Using tags with sessions

Tags can be a helpful way to quickly find sessions that meet particular criteria, such as sessions that contain PII (Personally Identifiable Information). You can add one or more keywords to sessions and then use those keywords in your session queries to find those specific audited sessions.

Assigning tags to sessions

You can assign tags to sessions or remove tags from sessions if you're assigned to an audit role with "Update Status" permission. To apply multiple tags, separate each tag by a space.

You can use assign one or more keywords to sessions in the following ways:

  • In the Audit Analyzer query results pane, right-click a session > select Add Tags.

    In this way, you tag the session itself and not a specific point in time of the session.

  • In a session's Indexed Command List, select a command and select Add Tags.

    When adding a tag this way, the tag is associated with a specific timestamp in the session.

  • While replaying a session, select Session Add Tags.

    When adding a tag this way, the tag is associated with a specific timestamp in the session if you have paused the session. If you are playing the session when you add a tag, the tag isn't associated with a timestamp.

  • Use the PowerShell cmdlets to tag sessions. For details, please see the PowerShell command help for the following cmdlets:

    • New-CdaAuditSessionTag

    • Get-CdaAuditSessionTag

    • Remove-CdaAuditSessionTag

    • Get-CdaAuditSession

When you add tags, each tag is a single word; to add multiple tags, just separate them with a space. Each tag needs to be at least 3 characters long.

Viewing tags associated with a session

You can view tags that are associated with a session if you're assigned to an audit role with "Read" permission. You can also remove the tag after reviewing the session, if you also have the "Update Status" permission.

To view tags associated with a session

  1. In Audit Analyzer, navigate to a list of sessions.

  2. Right-click a session and select Properties.

    The Session Properties dialog box opens.

  3. Click the Tags tab.

    The Tags tab lists all tags and related information that are associated with the selected session. In addition to tags, you can also see who added the tag to the session and when they added the tag.

  4. If desired, you can click Remove to remove the associated tag or Replay to replay the session.

  5. Click OK to save your changes and return to the Audit Analyzer window.


Searching for sessions associated with tags

You can enter tags as search criteria for either quick queries, private, or shared queries. For a quick query, enter the tag name as the search term.

For a private or shared query, when you add criteria for the query you can select Tag as an attribute to use in the query.