You can use an Expert rule to apply tags to an object.
Procedure
- On the Add Custom/Memory/Registry Rule page, provide a name for the rule.
- If the rule name does not contain the tags you intend to use, include them into the Description field.
Although you cannot add a column on the rules table pages, you can display the description. It helps in pairing the rule that creates a particular tag with a rule that uses that tag to identify matching operations.
- Select Expert as the rule type (for Custom rules) or click On in the Expert Mode radio button field (for Memory and Registry rules).
- In the Operations list, select the operations that must trigger the rule.
- In the Tagging Actions list, select the object that you want to tag (Tag Target, Tag Process, or Add Global Tags).
Selecting one of these actions, adds the Tags to Add/Remove field below the list.
- In the Tags to Add/Remove field, enter the names of the tags you want to apply when the conditions of this rule are met.
To add more than one tag, separate the tag names with commas.
- Enter any additional conditions for matching this rule, such as paths or files, the processes, and any restrictions by user or policy.
- Click Save & Exit after specifying the rule.