Managing Tanium Data Service

Register or unregister sensors for collection

Resource consumption for registered sensors

When you decide which sensors to register with Tanium Data Service, consider that results collection consumes resources such as network bandwidth, processing on endpoints, and resources on Tanium Clouddisk space on the Tanium Server. Resource consumption increases with the cardinality of sensors. For example, the IP Address sensor produces a unique result string for each endpoint, whereas the Operating System (OS) sensor produces the same string for all endpoints that have the same OS. In this case, the high cardinality IP Address sensor requires more bandwidth, CPU usage, and storage than the Operating System sensor.

To optimize resource consumption, configure collection only for low cardinality sensors that produce frequently accessed results, such as for daily reports. For example, you might generate reports based on the results of the Applicable Patches sensor to assess the hygiene or security posture of both online and offline endpoints. Conversely, the results of the High CPU Processes sensor fluctuate too much to be reliable for gauging activity on offline endpoints.

For details on monitoring the resource consumption associated with results collection, see Monitor resource usage for sensor results collection.

Manage sensor registration

After you register or unregister sensors for collection, Tanium Data Service automatically applies the changes for the next collection, when it issues questions to update the sensor results. Additionally, after you register a sensor for collection, Tanium Cloudthe Tanium Server immediately starts collecting results for the sensor. Registration changes also apply if you manually start collection.

You cannot unregister sensors that are registered by default. See Sensors that are registered by default.

1. Go to the Interact Overview page and click Settings .
2. (Optional) Filter the Registration and Collection tab to find specific sensors. See View sensor registration details.
3. Perform one of the following actions on the Registration and Collection tab:
   • Register sensors: Select Actions > Add to register a sensor.

     The Sensor Preview page opens with a preview of the results while Tanium Data Service checks the cardinality (uniqueness) of the sensor results. For example, a sensor would have high cardinality if it returns an event date/time that typically varies on each endpoint. The Online sensor has low cardinality because it returns only one possible value (True) from all responding endpoints. After the service checks the cardinality, a message indicates if you can register the sensor or if the service blocks registration due to high cardinality. If you can register the sensor, click Confirm and then click Yes to confirm the registration.

     For each parameterized sensor, you can register multiple instances. For each instance, specify the parameters and click Apply.

     Tanium recommends that you do not disable the cardinality check because high cardinality sensors can negatively impact Tanium Server performance. Contact Tanium Support for guidance if you want to disable the cardinality check. See Contact Tanium Support.
   • Unregister sensors: Select Actions > Release to unregister a sensor.

Pause or resume collection

When Tanium Cloudthe Tanium Server issues questions to update sensor results, it excludes any paused sensors. You can pause or resume collection for individual sensors without unregistering or re-registering them. When you pause a sensor, the Question Results page, reports, and dashboards continue showing the last results (if any) that Tanium Cloudthe server collected for that sensor before you paused it. You cannot pause sensors that are registered by default.

1. Go to the Interact Overview page and click Settings .
2. (Optional) Filter the Registration and Collection tab to find specific sensors. See View sensor registration details.
3. Select Actions > Disable to pause collection or Actions > Enable to resume collection for a sensor.

After you resume collection for a sensor, Tanium Cloudthe Tanium Server immediately starts collecting the sensor results.

Manually start collection

To keep sensor results up-to-date, Tanium Cloudthe Tanium Server automatically reissues questions to all endpoints and retrieves results continuously. Tanium CloudThe Tanium Server also collects results immediately for sensors that you register or for which you resume collection.

1. Go to the Interact Overview page and click Settings .
2. In the Registration and Collection tab, click Collect Now above the grid.

Purge results for specific sensors

You can purge the results of selected sensors from storage so that the Question Results page, reports, and dashboards do not display them.

To purge sensor results that Tanium Data Service collects from specific endpoints, see Tanium Reporting User Guide: Purge endpoint data.

1. Go to the Interact Overview page and click Settings .
2. (Optional) Filter the Registration and Collection tab to find specific sensors. See View sensor registration details.
3. Unregister or pause collection for the sensors that you want to purge:
   • Pause collection: Select Actions > Disable.
   • Unregister: Select Actions > Release.
4. For each sensor that you want to purge, select Actions > Purge and click Confirm.

Configure advanced collection settings

To collect results for registered sensors, Tanium Data Service issues questions that contain the sensors. The service issues one batch of questions at a time, downloads the results from Tanium Cloudthe Tanium Server, and writes the results to the Tanium database. The default collection settings prevent the questions from consuming too much network bandwidth and endpoint processing. The default settings also prevent the service from consuming too much Tanium Server memory when downloading and writing results. You can edit the settings as necessary based on the number of sensors that you registered for collection and on the resource limits of your network, Tanium Server, and endpoints.

Contact Tanium Support before modifying the collection settings. Only users with the Administrator reserved role can modify the settings. See Contact Tanium Support.

1. Go to the Interact Overview page and click Settings .
2. Select the Service Configuration > Collection tab and configure the following settings:

    Table 0: Sensor collection process settings

   Setting	Description
   Max Sensors Per Question	Specify the maximum number of single-column sensors in each question that Tanium Data Service issues to collect results. A single-column sensor returns an answer that the Question Results page and reports display in a single column. The default is 30 sensors per question. The service applies a non-configurable limit of one multi-column sensor per question.

Configure removal of expired results

When Tanium Data Service stores results, it maps them to each endpoint and evaluates their expiration age relative to when the endpoint last returned updates. This means that if multiple endpoints returned the same results but at different times, the garbage collection process removes only the results for endpoints that did not return updates within the expiration interval (Max Endpoint Age). You can edit garbage collection settings as necessary based on the growth rate for result strings and the available resources (storage space and memory) in your deployment. To monitor string growth and determine which sensors are generating the most strings, see Monitor resource usage for sensor results collection.

Contact Tanium Support before modifying garbage collection settings. Only users with the Administrator reserved role can modify the settings. See Contact Tanium Support.

1. Go to the Interact Overview page and click Settings .
2. Select the Service Configuration > Garbage Collection tab and configure the following settings:

    Table 1: Garbage collection settings for sensor results

   Setting	Description
   Garbage Collection Interval	Specify how frequently Tanium Data Service checks which results have expired and removes them. The units are minutes and the default is 15.
   Garbage Collection Timeout	Specify how long the garbage collection process runs before timing out. The units are minutes and the default is 30. While the process is running, Tanium Data Service delays any pending updates to the stored results. Be sure to specify enough time to remove all the expired results without delaying updates to a degree that significantly affects users who need to see the latest results. If the garbage collection process times out before removing all the expired results, it resumes the removal at the next Garbage Collection Interval.
   Max Endpoint Age	Specify the expiration age of the collected results. For each endpoint, Tanium Data Service evaluates the age of its results based on when the endpoint last returned updates for any sensors. The units are days and the default is 30. The garbage collection process removes the entries for any endpoints and their associated results from storage if those endpoints have not answered sensor collection questions within the Max Endpoint Age interval.
   Computer Group Max Endpoint Age	For each computer group, you can specify the expiration age of the collected results. Use this option to set lower expiration ages than the default value of 30 daysvalue specified in Max Endpoint Age. Note that any values that you set in Computer Group Max Endpoint Age do not override the default value set in Max Endpoint Age; whichever value is lower triggers the garbage collection process. The units are hours. Click Add Group and Select Computer Group. Select a computer group and click Save. Enter the Max Endpoint Age and click Save.

To troubleshoot other sensor collection issues, see:

• Tanium Core Platform Deployment Reference Guide: Logs and troubleshooting: The Tanium Data Service logs indicate when the Tanium Server issued each question to collect results, the question ID, and information about each sensor in the question.
• Tanium Console User Guide: Question history: In the Administration > Content > Question History page, use the question ID (Harvesting qid) from the Tanium Data Service logs to find specific questions that the Tanium Server issued to collect sensor results.

Sensors that are registered by default

Certain Tanium Core Platform sensors are registered for collection by default, including the following examples. After you deploy Tanium Cloudinstall Interact, Tanium Data Service immediately begins collecting and storing results for the registered sensors. You cannot unregister, pause collection, or purge results for these sensors.

• Endpoint identifier (EID) sensors:
  • Computer ID
  • Computer Name
  • Computer Serial Number
• Sensors that define membership in computer management groups:
  • Chassis Type
  • Computer Name
  • Is AIX
  • Is Linux
  • Is Mac
  • Is Solaris
  • Is Virtual
  • Is Windows
  • Operating System
  • Operating System Generation
  • Windows OS Release ID
  • Windows OS Type