How and Why to Nest Tags

Organizing Tags into a Parent–Child hierarchy (nesting) enables you to aggregate multiple IP ranges or subnet Tags under a single high-level container (such as a regional office, data center, or department).

This structure simplifies scan scheduling, dashboard roll-ups, and Role-Based Access Control (RBAC) permissions.

Note: You cannot nest Conditional Tags.

Key Benefits of Tag Nesting in Spirion Sensitive Data Platform

1. Permission & Access Inheritance (RBAC):
2. • By default, child tags set their Result Permissions and Tag Permissions to Inherited, automatically acquiring the security and viewing rights configured on the high-level parent tag.
2. One-Click Policy & Scan Targeting:
3. • When configuring a Scan or Policy, selecting the parent checkbox (GEO - US-East DataCenter) automatically includes all endpoints matching any of the nested child IP Tags.
3. Dashboard & Heatmap Roll-ups:
4. • Risk heatmaps and search dashboards aggregate sensitive data counts up to the parent tag level, allowing executives to see overall regional risk while letting engineers drill down into specific subnets.

Step-by-Step: Nesting Child IP Tags under a Parent Tag

Step 1: Create the High-Level Parent Tag (Root Container)

1. Navigate to Tag Management (under Agents or Management in the left menu).
2. Click + Add Tag.
3. In the Tag configuration window:
4. • Tag Name: Enter a descriptive high-level name.
   • • Examples:
     • • GEO - US-East DataCenter
       • NET - Corporate HQ
   • Tag Type: Select Manual (or create it as a top-level container).
   • Parent Tag: Leave blank or set to None (Root Level).
4. Click Save.

Step 2: Create and Nest the Child IP Tag

1. In Tag Management, click the + Add Tag button in the top-right corner of the page.
2. Configure the child tag details:
3. • Tag Name: Enter the specific subnet or IP group name.
   • • Examples:
     • • Subnet - Servers 10.0.1.0/24
       • Floor 1 Workstations
   • Parent Tag: Open the Parent Tag dropdown and select the high-level tag created in Step 1
   • • For example: GEO - US-East DataCenter
   • Tag Type: Select IP Range (or Conditional).
   • IP Range / CIDR Definition: Enter the specific IP range, CIDR block, or comma-separated addresses.
   • • Examples:
     • • 10.0.1.1 - 10.0.1.254
       • *(or CIDR: `10.0.1.0/24`)*
3. Click Save.
4. Repeat this step for additional child subnets
5. 1. Examples: Subnet - DMZ 10.0.2.0/24, Subnet - Storage 10.0.3.0/24

Step 3: Organizing Existing Tags

Note: You cannot nest Conditional Tags.

If you have already created IP tags and want to nest them under an existing parent:

• Edit Parent Field:
• • Open the child tag's Edit window, choose the Target parent Tag from the Parent Tag drop-down selector, and click Save.