Service groups & tags

Service groups bundle related domains under a name; tags auto-label traffic with a colored chip by URL pattern. Together they turn a raw firehose of hosts into something you can scan, filter, and decrypt selectively.

Service groups

A service group is a named bundle of domains — for example a "DoorDash" group holding all the hosts a single app talks to. Groups do two jobs:

• SSL-proxy bundle — applying a group adds its domains to the effective SSL-proxying list, so the tunnel decrypts that app's HTTPS in one move instead of host by host.
• Filter chip — every group shows up as a chip in the feed's Services rail and the Filter popover, so you can scope the feed to just that app's traffic.

Creating and editing

Open the Services page from the settings nav.

1. New service group — give it a name and an icon.
2. Add its domains (one per line or comma-separated; *.example.com matches subdomains).
3. Save.

Apply a group at global or per-device scope (under Remote settings) to fold its domains into that scope's effective SSL-proxying list. Deleting a group cascades — every settings doc that referenced it is patched to drop the id, so no scope is left pointing at a dead group.

This is the page where you define groups; the live Services rail beside the feed is where you use them as filters.

Tags

A tag is a colored label that attaches itself to any request whose URL matches a pattern you set — no manual tagging needed.

Creating a tag

Open the Tags page.

1. New tag — name it and pick a color.
2. Add one or more URL patterns. Patterns are anchored globs over the full URL:
   • *auth* — contains "auth" anywhere.
   • *login/ — ends with "login/".
   • https://api.example.com/v1/* — has that prefix.
3. Save.

From then on, any entry whose URL matches picks up the tag's colored chip in the feed automatically, and the tag becomes a filter chip you can use to isolate that traffic.

Tip: Use tags for cross-cutting concerns that span hosts — auth, analytics, errors — and service groups for "everything one app talks to". They compose: filter the feed to a service group and a tag at once.

How they differ

Both surfaces are capability-gated — see Roles & permissions.