> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-tagging.md).

# Asset Tagging

Cortex Xpanse supports the use of tags to enable custom IP ranges, advanced data filtering, customized data, and to restrict or permit access to data in Expander using Scope-Based Access Control (SBAC). There are two types of tags:

* *User-defined tags*—User-defined tags include the following:
  * **Asset Tags** (use the designation **AT** in the UI)—You can create, apply, and remove Asset Tags (AT) manually on the asset pages for domains, certificates, owned responsive IPs, and cloud assets in your Inventory.
  * **IP Range Tags** (**IPR**)—You can create, apply, and remove IP Range tags (IPR) manually on the **Owned IPv4 Ranges** and page in the **Inventory**.
  * **Rule-Based Tags** (**TR**)—You can define tag rules that apply tags automatically to assets that match your rule criteria, including any new assets that are attributed to your organization. Tag rules can be created for IPv4 addresses and IPv4 ranges, enabling you to define custom IPv4 ranges.
* *Xpanse-defined tags*—These tags are predefined and systematically applied to assets in Expander. Xpanse-defined tags cannot be removed or modified by users.
  * **Attribution Reason Tags** (**AR**)—Tags applied to assets by Expander indicating why the asset was attributed to your organization. Values are **Has Your Content** , **Registration Only**, **Discovered**, and **Provided**.

Both user-defined tags and Xpanse-defined tags are propagated from the asset to the related services, websites, alerts, and incidents within your tenant. Removing a tag from an asset will also remove the tag from any services, websites, alerts, and incidents to which it had propagated. When applying or removing a tag, it could take up to 2 hours for the tag to appear on (or disappear from) the services, websites, alerts, and incidents.

Tag-based filtering is supported on asset pages, services and websites pages, incidents, alerts, and reports and dashboards. For information about how to use tags for SBAC, see [Manage User Scope](/cortex-xpanse/users-and-roles/manage-user-scope.md).

In Expander, you can apply tags to all assets in your **Inventory** except websites and services. However, services inherit tags from the assets they are associated with.

Asset tags and IP Range tags are managed from the asset pages in your **Inventory**. Tag Rules are created and managed on the **Asset Tag Rules** page.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-tagging.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.