Other versions

Saving questions

In the Tanium™ Console, when you click a saved question, the question is issued to Tanium Clients. Saving the question syntax as a configuration object enables it to be reissued later. The configuration object can also be used throughout the platform, both by Tanium™ solution modules and by user-developed applications that use the SOAP API. For example, you can use Tanium™ Connect to configure a saved question to be run on a schedule with results sent to an external server.

Create a saved question

  1. Use the Question bar to ask a dynamic question.
  2. Click Save this question directly under the Question bar.
  3. Interact displays the New Saved Question form.

  4. Complete the settings described in the following table.
  5. Settings Guidelines
    Name Specify a configuration name. The name appears in saved question lists that are incorporated into Tanium Console workflows. Observe the existing naming scheme so that you and other administrators can find it easily.
    Content Set Assign to a content set. The list is populated with all content sets for which you have Write Saved Question permission.
    • According to RBAC. Users must have the Read Saved Question permission for the content set to which the saved question belongs to see the saved question.
    • Only the Owner and Admins. Only the object owner and users with the Administrator reserved role can see the saved question.
    Reissue this question every The saved question is first issued immediately upon saving the configuration. Clients that are online at that time respond with their answers.

    You can use the "reissue" option to account for machines that are not currently online but are routinely online within predictable cycles (and even unpredictable times). For example, employee laptops might be offline the moment you save the saved question configuration, but you think you are likely to find them online at least once if you were to check every 8 hours.

    When reissue is selected, the saved question is reissued in the background at the interval you specify. For example, if you save the saved question configuration at 9:00 a.m. local time and specify a reissue interval of every 8 hours, the Tanium Server reissues the saved question at 5:00 p.m., 1:00 a.m., 9:00 a.m., and so on. The results are archived. This improves the data quality of "recent" responses displayed in the results grid for machines that are not online when you use Interact to issue the question.

    You can use the Question History to verify that the saved questions are sent according to the reissue interval you have configured.

    Specify a number and unit for the reissue interval: Minutes, Hours, Days.

    Note: If you specify a reissue interval of 8 hours, the system reissues the saved question exactly every 8 hours, regardless of time changes due to daylight savings time.

    Default preferences This option is displayed for users with the Administrator or Content Administrator roles only. The purpose is to enable an advanced user to curate the configuration for other users. Defaults are commonly understood as good choices. When this option is selected, the administrator's choices populate the initial defaults shown for subsequent users.

    The subsequent users are free to modify the settings. When a non-admin user modifies the settings, their choices are preserved and will persist even when another administrator subsequently changes the default preferences.

    Note: When an Administrator or Content Administrator makes changes, it does change the settings for all other Administrator or Content Administrator users. This design forces administrators to be on the same page regarding the best default settings.

    Make this question available for drilldown Include in the Select Drilldown Question dialog box Saved Questions tab.
    Non-Counting Question / Counting Question Specify whether to turn the question into a non-counting question.

    Non-counting questions have a larger data footprint because the Tanium Server maintains data per computer ID. However, this makes it possible to store recent data for the endpoint, and it enables the question to be available for merging.

    The non-counting question option is displayed when the question is a counting question that has exactly one sensor in the select clause. The non-counting question option can be configured only in the New Saved Question form, not the Edit Saved Question form.

    The Allow for merging option is available if the question is converted to a non-counting question.

    The Enable collection and reporting of recent data option can be configured only in the New Saved Question form, not the Edit Saved Question form.

    Default Tab Specify a default tab: Question, Grid, Pie.

    The Default Tab setting is saved as a user preference unless the Use these as the default for all users setting is selected.

    Default Grid Chart Zoom Specify a data period for the initial results grid display: Current or Recent.

    Associated Actions Optional. Click Add Package and select a package you want to be the default when a user clicks the Deploy Action button from the results grid.
  6. Click Preview to preview the results you will get when you use the saved question.
  7. Click Create Saved Question.

Your question will be issued and results displayed in the results grid. Depending on the settings you configured, the saved question may appear in saved question lists that are incorporated into Tanium Console workflows.

When you save a question that has a parameterized sensor, the sensor definition, including the substituted values, is saved in an object called a temp sensor. On the endpoint, the Tanium™ Client runs the temp sensor when it computes answers to a saved question that calls it. A saved question that is reissued according to a schedule continues to use the temp sensor even if the sensor from which it was based is updated. Therefore, if a sensor is updated, and you want the saved question to use the updated code, you must re-create the saved question.

About the saved question configuration

The Tanium Server maintains a copy of the saved question configuration for each user who has saved the configuration. For example:

  1. admin01 creates a saved question.
  2. user01 edits it and saves a copy.
  3. user02 edits it and saves a copy.
  4. user03 does not edit the saved question but has permission to read or edit it.

Tanium Server now has three copies—one for each user who has saved it. The per-user settings are saved in the system as metadata for the saved question configuration.

The different preferences user01 or user02 may have with respect to a saved question are applied when the user logs in. For example, if user01 settings allow the question to be included in merge operations and user02 settings do not, those differences are applied, and the users have different experiences. user03, not having saved the configuration, is subject to the admin01 settings.

When the reissue option is set, the question is issued at the interval specified by each user configuration. However, if multiple users have essentially the same management computer group rights, the Tanium Server throttles the redundant traffic. For example, if user01 and user02 both have access to the All Computers computer group and set a reissue interval every 4 hours, the Tanium Server will reissue the question only once every 4 hours, not once for each user. However, if user01 has access to only the computer group A, and user02 has access only to computer group B, the Tanium Server will reissue the question according to each user's requirements.

Last updated: 11/8/2018 1:03 PM | Feedback