Search by category
This is what the taxonomy is for. Because every detection carries a category path, you can ask for a class of behaviour without knowing which detector fired.
Paths use
/ for hierarchy and /* to include descendants, so
malware/* covers every malware path while malware/infostealer stays narrow.
When searching hosts, prefix the field with services. to keep the condition on
one observed endpoint.
Worked examples:
Classification
Every tag also carries a classification, which tells you how to read a match rather than what it is.
Detection rules use
benign, suspicious, or malicious. Informational tags
can still add context without changing the security posture of a result.
Threat categories
Software categories
Software paths identify a product class without making a security judgment.What a tag is
A tag has a stable slug, a display name, one or more category paths, and a classification. The slug is the detector; the category is what it means. Slugs change less often than detector implementations, and categories change less often than slugs, so prefer the broadest level that still answers your question.
Write a rule
Turn typed scan evidence into a classified tag.
Search tagged infrastructure
Use exact tags, parent categories, and classifications in InfraQL.