Other versions

Asking questions

In a Tanium™ deployment, asking questions is a fundamental interaction with endpoints.

What is a question?

Tanium questions help you get key pieces of information from managed enterprise endpoints.

The Ask a Question feature is built on a natural language parser that enables you to get started with natural questions rather than a specialized query language. You do not need to enter questions as complete sentences or particularly well formed inquiries. Word forms are not case sensitive and can even include misspellings. The parser interprets your input and suggests a number of valid queries that you can use to formalize the question that is sent to Tanium™ Clients.

The following figure shows an example of how natural language input is parsed into proposed queries. First, the user enters the fragment last logged in user and clicks Search. In response, Interact returns a list of queries cast in valid syntax.

Figure  1:  Natural language parser

Basic questions include:

  • one or more sensor names in the get clause.
  • all machines (in other words, all Tanium Client host computers) in the from clause.

Advanced questions include filter clauses and parameterized sensors.

What is a sensor?

In essence, a sensor is a script that is executed on an endpoint to compute a response to a Tanium question. Sensors are distributed to clients during registration. Sensors enable you to ask questions about:

  • Hardware/software inventory and configuration
  • Running applications and processes
  • Files and directories
  • Network connections

The Initial Content that is imported during the Tanium Server installation includes sensors to support a wide range of common questions. Additional sensors may be added when you import additional Tanium content packs and Tanium solution modules. If you cannot find a sensor you need within Tanium-provided content, you can create user-defined sensors.

For more information, see Sensors.

Counting questions and non-counting questions

A counting question is designed to return results that can be meaningfully counted. A counting question can have only one sensor. For example, Get Tanium Client Logging Level from all machines is a counting question. The sensor returns the value of the LogVerbosityLevel setting. When a managed endpoint is prompted to add its answer to the answer message, it increments the tally of the answer that its value matches. The Tanium Server maintains a table of answer strings. In many cases, like logging level, there are just a few common answers, so the question has a relatively small footprint.

Figure  2:  Counting question

A non-counting question has sensors that return unique strings. For example, Get Tanium Client IP Address from all machines returns IP addresses, which are unique. When a Tanium Client is prompted to add its answer to the answer message, it adds a new string. On the Tanium Server, the data footprint for a non-counting question can be quite large.

Figure  3:  Non-counting question

Questions with multiple sensors

Use the AND operator in the get clause to specify multiple sensors. Results are grouped by the first sensor, then by the next sensor, and so on. The following example shows a question that uses multiple sensors.

Figure  4:  Question with multiple sensors

Questions with parameterized sensors

A parameterized sensor accepts a value specified at the time the question is asked. The following example shows the File Exists sensor. The parser prompts you to specify a file path and file name.

Figure  5:  File Exists parameterized sensor

Another example is the High CPU Processes sensor. You can specify a parameter that is the number of CPU processes to return from each machine. Let's say you want to get the top 5 highest CPU utilizing processes. The question has the following syntax:

Get High CPU Process[5] from all machines

For sensors with multiple parameters, you can pass an ordered list separated by a comma. For example, if you want to get the results of Tanium Action Log number 1 and get 10 lines of results, specify a parameter list as shown in the following example:

Get Tanium Action Log[1,10] from all machines

Questions with filters

You can use filters to craft questions that target fewer computers than "all machines". You often want to work with a set of computers that have a specific process name or value.

This is an example of an advanced question. The left side is a complete and valid query; the right side contains a filter—the "from all machines with" expression.

Filters in the from clause are the first part of a question that gets processed by the endpoint. If the endpoint data does not match the filter, then the endpoint does not process the question any further. If there are multiple filters, each filter is processed and evaluated. If the evaluation is true, then the sensors on the left side of the question are also executed and returned.

The filter expression on the right side must evaluate to a Boolean true or false. For example, the expression with Running Processes contains explore evaluates to true if the specified string matches the result string, or false if it does not.

A parameterized sensor like File Exists[] returns a string "File Exists: Filename" or "File does not exist", so you must be careful how you cast it in a filter expression.

Figure  6:  Example: Question with parameterized sensor

The filter expression with File Exists[c:\a.txt] containing "Exists" evaluates to true when the result is "File Exists: c:\a.txt" and false when the result is "File does not exist", so it can be used to filter the set of responses.

Figure  7:  Example: Filter with parameterized sensor

Filter expressions can match strings or regular expressions. The following table describes the operators supported in filter clauses.

Table 1:   Filter operators
Filter Usage
contains Sensor value contains the specified string.

Example: running processes contains "explore"

does not contain Sensor value does not contain the specified string.
starts with Sensor value starts with the specified string.

Example: starts with "explore"

When the question is loaded, the expression is translated to a regular expression using the matches operator.

does not start with Sensor value does not start with the specified string.
ends with Sensor value ends with the specified string.

Example: ends with "explore.exe"

When the question is loaded, the expression is translated to a regular expression using the matches operator.

does not end with Sensor value does not end with the specified string.
matches Sensor value matches the specified regular expression (in Boost syntax).
does not match Sensor value does not match the specified regular expression.
is equal to Sensor value is equal to the specified value or string.
is not equal to Sensor value is not equal to the specified value or string.
is less than Sensor value is less than the specified value.

When the question is loaded, the expression shown in the question bar uses symbols in place of the words.

Example: installed application version[chrome] < 12

is less than or equal to Sensor value is less than or equal to the specified string.

When the question is loaded, the expression shown in the question bar uses symbols in place of the words.

Example: installed application version[chrome] <= 12

is greater than Sensor value is greater than the specified value. When the question is loaded, the expression shown in the question bar uses symbols in place of the words.

Example: installed application version[chrome] > 12

is greater than or equal to Sensor value is greater than or equal to the specified string. When the question is loaded, the expression shown in the question bar uses symbols in place of the words.

Example: installed application version[chrome] >= 12

See Reference: Advanced question syntax for examples of complex filter expressions.

Using the Question Builder

The Question Builder is another way to create a question. It has form fields to help you complete the get statement and the from clause, including any filters.

You can launch the Question Builder in either of the following ways:

  • In the Ask a Question box, click Question Builder in the top right corner.
  • After you have asked a question and want to refine it, click Copy to Question Builder.


The following figure shows the Question Builder.

Figure  8:  Question Builder

Get statement

The first text box is for sensor names. Start typing and then use the typeaheads to select sensors.

Figure  9:  Typeaheads

Alternatively, you can use the Browse Sensors dialog box to select sensors. When you use the dialog box, you can review sensor descriptions.

Figure  10:  Browse sensors

For multicolumn sensors, you can add filters based on column data matches.

Figure  11:  Column data filter

You can select matching operators and specify regular expressions to match strings. To match on substrings, select the Substring box and specify a starting position (where 0 is the first position) and number of characters.

Figure  12:  Match on substring

If you add a filter in either the get statement and from clause, you can specify advanced options.

Table 2:   Advanced Sensor Options
Settings Guidelines
Case Sensitivity Group strings:
  • Ignore case

    Group and count result values regardless of differences in upper-case and lower-case characters.

  • Match case

    Group and count result values with strict attention to lettercase.

Matching This option is valid in the "from computers with" clause.

For some sensors, a Tanium Client might compute multiple results. When the sensor is used as a filter in the from clause, specify whether any or all of the results must match the filter:

  • Match Any Value

    Any value in the answer must match the value specified in the question.

  • Match All Values

    All values in the answer must match the value specified in the question.

For example, in response to the IP Address sensor, it is possible for a Tanium Client to return both an IPv4 address and an IPv6 address. A question based on the IP Address sensor containing 192.168 for example could possibly match the IPv4 address but not the IPv6 address. In this case, you probably want to match "any".

Treat Data As Sensor values are treated as the type of data you specify:
  • Date/Time (BES)
  • Date/Time (WMI)
  • File Size
  • Integer
  • IP Address
  • Numeric
  • Text
  • Time Duration
  • Version
Maximum Data Age Maximum time the Tanium Client may use a cached result to answer a question. For example, by default, the maximum data age for the File Size sensor is 15 minutes. When a Tanium Client is asked a question that executes the File Size sensor, it caches the result. Over the next 15 minutes, if the Tanium Client is asked a question that includes the File Size sensor, it responds with the cached answer. After 15 minutes, if the Tanium Client is asked a question that includes the File Size sensor, it executes the sensor script again to compute a fresh answer.

Use shorter ages for sensors that return values subject to change frequently, such as status and utilization sensors. Use longer ages for values that typically change infrequently, such as the chassis type or Active Directory Domain membership.

From clause

In the from clause, you can configure multiple filters, including nested filters. For example, suppose you wanted to investigate the web browsers installed on computers. You can use Boolean ANDs and ORs in the from clause to target "modern" browsers.

Figure  13:  Nested filters

Click + and use the controls to add filter conditions:

  • Add Row

    Add one or more conditions.

  • Add Group

    Select this option to nest a Boolean operator and then use Add Row to build the nested expression.

Question expiration

When a dynamic or saved question is issued, the question is assigned a question ID. In your web browser, you will notice the question ID in the URL.

Figure  14:  Question ID

The question ID "expires" after 10 minutes, and its corresponding URL becomes invalid. This means that for up to 10 minutes, you can refresh the page or share the link. After 10 minutes, if you navigate to the link, Interact displays a message indicating the question has expired, and it gives you the option to copy the question text to the Question Bar so you can reissue it.

Figure  15:  Question Expired message

Question History

Go to Administration > Question History to review a chronology of questions that have been issued. By default, an entry for a question is maintained in the chronology for 7 days. You can change the default limit with the global setting SOAPQuestionHistoryLimitInDays.

You can use the Question History to review question syntax and the question expiration timestamps. You can also copy the question to the Question Bar or Question Builder.

You must be assigned a role with the Read Question History (Micro Admin) permission to see the Question History page. However, a user with only the microadmin permission cannot load a question from the Question History page. Users assigned the Administrator reserved role can see the Question History page and load a question from the page.

Question permissions

You must be assigned the Show Interact module permission to see the Ask a Question bar and the Question Builder. You must also have the Ask Dynamic Questions permission (can be assigned in any advanced role). The sensors available for questions are determined by Read Sensor content set permissions.

The Administrator reserved role has all of these permissions. The Content Administrator role has all except the Show Interact module permission. Be sure to explicitly assign the Interact permission.

Last updated: 11/8/2018 1:02 PM | Feedback