Security Tag UI Appears in SIR Workspace but Is Non‑Functional and Cannot Be Removed

[charles2024]

Hi, I hope I can get some help with this frustrating issue.
 I was asked to prove SOC analyst with an option to add a coloured tag for particular SIR records from the workspace.
These would be used in historical analysis and reporting.
I added the required tag, let's say for example "Kardashian onboard" in the "Security Group tag".
But this cannot be added or viewed from the Security Operations Work Space.

I hope to found out

• Is the Security Tag button in SIR Workspace intentionally unsupported, or is this a known gap?
• If unsupported, why is the UI control exposed at all for Workspace users?
• Is there an OOTB or supported way to hide/remove this action so analysts don’t attempt to use it?

Any clarification from ServiceNow or others who have handled this in production would be greatly appreciated.

Thanks in advance.

Charles.

[Tanushree Maiti]

Hi @charles2024 

Try  Navigate to All > Workspace Experience > Administration > Highlighted Values

refer: how to add color coding in service operation workspace 

Also you can check following option:

Group and find records using tags in workspace 

Reporting based on Security Tag Groups 

[charles2024]

Thank you for your suggestion.(I tried to reply last week but this has not appeared on the posting).
This is not the type of higlighting required.
The flag or tag need to appear in the SIR incident details in front of the SOC analyts.

Thank you for you time to reply.

Thanks