add sec tags, fix filter order

(cherry picked from commit 8c9fde4fc53c77ecea01768b794acf42578bf875)