What is a one sentence summary of your feature request?
Allow a tag to be selected across different relevant filter types
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
We currently have two available filters available in the investigation builder related to tags (Tag (Direct) and Tag (Effective)) which just find events with any type of information included that match something in a specified tag. The problem is this doesn’t allow the ability to check specifics involving members of a tag (like Target = Tag or Client = Tag). That ability to specify would allow more fine-tuned investigations to be possible in an easier to manage way.
How do you currently solve the challenges you have by not having this feature?
It is currently possible to specify a list of hosts as an example individually on a single investigation (Target = Host1, Host2, Host3). This is just a more tedious process than having a single tag that can be referenced in any investigation.