Sensor-sourced packages are designed like parameterized packages, but take sensor output instead of user input as run-time arguments. The command syntax requires a sensor result that is passed from the Interact Question Results grid when you initiate the action deployment workflow. For example, Start Service - || Stopped Service || is a Tanium-provided sensor-sourced package. You can issue a question with the Stopped Service sensor to find endpoints that have stopped services and then deploy an action with the Start Service - || Stopped Service || package to start the services.
On the Action Deployment
In the Targeting Criteria section of the Action Deployment
In the startservice.vbs script, the value passed to strService must be UTF-8-decoded, just as if it were a parameterized package that took user input: see Package script and command-line parameters.
When you configure a sensor-sourced package (see Create a package), add the sensor in the Command field: click Add sensor variable, select a sensor, and click Confirm.
When you configure a sensor-sourced package (see Create a package), specify the name of the sensor in the Command field. Enclose the name with double vertical bars (||), such as ||Stopped Service|| in the following example.
You cannot use a sensor that has an underscore character (_) in the name. The underscore is a delimiter for sensor sub-columns. If the sensor name has an underscore, it causes errors and unexpected results in sensor-sourced packages.
Last updated: 5/6/2021 4:16 PM | Feedback