diff --git a/thehive/app/org/thp/thehive/controllers/v0/AlertCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/AlertCtrl.scala
index 68fa42aaf1..157180e68a 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/AlertCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/AlertCtrl.scala
@@ -62,7 +62,7 @@ class AlertCtrl @Inject() (
               .get(request.organisation)
               .orFail(AuthorizationError("Operation not permitted"))
           richObservables <- observables.toTry(createObservable).map(_.flatten)
-          richAlert       <- alertSrv.create(request.body("alert").toAlert, organisation, inputAlert.tags, customFields, caseTemplate)
+          richAlert       <- alertSrv.create(inputAlert.toAlert, organisation, inputAlert.tags, customFields, caseTemplate)
           _               <- auditSrv.mergeAudits(richObservables.toTry(o => alertSrv.addObservable(richAlert.alert, o)))(_ => Success(()))
           createdObservables = alertSrv.get(richAlert.alert).observables.richObservable.toSeq
         } yield Results.Created((richAlert -> createdObservables).toJson)
@@ -369,6 +369,20 @@ class PublicAlert @Inject() (
       .property("lastSyncDate", UMapping.date.optional)(_.field.updatable)
       .property("tags", UMapping.string.set)(
         _.select(_.tags.displayName)
+          .filter((_, cases) =>
+            cases
+              .tags
+              .graphMap[String, String, Converter.Identity[String]](
+                { v =>
+                  val namespace = UMapping.string.getProperty(v, "namespace")
+                  val predicate = UMapping.string.getProperty(v, "predicate")
+                  val value     = UMapping.string.optional.getProperty(v, "value")
+                  Tag(namespace, predicate, value, None, 0).toString
+                },
+                Converter.identity[String]
+              )
+          )
+          .converter(_ => Converter.identity[String])
           .custom { (_, value, vertex, _, graph, authContext) =>
             alertSrv
               .get(vertex)(graph)
diff --git a/thehive/app/org/thp/thehive/controllers/v0/CaseCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/CaseCtrl.scala
index 53bbd8b1c8..ec72368785 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/CaseCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/CaseCtrl.scala
@@ -240,6 +240,20 @@ class PublicCase @Inject() (
       .property("endDate", UMapping.date.optional)(_.field.updatable)
       .property("tags", UMapping.string.set)(
         _.select(_.tags.displayName)
+          .filter((_, cases) =>
+            cases
+              .tags
+              .graphMap[String, String, Converter.Identity[String]](
+                { v =>
+                  val namespace = UMapping.string.getProperty(v, "namespace")
+                  val predicate = UMapping.string.getProperty(v, "predicate")
+                  val value     = UMapping.string.optional.getProperty(v, "value")
+                  Tag(namespace, predicate, value, None, 0).toString
+                },
+                Converter.identity[String]
+              )
+          )
+          .converter(_ => Converter.identity[String])
           .custom { (_, value, vertex, _, graph, authContext) =>
             caseSrv
               .get(vertex)(graph)
diff --git a/thehive/app/org/thp/thehive/controllers/v0/CaseTemplateCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/CaseTemplateCtrl.scala
index b8f36f5df3..6973c978b2 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/CaseTemplateCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/CaseTemplateCtrl.scala
@@ -6,11 +6,11 @@ import org.thp.scalligraph.controllers._
 import org.thp.scalligraph.models.{Database, UMapping}
 import org.thp.scalligraph.query._
 import org.thp.scalligraph.traversal.TraversalOps._
-import org.thp.scalligraph.traversal.{IteratorOutput, Traversal}
+import org.thp.scalligraph.traversal.{Converter, IteratorOutput, Traversal}
 import org.thp.scalligraph.{AttributeCheckingError, BadRequestError, EntityIdOrName, RichSeq}
 import org.thp.thehive.controllers.v0.Conversion._
 import org.thp.thehive.dto.v0.{InputCaseTemplate, InputTask}
-import org.thp.thehive.models.{CaseTemplate, Permissions, RichCaseTemplate}
+import org.thp.thehive.models.{CaseTemplate, Permissions, RichCaseTemplate, Tag}
 import org.thp.thehive.services.CaseTemplateOps._
 import org.thp.thehive.services.OrganisationOps._
 import org.thp.thehive.services.TagOps._
@@ -115,6 +115,20 @@ class PublicCaseTemplate @Inject() (
     .property("severity", UMapping.int.optional)(_.field.updatable)
     .property("tags", UMapping.string.set)(
       _.select(_.tags.displayName)
+        .filter((_, cases) =>
+          cases
+            .tags
+            .graphMap[String, String, Converter.Identity[String]](
+              { v =>
+                val namespace = UMapping.string.getProperty(v, "namespace")
+                val predicate = UMapping.string.getProperty(v, "predicate")
+                val value     = UMapping.string.optional.getProperty(v, "value")
+                Tag(namespace, predicate, value, None, 0).toString
+              },
+              Converter.identity[String]
+            )
+        )
+        .converter(_ => Converter.identity[String])
         .custom { (_, value, vertex, _, graph, authContext) =>
           caseTemplateSrv
             .get(vertex)(graph)
diff --git a/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala
index e52c3458b2..8278610233 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala
@@ -6,7 +6,7 @@ import org.thp.scalligraph.controllers._
 import org.thp.scalligraph.models.{Database, UMapping}
 import org.thp.scalligraph.query._
 import org.thp.scalligraph.traversal.TraversalOps._
-import org.thp.scalligraph.traversal.{IteratorOutput, Traversal}
+import org.thp.scalligraph.traversal.{Converter, IteratorOutput, Traversal}
 import org.thp.thehive.controllers.v0.Conversion._
 import org.thp.thehive.dto.v0.InputObservable
 import org.thp.thehive.models._
@@ -210,6 +210,20 @@ class PublicObservable @Inject() (
     .property("sighted", UMapping.boolean)(_.field.updatable)
     .property("tags", UMapping.string.set)(
       _.select(_.tags.displayName)
+        .filter((_, cases) =>
+          cases
+            .tags
+            .graphMap[String, String, Converter.Identity[String]](
+              { v =>
+                val namespace = UMapping.string.getProperty(v, "namespace")
+                val predicate = UMapping.string.getProperty(v, "predicate")
+                val value     = UMapping.string.optional.getProperty(v, "value")
+                Tag(namespace, predicate, value, None, 0).toString
+              },
+              Converter.identity[String]
+            )
+        )
+        .converter(_ => Converter.identity[String])
         .custom { (_, value, vertex, _, graph, authContext) =>
           observableSrv
             .get(vertex)(graph)
diff --git a/thehive/app/org/thp/thehive/controllers/v1/AlertCtrl.scala b/thehive/app/org/thp/thehive/controllers/v1/AlertCtrl.scala
index 333bf115d4..d4ca260509 100644
--- a/thehive/app/org/thp/thehive/controllers/v1/AlertCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v1/AlertCtrl.scala
@@ -85,7 +85,7 @@ class AlertCtrl @Inject() (
         for {
           organisation <- userSrv.current.organisations(Permissions.manageAlert).getOrFail("Organisation")
           customFields = inputAlert.customFieldValue.map(cf => cf.name -> cf.value).toMap
-          richAlert <- alertSrv.create(request.body("alert").toAlert, organisation, inputAlert.tags, customFields, caseTemplate)
+          richAlert <- alertSrv.create(inputAlert.toAlert, organisation, inputAlert.tags, customFields, caseTemplate)
         } yield Results.Created(richAlert.toJson)
       }
 
diff --git a/thehive/app/org/thp/thehive/controllers/v1/Properties.scala b/thehive/app/org/thp/thehive/controllers/v1/Properties.scala
index 608c62cd71..5151fb2b4e 100644
--- a/thehive/app/org/thp/thehive/controllers/v1/Properties.scala
+++ b/thehive/app/org/thp/thehive/controllers/v1/Properties.scala
@@ -49,6 +49,20 @@ class Properties @Inject() (
       .property("lastSyncDate", UMapping.date.optional)(_.field.updatable)
       .property("tags", UMapping.string.set)(
         _.select(_.tags.displayName)
+          .filter((_, cases) =>
+            cases
+              .tags
+              .graphMap[String, String, Converter.Identity[String]](
+                { v =>
+                  val namespace = UMapping.string.getProperty(v, "namespace")
+                  val predicate = UMapping.string.getProperty(v, "predicate")
+                  val value     = UMapping.string.optional.getProperty(v, "value")
+                  Tag(namespace, predicate, value, None, 0).toString
+                },
+                Converter.identity[String]
+              )
+          )
+          .converter(_ => Converter.identity[String])
           .custom { (_, value, vertex, _, graph, authContext) =>
             alertSrv
               .get(vertex)(graph)
@@ -101,6 +115,20 @@ class Properties @Inject() (
       .property("number", UMapping.int)(_.field.readonly)
       .property("tags", UMapping.string.set)(
         _.select(_.tags.displayName)
+          .filter((_, cases) =>
+            cases
+              .tags
+              .graphMap[String, String, Converter.Identity[String]](
+                { v =>
+                  val namespace = UMapping.string.getProperty(v, "namespace")
+                  val predicate = UMapping.string.getProperty(v, "predicate")
+                  val value     = UMapping.string.optional.getProperty(v, "value")
+                  Tag(namespace, predicate, value, None, 0).toString
+                },
+                Converter.identity[String]
+              )
+          )
+          .converter(_ => Converter.identity[String])
           .custom { (_, value, vertex, _, graph, authContext) =>
             caseSrv
               .get(vertex)(graph)
@@ -206,6 +234,20 @@ class Properties @Inject() (
       .property("severity", UMapping.int.optional)(_.field.updatable)
       .property("tags", UMapping.string.set)(
         _.select(_.tags.displayName)
+          .filter((_, cases) =>
+            cases
+              .tags
+              .graphMap[String, String, Converter.Identity[String]](
+                { v =>
+                  val namespace = UMapping.string.getProperty(v, "namespace")
+                  val predicate = UMapping.string.getProperty(v, "predicate")
+                  val value     = UMapping.string.optional.getProperty(v, "value")
+                  Tag(namespace, predicate, value, None, 0).toString
+                },
+                Converter.identity[String]
+              )
+          )
+          .converter(_ => Converter.identity[String])
           .custom { (_, value, vertex, _, graph, authContext) =>
             caseTemplateSrv
               .get(vertex)(graph)
@@ -295,6 +337,20 @@ class Properties @Inject() (
       .property("sighted", UMapping.boolean)(_.field.updatable)
       .property("tags", UMapping.string.set)(
         _.select(_.tags.displayName)
+          .filter((_, cases) =>
+            cases
+              .tags
+              .graphMap[String, String, Converter.Identity[String]](
+                { v =>
+                  val namespace = UMapping.string.getProperty(v, "namespace")
+                  val predicate = UMapping.string.getProperty(v, "predicate")
+                  val value     = UMapping.string.optional.getProperty(v, "value")
+                  Tag(namespace, predicate, value, None, 0).toString
+                },
+                Converter.identity[String]
+              )
+          )
+          .converter(_ => Converter.identity[String])
           .custom { (_, value, vertex, _, graph, authContext) =>
             observableSrv
               .getOrFail(vertex)(graph)