Other versions

Managing and creating sensors

A sensor configuration includes settings, script content, and script parameters.

Overview

Sensors use familiar, industry-standard scripting languages rather than arcane, proprietary coding syntax. Ideally, a sensor should use the scripting engine available on the largest number of devices under management.

For computers running a Microsoft Windows operating system, VBScript typically provides the most comprehensive "out-of-the-box" coverage since it has been installed by default in every desktop release of Microsoft Windows since Windows 98 and in Windows Server since Windows NT 4.0 Option Pack. Of course, any other scripting language that the Microsoft Windows operating system supports, such as PowerShell, can also be used to develop sensors, as long as the respective scripting engine already exists or can be deployed and configured on the systems that do not have it already installed.

For computers running macOS or a Linux operating system, shell script generally provides the most comprehensive "out-of-the-box" coverage. Again, sensors can be developed using any macOS or Linux supported scripting languages as long as the respective scripting engine already exists or can be deployed and configured on the systems that do not have it already installed.

Some sensor configuration objects cannot be edited. A Tanium "reserved sensor" is a core system sensor, and its code is not meant to be edited by end-users. Reserved sensors include Computer Name, Action Statuses, Computer ID, and Download Statuses.

Role requirements

You must be assigned a role with the Write Sensor permission to create, modify, or delete sensor configurations. Users assigned the Administrator or Content Administrator reserved roles have this permission.

Edit a sensor

  1. Go to Authoring > Sensors.
  2. Use the search and column sorting features to find the sensor you want to edit.
  3. Click the sensor row to select it.
  4. Click Edit and complete the configuration as described in Table 1.
  5. Save your changes.

Create a sensor

  1. Go to Authoring > Sensors.
  2. Click New Sensor and complete the configuration as described in Table 1.
  3. Save the configuration.
Table 1:   Sensor configuration guidelines
Settings Guidelines
Name Specify a configuration name. The name appears in sensors lists that are incorporated into Tanium™ Console workflows. Observe the existing naming scheme so that you and other administrators can find it easily.

Do not use an underscore character (_) in the sensor name. The underscore is a delimiter for sensor subcolumns. If the sensor name has an underscore, the sensor cannot be used as a sensor variable in sensor-sourced packages.

Important: If you change the name, be sure to reconfigure content that references it. For example, if you change the name of a sensor, be sure to change it in any saved questions that were configured with the previous name.

Description Enter a description. Include examples of formatted results. The description appears in the Sensors page and in the Browse Sensors dialog box of the Question Builder.
Content Set Assign to a content set. The list is populated with all content sets for which you have Write Sensor permission.
Category Specify one of the categories that appears on the Sensors page and in the Browse Sensors dialog box of the Question Builder.
Result Type In the results grid, values returned by the sensor are treated as the type of data you specify:
  • Date/Time (RFC822)
  • Date/Time (WMI)
  • File Size
  • Integer
  • IP Address
  • Numeric
  • Text
  • Time Duration
  • Version
Max Age Maximum time the Tanium Client may use a cached result to answer a question. For example, by default, the maximum data age for the File Size sensor is 15 minutes. When a Tanium Client is asked a question that executes the File Size sensor, it caches the result. Over the next 15 minutes, if the Tanium Client is asked a question that includes the File Size sensor, it responds with the cached answer. After 15 minutes, if the Tanium Client is asked a question that includes the File Size sensor, it executes the sensor script again to compute a fresh answer.

Use shorter ages for sensors that return values subject to change frequently, such as status and utilization sensors. Use longer ages for values that typically change infrequently, such as the chassis type or Active Directory Domain membership.

Ignore case in result values Group and count result values regardless of differences in upper-case and lower-case characters.
Exclude result values when parsing questions By default, the Tanium Server archives the unique result values gathered from Tanium Clients in response to a sensor. The natural language parser uses these results to determine the most likely sensor to return a particular value when an Interact user enters a result value as part of a question rather than using a sensor name.

Enabling this option improves overall performance of the question parser.

Hide this sensor from sensor lists and parse results Select this option if you do not want the object to appear in sensor lists throughout the user interface.
Split into multiple columns using delimiter For multicolumn sensors only.

If the sensor script returns multiple results, display them in multiple columns on the results grid. Specify the delimiter character used to separate result values in the script. Enter column names and corresponding result types, and arrange them in the order you want them displayed in the results grid. Select the Hide option to hide the column from the default view of the results grid.

Scripts For each target platform:
  1. Select (+) to add a target platform.
  2. Select a corresponding scripting engine from the Query Type list box.
  3. Paste in script text.
Parameter Inputs For parameterized sensors only.

Click the + and then select from the Add Parameter drop-down list to configure parameters. Options include:

  • Checkbox—User enables a setting by checking a box. 0 or 1 is entered into the variable. Returns 1 if checked and 0 if not checked.
  • Date, Date Time, Date Time Range—User selects a date and time or a range. The date time format is epoch with milliseconds. For a range, the user specifies two date times separated by a pipe.
  • Drop Down List—User selects only one option from a list.
  • List—User selects one or more values. Multiple values are separated by a pipe.
  • Numeric—User enters a number. The input can be controlled with minimum and maximums. You can specify a Step Size to require that the input be divisible by the specified value. Snap Interval is the amount that a number is increased or decreased by pressing the up or down button respectively. The value for Step Size should be a multiple of the value for Snap Interval unless Snap Interval is 0. The user-selected number is entered into the variable.
  • Numeric Interval—User selects a number and an item from a list. The list item has a numeric value. The value entered into the variable is the result of the multiplication. For example, if a user selects 2 and selects High (with high having a value of 3), the value is 6 in the variable.
  • Plugin—Not intended for use by most users. Contact your TAM for additional information about its use.
  • Separator—A separator is a graphical way to separate sections in the user input form.
  • Text Area—User enters a large amount of text. The text is entered into the variable.
  • Text Input—User enters text input. Allowed entries can be controlled with regular expressions. The user input is entered into the variable.
  • Time—User selects a time from a drop-down list. The input can be subject to restrictions.
Sensor Preview Select a computer group or click Add to build one and then click Preview to see test results for the sensor.

Import/export a sensor configuration

We recommend that you develop and test content in your lab environment before distributing it to your production servers. The console import/export XML feature supports this practice.

Role requirements

Users can export specific sensors for which they have Write Sensor permission. Users with the Administrator or Content Administrator reserved role can export and import the complete sensors configuration.

Export specific sensors

  1. Go to Authoring > Sensors.
  2. Select one or more sensors and click the Export icon.
  3. Enter a file name or use the default and click OK.

Export the complete sensors configuration

  1. From any Authoring page, click the Export to XML link on the top right.
  2. In the Export Content selection box, select the Sensors item and click Export.
  3. Enter a file name or use the default and click OK.

Import a sensors configuration

  1. From any Authoring page, click the Import from XML link on the top right.
  2. Browse to the configuration file and click Import.

    If you are unsure how to handle naming conflicts, see Conflicts and Best practices or consult with your TAM.

You must use KeyUtility.exe to sign XML files before you import them. You must also copy the public key for the key that signed the XML file to the Tanium Server keys folder. When you import content, the Tanium Server verifies the signature on the imported content against its store of content signing key files. See Signing content XML files.

Last updated: 7/31/2018 5:03 PM | Feedback