Understanding Tags in Qevlar AI – Qevlar AI

💡 A Guide to Using Tags for Enhanced Security Investigations

Overview

Tags in Qevlar AI provide quick, accurate, and actionable intelligence about investigations and observables. They help you rapidly understand threats, prioritize your response efforts, and drive automated workflows.

This guide covers:

The two types of tags (Observable and Insight)
The complete tag catalog by category
How tags are applied
How to interpret different "Malicious" situations depending on containment and user exposure
How to use tags for prioritization and automation

Types of Tags

Observable Tags

Observable tags appear in the Observables table within investigation reports. They are attached to specific observables (IP addresses, domains, URLs, files, processes, devices, email addresses, users) to provide context about what the investigation found.

Observable tags help you quickly identify:

Risk indicators associated with specific observables
Actions that have been taken (blocked, quarantined, removed)
User interactions with threats (clicked, downloaded, executed)
Contextual characteristics of the observable (country, private, trusted)

Insight Tags

Insight tags appear in the header of investigation reports and provide a high-level summary of the most important findings. They aggregate information from observable tags to give you an immediate understanding of the threat landscape.

Up to 4 insight tags are displayed, prioritized by their significance to your security posture. They help you:

Quickly assess severity and threat type
Understand the scope of impact (for example, whether a VIP is involved)
Identify critical actions that occurred (malicious URL clicked, malicious file executed)

Insight tags always stay consistent with the investigation verdict:

When the verdict is Benign, the Malicious, Phishing, Reconnaissance and Scam tags and the file threat classifications are not shown in the header.
When the verdict is Suspicious or Missing Data, the Malicious tag and the file threat classifications are not shown in the header.
When the verdict is Malicious, the Legitimate, Marketing and Spam tags are not shown in the header.

The tags remain visible on the observables themselves in the Observables table.

Some insight tags exist only in the header and summarize several observable tags. For example, Email Authentication Failed is shown once whenever any DMARC, SPF, DKIM or CompAuth check failed.

Tag Categories

Threat Classification Tags

These tags identify the nature and severity of threats detected in your environment.

Malicious – Confirmed malicious through threat intelligence or analysis
Suspicious – Exhibits suspicious characteristics warranting investigation
Phishing – Email or URL identified as part of a phishing campaign
Reconnaissance – Email classified as reconnaissance activity by Qevlar Eye
Scam – Content identified as fraudulent or deceptive
Impersonation – The email claims to represent a brand or organization that does not match the sender
Spam – Unsolicited bulk email detected
Marketing – Email identified as marketing/promotional content
Legitimate – Email classified by Qevlar Eye as legitimate business communication
Compliance Violation – An enterprise policy violation has been detected
Grayware – Unwanted behavior but not outright malicious
HackTool – Legitimate security tools that could be used maliciously
Security Tool – File identified as a security tool
Dual-Use – Legitimate tool that is also commonly abused by attackers
Malware – Malware detected
PUA – Potentially Unwanted Application
Blocklisted – File is on a user-defined blocklist
Unknown Hash – A file hash taken from the alert is unknown to threat intelligence sources
Compromised – A device or user account has been reported as compromised

Advanced File Threat Classifications

Specialized tags from sandbox analysis and threat intelligence identifying specific malware behaviors and families.

Ransomware – Can potentially encrypt files or restrict access until a ransom is paid
Trojan/bot – Capable of covertly executing commands or being controlled remotely
Spyware – May steal sensitive information and track user activity
Banker – Monitors or modifies e-banking transactions
Evader – Can bypass OS protections and obfuscate behavior
Exploit – Exploits vulnerabilities to cause unintended code execution
Spreading – Behavior that could infect other devices or network systems
Miner – Uses the host device to mine cryptocurrencies
Adware – Potentially injects advertisements into browser results
Dropper / Downloader – Installs or retrieves additional malicious payloads
Worm – Self-propagates to other systems
Virus – Infects other files to replicate
Wiper – Destroys or irreversibly erases data
WebShell – Gives remote command access through a web server
Botnet – Associated with a network of remotely controlled machines
DDOS – Used to perform denial-of-service attacks
Fake AV – Poses as antivirus software

User Interaction Tags

These tags indicate how users have interacted with potentially malicious content, helping you assess level of exposure and potential compromise.

Clicked on – A user clicked on a URL
Visited – A URL was visited by a user
Downloaded – A file was downloaded by a user
Executed – A file or process was executed on an endpoint
Contacted – An IP address was contacted by a file or process
Replied – A recipient replied to a suspicious email
Forwarded – A recipient forwarded a suspicious email to others
Reported – A user reported the email

Containment Action Tags

These tags show what security controls have acted upon threats, helping you understand the current containment status.

Blocked – Observable was blocked by a preventative security system (currently available for Email and File observables)
Quarantined – Email or file has been quarantined
Removed – Email or file was removed by security systems (shown as Email Removed or File Removed in the report header)
Junked – Email was delivered to the junk folder

Email Authentication Tags

These tags indicate the results of email authentication checks, critical for identifying spoofed or forged emails.

DMARC Failed – Email failed DMARC authentication
SPF Failed – Email failed SPF authentication
DKIM Failed – Email failed DKIM authentication
CompAuth Failed – Email failed composite authentication

When any of these is present, the report header shows a single Email Authentication Failed insight tag.

Infrastructure & Network Tags

These tags provide context about network infrastructure associated with observables.

Country – Geographic location of the IP address
Private – IP address is within private address space
Internal / Loopback / Link Local / Reserved – IP address belongs to a non-public address range
VPN – IP address belongs to a VPN service
Proxy – IP address is a known proxy server
Tor – IP address is a Tor node
Relay – IP address is a relay service
Hosting – IP is associated with a data center or cloud provider
Service Provider – IP belongs to a recognized service provider (Google, Amazon, etc.)
Source / Destination – Direction of the IP address in the observed network traffic

User Context Tags

These tags identify users and assets that may require special attention.

VIP – User identified as a VIP within the organization (executive, board member, etc.)
Critical Asset – Asset identified as critical to the organization
Targeted – Identified as a potential target
Machine – The account belongs to a machine rather than a person

Anomaly & User Risk Tags

These tags describe behavioral anomalies and identity risk events reported by your security tools, for example Abnormal Authentication Pattern, Cross Region Access, Multiple Authentication Failures, High Volume File Download, Uncommon Process Execution, User Account Permission Change, Account Disabled or User Password Reset.

Investigation Context Tags

These tags provide additional context about the investigation process and findings.

Embedded – URL was embedded within email content
Redirection – URL was discovered as part of a redirection chain
Exploration Hop – URL was discovered while Qevlar AI followed a chain of links
Call to Action – Link asks the user to interact with it
Attached – File was attached to an email
QR Code – Observable was extracted from a QR code
Typosquatting – Domain appears to be impersonating a legitimate domain (shown as Typosquatted Domain in the report header)
Suspected Typosquatting – Domain exhibits characteristics suggesting potential typosquatting
Mass Distribution – Email was sent to a number of recipients at or above the threshold configured for your organisation
Needs Corroboration – Finding requires human validation to reach a final determination
Missing Body – Email alert does not contain the message body
Empty Steps – The investigation steps returned no data
Trusted – Domain is on your organization's or Qevlar's trusted list
Downloadable Content – URL is a download link
Signed – File has been verified as signed
Unsigned – File is not signed (not shown when the file is also Signed or Trusted)
Sender – Observable is associated with the email sender
Recipient – Email address is a recipient

How Tags Are Applied

Tags are applied automatically by Qevlar AI during investigation based on:

Threat intelligence lookups → e.g. Malicious, Suspicious, Unknown Hash
Qevlar Eye email analysis → e.g. Phishing, Impersonation, Spam, Legitimate
Sandbox analysis results → e.g. Ransomware, Trojan/bot, Evader
Security control signals → e.g. Blocked, Quarantined, Removed
User and endpoint activity logs → e.g. Clicked on, Downloaded, Executed, Replied
Email authentication results → e.g. DMARC Failed, SPF Failed
Contextual enrichment → e.g. VIP, Trusted, VPN

Tags are applied at the observable level first, then aggregated into Insight tags in the report header.

Understanding "Malicious" Situations: Containment vs. Exposure

Not all Malicious tags carry the same urgency. The critical question is whether the threat was contained before user exposure or whether a user interacted with it. Use this matrix to assess the appropriate response.

Tag Combination	Situation	Recommended Action
Malicious only	Threat identified, exposure unclear	Verify whether any user accessed the observable
Malicious • Blocked	Threat detected and stopped	Confirm the block is complete across all gateways; no user action required if no interaction tag is present
Malicious • Blocked • user interaction	Threat was blocked after user interaction	Investigate the timing; assess whether the user accessed the content before the block took effect
Malicious • Clicked on	User accessed the threat	Assess credential or session risk; consider further investigation
Malicious • Downloaded	Malicious file reached the endpoint	Initiate endpoint investigation; consider isolation
Malicious • Executed	Active execution of malicious content	High-confidence compromise; initiate incident response immediately
Malicious • VIP	High-value user targeted	Escalate to executive protection workflow
Ransomware / Spreading / Worm / Wiper	Potential propagation or destruction risk	Trigger containment playbook; check for lateral movement
Phishing • Replied	Possible credential harvesting	Initiate credential reset for affected users
Impersonation • Email Authentication Failed	Likely spoofed sender	Review the sender; block the spoofed domain if confirmed

💡 Key rule of thumb: Malicious + Blocked with no user interaction tag → threat was stopped. Malicious + a user interaction tag (regardless of Blocked) → the threat reached a user and requires active investigation.

Using Tags for Prioritization and Automation

Rapid Triage

When managing multiple alerts, start with Insight tags in the report header. They provide the highest-level summary and help you determine priority at a glance.

Example: Malicious URL Clicked | VIP immediately signals a high-value user interacted with a confirmed threat — no need to read the full report before escalating.

Assessing Impact

The combination of threat classification tags and user interaction tags determines how far a threat has progressed:

Scenario	Risk Level	Implication
Malicious • Blocked (no interaction)	🟢 Contained	Security controls were effective
Clicked on a malicious URL	🟠 High	User accessed threat content
Clicked on • Downloaded	🔴 Critical	Malicious file on user's system
Malicious file Executed	🔴 Critical	Malicious code ran on the endpoint
Downloaded • multiple file threat tags	🔴 Critical	High-confidence threat with specific behavior indicators

Automation Triggers

Tags enable automated response workflows. Recommended triggers:

Tag Combination	Recommended Automated Action
Malicious • Downloaded	Isolate endpoint; open high-priority ticket
Malicious • Executed	Isolate endpoint; open incident
Malicious • VIP	Page on-call team; notify security leadership
Ransomware / Spreading	Trigger network isolation playbook
Phishing • Mass Distribution	Block sender domain; notify all recipients
Impersonation • Email Authentication Failed	Trigger anti-spoofing review
Malicious • Blocked (no interaction)	Log and close; add to blocklist
Needs Corroboration	Route to Tier 2 analyst queue
Unknown Hash	Submit the file for sandbox analysis
Trusted	Consider suppressing future alerts for that observable in your SOAR/SIEM
Email Authentication Failed • Mass Distribution	Trigger anti-spoofing review

Following the Attack Chain

Use context tags to reconstruct the full delivery chain:

Embedded + Redirection / Exploration Hop → understand how a URL was reached
Attached → trace file delivery via email
QR Code → identify unconventional delivery methods
Typosquatting / Suspected Typosquatting / Impersonation → map impersonation infrastructure
Downloaded → Executed → Contacted → follow a file from delivery to network activity

Best Practices

Start with Insight tags. When opening a new investigation, the header tags give you immediate signal on priority and required action before reading the full report.

Check for containment first. Before acting, verify whether Blocked, Quarantined, or Removed tags are present — this determines whether a threat is already contained or still active.

Escalate on VIP + interaction combinations. Investigations combining VIP or Critical Asset with any user interaction tag should always be treated as high priority.

Use Advanced File Classifications for targeted response. Tags like Ransomware, Spreading and Wiper map directly to specific IR playbooks — don't treat them as generic malware alerts.

Submit feedback to keep tags accurate. The quality feedback feature ensures that tag corrections are tracked and auditable, improving the accuracy of future investigations and your automation triggers.

Conclusion

Tags are designed to accelerate your security operations by providing immediate, actionable intelligence about threats and observables. With a clear understanding of the tag catalog, containment vs. exposure scenarios, and the quality feedback loop, you can:

✅ Triage alerts faster and more accurately
✅ Distinguish between contained threats and active incidents requiring immediate response
✅ Keep investigation verdicts accurate through structured feedback
✅ Drive reliable automations and reporting based on tag combinations
✅ Reduce mean time to respond (MTTR) to security incidents