diff --git a/x-pack/plugins/security_solution/example_tags.json b/x-pack/plugins/security_solution/example_tags.json
new file mode 100644
index 0000000000000..a196052707ba5
--- /dev/null
+++ b/x-pack/plugins/security_solution/example_tags.json
@@ -0,0 +1,10 @@
+[
+  "Domain: Endpoint",
+  "OS: Windows",
+  "Use Case: Threat Detection",
+  "Tactic: Persistence",
+  "Tactic: Defense Evasion",
+  "Data Source: Elastic Endgame",
+  "Data Source: Elastic Defend",
+  "Data Source: Sysmon"
+]