Saved questions are questions that you can store on the Tanium Server as configuration objects and reissue without retyping them in the Interact Explore Data field or Question Builder. For an overview of saved questions and related concepts, see Get started quickly with Interact.
Use the Interact Overview page to perform the following actions:
- View, issue, create, and edit saved questions.
- Move questions between content sets.
- Define categories and dashboards, and assign saved questions to them.
- View and select favorite categories, dashboards, and saved questions.
For details about the user roles and permissions required to manage saved questions, see User role requirements.
When multiple users work with the same saved question, the following factors control which users can see the question, and which question settings and results the users can see:
- User role permissions: To view and edit a saved question, a user must have the required role permissions for the content set to which the question is assigned (see User role requirements). Additionally, the following settings in the question configuration interact with role permissions to affect which users can see the question and which other settings they can see:
- Visibility: Determines whether the question is visible only to the owner (question creator) and administrators, or to any user who has the required role permissions.Determines whether the question is visible only to the owner (question creator), or to any user who has the required role permissions.
- Default Preferences: Determine the default values that users see for the User Settings & Defaults in the question configuration.
- User-specific configuration changes: When a user saves changes to the question configuration,
Tanium as a Service the Tanium Serversaves a copy of the question. Upon logging into the server, users see only the copy with their own changes.
- Computer group management rights: The computer groups assigned to users and user groups determine the visibility of the saved question Reissue interval and recent question results.
For details, see the KB article Reference: User-specific saved questions.
- Use the Interact Explore Data field or Question Builder to ask a dynamic question.
The Question Results page displays with the results.
- Click Save above the question field to open the New Saved Question page.
- Complete the settings described in the following table.
- According to RBAC. Users must have the Read Saved Question permission for the content set to which the saved question belongs to see the saved question.
- Only the Owner and Admins. Only the question owner (creator) and users with the Administrator reserved role can see the saved question.Only the question owner (creator) can see the saved question.
- If you specify an eight-hour reissue interval, the Tanium Server reissues the question exactly every eight hours, regardless of time changes due to daylight savings time.
- Which users can see the reissue interval for a saved question depends on the computer groups assigned to those users. For details, see the KB article Reference: User-specific saved questions.
- Non-counting questions consume more disk storage because the Tanium Server maintains the answer strings for each endpoint (based on computer ID).
- You cannot change this setting after you save a new saved question configuration.
- Current: The grid displays results only from endpoints that are currently online.
- Recent: In addition to results from online endpoints, this option includes results from offline endpoints if those results still reside on the Tanium Server after the last time the server issued that question.
- Expand the Preview section to preview the results of the saved question.
- Click Create Saved Question.
|Name||Specify a configuration name. The name appears in saved question lists that are incorporated into Tanium Console workflows. Observe the existing naming scheme so that you and other users can find it easily.|
|Content Set||Assign to a content set. The list is populated with all content sets for which you have Write Saved Question permission.|
|Reissue this question every||If you want to periodically reissue the question, specify a number and unit for the reissue interval: Minutes, Hours, Days. The Tanium Server first issues the saved question immediately after you save the configuration. Tanium Clients that are online at that time respond with their answers. You can use the reissue option to account for clients that are currently offline but will be online later. For example, employee laptops that are offline at the moment you save the saved question configuration might be online at least once during an eight-hour reissue interval.
If you configure reissuing, the Tanium Server reissues the saved question in the background at the specified interval. For example, if you save the saved question configuration at 9:00 a.m. local time and specify a reissue interval of every eight hours, the Tanium Server reissues the saved question at 5:00 p.m., 1:00 a.m., 9:00 a.m., and so on. By default, the Tanium server caches responses for seven days, and displays the cached responses in the Question Results grid for endpoints that are offline when the server issues the question. You can use the Question History to verify that the server issues the saved questions based on the specified reissue interval.
|Default preferences||The User Settings & Defaults that users see for a saved question vary based on their role permissions and the Default Preferences setting. Default preferences are useful when you want a question to initially have the same values for all users until the users edit those settings. Only users who have the Administrator or Content Administrator reserved role can see and set Default Preferences. For details, see the KB article Reference: User-specific saved questions.|
|Make this question available for drilldown||Enabling this option makes the question available for drill-down operations on question results. When you select results in the Question Results grid and click Drill Down, the Select Drilldown Question dialog opens and displays the available questions in the Saved Questions tab. You can then select the question and click Drill Down to filter the results based on that question. For details, see Drill down.|
|Non-Counting Question / Counting Question||The option to convert the question to a non-counting question is available only if the question has one sensor in the get clause. Converting to a non-counting question enables the Tanium Server to store the answers as recent data, which the server uses when live data is unavailable (when the answering endpoints are offline). For details, see Display current or recent question results. Converting to a non-counting question also enables the merging option.
|Make this question available for merging||Only non-counting questions provide this option to make the question available for merge operations (see Merge questions). You cannot change this setting after you save a new saved question configuration.|
|Default Tab||Specify a default tab: Question, Grid, or Pie. The Default Tab setting is saved as a user preference unless you set the Default Preferences to all users.|
|Default Grid Chart Zoom||Select whether the Question Results grid initially displays only current results or both current and stored results:
For details on these options, see Display results for online and offline endpoints.
|Associated Actions||Optional. Click Add Package and select the package that you want to be the default when a user clicks the Deploy Action button in the Question Results grid.|
The Tanium Server reissues your question and displays the results in the saved question results grid. Depending on the settings you configured, the saved question might appear in the saved question lists that are used in various Tanium Console workflows.
When you save a question that has a parameterized sensor, the sensor definition, including the substituted values, is saved in an object called a temp sensor. On the endpoint, the Tanium™ Client runs the temp sensor when it computes answers to a saved question that calls it. A saved question that is reissued according to a schedule continues to use the temp sensor even if the sensor from which it was based is updated. Therefore, if a sensor is updated, and you want the saved question to use the updated code, you must re-create the saved question.
As a best practice, do not edit saved questions that are provided through Tanium content packs (for details, see Tanium Console User Guide: Best practices for resolving import conflicts (Tip 4)). If you need to edit Tanium-provided questions, review User-specific saved questions and contact Tanium Support. For more information, see Contact Tanium Support.
Alternatively, you can create copies of Tanium-provided questions and edit the copies. You can also edit custom saved questions that you created from scratch. To edit a saved question:
- From the Interact Overview page, find the question in the Saved Questions panel, mouse over the question, click Options , and select Edit Properties.
- Configure the settings described in Create a saved question and save your changes.
If you create a saved question based on a parameterized sensor and then modify the sensor, the saved question behavior will still reflect the original sensor definition. Only after you modify the saved question will it behave as expected with the new sensor definition. For details on parameterized sensors, see Asking questions .
The number of saved questions tends to increase as your team uses the Tanium system more. To find specific questions when the Interact Overview page has too many to scan quickly, you can filter by text strings, categories, dashboards, and favorites.
In the Interact Overview page, you can select check boxes in the panels so that only items belonging to the selected categories or dashboards appear. You can apply multiple filters. Click Deselect in a panel header to deselect all its filters.
In the Interact Overview page, use text filters in the panels to find items that match a specified string. Click the x in the text search box to deselect the filter.
A favorite is a category, dashboard, or saved question that you want to appear on the Interact Overview page. You can also use favorites as an optional filter on the Interact Overview page. The Tanium Server saves favorites as a user-specific setting; your favorites selections do not apply to other users.
Items that you select as favorites before upgrading to Interact 2.0 or later remain favorites after upgrading. If you did not have favorites before an upgrade or before installing a new Tanium Server, all categories and dashboards for which you have read permission are set as favorites anyway.
To configure the display of favorite content, perform the following steps:
- From the Main menu, go to Modules > Interact.
On the Tanium Home page, click the Favorites icon for an item to deselect it as a favorite and remove it from the page. However, the Tanium Home page does not provide the option to show items that are not favorites, so you cannot restore favorite status to items on that page.
- Click the Favorites icon next to the name of a category, dashboard, or saved question to select or deselect that item as a favorite.
To reduce clicks, click Favorite All or Unfavorite All in a panel header and then toggle on or off individual items in that panel.
- To view only favorite categories, dashboards, and saved questions, click Favorites in the upper right of the Content section.
The button changes to a dark background to indicate that the panels display only favorites. Click Favorites again to toggle off the filter.
After you find and select your favorite Categories or Dashboards, you might want to toggle off the Favorites filter so that the Saved Questions panel displays both favorite and non-favorite questions.
After you save a question, you can manually reissue it anytime by performing one of the following steps:
- From the Interact Overview page, click the question name in the Saved Questions panel.
- If the question is selected as a favorite, go to the Tanium Home page, scroll to the Favorite Interact Categories, expand the corresponding category and dashboard, and click the question name.
The Tanium Console displays the results in the saved question results page. This page provides the option to see recent results from offline endpoints if those results still reside on the Tanium Server after the last time the question was issued. The server stores the results of saved questions for seven days by default. For details, see Display results for online and offline endpoints.
If you want to simultaneously issue all the questions in a dashboard, see Issue a dashboard of saved questions.
In some cases, it is useful to issue several saved questions that are related based on the kind of information they retrieve from endpoints. In such cases, you can group the questions in a single dashboard and issue them simultaneously. For example, the predefined Hardware Inventory dashboard contains questions that retrieve chassis type, operating system, monitor, CPU, disk, memory, and BIOS information.
To issue all the questions in a dashboard:
- From the Main menu, go to Modules > Interact.
- In the Dashboards panel, click the dashboard name.
The Tanium Console displays the dashboard results page, which shows a results grid for each saved question in the dashboard.
For each question, the dashboard results page provides all the features that are available in the saved question results page, such as viewing Current, Recent, or Cached results (see Managing question results). The dashboard results page also has the following features (matching the numbers in Figure 3):
|Use the dashboards drop-down list to issue a different dashboard.|
|Use the Filter All Questions Displayed drop-down to filter all the results grids by computer group.|
|The page displays the dashboard name, favorite status ( for favorite, for non-favorite), and number of saved questions in the dashboard. Click the favorite icon / to toggle the favorite status of the dashboard.|
|For each results grid, the page displays the question name and favorite status. Click the favorite icon / to toggle the favorite status of the question. Click the question name to reissue the question. Click Edit to change the question settings (see Edit a saved question).|
|Filter by computer group or text.|
|Apply additional filters to a specific results grid.
Tanium modules and content packs
- In the Categories panel heading, click Options and select New Category.
- Specify a Name, Content Set, Icon, and Visibility option, and click Save.
- In the Dashboards panel heading, click Options and select New Dashboard.
- Specify a Name, Filter Group, Content Set, and Visibility option, and click Save.
By default, new dashboards belong to the Other Dashboards category. Only users with the Administrator or Content Administrator role can see that category, and therefore only those users, and the dashboard creator, can see the new dashboard. If you want other users to see the new dashboard, a user with the required permissions must move it to another category.
- In the Categories panel, mouse over the category, click Options , and select Add/Remove Dashboards.
- In the Dashboards panel, select the dashboards to include in this category and click Apply.
- In the Dashboards panel, mouse over the category, click Options , and select Add/Remove Saved Questions.
- In the Saved Questions panel, select the saved questions to include in this dashboard and click Apply.
- In the Categories or Dashboards panel, mouse over the category or dashboard, click Options , and select Edit Category Information or Edit Dashboard Information.
- Edit the settings and save the configuration.
To edit saved questions settings, see Edit a saved question.
When you delete a category, the Tanium Server reassigns its dashboards to the Other Dashboards category. When you delete a dashboard, the Tanium Server does not assign its saved questions to any other dashboard.
- In the Categories or Dashboards panel, mouse over the category or dashboard and click Delete .
- Confirm that you want to delete the configuration.
You cannot delete a saved question configuration from the Interact Overview page, only from the
The following procedures describe how to export and import the configurations of categories, dashboards, or saved questions.
Develop and test content in your lab environment before importing that content into your production environment.
Export categories, dashboards, or questions
If you want to export multiple content types in a single operation, see Manage Tanium shared services and content.
- Click Options in the panel header and select the export option.
- Select items to export or Select all.
- Click Export.
- Specify a File Name and click OK.
The JSON file is saved to the downloads folder on the computer that you use to access the Tanium Console.
You can import content files that are in JSON or XML format.
- Digitally sign the content file and ensure a public key is in place to validate the signature. See Authenticating content files.
- From the Main menu, go to Administration > Configuration > Solutions.
- Scroll to the Content section and click Import Content.
- Click Choose File, select the content file, and click Open.
- Click Import.
If object names in the file are the same as for existing objects, the Tanium Console itemizes the conflicts and provides resolution options for each one.
- Select resolutions for any conflicts. For guidance, see Conflicts and Best practices.
- Click Import again, and click Close when the import finishes.
Last updated: 2/23/2021 1:43 PM | Feedback