So I am creating a dashboard that is breaking down events by event types, we are handling event types with tags within SecOps, however tags are also being used in multiple other areas.
What I am trying to create is a dashboard showing all cases with some defined tags in a pie chart, but I only want it to display THOSE defined tags, not any other tags that may be attached to the same cases.

Excluding those tags in the query also excludes those cases they are attached to which is no use

Is there a way for a defined output list in the query that will only show the required tags (This was possible in the legacy Dashboarding but I cannot seem to do it in the new Dashboarding)