Every live report has the same who box. Tags sit under types. A tag is a path such as site/Melbourne. Any of these is the default.
Open Morning brief. Under tags, leave the menu on any of these, type site/Melbourne and press enter. The chip is the tag. The line says 4 of 6 machines. Accounts server, Reception PC, Lab host and files01 stay. Branch router is site/Branch, and Spare laptop has no tag, so both drop out. Accounts server still has the disk at 92% and an open disk alert. Lab host and files01 are offline. Reception PC is off and excluded from offline alerts, so that by itself is not attention. Press the × on a chip to remove that tag. Clear filters removes every tag and type.
Set the menu to all of these and add role/DC. A machine must carry both tags. Accounts server is site/Melbourne and role/DC, so it stays. Reception PC and files01 are Melbourne and not the DC role. Lab host is Melbourne and role/hypervisor. The line says 1 of 6. Any of these would have kept every machine that had either tag. The same box is on the alert journal, the patch window, approvals aging, and shell and proxy.
Clear filters removes the tags. Ticking a type instead is Limit a report to servers. Saving the tags is Save a report you will open again. An alert rule limited the same way is Limit an alert rule to one site. The tag on the machine is Name a machine and put it in a group.