Tagging objects manually
Once you have defined a category, you can manually tag the objects of the type associated to the category. Tagging is applying a keyword of a category to an object. Thus the object becomes a member of the class of objects identified by the keyword.
Some category keywords include auto-tagging conditions in their definition for tagging objects automatically. Other keywords may not define any auto-tagging conditions. To manually tag objects you can use both types of keywords: with our without auto-tagging conditions.
In any case, note that when you tag an object manually, you override the automatic tagging based on conditions for that object. Despite the override, manually tagging an object does not change the definition of a category keyword. The modification applies to the object locally in the Engine and not to the definition of categories, which are themselves centralized and apply to all Engines.
To manually tag an object with a keyword in the Finder:
Find the object to tag in the list of results of an investigation. For that purpose, you can use the default investigation that executes after you edit the category that defines the keyword.
Right-click the name of the object and select Edit.... A dialog with the list of all the categories that you can apply to the object pops up.
Note that the option to edit an object is not available in Cross-Engine contexts; that is, when examining the results of an investigation from the List (all entities) view.
Next to each category, you have a drop down list to choose a keyword for the object. By default, the system tags objects automatically, so the option auto appears selected in the drop down. Click the down arrow of the drop down list to see all the available keywords for that category.
Select the desired keyword to tag the object. Otherwise, you can assign the empty keyword or let the system automatically tag the object by choosing the auto option.
Optional: If you do not find a suitable keyword for the object, you can add a new keyword to the category by selecting Add new keyword... from the drop down list.
If the operation was successful, the dialog finishes with a message displaying the number of objects that were updated. Click OK to close the dialog.
You may apply the same keyword to a group of objects if you select several objects instead of just one. Use the Ctrl key to click multiple objects or the Shift key to select a range of objects in the list. Then right-click and proceed as explained above.
RELATED REFERENCE
Last updated