Reference: Advanced question syntax
Tanium Core Platform 7.2 or later supports the following advanced question syntax.
The question parser supports regular expression matching (Boost syntax).
The following example matches computer names that begin with the letter t in the tam.local domain.
The Detect Primary Alerts saved question uses a regular expression to collect results that match any digit 0-9. Because Detect alerts have numeric IDs, this expression would exclude empty results.
You can also use a combination of negation and regular expressions to build filter expressions. For example, the built-in computer group No Computers uses a question with the not matches expression and a regular expression (.*) to match empty results. The author knows that Computer Name always returns a string, so it is a clever way to turn off a scheduled action. The default action group includes only No Computers so that no computers are targeted until an administrator knowingly changes the configuration.
In 7.2 and later, you can issue questions that specify a computer group in the from clause.
For computer groups with filter-defined membership, the question parser converts the specified computer group name into the question that determines membership. In the following example, the computer group named Windows is parsed into its definition: is Windows contains true.
For computer groups with manually-defined membership, the question parser lists possible manual group object IDs. In the following example, the computer group named Infrastructure is parsed into its manual group object ID: Manual Group Membership equals 95.
Multi-column sensors are designed to collect multiple pieces of related information in a single answer.
Using the regular expression starts with, ends with, or contains to filter results for a multicolumn sensor, such as Installed Applications, can be tricky because the result string for a multicolumn sensor is actually a single string with column delimiters. If you are not careful, you might match a string in an unexpected column or unknowingly match a string in a hidden column that you were not even aware of. In Tanium Core Platform 7.2 and later, you can specify which column to match results from multi-column sensors. The syntax is get sensor having sensor:column contains value. The column name is case sensitive. Note that single-column filtering works only if the sensor definition specifies column delimiters with a single character (such as |), not multiple characters (such as |:). To match results from all the columns, the syntax is get sensor contains value.
The following example uses a sensor column filter in the get clause.
The following example uses a sensor column filter in both the get clause and the from clause.
You can use $substring() filters to match result string patterns. The $substring() function takes the following arguments: sensor name, starting position (where 0 is the first position), number of characters.
The following example matches results from the Computer Name sensor where the first two characters match the string ts.
The following example matches results from the MAC Address column of the Network Adapters sensor where the fourth and fifth characters match the string e8.
You can use the in operator to specify a collection of matching sensor results. The operator takes a comma-separated list of arguments that is parsed into a Boolean OR.
The following example uses the in operator to match a sensor filter in the from clause with results containing Virtual or Physical.
The following example uses the in operator to match a sensor column filter in the from clause.
In the from clause of a question, you can configure multiple filters, including nested filters.
The following example shows nested filters in the Question Builder. The example combines one matching expression with either one of the nested expression.
You can also specify nested filters in the Ask a Question field.
The following example shows different Boolean logic: match both of these OR this one.
Tanium Client answers must conform with any advanced sensor settings that are specified in a question message. In releases before Tanium Server 7.2, you could configure advanced sensor settings only with the Question Builder.
In Version 7.2 and later, you can specify advanced sensor settings in the Ask a Question field.
The following example specifies the Treat Data as <type> option. The syntax is sensor?type=value.
Only use the Treat Data as type option with comparison operators, such as Free Memory greater than 300, as shown in the example.
The following example specifies the Max Age option. The syntax is sensor?maxAge=value. When specifying maxAge in the Ask a Question field, specify a number of seconds.
The following example specifies the Ignore Case option. The syntax is sensor?ignoreCase=value. 0 means match case and 1 means ignore case.
The following example specifies the Matches all option. A machine might have multiple interfaces and multiple IP addresses for those interfaces. In this example, the Matches all option is used to filter results for only computers with all IP addresses matching the specified string. You can specify this option only in the from clause. The syntax is with all sensor contains value.
The following examples shows how to specify multiple advanced sensor options.
In Tanium Server 7.3.314.3639 and later, you can enable a Force Computer ID setting to convert a counting question into a non-counting question by forcing Tanium Clients to include the computer ID in their answers. Converting to a non-counting question is a workaround that resolves cases where a counting question returns the too many results answer. For details, see the KB article Troubleshooting Errors / Informational Messages (too many results message). You can enable the setting in the Ask a Question field by using the get?forceComputerIdFlag=1 statement. You can also enable the setting in the Question Builder, under Advanced Question Options. The following figure shows the results for a question converted to a non-counting question.
The following figure shows the results for the same question issued as a counting question.
Last updated: 4/2/2020 7:12 PM | Feedback