Configuring Performance

If you did not install Performance with the Apply All Tanium recommended configurations, you must enable and configure certain features.

(Tanium Core Platform 7.4.5 or later only) You can set the module action group to target the No Computers filter group by enabling restricted targeting before adding the module to your Tanium licenseimporting the module. This option enables you to control tools deployment through scheduled actions that are created during the import and that target the module action group. For example, you might want to test tools on a subset of endpoints before deploying the tools to all endpoints. In this case, you can manually deploy the tools to an action group that you configured to target only the subset. To configure an action group, see Tanium Console User Guide: Managing action groups. To enable or disable restricted targeting, see Tanium Console User Guide: Dependencies, default settings, and tools deployment.

When you import Performance with automatic configuration, the following default settings are configured:

The following default settings are configured:

Setting Default value
Action group
  • Restricted targeting disabled (default): All Windows, All Linux, and All Mac computer groups.
  • Restricted targeting enabled: No Computers computer group.
Service account The service account is set to the account that you used to import the module.
Profiles A profile is created with the default event rule configuration that targets All Computers.

Install and configure Configure Tanium Endpoint Configuration

Manage solution configurations with Tanium Endpoint Configuration

Tanium Endpoint Configuration delivers configuration information and required tools for Tanium Solutions to endpoints. Endpoint Configuration consolidates the configuration actions that traditionally accompany additional Tanium functionality and eliminates the potential for timing errors that occur between when a solution configuration is made and the time that configuration reaches an endpoint. Managing configuration in this way greatly reduces the time to install, configure, and use Tanium functionality, and improves the flexibility to target specific configurations to groups of endpoints.

Endpoint Configuration is installed as a part of Tanium Client Management. For more information, see the Tanium Client Management User Guide: Installing Client Management.

Additionally you can use Endpoint Configuration to manage configuration approval. For example, configuration changes are not deployed to endpoints until a user with approval permission approves the configuration changes in Endpoint Configuration. For more information about the roles and permissions that are required to approve configuration changes for Performance, see User role requirements.

To use Endpoint Configuration to manage approvals, you must enable configuration approvals.

  1. From the Main menu, go to Administration > Shared Services > Endpoint Configuration to open the Endpoint Configuration Overview page.
  2. Click Settings and click the Global tab.
  3. Select Enable configuration approvals, and click Save.

For more information about Endpoint Configuration, see Tanium Endpoint Configuration User Guide.

If you enabled configuration approvals, the following configuration changes must be approved in Endpoint Configuration before they deploy to endpoints:

  • Creating, updating, or deleting patch lists
  • Adding or removing enforcements
  • Removing all enforcements
  • Updating scan configuration priorities
  • Creating deployments
  • Stopping deployments
  • Adding targets to deployments
  • User-initiated actions, such as initializing endpoints, uploading custom field files, enabling Linux

Configure Performance

Configure service account

The service account is a user that runs several background processes for Performance. This user requires the following roles and access:

  • Performance Components Manage permission, which the Performance Service Account role provides. For more information, see User role requirements.
  • Access granted to the computer groups that provide input to Performance reports. For more information about assigning computer groups to a user, see Tanium Core Platform User Guide: Assign computer groups to a user.
  • If you installed Tanium Client Management, Endpoint Configuration is installed, and by default, configuration changes initiated by the module service account (such as tool deployment) require approval. You can bypass approval for module-generated configuration changes by applying the Endpoint Configuration Bypass Approval permission to this role and adding the relevant content sets. For more information, see Tanium Endpoint Configuration User Guide: User role requirements.

  1. On the Performance Overview page, click Settings and then click Service Account if needed.
  2. Provide a user name and password, and then click Set Credentials.

Add computer groups to the Performance action group

Importing the Performance module automatically creates an action group to target specific endpoints. Select the computer groups to include in the Performance action group. By default, Performance targets All Windows, All Linux, and All Mac.

Include only endpoints with operating systems that are supported by Performance in this action group.

Only endpoints that are members of the Performance action group can be targets of profiles because the necessary tools are distributed exclusively to endpoints in this action group. Metric collection begins when these tools and profiles are installed on an endpoint.

  1. From the Main menu, go to Administration > Actions > Action Groups.
  2. Click Tanium Performance.
  3. Select the computer groups that you want to include in the action group and click Save.
    If you select multiple computer groups, choose an operator (AND or OR) to combine the groups.

Configure Profiles

Profiles define performance events for specified computer groups.

  1. From the Performance menu, select Profiles.
  2. Create and prioritize profiles. For more information, see Configuring profiles.

(Optional) Install and configure Direct Connect

If you want to connect directly to endpoints to see live and historical performance data, install and configure Direct Connect.

  1. From the Main menu, go to Administration > Configuration > Solutions.
  2. In the Content section, select Direct Connect, and click Import Selected.
  3. Enter your password and click OK.
  4. Configure Direct Connect. You must configure Direct Connect before you can connect to endpoints from Performance. For more information, see Direct Connect User Guide: Import and configure Direct Connect with custom settings.

For more information about using Direct Connect with Performance, see Connecting directly to endpoints.