Managing and creating sensors

Overview

A sensor configuration includes settings, script content, and script parameters. Sensors use familiar, industry-standard scripting languages rather than arcane, proprietary coding syntax. The best practice is for sensors to use the scripting engine available on the largest number of managed endpoints. On Windows endpoints, VBScript typically provides the most comprehensive out-of-the-box coverage because it is installed by default in every desktop release of Microsoft Windows since Windows 98 and in Windows Server since Windows NT 4.0 Option Pack. On macOS and Linux endpoints, shell script generally provides the most comprehensive out-of-the-box coverage. Of course, you can develop sensors using any other scripting language that the operating system supports (such as PowerShell on Windows), as long as the associated scripting engine already exists on the endpoint, or you can deploy and configure the engine on the endpoints that do not have it installed.

You cannot edit the configurations of Tanium reserved sensors, which are core system sensors that include Computer Name, Action Statuses, Computer ID, and Download Statuses.

Use the Content > Sensors page to view, add, edit, or delete sensor configurations. To help you assess the impact that sensors have on endpoint resources, the top of the page displays Sensor Runtime Metrics. For each runtime threshold, the metrics indicate the number of sensors that exceeded it, the average runtime for those sensors, and the maximum runtime for any of those sensors. The Overall metrics indicate the average and fastest runtimes among all the sensors. You can click the metrics to filter the grid based on sensors that exceeded the High, Medium, or Low runtime thresholds. For details and tasks related to runtime thresholds and indicators, see Managing question and sensor thresholds. You can also use the text field above the grid to filter by sensor name or use the Filter Results options to filter by Runtime thresholds, Content Set, Category (such as module, tags, or SQL), and user (Modified by).

User role requirements

To create, modify, or delete sensor configurations, your user account requires a role with the Write Sensor permission. Users with the Administrator or Content Administrator reserved roles have this permission.

Edit a sensor

As a best practice, do not edit predefined sensors that are provided through content packs imported from Tanium (for details, see Tip 4: Limit customizations to Tanium content). Consult your Technical Account Manager (TAM) if editing the Tanium-provided sensors is necessary. Alternatively, you can clone Tanium-provided sensors (see Clone a sensor) and edit the copies. You can also edit custom sensors that you created from scratch. To edit a sensor:

  1. Go to Content > Sensors.
  2. Use the search and column sorting features to find the sensor that you want to edit.
  3. Select the sensor row, click Edit, and configure the settings as described in Table 1.
  4. Save your changes.

Clone a sensor

Cloning is useful when you need to:

  • Create a modified version of a predefined sensor from a Tanium content pack. As a best practice, do not modify the original Tanium sensor.
  • Create a new sensor with settings that differ only slightly from an existing sensor; this is often easier than creating a new sensor from scratch.

To clone a sensor:

  1. Go to Content > Sensors.
  2. Use the search and column sorting features to find the sensor that you want to clone.
  3. Select the sensor row, click Clone, and configure the settings as described in Table 1.
  4. Save your changes.

Create a sensor

  1. Go to Content > Sensors.
  2. Click New Sensor and complete the configuration as described in Table 1.
  3. Save the configuration.
Table 1:   Sensor configuration guidelines
Settings Guidelines
Name Specify a configuration name. The name appears in sensors lists that are incorporated into Tanium Console workflows. Observe the existing naming scheme so that you and other administrators can find it easily. Do not use an underscore character (_), which is a delimiter for sensor subcolumns. If the sensor name has an underscore, sensor-sourced packages cannot use the sensor as a sensor variable.

Important: If you change the sensor name, be sure to reconfigure content that references it. For example, you must update the sensor name in any saved questions that are configured with the previous name.

Description Enter a description. Include examples of formatted results. The description appears in the Sensors page and in the Browse Sensors dialog box of the Question Builder.
Content Set Assign to a content set. The list is populated with all content sets for which you have Write Sensor permission.
Category Specify one of the categories that appears on the Sensors page and in the Browse Sensors dialog box of the Question Builder.
Result Type The Question Results grid treats values that the sensor returns as the type of data you specify:
  • Date/Time (RFC822)
  • Date/Time (WMI)
  • File Size
  • Integer
  • IP Address
  • Numeric
  • Text
  • Time Duration
  • Version
Max Age Maximum time for which the Tanium Client can use a cached result to answer a question. For example, the maximum data age for the File Size sensor is 15 minutes by default. When a Tanium Client is asked a question that executes the File Size sensor, it caches the result. Over the next 15 minutes, if the Tanium Client is asked a question that includes the File Size sensor, it responds with the cached answer. After 15 minutes, if the Tanium Client is asked a question that includes the File Size sensor, it executes the sensor script again to compute a fresh answer.

Use shorter ages for sensors that return values that change frequently, such as status and utilization sensors. Use longer ages for values that typically change infrequently, such as the chassis type or Active Directory domain membership.

Ignore case in result values Group and count result values regardless of differences in upper-case and lower-case characters.
Hide this sensor from sensor lists and parse results Select this option if you want sensor lists throughout the user interface to exclude the object.
Split into multiple columns using delimiter (Multicolumn sensors only) If the sensor script returns multiple results, display them in multiple columns on the Question Results grid. Specify the delimiter character used to separate result values in the script. Enter column names and corresponding result types, and arrange them in the order you want them displayed in the results grid. Select the Hide option to hide the column from the default view of the results grid. Note that when creating questions that filter multi-column sensors, single-column filtering works only if the sensor definition specifies column delimiters with a single character (such as "|"), not multiple characters (such as "|:").
Scripts For each target platform:
  1. Click + to add a target platform.
  2. Set the Query Type to the desired scripting engine.
  3. Paste in script text.
Parameter Inputs (Parameterized sensors only) Click + and then Add Parameter to configure a parameter. Options include:
  • Checkbox—User enables a setting by checking a box. 0 or 1 is entered into the variable. Returns 1 if checked and 0 if not checked.
  • Date, Date Time, Date Time Range—User selects a date and time or a range. The date time format is epoch with milliseconds. For a range, the user specifies two date times separated by a pipe.
  • Drop Down List—User selects only one option from a list.
  • List—User selects one or more values. Multiple values are separated by a pipe.
  • Numeric—User enters a number. The input can be controlled with minimum and maximums. You can specify a Step Size to require that the input be divisible by the specified value. Snap Interval is the amount that a number is increased or decreased by pressing the up or down button respectively. The value for Step Size should be a multiple of the value for Snap Interval unless Snap Interval is 0. The user-selected number is entered into the variable.
  • Numeric Interval—User selects a number and an item from a list. The list item has a numeric value. The value entered into the variable is the result of the multiplication. For example, if a user selects 2 and selects High (with high having a value of 3), the value is 6 in the variable.
  • Plugin—Not intended for use by most users. Contact your TAM for additional information about its use.
  • Separator—A separator is a graphical way to separate sections in the user input form.
  • Text Area—User enters a large amount of text. The text is entered into the variable.
  • Text Input—User enters text input. Allowed entries can be controlled with regular expressions. The user input is entered into the variable.
  • Time—User selects a time from a drop-down list. The input can be subject to restrictions.
Sensor Preview Select a computer group or click Add to build one and then click Preview to see test results for the sensor.

Import/export a sensor configuration

As a best practice, develop and test content in your lab environment before distributing it to your production servers. The Tanium Console import/export XML feature supports this practice.

User role requirements

Users can export specific sensors for which they have Write Sensor permission. Users with the Administrator or Content Administrator reserved role can export and import the complete sensors configuration.

Export specific sensors

  1. Go to Content > Sensors.
  2. Select one or more sensors and click Export in the toolbar above the table header.
  3. Enter a File Name or accept the default, and then click OK. The Tanium Server exports the XML file to the Downloads folder on the system you use to access the Tanium Console.

Export the complete sensors configuration

  1. Go to Content > Sensors and click Export All in the table header.

    Alternatively, or if you want to export other configuration objects in addition to sensors, go to any Content or Permissions page, click Export to XML in the top right of the Tanium Console, select Sensors and any other object types, and click Export.

  2. Enter a File Name or accept the default, and then click OK. The Tanium Server exports the XML file to the Downloads folder on the system you use to access the Tanium Console.

Import a sensors configuration

  1. Use KeyUtility.exe to sign the XML configuration file before you import it. As a one-time action, you must also copy the associated public key to the correct folder. For the procedures, see Signing content XML files.
  2. From any Content or Permissions page, click Import from XML at the top right of the Tanium Console.
  3. Click Choose File, find and select the configuration file, and click Open.
  4. Click Import. If object names in the file are the same as for existing objects, the Tanium Console itemizes the conflicts and provides resolution options for each one.
  5. Select resolutions for any conflicts. For guidance, see Conflicts and Best practices or consult your TAM.
  6. Click Import again, and click Close when the import finishes.

Manage sensor quarantines

Tanium Clients stop and quarantine a sensor if its runtime exceeds the non-configurable one-minute timeout. If you enable quarantine enforcement, the quarantined sensors cannot run again for subsequent questions. If you disable enforcement, clients still assign quarantine status and log quarantine events, but only to indicate which sensors timed out at least once. For details, and the procedures to view, add, remove, enable, and disable sensor quarantines, see Tanium Client Deployment Guide: Manage sensor quarantines.

Last updated: 6/4/2019 4:33 PM | Feedback