Tagged external-threat-hunting