Automated tagging rule conditions

Asset name

contains

Text box (single value)

Matches assets whose name contains the specified term.

prod-db matches assets named like prod-db-01 or acme-prod-db.

begins with

Matches assets whose name begins with the specified term.

prod-db matches assets named like prod-db-01 but not acme-prod-db.

Asset criticality

any of

Multi-select dropdown

Match assets by criticality level. Available values: High, Medium, Low.

Any of High matches all assets flagged as high-criticality.

Risk score

equals (=), greater than (>), less than (<), greater than or equal to (>=), less than or equal to (<=)

Text box (single integer value)

Match assets by risk score.

> 80 matches assets with a risk score above 80.

Asset group

any of

Multi-select dropdown

Match assets that belong to specified asset groups.

Any of Production servers matches all assets in the Production servers group.

Custom tags

any of

Multi-select dropdown

Match assets that have specified custom tags applied.

Any of custom tag A matches all assets that have the custom tag A tag applied.

Device importance

any of

Multi-select dropdown

Match devices by importance level. Available values: Low, Medium, High, Critical.

Any of Critical matches all devices flagged for critical importance.

Device services

any of

Multi-select dropdown

Match devices by associated services. Available values:

Any of Domain controller matches all devices acting as domain controllers.

Device type

any of

Multi-select dropdown

Match devices by type. Available values:

Any of Server matches all devices identified as servers.

IP address / range / subnet

any of

Text box (single value)

Match devices by IP address. Specify a single IP address, range, or subnet. Both IPv4 and IPv6 are supported.

Here are some of the formats supported:

Any of 10.0.0.0/16 matches all devices on that subnet.

Device managed status

any of

Multi-select checkbox

Match devices by managed status. Available values:

Any of Managed matches all devices managed by TrendAI Vision One™.

Operating system and version

any of

Multi-select dropdown

Matches devices running selected operating systems.

Any of Windows matches all Windows devices.

contains

Text box (single value)

Matches devices whose operating system or version contains the specified term.

Server 2025 matches devices running OSes like Windows Server 2025 Datacenter.

begins with

Matches devices whose operating system or version begins with the specified term.

Microsoft Windows matches devices running Microsoft Windows Server or Microsoft Windows (64 bit) but not Windows 11.

Organizational unit (OU)

contains

Text box (single value)

Matches devices in Active Directory organizational units whose name contains the specified term.

Sales matches devices in organizational units like Sales, Sales Operations, or Western Sales.

begins with

Matches devices in Active Directory organizational units whose name begins with the specified term.

Sales matches devices in organizational units like Sales or Sales Operations but not Western Sales.

Services

any of

Multi-select dropdown

Match domains by detected services. Available values: HTTP, HTTPS, SMTP, DNS.

Any of HTTPS matches all domains serving HTTPS.

Host provider

any of

Multi-select dropdown

Match domains by hosting provider. Available values:

Any of Amazon Web Services matches all domains hosted on AWS.

Services

any of

Multi-select dropdown

Match IP addresses by detected services. Available values: HTTP, HTTPS, SMTP, DNS.

Any of HTTPS matches all IP addresses serving HTTPS.

Host provider

any of

Multi-select dropdown

Match IP addresses by hosting provider. Available values:

Any of Amazon Web Services matches all IP addresses hosted on AWS.

Job level

any of

Multi-select dropdown

Match accounts by job level. Available values: C-level executive, Director, Independent contractor, Manager, Non-managerial employee, Senior employee, Temporary employee, Vice president.

Any of Manager matches all accounts at the manager level.

Job function

any of

Multi-select dropdown

Match accounts by job function. Available values:

Any of Information technology matches all accounts in IT roles.

Account level

any of

Multi-select dropdown

Match accounts by account level. Available values: High-profile user.

Any of High-profile user matches all accounts flagged as high-profile users.

Work location

any of

Multi-select dropdown

Match accounts by work location.

Any of New York matches all accounts based in the New York office.

Department

any of

Multi-select dropdown

Match accounts by department.

Any of Sales matches all accounts in the Sales department.

User principal name

contains

Text box (single value)

Matches accounts whose user principal name contains the specified term.

john.doe matches accounts with UPNs like john.doe@example.com or dr.john.doe@example.com.

begins with

Matches accounts whose user principal name begins with the specified term.

john.doe matches accounts with UPNs like john.doe@example.com but not dr.john.doe@example.com.

Cloud provider

any of

Multi-select dropdown

Match cloud assets by cloud provider. Available values: AWS, Azure, GCP, Alibaba Cloud.

Any of AWS matches all assets in your connected AWS accounts.

Service

any of

Multi-select dropdown

Match cloud assets by cloud service. Available values:

Any of EC2 matches all AWS EC2 instances.

Location

any of

Multi-select dropdown

Match cloud assets by region or location. Available values are sourced from your connected cloud provider regions.

Any of United States matches all cloud assets located in the United States.

Cloud account ID

any of

Dropdown

Match cloud assets by cloud account ID.

Any of 123456789012 matches all assets in that cloud account.

Cloud account name

any of

Multi-select dropdown

Matches cloud assets in selected cloud accounts.

Any of production-east matches all cloud assets in the production-east cloud account.

begins with

Text box (single value)

Matches cloud assets in cloud accounts whose name begins with the specified term.

prod- matches cloud assets in cloud accounts like prod-east or prod-west.

Cloud provider asset tag

any of

Two text boxes (key and value)

Match cloud assets by tags assigned in the cloud provider. Specify a key and a value for the tag.

Specifying key Environment and value Production matches all cloud assets tagged with Environment=Production in their cloud provider.

Cluster Groups

any of

Multi-select dropdown

Match cloud assets by cluster group. Available values: Alibaba Cloud ACK, Amazon EKS, Google Cloud GKE, Microsoft AKS, Self-managed.

Any of Amazon EKS matches all cloud assets in Amazon EKS clusters.