Tags & Asset Groups - Snapsec Suite

Tags and Asset Groups allow security teams to organize thousands of assets for targeted scans, access policies, and compliance reporting.

Tagging Strategies

1. Automated Tags (System Inferred)

env:production, env:staging, env:dev
cloud:aws, cloud:gcp, cloud:oci
exposure:internet-facing, exposure:internal
framework:spring-boot, framework:react, web-server:nginx

2. Custom Organizational Tags

Key-value labels applied manually or via API:

owner:checkout-team
compliance:pci-dss
data-classification:confidential

Dynamic Asset Groups

Asset Groups can be Dynamic (evaluated continuously using query rules) or Static (explicit manual list):

# Example Dynamic Asset Group Rule
name: "Production Payment Perimeter"
filter:
  and:
    - tag: "env:production"
    - tag: "exposure:internet-facing"
    - or:
        - tag: "compliance:pci-dss"
        - attribute: "business_unit == 'FinTech'"

When new subdomains or cloud resources matching this filter are discovered by ASM or cloud adapters, they are automatically enrolled into the group and scheduled for scans.