Just like you might tag a blog post, you can tag a Katapult virtual machine. You can define what these tags are at the point of virtual machine creation; or, you can pre-define them or manage existing tags within the tags section of the Katapult settings.
Tagging virtual machines allows you to create your own subsets of given compute resources which can then be used within other parts of the Katapult service. For example, you may wish to tag machines as "webserver" and then create a hypervisor level firewall rule to permit traffic over port 80/443 therefore removing any requirement for machine level firewall policies.
To manage the list of tags you have already used; or to create additional tags, browse to the tags page in settings for your given organisation (Settings -> Tags).
Once you've set a few tags and assigned resources to them you are able to use these tags in various other areas of the Katapult Platform, for example with Load Balancers, or Firewalls.