Tags in McAfee ePO assist you to identify and sort managed endpoints. If you are a McAfee ePO administrator it is crucial for you to be able to identify individual endpoints or groups of endpoints when you create tasks and queries. Tags and tag groups make this task of identification simpler. For more details about tags and how they can be best used to benefit your network, refer to chapters The System Tree and Tags in the McAfee ePolicy Orchestrator 5.10.0 Product Guide.

If McAfee ePO is integrated with Network Security Platform, which identifies endpoints by their IP addresses while McAfee ePO identifies endpoints by a unique ID, there are likely going to be events triggered in the Manager in Network Security Platform which are suspicious or confirmed malicious. In such instances between the time that an endpoint IP address is identified as suspicious and the time that the McAfee ePO administrator tags the endpoint for further action, the IP address of the endpoint might have changed. To overcome this lag, the security analyst is provided a list of tags within the Manager in Network Security Platform. These tags are defined in McAfee ePO and are communicated to the Manager in real-time.

Note: Tags can be assigned only to managed endpoints, that is endpoints that are running a compatible version of the McAfee Agent.