CBOM Documentation

CBOM Secure

  • Product Overview
    • Overview
    • Dashboard Interface
    • Dashboard Operations
    • Data Visualization
    • Overview
    • Host
    • Template
      • Networked Deployments
      • Cloud Deployments
      • Off-Grid Deployments
    • Discovery History
      • Tags
      • Tag Scope
      • Integrations
      • Cloud Servers
      • CycloneDX Export
    • Sensors Reference
    • Overview
    • Summary Report
    • PQC Report
    • AI Services
    • Source Code Visualizer
    • Key
    • Certificate
    • CipherSuites
    • Analysis
    • Policy Management
    • User Policy
    • Standard Policy
    • Overview
    • Cases
    • Criteria
    • Notification Format
    • Rules
      • Connections
      • Health
    • User Management
    • Roles & Permissions
    • Audit Trail
    • System Logs
    • Top Bar and User Menu
    • System Configuration
  • Login and Authentication
    • Introduction
      • Components
      • Data Flows
      • Execution Models
      • Incremental Scanning
      • Security Model
      • Topologies
      • Sizing Guide
      • HA and Scaling
      • Ports and Firewall
      • Prerequisites
      • Docker Compose
      • Native on Linux
      • Deployment Server
      • Install Troubleshooting
      • Validation Checklist
      • Managing Services
      • Logging
      • Certificates
      • Configuration
      • Backup and Recovery
      • Ops Troubleshooting
      • Methods
      • SAML 2.0 SSO
      • OIDC and Entra ID
      • Token Authentication
      • Password Policy
      • Sensor vs Connector
      • Sensor Guide Structure
      • Capability Matrix
      • GitHub Sensor
        • AWS
        • Azure
        • Google Cloud
        • Active Directory
        • LDAP Directories
        • AD CS
        • Thales Luna HSM
        • Entrust nShield HSM
        • HashiCorp Vault KMIP
        • Windows Cert Store
        • Linux Trust Store
        • MSSQL TDE
      • Roadmap
      • Integration Model
      • CrowdStrike
      • ServiceNow
      • ServiceNow and Jira Setup
      • Notification Engine
  • Administrative Guide
    • Glossary
    • Configuration Reference
    • Data Model Reference
    • API Reference
    • API Authentication
    • CycloneDX Export Specification
    • Risk and PQC Scoring
    • Built-in Standards
    • Widget Catalogue
    • AI Services Data Handling

Tag Scope

A Tag Scope is a named, reusable tag filter. It is written once as an expression over tags — for example "Production" $and $not "Test" — and then chosen by name wherever a slice of the estate is needed: on dashboard widgets and on notification rules. Changing a scope changes every widget and rule that uses it. For how to apply a scope to a widget, see Focusing a Widget with a Tag Scope.

A material carries the tags of the hosts and tasks it was discovered through. A scope therefore selects materials by where they are deployed.

The page is reached from Discovery > Settings > Tag Scope in the left navigation menu.

Viewing Tag Scopes

CBOM Secure Discovery — Tag Scope
  • Scope: The scope's name, with its identifier (TS- followed by a number) and version beneath.

  • Expression: The tag expression the scope stands for.

  • Description: What the scope is for.

  • Enabled: Whether widgets and rules may use it.

  • Updated: When it was last changed.

Search Keyword filters the list and Clear resets it. Refresh caches makes the server re-read scopes and tags at once. It does this on its own every minute, so you only need the button straight after a change you want to see immediately.

Creating a Tag Scope

Click New Tag Scope:

CBOM Secure Discovery — New Tag Scope
  • Scope Name: Required and unique. Other scopes refer to this one as @"Name".

  • Expression: Required. Type it, or build it with Insert tag, Insert scope and the operator buttons beneath the box.

  • Description: Optional.

  • Enabled: A disabled scope stays defined, but a widget that asks for it is refused, and other scopes cannot reference it.

Click Create to save, or Cancel to discard.

Expression Syntax

  • Tag names are always quoted — with " or '. An unquoted word is an error, as is a tag that does not exist.

  • Operators: $and, $or and $not, with parentheses to group. $not binds tightest, then $and, then $or. The plain words and/or/not also work.

  • Everything and nothing: $all selects every material, $tagged every material with at least one tag, and $untagged every material with none.

  • Lists: $anyOf("A", "B") and $allOf("A", "B") are shorthand for a chain of $or or $and.

  • Wildcards: * and ? inside the quotes match several tags — "prod-*" means every tag starting prod-.

  • Other scopes: @"Name" includes another scope's expression. A scope cannot include itself, directly or through others, and nesting stops at ten levels.

One point catches people out. $not "Test" includes materials with no tags at all, because they do not carry "Test". For "tagged, but not Test", write $tagged $not "Test".

Editing, Duplicating and Deleting

Right-click any row for its actions:

  • Edit: Reopens the dialog on the saved values. Renaming a scope updates the other scopes that refer to it by name.

  • Duplicate: Starts a new scope from a copy of this one.

  • Usage: Shows which scopes and widgets use this one.

  • Delete: Removes the scope, after a confirmation.

A scope that another scope or a dashboard widget still uses cannot be deleted. The refusal names what uses it, so you can remove those references first.

On this Page:
Support Privacy Policy Terms of Service

Copyright 2026 Encryption Consulting LLC. All rights reserved.