Prerequisite: To assign tags from the Manager, make sure you have enabled the Enable Endpoint Tagging? checkbox in the ePO Integration page in the Manager.
You are able to assign tags to endpoints managed by ePO - On-prem through the Threat Explorer of the Manager. These assignments reflect in ePO - On-prem in real-time.
Go to → → .
Note
You must select a domain in which integration with ePO - On-prem is enabled. The integration must also have endpoint tagging enabled in the Manager.
Click an IP address from the Top Attackers or Top Targets panel.
Details about the IP address appear.
Endpoint Information tab.png "GUID-88123203-5553-4C50-B712-3A4238FF0726-low.png")
Within the Endpoint Information tab, look for the Endpoint Type.
You are able to assign tags only to endpoints that denote the Endpoint Type as MANAGED, which means that that endpoint is managed by ePO - On-prem using the Trellix Agent.
If the endpoint is managed, click the Tag (in ePO) button.
The Tag Endpoint pop-up window appears with the IP address of the endpoint that you are about to tag, the ePO server that you have integrated with, and a drop-down list of tags you can assign. These tags are created in ePO - On-prem.
Drop-down contains the list of tags created in ePO - On-prem.png "GUID-3BDF1DF4-5856-4BD0-B593-729142F9280E-low.png")
Select the tag you want to assign and click Tag.
If the assignment is successful, you receive a message stating the same.
Tagging successful.png "GUID-B5C87A29-4648-488E-81FB-5101675E6C5D-low.png")
If you have selected an unmanaged endpoint or the tagging is unsuccessful for another reason, you receive a message stating the failure.
Tagging fails when the endpoint is not managed by ePO - On-prem.png "GUID-D4FEF8CE-C088-4D61-A581-7E45E15E3B80-low.png")
The tag is assigned to the endpoint. You will be able to view it in ePO - On-prem. To see the steps you need to follow to view the tags, see View tags in Trellix ePO - On-prem.