The Tag field (rv145) is a tokenized field that has special parsing rules for words. The parsing rules enable you to search on tags that include non-alphanumeric characters. However, the only word delimiters are white space characters such as the blank and the tab. This is because tags do not include white space in their names. For example, the following queries find the event if the event is tagged with the ISO/IEC_27002:2005 tag and the NIST_800-53 tag:
rv145:"ISO/IEC_27002:2005"
rv145:"iso/iec_27002:2005"
rv145:"ISO/IEC_27002*"
rv145:nist_*
The slash (/), hyphen (-), and colon (:) characters are significant in the search value because, unlike other tokenized fields, the parsing rules for rv145 do not treat them as a word delimiter. Also, the search is not case sensitive.
The following queries would not find the event:
rv145:"ISO IEC_27002 2005"
rv145:"iso *"