diff --git a/mail_to_misp_config.py-example b/mail_to_misp_config.py-example
index 01fc6b2..9667367 100644
--- a/mail_to_misp_config.py-example
+++ b/mail_to_misp_config.py-example
@@ -30,3 +30,5 @@ malwaretags = { 'locky':    [ 'ecsirt:malicious-code="ransomware"', 'misp-galaxy
 dependingtags = { 'tlp:white': [ 'circl:osint-feed' ]
                 }
 
+# Tags to add when hashes are found (e.g. to do automatic expansion)
+hash_only_tags = { 'TODO:VT-ENRICHMENT' }