GuardMode 2024.2
Catalogic SoftwareKnowledge BaseMySupport
  • Welcome to GuardMode!
  • Intro
  • Installation
    • System requirements
    • Installing GuardMode Agent on Windows
      • Updating GuardMode Agent on Windows
    • Installing GuardMode Agent on Linux
      • Using GuardMode Agent as a Container
    • Uninstalling GuardMode Agent on Windows
    • Uninstalling GuardMode Agent on Linux
    • Configuring GuardMode Agent for SAMBA setup
    • Uninstalling GuardMode Agent on SAMBA setup
  • Agent Configuration
    • General Settings
    • Excluded Paths Configuration
    • Adding malware detection rules
      • Honeypot and Decoy Files
      • Write Operations Threshold
      • Detecting File Renaming with Abnormal File Extensions
      • Special Files Monitoring
    • Security Incident Detection
    • SMB Monitoring (Linux Only)
    • Event Reports
      • Configuring Event Reports
      • Excluding Paths From Event Reports
      • Tagging Agent
    • NFS Share Monitoring
    • Altering Audit Rules
    • Configuring DPX for Automatic Blocklist Updates
    • Using TLS
    • Configuring YARA-X
  • Using GuardMode Agent Command Line
  • REST API Documentation
  • On-demand Scanning
  • Logging
  • FAQ
  • Found an issue?
Powered by GitBook
On this page
  1. Agent Configuration
  2. Event Reports

Tagging Agent

PreviousExcluding Paths From Event ReportsNextNFS Share Monitoring

Last updated 10 months ago

Agent tagging in GuardMode allows you to organize instances of the GuardMode Agent by tagging them under a shared "campus" value. Tags are added to every alert, both in provider notifications and logs.

In DPX notifications, the tags are displayed as labels. In Syslog notifications, they are added as prefixes to the messages in the following way:

[Tag=<tag1> Tag=<tag2>] <message>

Tag naming requirements

  • Tags can include letters, numbers, dashes, and underscores

  • All tags are normalized to lowercase.

  • Each tag can be up to 250 alphanumeric characters.

Viewing Agent tags

Tip. GuardMode Agent tags can be managed using REST API or the CLI.

Viewing Agent tags using REST API

To view Agent Tags, send a GET request to /settings/tags.

The response includes IDs for each tag. The collection is empty by default.

Viewing Agent tags using CLI

To view Agent Tags using the CLI:

cd /opt/catalogic/guard-mode/agent
./Catalogic.GuardMode.Agent config list tag

Adding tags

Adding tags using REST API

To add a tag to GuardMode Agent, send a POST request to /settings/tags:

You need to specify the tag name in the request body in the following way:

{
    "tag": "tag name"
}

Attention! Do not add the same tag twice.

Adding tags using CLI

To add a tag to GuardMode Agent using the CLI:

cd /opt/catalogic/guard-mode/agent
sudo ./Catalogic.GuardMode.Agent config add tag <name>

Removing tags

Removing tags using REST API

Delete a tag by sending a DELETE request to /settings/tags/{id}:

The tag ID can be obtained from the GET request response to the same endpoint.

Removing tags using CLI

To remove a tag to GuardMode Agent using the CLI:

cd /opt/catalogic/guard-mode/agent
sudo ./Catalogic.GuardMode.Agent config remove tag <tag_ID>

Removes an agent tag

delete
Authorizations
Path parameters
idstring · uuidRequired
Header parameters
api-versionstringRequired
Responses
204
Tag was removed
400
Bad request was sent
delete
DELETE /settings/tags/{id} HTTP/1.1
Host: 
Authorization: Basic username:password
api-version: text
Accept: */*

No content

  • Tag naming requirements
  • Viewing Agent tags
  • Viewing Agent tags using REST API
  • POSTAdds a new agent tag
  • Viewing Agent tags using CLI
  • Adding tags
  • Adding tags using REST API
  • POSTAdds a new agent tag
  • Adding tags using CLI
  • Removing tags
  • Removing tags using REST API
  • DELETERemoves an agent tag
  • Removing tags using CLI

Adds a new agent tag

post
Authorizations
Header parameters
api-versionstringRequired
Body
tagstring · min: 1 · max: 250Required
Responses
201
Tag was successfully added
400
Bad request was sent
409
Tag already exists and can't be added again
post
POST /settings/tags HTTP/1.1
Host: 
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 14

{
  "tag": "text"
}
{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "tag": "text",
  "createdAt": "2025-05-09T04:06:50.113Z"
}

Adds a new agent tag

post
Authorizations
Header parameters
api-versionstringRequired
Body
tagstring · min: 1 · max: 250Required
Responses
201
Tag was successfully added
400
Bad request was sent
409
Tag already exists and can't be added again
post
POST /settings/tags HTTP/1.1
Host: 
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 14

{
  "tag": "text"
}
{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "tag": "text",
  "createdAt": "2025-05-09T04:06:50.113Z"
}