Hi @lmcgchr
See the following issue:
https://github.com/guilhemmarchand/trackme/issues/281
In a nutshell you could easily create your own workflow, with a scheduled report handling this:
Example:
| inputlookup trackme_data_source_monitoring | eval keyid=_key
| search data_name="firewall:pan:traffic"
| eval tags_expanded=tags
| makemv delim="," tags_expanded
| eval priority=if(tags_expanded="CIM", "high", priority)
| fields - tags_expanded
| outputlookup append=t key_field=keyid trackme_data_source_monitoring
--> Create a report using a similar logic
--> schedule this report to run on a regular basis, daily for example
What it does is loading the collection, creating an expanded version of the tags, defining the priority, and updating the values.
Everything else will be preserved y the outputlookup.
Guilhem
