There are requirements and restrictions, which tags must meet.

  • If there are multiple tags, separate them wih commas. Do not use commas in the tag name itself.
  • Tags must have at least one non-numeric character.
  • The prefixes <Bit9:, YaraTags, or <LegacyClassification: are reserved for use by Carbon Black App Control and should not be used in a tag unless advised by Carbon Black Support or Services. For more details, see Built-in Tags.
  • A tag and the process pattern of a rule (i.e., the pattern in any of the process fields) must not be the same. This helps avoid conflicts during rule processing.
  • Avoid extremely long tag names. All of the fields in a rule combined must not exceed 2048 characters.
  • Do not use the pipe (|) character.