---
title: "Tag endpoints for context and reporting"
slug: "tag-endpoints-for-context-and-reporting"
updated: 2026-09-09T16:09:29Z
published: 2026-09-09T16:09:29Z
canonical: "docs.redcanary.com/tag-endpoints-for-context-and-reporting"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tag Endpoints for Context and Reporting

Tags are key-value pairs applied either automatically or manually to an endpoint or identity. Key-value pairs are superior to typical single-value tags because they allow a greater level of both flexibility and control.

You can use tags to separate endpoints by geography or business unit/function, denote specific endpoints as "high risk," or tag endpoint types that have specific response playbooks such as critical infrastructure, domain controllers, etc.

## Manage, add and remove a tag to an endpoint

### Manage tags

Endpoints will have several tags automatically applied that cannot be removed. Additional tags can be added or removed as needed.

> **Note**: please ensure there is no whitespace in the tags.

### Add a tag

1. View the endpoint using **⌘-K** or by clicking **Endpoints** and filtering for the endpoint’s hostname.
2. Click **+** next to **Reporting Tags**.
3. Select whether you want to create a new tag key, or use an existing tag key.
4. Enter the value for the tag.
5. Click **Add Reporting Tag**.

### Remove a tag

1. View the endpoint using **⌘-K** or by clicking **Endpoints** and filtering for the endpoint’s hostname.
2. Scroll down to **Reporting Tags**.
3. Click the icon on the tag you want to remove from the endpoint.

## Add and remove tags to multiple endpoints

### Add tags to multiple endpoints

1. In the Zscaler MDR portal, click **Endpoints**.
2. Select multiple endpoints.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Screenshot 2025-03-05 at 2.39.18 PM(1).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A18Z&se=2026-11-09T12%3A54%3A18Z&sr=c&sp=r&sig=UmZKohPMUWHEZf%2FNelxcQmwGUomQRyUZYrj69ZGx808%3D)
3. Click the **Reporting Tags** dropdown, and then click **Set tag and value**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Screenshot 2025-03-05 at 2.44.59 PM.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A18Z&se=2026-11-09T12%3A54%3A18Z&sr=c&sp=r&sig=UmZKohPMUWHEZf%2FNelxcQmwGUomQRyUZYrj69ZGx808%3D)
4. Enter a tag name.
5. Enter a tag value.
6. Click **Set Reporting Tag**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Screenshot 2025-03-05 at 2.45.53 PM.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A18Z&se=2026-11-09T12%3A54%3A18Z&sr=c&sp=r&sig=UmZKohPMUWHEZf%2FNelxcQmwGUomQRyUZYrj69ZGx808%3D)

### Remove tags from multiple endpoints

1. In the Zscaler MDR portal, click **Endpoints**.
2. Select multiple endpoints.
3. Click the **Reporting Tags** dropdown, and then click the tag you want removed.
4. Click **Yes**.

## Add and remove tags to all of your endpoints

### Add tags to all of your endpoints

1. In the Zscaler MDR portal, click **Endpoints**.
2. Click **Select All**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Screenshot 2025-03-05 at 2.48.44 PM.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A18Z&se=2026-11-09T12%3A54%3A18Z&sr=c&sp=r&sig=UmZKohPMUWHEZf%2FNelxcQmwGUomQRyUZYrj69ZGx808%3D)
3. Click the **Reporting Tags** dropdown, and then click **Set tag and value**.
4. Enter a tag name.
5. Enter a tag value.
6. Click **Set Reporting Tag**.

### Remove tags from all of your endpoints

1. In the Zscaler MDR portal, click **Endpoints**.
2. Click **Select All**.
3. Click the **Reporting Tags** dropdown, and then click the tag you want removed.
4. Click **Yes**.

## Tags that are automatically applied to endpoints

Zscaler MDR automatically applies several tags to endpoints as they are created and updated:

- **endpoint_type** is set to *server* if the endpoint’s operating system is a known server operating system variant. In all other cases, it is set to *workstation*.
- **endpoint_platform** is set to *Windows*, *OS X*, or *Linux* depending on the endpoint’s operating system.
- **endpoint_operating_system** is set to the complete operating system name as provided by the EDR/EPP sensor.
- **endpoint_sensor_group**

EDR/EPP platform integrations will provide additional tags based on the data collected by those platforms.

For endpoints discovered in your cloud accounts, additional tags are applied:

- **cloud_provider** is the provider of the cloud, such as *Amazon Web Services*, *Microsoft Azure*, or *Google Cloud Platform*.
- **cloud_instance_id** is the unique identifier the cloud provider uses to identify the instance.
- **cloud_image_id** is the unique identifier of the “image” that the instance was built from (for example, in AWS this is the AMI ID).

You can add your own tags to further classify and label identities.

## 

### 

## 

##