Example: Multi-column sensors
Multi-column sensors collect multiple pieces of related data in a single answer.
Registry Key Value Names with Data is an example of a Tanium-provided multi-column sensor. For the registry key that you specify, the sensor returns the User (if User hive), Key path, Value, Data, Data Type, and OS architecture type.

Script
The script must add a delimiter between each property as it writes to the standard output channel. The delimiter in the script must match the delimiter specified in the settings.

Settings
For multi-column sensors, when you configure sensor settings, select Split into multiple columns using delimiter, specify a string separator (a pipe is common), and use the controls to specify the columns. Note that when creating questions that filter multi-column sensors, single-column filtering works only if the sensor definition specifies column delimiters with a single character (such as "|"), not multiple characters (such as "|:").

Last updated: 2/11/2021 3:37 PM | Feedback