Reference: Advanced question syntax
Use reserved words or characters
Reserved words or characters in question text
The Tanium™ parser uses certain words and characters to interpret the question text that you enter as valid query syntax. For example, the parser uses the bracket characters [ and ] to enclose the values of parameterized sensors and uses variations of the word match to support regular expressions. You must enclose these reserved words and characters in quotation marks when you use them as string literals in questions. For example, to see all endpoints that have computer names containing the letter combination in, issue the question Get Computer Name from all machines with Computer Name contains "in".
View characters that require quotation marks in questions
View words that require quotation marks in questions
Reserved words in sensor names
Sensors with names that use reserved words require quotation marks when you use them as string literals in the Interact Ask a QuestionExplore Data field. Otherwise, the dropdown list that displays suggested questions cannot accurately match your entry. For example, if you enter the Running Processes with MD5 Hash sensor without quotation marks, the dropdown list displays suggestions that confuse your entry with other sensors that contain the words MD5 Hash:
If you use quotation marks around the sensor name, the dropdown list displays the correct question:
View reserved words in sensor names
Use regular expression filters
The question parser supports regular expression matching based on Boost syntax. The following example matches computer names that begin with the letter q in the tanium.com domain.
The Detect Primary Alerts sensor uses a regular expression to collect results that match any digit in the range 0 to 9. Because alerts have numeric IDs, this expression excludes empty results.
You can also use a combination of negation and regular expressions to build filter expressions. For example, the predefined computer group No Computers uses a question with the not matches expression and a regular expression (.*) to match empty results. Because the Computer Name sensor always returns a string, this combination provides a way to prevent action deployment. To stop
Use computer group filters
You can issue questions that specify a computer group in the from clause. Use quotation marks around the computer group name. The computer group can be a management group or filter group. For details about these types, see Managing computer groups.
For computer groups with filter-defined membership, the question parser converts the specified computer group name into the question that determines membership.
Use sensor column filters
Multi-column sensors are designed to collect multiple pieces of related information in a single answer.
Using the regular expression starts with, ends with, or contains to filter results for a multi-column sensor, such as Installed Applications, can be tricky because the result string for a multi-column sensor is actually a single string with column delimiters. If you are not careful, you might match a string in an unexpected column or unknowingly match a string in a hidden column. For a multi-column sensor, you can specify a particular column for results matching. The syntax is get <sensor> having <sensor>:<column> contains <value>. The column name is case sensitive. Note that single-column filtering works only if the sensor configuration specifies column delimiters (Split into multiple columns field) with a single character (such as |), not multiple characters (such as |:). To match results from all the columns, the syntax is get <sensor> contains <value>.
The following example uses a sensor column filter in the get clause.
The following example uses a sensor column filter in both the get clause and the from clause.
Use $substring() filters
You can use $substring() filters to match result string patterns. The $substring() function takes the following arguments: sensor name, starting position (where 0 is the first position), number of characters.
The following example matches results from the Installed Applications sensor where the first two characters match the string Go.
You cannot use the $substring() filter with multi-column sensors.
Use the in operator for filtering
You can use the in operator to specify a collection of matching sensor results. The operator takes a comma-separated list of arguments that is parsed into a Boolean OR.
The following example uses the in operator to match a sensor filter in the from clause with results containing Virtual or Physical.
The following example uses the in operator to match a sensor column filter in the from clause. The question syntax is:
Get Computer Name and Installed Applications having Installed Applications:Name contains Adobe Reader from all machines with Installed Applications:Name contains Adobe Reader and Installed Applications:Version in(9.5.0,11.0.06)
Use nested filters
In the from clause of a question, you can configure multiple filters, including nested filters.
The following example shows nested filters in the Question Builder. The example combines one matching expression with either one of the nested expressions.
You can also specify nested filters in the Ask a QuestionExplore Data field.
The following example shows different Boolean logic: match both of these OR this one.
Target random endpoints
Use the Online Random Sample sensor to identify a random subset of online endpoints from all targeted endpoints. You might want to target random endpoints when you test a new package or configuration on a random subset of endpoints, or to check a random set of endpoints to ensure they have proper configurations prior to an audit. The Online Random Sample sensor is included in the Default Content pack.
The Online Random Sample sensor retrieves True and False results from all targeted endpoints. The sensor accepts a Sample % parameter from 0-100 to determine the rough percentage of endpoints that answer with True. For example, if you pass 25 as a parameter and target from all machines, approximately 25% of endpoints in the environment will return a True response. Because each endpoint evaluates the sensor and generates a random True or False answer according to the percentage that you specify, the number of endpoints that return True can vary. The default value for Sample % is 5.
Use advanced sensor options
Question results from Tanium Clients must conform with any advanced options that you specify for sensors in the question. You can configure advanced sensor options in the Question Builder (see Figure 17) or in the Ask a QuestionExplore Data field (see the examples after Table 1).
The following table describes the advanced sensor options:
| Option | Guidelines |
|---|---|
| Case Sensitivity | Select whether Interact factors in upper-case and lower-case characters when grouping and counting question results:
|
| Matching | This option is available only in the from computers with section of the Question Builder, which corresponds to the from clause of a question in the Ask a QuestionExplore Data field.
A Tanium Client might compute multiple results for certain sensors. For example, a client that has multiple interfaces returns multiple results for the IP Address sensor. You can use the Matching option as a filter such that a client answers the question only if its results conform to your selection:
See Example: Matching. |
| Treat Data As | Interact treats sensor values as the type of data that you specify. For a descriptions of the data types, see Result Type. For an example, see Example: Treat data as type. |
| Maximum Data Age |
Specify the maximum time for which the Tanium Client can use a cached result for the sensor, instead of reexecuting it for a fresh result, when answering questions. For example, you might specify 15 minutes for the File Size sensor. When a client receives a question that executes the File Size sensor, it caches the result. Over the next 15 minutes, if the client receives another question with the File Size sensor, it returns the cached result. After 15 minutes, if the client receives a question with the File Size sensor, it reexecutes the sensor script to return a fresh result. For an example, see Example: Maximum Data Age. To improve the accuracy of results, use shorter ages for sensors with values that change frequently, such as status and utilization sensors. To reduce unnecessary CPU usage on endpoints, use longer ages for sensors with values that typically do not change frequently, such as the chassis type or Active Directory domain membership. If you omit the Maximum Data Age, the Max Sensor Age setting in the sensor configuration determines the maximum time for cached results. See Max Sensor Age. Specify a Maximum Data Age only when issuing dynamic questions, not when creating saved questions or configuring endpoint membership in computer management groups and filter groups. Setting a Maximum Data Age that is lower than the Max Sensor Age increases CPU usage on endpoints. |
The following examples describe how to enter advanced sensor options in the Ask a QuestionExplore Data field using the syntax <sensor>?<option>=<value>.
Example: Treat data as type
The syntax for filtering by data type is <sensor>?type=<type>. The following example specifies Numeric as the type.
The File Size data type in the Question Builder corresponds to the DataSize type in the Ask a QuestionExplore Data field, where the syntax is <sensor>?type=DataSize. The following example returns results from endpoints where the installation folder of the Tanium Client is at least 10 GB.
Use the Treat Data as <type> option only with comparison operators, such as Free Memory > 300.
Example: Maximum Data Age
The syntax for setting the Maximum Data Age for cached results is <sensor>?maxAge=<value>. In the Question Builder, you can specify the age units (minutes, hours, days). In the Ask a QuestionExplore Data field, the age is always in seconds. The following example specifies a maximum age of 3600 seconds.
Example: Case Sensitivity
The Case Sensitivity option in the Question Builder corresponds to the ignoreCase option in the Ask a QuestionExplore Data field, where the syntax is <sensor>?ignoreCase=[0|1]. The value 0 means match the case and the value 1 means ignore the case for sensor results with letters. The following example specifies the Case Sensitivity option with a value set to Ignore Case.
Example: Matching
This Matching option applies only in the from clause of a question. The syntax for matching all or any results for a sensor is with [all] <sensor> contains <value>, where omitting the all option specifies Match Any Value. In the following example, the Matching option is set to Match All Values (with all) for the IP Address sensor. This example addresses a case where each endpoint might have multiple interfaces and you want to return results only from endpoints on which all the interfaces have an IP address that contains the string 192.
Example: Multiple options
To specify multiple advanced options for a sensor, separate each option with an ampersand &. The syntax is <sensor>?<option 1>=<value>&<option 2>=<value>...&<option N>=<value>. The following example shows a question with two options for the Installed Applications sensor:
Use advanced question options
Enable the Force Computer ID option to convert a single-sensor, counting question into a non-counting question by forcing Tanium Clients to include the computer ID in their answers. Note that the Question Results page does not include the computer ID results when you select this option. Converting to a non-counting question is a workaround that resolves cases where a counting question returns the too many results answer. For details, see Enable or disable live updates. You can enable the option in the Ask a QuestionExplore Data field by using the Get?forceComputerIdFlag=1 statement. You can also enable the option in the Question Builder, under Advanced Question Options.
Last updated: 10/3/2022 3:11 PM | Feedback