hey everyone chris walker your security doctor back again for another valuable secobyte session and for today's discussion i want to go ahead and show you another valuable piece of content that's built out of the box as part of security operations now today we're going to be learning how to set up a security tag group that will allow you to enforce a very simple policy to hide a specific security incident record based on a tag these tags can actually be attached to incidents response tasks vulnerable items observables iocs and even security case management so there are so many different use cases you can leverage this valuable type of content so let's go ahead and get right into it so as you can see i'm in my instance and i've gone ahead and jumped right into the security tag groups simply by navigating and using my filter navigator now there are a couple of security tag groups already out of the box but for the purpose of this demonstration let's go ahead and create one new on the fly i'm going to go ahead and name this risky business click on submit and you guessed it go back into the security tag group we're going to create the security tag which is going to be attached to the security incident record and we're going to call this very risky my favorite part selecting the color we're going to select blue but the most important part is the enforcement policy so we're going to click on the enforce restricted access check box and notice i have two controls right these are the user access controls that are going to be tied to the security tag so for the purpose of this demonstration i'm going to select admin so only the admin can read and write to this particular security incident record that is tagged with the very risky metadata tag click on submit and we're done it was that simple that easy right value out of the box so now let's go ahead and test that with our test user now before we do that let's go ahead and apply this to our security incident record so we can actually see how this works in real time so i have this security incident record 20262 take note of that because we're going to see how this works and i'm going to go ahead and find my security tag group there it is risky business very risky we can see it's in a lovely blue and we'll go ahead and of course save the security incident record with the new tag and we can see that has been applied perfect now let's impersonate our test user adella who has snsi basic so just so you know that is what her role is and we're going to go ahead and look at all the security incidents and remember that 20262 was the security incident number if i go here we should not see that and look at that the latest and last one we see is 261 so 262 is completely hidden why because we created a security tag with a very simple policy that policy is now going to streamline and hard harden your security and really start orchestrating how important it is to have a security first mindset by leveraging these native common functionalities out of the security operations offering so with that i'll go ahead and sign off thank you so much for watching make sure you like and subscribe this video and stay tuned for some additional content and as always stay safe