Managing question results

Question results overview

After you use Tanium Interact to issue a dynamic question, the Question Results page opens and displays a grid with the answers (results) from endpoints. The page facilitates analyzing the results by providing display options such as live updates, filters, and charts. You can also use the page to retrieve additional information from endpoints by merging questions and by drilling down into the results. When you issue a saved question, the Tanium Console opens the Saved Question Results page, which has similar display options. When you issue a dashboard of saved questions, the Tanium Console opens the dashboard results page, which also resembles the Question Results page, but has additional options: see Issue a dashboard of saved questions.

In the Question Results grid, each row is an aggregation of the endpoints that reported the same answer. The Count column shows the number of Tanium Clients with that answer.

Figure  1:  Question Results grid

Set the number of rows in the Question Results grid

After you issue a question, the Question Results grid displays the first 100 answer rows by default. If you want to change the number of rows, perform the following steps:

  1. Open the drop-down list beside Logged In: <username> at the top right of the Tanium Console, and select Preferences.
  2. Enter the Number of answer rows to load per request and click Save.

Enable or disable live updates

In the Question Results grid toolbar, the Live Updates field shows the percentage of Tanium Clients that reported results. By default, the Tanium Console updates the grid as more Tanium Clients report results.

You can click Pause to stop the grid from updating and click Play to resume updating.

Even after 100% of Tanium Clients have reported, some answer rows might indicate incomplete results.

[no results]

This result indicates that the Tanium Client was instructed to answer but does not have a value that matches the sensor filter. This occurs if you apply a filter to the get clause and not the from clause. For example, if the question is Get IP Address ending with 2 from all machines, all endpoints would report answers and all endpoints that did not have an IP address ending in 2 would report [no results]. As a best practice, put the filter in the from clause. For example, Get IP Address from all machines where IP Address ends in 2 would not return unexpected [no results] rows. You might also see [no results] if the sensor does not return a value, or the sensor could not execute the script.

[Current Result Unavailable]

If an endpoint takes longer than usual to evaluate a sensor, it might pass [current results unavailable] to its peer. The sensor process continues on the endpoint, and when it is complete, the endpoint sends its updated answer. The Tanium Console then updates the Question Results grid.

[Results Currently Unavailable]

This result indicates that the Tanium Server cannot correctly parse an answer. If this occurs, contact your technical account manager (TAM).

Display current or recent question results

When you issue a saved question from the Interact Content page, the Tanium Console displays the Saved Question Results grid. In addition to all of the features of the results grid for dynamic questions, the results grid for saved questions includes a Zoom option: Current or Recent. Current data includes responses only from endpoints that are currently online. In addition to data from online endpoints, recent data includes responses from offline endpoints if those responses still reside in the Tanium Server cache. The Tanium Server caches responses for seven days by default. If an endpoint is offline when the Tanium Server issues a question, Tanium Server passes any cached value for that endpoint to the results grid.

Filter question results

Use the filter controls in the header of the Question Results grid to display only results that match the specified criteria.

Figure  2:  Question Results grid filters

The Question Results grid includes multiple grid filters. The Tanium Server combines the filters with a Boolean AND. For example, if you select a computer group filter and also configure an advanced filter, the server combines the logic of both filters.

Use a text filter

When you use the Filter By Text field, the Tanium Server filters the Question Results grid without reissuing the question. Select the Contains or Does not contain operator, enter a search string, and click Search .

Use a computer group filter

After you select a Computer Group from the drop-down list, the Tanium Server issues a new question with the added filter. Select All Computers, No Computers, a user-configured computer group, or the Create Ad Hoc Filter option, which enables you to create a custom filter. If the list of computer groups is long, you can use the text filter within the Computer Group drop-down list to filter by group name. If you save the question, the question text includes the Computer Group filter but not the text filter within the drop-down list.

The list of computer groups includes all computer groups configured in the Tanium Console, even ones for which you do not have computer group management rights. However, if you select a computer group for which you do not have management rights, the new question returns no results.

Use an ad-hoc filter

An ad-hoc filter is a one-time only filter; you cannot save it.

  1. In the header of the Question Results grid, select Computer Group > Create Ad Hoc Filter.

    Interact displays the Group Builder dialog box.

  2. Use one of the tabs to create a filter and then click Apply.

    The Filter Bar tab includes a natural language parsing search box that helps you build a valid filter expression.

    The Filter Builder tab includes fields that enable you to add a filter, apply it, and issue the resulting question. The question is always Get computer name and IP address from all machines with the filter added to the from clause.

    The Manual List tab includes fields that enable you to specify a list of computers by hostname or IP address.

Use an advanced filter

Use advanced filters to filter question results based on match conditions, including column values.

  1. In the header of the Question Results grid, click Advanced Filtering.
  2. Click + and use the controls to add filter conditions:
    • Add Row: Add one or more conditions.
    • Add Group: Select this option to nest a Boolean operator and then use Add Row to build the nested expression.

    After you click Apply, the grid refreshes.

Manage row sorting and columns for question results

To display the menu for sorting rows and showing or hiding columns in the Question Results grid, click the menu icon in a column header. Click the Clear Sort button to clear sorting criteria.

Figure  3:  Question Results grid row and column controls

Display question results in charts

By default, the Question Results page displays results as a grid. You can use the View button bar to add a pie chart or bar chart view of the results, and to hide the grid.

Mouse over a pie slice or bar to display the result string and count. If the result count is less than 3% of the total, it is included in the Other group.

Figure  4:  Pie chart

Figure  5:  Bar chart

Export and copy question results

The Question Results page provides several options for copying and exporting the results grid contents. The following figure shows the buttons and menu options for these operations. Use the More menu (options 1 in the figure) to copy or export specific results. To capture the entire grid contents, click (icon number 2 in the figure) to export or click (icon number 3 in the figure) to copy.

Figure  6:  Copy or export question results

Copy question results to the clipboard

You can copy question results to the clipboard in text format. To include sensor names (displayed in the grid as column headers) in the copied text, see Set Tanium Console user preferences.

  • To copy specific results, select the rows, and select More > Copy.
  • To copy the complete results, click Copy Table .
  • To copy the contents of a grid cell, press the Alt key (Windows) or Option key (macOS) and click in the grid cell. The Tanium Console then displays a message indicating that the clipboard has a copy of the cell contents. This operation works for most grids in the Tanium Console.

Export question results

You can export question results to a .csv file.

  1. Select one of the following export options:
    • To export specific results, select the desired result rows and select More > Export. Skip the remaining steps, which describe options that are available only if you are exporting the complete results.
    • To export the complete results, click Export Table .
  2. Enter a File Name for the .csv file.
  3. To include column names in the .csv file, select Include Table Header. To set this option as enabled or disabled by default, see Set Tanium Console user preferences.
  4. Select how the .csv file displays results for questions where a single sensor generates multiple results for each responding endpoint. As an example, for the question Get Computer Name and High CPU Processes[5] from all machines, the High CPU Processes sensor would list five processes for each endpoint.
    • Single Rows - Flattened: Display a row for each result that a sensor generates. For the example question, this would mean five rows per endpoint: one row for each process that the High CPU Processes sensor returned. Note that this option works only if just one sensor in the question has multiple results; flattening does not work if multiple sensors each have multiple results.
    • Multiple Lines Per Row - Stacked: Display one row for all the results that the sensor generated for an endpoint. For the example question, this would mean each row lists all the top five processes for each Computer Name.
  5. Click OK to proceed with the export.

Merge questions

Question results often lead to additional questions. For example, say you ask for a list of computer names and running processes, and the results indicate a suspicious process is running on some endpoints. You can merge the question with another question to learn more, such as the last logged-in user. The Tanium Server issues the merge question in the background, and the Tanium Console redisplays the Question Results grid with one or more additional columns containing data for the sensor associated with the merge question. Perform the following steps to merge questions:

  1. Click Merge in the upper right corner of the Question Results grid toolbar.

    Interact displays the Select Merge Questions dialog box.

  2. Use one of the tabs to add one or more questions and then click the red Merge button.
    • Saved Questions: Includes a list of saved questions for which you have Read Saved Question permission.
    • Create a Question: Includes fields that enable you to start a new question.
    • Build a Question: Includes fields that enable you to select sensors for the merge question.

      Notice that you add sensors to the get clause but you do not add filters to the from clause. The from clause is built from the rows that you selected in the Question Results grid when you clicked Merge.

Drill down

In the Question Results grid, you can drill down into selected results to retrieve additional information from the selected endpoints. Adding a drill-down question essentially means adding sensor filters. A typical use case is targeting a smaller group of endpoints for an action. For example, let's say you ask for a list of chassis types and operating systems. You can drill down into these results to the list of computer names for the matching records.

  1. In the Question Results grid, select the results for which you want additional information. The Drill Down button then appears above the grid.
  2. Click Drill Down to open the Select Drilldown Question dialog box.

    The Saved Questions tab includes a list of saved questions for which you have Read Saved Question permission.

    The Create a Question tab includes fields that enable you to start a new question.

    The Build a Question tab includes fields that enable you to select sensors for a drill-down question.

  3. Select or configure a drill-down question and click Drill Down.
  4. Interact displays the progression of results, including a new Question Results grid for the drill-down question. You can then drill down further, deploy an action, save the question, or copy it to the Question Bar or Question Builder for further refinement.



Last updated: 7/17/2019 8:43 AM | Feedback