diff --git a/server/integration-files/known-fields.js b/server/integration-files/known-fields.js
index cc40d9122..622e05fc8 100644
--- a/server/integration-files/known-fields.js
+++ b/server/integration-files/known-fields.js
@@ -4855,6 +4855,15 @@ export const knownFields = [
     aggregatable: true,
     readFromDocValues: true
   },
+  {
+    name: 'syscheck.tags',
+    type: 'string',
+    count: 0,
+    scripted: false,
+    searchable: true,
+    aggregatable: true,
+    readFromDocValues: true
+  },
   {
     name: 'title',
     type: 'string',