---
title: "How and Why to Nest Tags"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/new-article-565"
language: "en"
last_updated: "2026-09-16T16:19:18.089Z"
---

# How and Why to Nest Tags

In Spirion Sensitive Data Platform (SDP) organizing Tags into a Parent–Child hierarchy (nesting) enables you to aggregate multiple IP ranges or subnet Tags under a single high-level container.

Organizing Tags into a **Parent–Child hierarchy** (nesting) enables you to aggregate multiple IP ranges or subnet Tags under a single high-level container (such as a regional office, data center, or department).

This structure simplifies scan scheduling, dashboard roll-ups, and Role-Based Access Control (RBAC) permissions.

**Note**: You cannot nest Conditional Tags.

## Key Benefits of Tag Nesting in Spirion Sensitive Data Platform

1.  **Permission & Access Inheritance (RBAC):**
2.  -   By default, child tags set their **Result Permissions** and **Tag Permissions** to `Inherited`, automatically acquiring the security and viewing rights configured on the high-level parent tag.
3.  **One-Click Policy & Scan Targeting:**
4.  -   When configuring a Scan or Policy, selecting the parent checkbox (**GEO - US-East DataCenter**) automatically includes all endpoints matching any of the nested child IP Tags.
5.  **Dashboard & Heatmap Roll-ups:**
6.  -   Risk heatmaps and search dashboards aggregate sensitive data counts up to the parent tag level, allowing executives to see overall regional risk while letting engineers drill down into specific subnets.

## Step-by-Step: Nesting Child IP Tags under a Parent Tag

### Step 1: Create the High-Level Parent Tag (Root Container)

1.  Navigate to **Tag Management** (under *Agents* or *Management* in the left menu).
2.  Click **\+ Add Tag**.
3.  In the Tag configuration window:
4.  -   **Tag Name:** Enter a descriptive high-level name.
    -   -   Examples:
        -   -   GEO - US-East DataCenter
            -   NET - Corporate HQ
    -   **Tag Type:** Select **Manual** (or create it as a top-level container).
    -   **Parent Tag:** Leave blank or set to **None** (Root Level).
5.  Click **Save**.

### Step 2: Create and Nest the Child IP Tag

1.  In **Tag Management**, click the **\+ Add Tag** button in the top-right corner of the page.
2.  Configure the child tag details:
3.  -   **Tag Name:** Enter the specific subnet or IP group name.
    -   -   Examples:
        -   -   Subnet - Servers 10.0.1.0/24
            -   Floor 1 Workstations
    -   **Parent Tag:** Open the **Parent Tag** dropdown and select the high-level tag created in Step 1
    -   -   For example: **GEO - US-East DataCenter**
    -   **Tag Type:** Select **IP Range** (or **Conditional**).
    -   **IP Range / CIDR Definition:** Enter the specific IP range, CIDR block, or comma-separated addresses.
    -   -   Examples:
        -   -   10.0.1.1 - 10.0.1.254
            -   \*(or CIDR: \`10.0.1.0/24\`)\*
4.  Click **Save**.
5.  Repeat this step for additional child subnets
6.  1.  Examples: Subnet - DMZ 10.0.2.0/24, Subnet - Storage 10.0.3.0/24

### Step 3: Organizing Existing Tags

**Note**: You cannot nest Conditional Tags.

If you have already created IP tags and want to nest them under an existing parent:

-   **Edit Parent Field:**
-   -   Open the child tag's **Edit** window, choose the Target parent Tag from the **Parent Tag** drop-down selector, and click **Save**.