Managing question and sensor thresholds

Overview

The time that a Tanium Client takes to run a question varies widely, based on which sensors, and how many, the question invokes. To assess the impact that running Tanium questions has on endpoint resources, you can customize the question and sensor runtime thresholds that trigger indicator icons in the Tanium Console.

The Tanium Client tracks the runtime for each sensor when a question runs it, calculates the average of all the past runtimes for that sensor, and sends the updated runtime information to the Tanium Server every three hours. The Tanium Server calculates the average runtime based on the latest updates from all the endpoints that reported runtimes for the sensor.

The following table lists describes the threshold icons and their default labels and values.

Table 1:   Question and sensor runtime threshold icons
Threshold icon Description
Not Run The Tanium Server has not yet received runtime information from any endpoints for this sensor.

This icon also displays for built-in sensors regardless of their runtimes. The Tanium Server does not record runtime statistics for built-in sensors, and does not account for those sensors when calculating runtimes for questions that use them. The built-in sensors are:

  • Action Statuses
  • Download Statuses
  • Computer Name
  • Computer ID
  • Manual Group Membership
  • IP Address
Below any threshold The runtime average for a question or sensor does not exceed any threshold.
Low The runtime average exceeds the Low threshold but does not exceed the Medium threshold. By default, the Low threshold is 100 ms for a sensor and 1,000 ms for a question. You can customize the threshold and the label.
Medium The runtime average exceeds the Medium threshold but does not exceed the High threshold. By default, the Medium threshold is 500 ms for a sensor and 5,000 ms for a question. You can customize the threshold and the label.
High The runtime average exceeds the High threshold, which by default is 1,000 ms for a sensor and 10,000 ms for a question. You can customize the threshold and the label.

When viewing threshold indicators, note the following caveats:

  • The Tanium Server does not use cached responses to questions when calculating runtime averages.
  • Sensors that require data sampling are more likely to exceed runtime thresholds. However, the longer runtimes required for sampling do not necessarily indicate high resource usage when endpoints run these sensors. Consult your TAM for details. The affected sensors include:
    • CPU by Process
    • CPU Consumption
    • Disk IOPS
    • High CPU Consumption
    • High CPU Processes
    • Network Throughput Inbound
    • Network Throughput Outbound
    • SQL Server CPU Consumption
    • Tanium Client CPU

User role requirements

Your user account requires the Administrator reserved role to see and use the Configuration pages, including the Sensor Thresholds page.

Before you begin

Work with your technical account manager (TAM) to determine the runtime thresholds that you expect will influence administrator decisions about whether to run a question, how often to run it, and which sensors to include in the question. The goal is to plan questions in a way that does not interfere with other, more critical tasks that endpoints perform. The factors to consider are:

  • The runtime for any question is the cumulative total of the average runtimes for all the sensors it includes. Therefore, the best practice is to set question thresholds higher than sensor thresholds.
  • The best practice is to set thresholds that reflect decisions Tanium administrators must make, based on the endpoint management policies of your organization. For example, policies might dictate that administrators must never run a question that takes longer than 10 seconds during peak traffic times on endpoints that perform tasks with a higher priority than responding to questions.

Configure question and sensor thresholds

The Tanium Console displays threshold indicators by default. However, you can change the default thresholds as follows.

  1. Go to Configuration > Common > Sensor Thresholds.
  2. Select whether you want the Tanium Console to Display thresholds to only those Tanium users with predefined administrative roles (Admin) or to all users who are allowed to see questions and sensors (Admin and Users).
  3. Enter a label for each threshold or accept the defaults: High, Medium, and Low.
  4. Set the average runtime (in milliseconds) for each threshold or accept the defaults.
  5. Save your changes.

Verify question and sensor thresholds

Threshold indicator icons appear wherever you view and select questions or sensors in the Tanium Console. After modifying threshold values, verify that the Tanium Server applied your changes.

The Content > Sensors page displays runtime statistics for all sensors.

  1. Go to Interact.
  2. In the Ask a Question field, type a question that uses a sensor expected to have a short runtime, such as Computer Name, and a sensor expected to have a long runtime, such as Running Processes of User. For example: Get Computer Name and Running Processes Of User[admin] from all machines. Press Enter to display a list of suggested questions.
  3. Verify that the list of suggested questions displays the expected threshold icons. If you see unexpected indicators, review the icon descriptions and caveats described in Overview.
  4. Hover over the icon for the suggested question that you want, and verify that the popup displays the expected runtime (in milliseconds) for the question and the expected threshold icons for its individual sensors.

Last updated: 3/15/2019 3:19 PM | Feedback