Skip to content
Furl Docs

Endpoint Tags

Endpoint tags label devices so you can filter the fleet, scope remediation, and drive tag-based execution policies. Furl has four kinds of tags. They differ in who assigns them, and every kind counts the same wherever tags are consumed.

Kind Assigned by Removed by
Static You, manually. One endpoint at a time from the endpoint panel, or in bulk from the endpoints list. You, manually.
Dynamic A rule expression evaluated against endpoint properties such as CIDR ranges, OS version, owner, or other tags. Membership recomputes automatically as endpoints change. The rule. Membership leaves when the endpoint stops matching.
Agent The Furl agent, from tags in its enrollment configuration. The agent’s configuration.
Imported A connected integration, when tag import is enabled on its datasource. The integration. Membership mirrors what the vendor reports.

Imported tags

Section titled “Imported tags”

Many security and IT tools let operators tag the devices they manage. Enabling tag import on a datasource turns those vendor tags into Furl endpoint tags, so groupings your team already maintains elsewhere work in Furl without re-tagging the fleet.

Enabling tag import

Section titled “Enabling tag import”
  1. Open Integrations and select the integration.
  2. Open the settings for the datasource that syncs endpoints.
  3. Turn on Import tags.

The toggle only appears on datasources that support tag import. It is off by default. Once enabled, every sync updates the imported tags to match what the source reports.

How imported tags behave

Section titled “How imported tags behave”
  • They are read-only in Furl. You cannot rename an imported tag or add or remove it on individual endpoints. Membership mirrors the source. To change it, change the tag in the source tool and let the next sync pick it up.
  • They show their origin. Imported tags are visually distinct from other kinds, and hovering one shows which integration reported it.
  • Shared names merge. When two integrations report the same tag name, the endpoint shows one tag connected to both sources, not a duplicate.
  • They work everywhere tags work. Endpoint filters, remediation scope membership, and tag-based execution policies treat imported tags like any other tag.
  • Volume is capped. Furl imports up to 50 tags per endpoint from each source and skips names longer than 100 characters.

Removing imported tags

Section titled “Removing imported tags”

An imported tag leaves an endpoint when its source stops backing it:

  • Remove the tag in the source tool. The next sync drops it from the endpoint. Vendor APIs can take a few minutes to reflect a removal, so a tag deleted moments before a manual sync may need one more sync to clear.
  • Turn off Import tags on the datasource. Its imported tag memberships are removed immediately.
  • Delete the connection and discard its data. Its imported tag memberships go with it. Deleting the connection but keeping its data keeps the tags too — they are part of the retained snapshot, and Furl marks them as no longer maintained by their source.

When a tag’s last membership is removed, the tag itself remains, empty, so scope filters and policies that reference it keep working. A tag no longer backed by any live datasource can be deleted outright.

Integrations that support tag import

Section titled “Integrations that support tag import”
Integration Datasource What gets imported
Automox Devices Device tags.
CrowdStrike Falcon Spotlight Assets and Vulnerabilities Falcon grouping tags and sensor grouping tags, without their namespace prefixes. Host groups are not imported.
Rapid7 InsightVM Assets Asset tags.
Section titled “Related”