created with uppercase via overrides are converted to lowercase.

Updating or Deleting a Custom Tag

To update or delete a tag:

1. Click the tag to open its description.
2. Click the Edit custom tag button in the description panel.
3. Update fields as needed in the modal, then save, or click Delete to remove the tag.

info

CVE, CIS, Cyber Kill Chain, MITRE ATT&CK, and NIST CSF tags require a valid Security Knowledge Feature Pack license. See Licensing and Support.

CVE Tags

CVE tags are downloaded from <https://services.nvd.nist.gov/rest/json/cves/2.0> when added to events.

• Filters: Search tags by name, filter by CVSS score (using Score Comparator and Threshold), or by Publish Date.
• Manual Add: Use the Add button to add a CVE tag manually.

CIS Tags

CIS tags are static and view-only. Use the search field to filter by tag name.

Cyber Kill Chain Tags

Cyber Kill Chain tags are static and view-only. Use the search field to filter by tag name.

MITRE ATT&CK Tags

MITRE ATT&CK tags are preloaded in AME. The management page is shown below:

Updating MITRE ATT&CK Tags

To refresh MITRE ATT&CK tags:

• Click the Refresh Tags button to update tags from the MITRE GitHub repository.
• AME downloads tags directly or via an HTTP Proxy if configured.

Button	Function
	Refresh Tags

info

Contact Support if AME lacks internet access and MITRE tags need updating.

NIST CSF Tags

NIST CSF tags are static and view-only. Use the search field to filter by tag name.