Tag security incidents with the Sandbox submission status
Tag security incidents with the Submission Initiated and Submission Complete tags.
When you select the Display tags option in the Sandbox submission configuration, tags are displayed to provide the status of a file or URL submission. Checking the status this way is useful because the sandbox analysis may take several minutes to process.
The display tags are called submission initiated, submission completed, and submission failed.
The following example shows a security incident where the submission has been initiated.
[Omitted image "submission-initiated-tag.png"] Alt text: Submission- initiated tag.
The following example shows a security incident where the submission has been completed.
[Omitted image "submission-completed-tag.png"] Alt text: Submission- completed tag.
--- title: Tag security incidents with the Sandbox submission status description: Tag security incidents with the Submission Initiated and Submission Complete tags. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/sandbox-tags.html release: australia product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [CrowdStrike Falcon X Sandbox integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Tag security incidents with the Sandbox submission status Tag security incidents with the Submission Initiated and Submission Complete tags. When you select the **Display tags** option in the [Sandbox submission configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/setup-sandbox-submission-configurations.md), tags are displayed to provide the status of a file or URL submission. Checking the status this way is useful because the sandbox analysis may take several minutes to process. The display tags are called submission initiated, submission completed, and submission failed. The following example shows a security incident where the submission has been initiated. \[Omitted image "submission-initiated-tag.png"\] Alt text: Submission- initiated tag. The following example shows a security incident where the submission has been completed. \[Omitted image "submission-completed-tag.png"\] Alt text: Submission- completed tag.
| title | Tag security incidents with the Sandbox submission status |
| description | Tag security incidents with the Submission Initiated and Submission Complete tags. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/sandbox-tags.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | CrowdStrike Falcon X Sandbox integrationSecurity Incident Response integrationsSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |