More options with tags
04 March 2024
Since the use of tags is increasing, it was time for a review. They now appear in more places, most notable phishy urls. The
documentation on how tags work is updated, and here are the most important rules to keep in mind:
- If you tag a domain, all subdomains will inherit that tag
- Subdomains can have tags that do not appear on the pay level domain.
- If you tag a url corresponding certificates, websites and DNS records get it too
- Certificates and websites can have additional tags that are not on the url
- Phishy_domains inherit tags from the original pay level domain
- If you tag a subnet, all hosts in it will inherit the tag
Some of the new reports make heavy use of magic queries (those starting with a $). All magic queries support two extra options
last_seen and
tags
So, to make a custom Software Vulnerabilities Report only for assets with the tag "my_tag" that are seen in the last two weeks, you use the query:
$software_vulnerabilities_report and last_seen>-14d and tags=my_tag