Asking questions

Using Tanium Interact to ask questions enables you to retrieve information from endpoints. For example, you can ask a question that determines whether any endpoints are missing critical security patches. Based on the question results that the endpoints return, you can then deploy actions, such as installing security patches. For the user roles and permissions required to ask questions, see Tanium Interact permissions.

What is a question?

A Tanium question is a query that you issue from the Tanium Server to managed endpoints. A dynamic question is one that you create and issue through the Ask a Question or Question Builder features in Interact. A saved question is a configuration object that enables you to reissue a question without retyping its text.

The Ask a Question feature is built on a natural language parser that enables you to get started with natural questions rather than a specialized query language. You do not need to enter questions as complete sentences or particularly well-formed inquiries. Word forms are not case sensitive and can even include misspellings. The parser interprets your input and suggests a number of valid queries that you can use to formalize the question that is sent to Tanium Clients. Interact provides the Ask a Question feature as a text-entry field in the Question Bar at the top of the Interact Home page and Interact Content page.

The following figure shows an example of how natural language input is parsed into proposed queries. First, the user enters the fragment last logged in user and clicks Search. In response, Interact returns a list of queries cast in valid syntax.

Figure  1:  Natural language parser

Questions have a get clause that specifies the information to retrieve and a from clause that specifies the target endpoints. Basic questions include the following:

  • One or more sensor names (such as Last Logged In User) in the get clause
  • From all machines (all endpoints that host the Tanium Client) in the from clause

Advanced questions include filter clauses and parameterized sensors.

For more information about question syntax, see Reference: Example questions and Reference: Advanced question syntax.

What is a sensor?

A sensor is a script that runs on an endpoint to compute a response to a Tanium question. The Tanium Server distributes sensors to endpoints during Tanium Client registration. Sensors enable you to ask questions that collect information such as the following:

  • Hardware and software inventory and configuration
  • Running applications and processes
  • Files and directories
  • Network connections

The installation process for the Tanium Server automatically imports Initial Content packs that include sensors for a wide range of common questions. Other Tanium solutions that you import might add more sensors, depending on which Tanium content packs or Tanium solution modules you import. If you cannot find a sensor you need within Tanium-provided content, you can create custom sensors.

For more information, see Managing sensors.

Counting and non-counting questions

A counting question is designed to return results that can be meaningfully counted. A counting question can have only one sensor. For example, Get Tanium Client Logging Level from all machines is a counting question. The sensor returns the value of the LogVerbosityLevel setting. When a managed endpoint is prompted to add its answer to the answer message, it increments the tally of the answer that its value matches. The Tanium Server maintains a table of answer strings. In many cases, like logging level, there are just a few common answers, so the question has a relatively small footprint.

Figure  2:  Counting question

A non-counting question has sensors that return unique strings. For example, Get Tanium Client IP Address from all machines returns IP addresses, which are unique. When a Tanium Client is prompted to add its answer to the answer message, it adds a new string. On the Tanium Server, the data footprint for a non-counting question can be quite large.

Figure  3:  Non-counting question

When using the Question Builder to construct a question, you have the option to convert a counting question to a non-counting question for cases where a counting question returns the too many results answer.

Questions with multiple sensors

Use the AND operator in the get clause to specify multiple sensors. The Question Results page groups results by the first sensor, then by the next sensor, and so on. The following example shows a question that uses multiple sensors.

Figure  4:  Question with multiple sensors

Questions with parameterized sensors

A parameterized sensor uses a value that you specify when entering the question in the Question Bar or Question Builder. The following example shows the File Exists sensor. The Tanium Console prompts you to specify a file path and file name.

Figure  5:  File Exists parameterized sensor

Another example is the High CPU Processes sensor. You can specify a parameter that is the number of CPU processes to return from each machine. Let's say you want to get the top 5 highest CPU utilizing processes. The question has the following syntax:

Get High CPU Process[5] from all machines

For sensors with multiple parameters, you can pass an ordered list separated by a comma. For example, if you want to see the first 10 lines from the action log for the action with ID 1, specify a parameter list as shown in the following example:

Get Tanium Action Log[1,10] from all machines

Questions with filters

You can use filters to create questions that target fewer endpoints than the default all machines. For example, the following advanced question targets only endpoints that have a specific process name or value.

The left side (get clause) is a complete and valid query; the right side contains a filter: the from all machines with expression. Filters in the from clause are the first part of a question that an endpoint processes. If the endpoint data does not match the filter, the endpoint does not process the question any further. If the question has multiple filters, the endpoint evaluates each filter. The filter expression must evaluate to a Boolean true or false. For example, the expression with Running Processes contains explore evaluates to true if the specified string matches the result string, or false if it does not. If a filter evaluates to true, the endpoint runs the sensors on the left side of the question and returns the results.

A parameterized sensor like File Exists[] returns the string File Exists: Filename or File does not exist, so be careful how you enter the sensor in a filter expression.

Figure  6:  Example: Question with parameterized sensor

The filter expression with File Exists[c:\a.txt] containing "Exists" evaluates to true when the result is File Exists: c:\a.txt and false when the result is File does not exist, so you can use it to filter the set of responses.

Figure  7:  Example: Filter with parameterized sensor

Filter expressions can match strings or regular expressions. The following table describes the supported filter operators as they appear when you use the Question Builder. The table also describes how some operators are normalized after you load them from the Question Builder or enter the expressions in the Question Bar.

Table 1:   Filter operators
Filter operator Usage
contains Sensor value contains the specified string.

Example: running processes contains "explore"

does not contain Sensor value does not contain the specified string.
starts with Sensor value starts with the specified string.

Example: starts with "explore"

does not start with Sensor value does not start with the specified string.
ends with Sensor value ends with the specified string.

Example: ends with "explore.exe"

does not end with Sensor value does not end with the specified string.
matches Sensor value matches the specified regular expression (in Boost syntax).
does not match Sensor value does not match the specified regular expression.
in Sensor value matches one of the specified strings. Use commas without spaces to separate the strings. When you load the question, the expression shown in the question bar uses equals and or operators in place of in.

Example: The filter in "10.10.10.10,10.10.10.11" in the Question Builder becomes IP Address equals 10.10.10.10 or IP Address equals 10.10.10.11 when you load the question.

is equal to Sensor value is equal to the specified value or string. When you load the question, the expression shown in the question bar uses equals in place of is equal to.
is not equal to Sensor value is not equal to the specified value or string. When you load the question, the expression shown in the question bar uses not equals in place of is not equal to.
is less than Sensor value is less than the specified value. When you load the question, the expression shown in the question bar uses a symbol (<) in place of the operator words.

Example: installed application version[chrome] < 12

is less than or equal to Sensor value is less than or equal to the specified string. When you load the question, the expression shown in the question bar uses symbols (<=) in place of the operator words.

Example: installed application version[chrome] <= 12

is greater than Sensor value is greater than the specified value. When you load the question, the expression shown in the question bar uses a symbol (>) in place of the operator words.

Example: installed application version[chrome] > 12

is greater than or equal to Sensor value is greater than or equal to the specified string. When you load the question, the expression shown in the question bar uses symbols (>=) in place of the operator words.

Example: installed application version[chrome] >= 12

See Reference: Advanced question syntax for examples of complex filter expressions, including questions with multi-column sensors.

Issue a question through the Question Bar

  1. Go to the Tanium Console home page, Interact Home page, or Interact Content page.
  2. (Interact Content page only) Open the collapsed Question Bar to display the Ask a Question field.
  3. Enter your question in the Ask a Question field at the top of the page.

    Interact uses a natural language parser to interpret your entry. The question text can be in natural English and does not require complete sentences, case sensitivity, or strictly correct spelling.

    Unless you specify a from clause in the question, Interact uses the default from all machines. This default value specifies that all managed endpoints for which you have computer group management rights will answer the question.

  4. Click Search.

    Interact displays a set of proposed questions in valid syntax, listed from top to bottom in the order of how closely they approximate your question text. For example, if you entered last logged in user, the top-most question might be Get Last Logged In User from all machines.



    If your question text includes a parameterized sensor, Interact indicates the number of parameters for each proposed question.

  5. Click a proposed question to issue it. If the question has a parameterized sensor, click Expand , enter the parameter value, and click Go to issue the question.

    The Question Results page opens to display the answers from endpoints.

For details on question syntax, see Reference: Example questions and Reference: Advanced question syntax. For details and tasks relating to question results, see Managing question results.

Issue a question through the Question Builder

The Question Builder provides a guided method for creating a question. It has form fields to help you complete the get statement and the from clause, including any filters.

Figure  8:  Question Builder

  1. Open the Question Builder page:
    • To create a new question, click Question Builder at the top right of the Ask a Question box.
    • To refine a question that you already issued, click Copy to Question Builder below the Question field.
  2. Click + beside Get the following data to create the get statement. A row appears with a text field for entering a sensor name.
  3. Start typing in the sensor name field, use the typeaheads to select a sensor, and click Apply.



    Alternatively, click Browse all Sensors below the sensor name field to open the Browse Sensors dialog box and select sensors. When you use the dialog box, you can review sensor descriptions.

  4. For a sensor that produces data across multiple Question Results columns, you can add filters based on column data matches. In the Question Builder, click Add Filter below the sensor field to configure a filter. By default, filter matching applies to a single column, which you select in the first drop-down list below the sensor name. Note that single-column filtering works only if the sensor definition specifies column delimiters with a single character (such as "|"), not multiple characters (such as "|:"). To apply matching to all the columns for a sensor, enable Row filter.



    You can select matching operators and specify regular expressions to match strings. To match on substrings, select the Substring box and specify a starting position (where 0 is the first position) and number of characters.

  5. (Optional) If you add a filter in the Get the following data or from computers with sections, you can click Advanced Sensor Options below the filter to configure the following settings:
    Table 2:   Advanced Sensor Options
    SettingsGuidelines
    Case SensitivityGroup strings:
    • Ignore case: Group and count result values regardless of differences in upper-case and lower-case characters.
    • Match case: Group and count result values with strict attention to lettercase.
    MatchingThis option is valid in the from computers with clause.

    For some sensors, a Tanium Client might compute multiple results. When the sensor is used as a filter in the from clause, specify whether any or all of the results must match the filter:

    • Match Any Value: Any value in the answer must match the value specified in the question.
    • Match All Values: All values in the answer must match the value specified in the question.

    For example, in response to the IP Address sensor, it is possible for a Tanium Client to return both an IPv4 address and an IPv6 address. A question based on the IP Address sensor containing 192.168 for example could possibly match the IPv4 address but not the IPv6 address. In this case, you probably want to match "any".

    Treat Data AsSensor values are treated as the type of data you specify:
    • Date/Time (BES)
    • Date/Time (WMI)
    • File Size
    • Integer
    • IP Address
    • Numeric
    • Text
    • Time Duration
    • Version
    Maximum Data Age Maximum amount of time that the Tanium Client can use a cached result to answer a question. For example, the maximum data age for the File Size sensor is 15 minutes by default. When a Tanium Client is asked a question that executes the File Size sensor, it caches the result. Over the next 15 minutes, if the Tanium Client is asked a question that includes the File Size sensor, it responds with the cached answer. After 15 minutes, if the Tanium Client is asked a question that includes the File Size sensor, it executes the sensor script again to compute a fresh answer.

    Use shorter ages for sensors that return values subject to change frequently, such as status and utilization sensors. Use longer ages for values that typically change infrequently, such as the chassis type or Active Directory Domain membership.

  6. Beside from computers with, click +, select one of the following options to create the from clause, and click Apply:
    • Add Row: Add one or more conditions.
    • Add Group: Select this option to nest a Boolean operator and then use Add Row to build the nested expression.

    You can configure multiple filters, including nested filters. For example, to investigate the web browsers installed on computers, you can use Boolean ANDs and ORs in the from clause to target modern browsers.

  7. (Optional) Click Advanced Question Options and enable Force Computer ID if you want to convert a counting question into a non-counting question by forcing Tanium Clients to include the computer ID in their answers. Converting to a non-counting question is a workaround that resolves cases where a counting question returns the too many results answer. For details, see the KB article Troubleshooting Errors / Informational Messages (too many results message).

    For a non-counting question, the Tanium Console aggregates the results for each reporting Tanium Client.



    For a counting question, the Tanium Console displays a row for each unique result.

  8. Click Ask Question to issue the question.

    The Question Results page opens to display the answers from endpoints.

Question expiration

Upon issuing a dynamic or saved question, the Tanium Server assigns a question ID to the question. In your web browser, the question ID appears in the URL field.

Figure  9:  Question ID

The question ID expires after 10 minutes, and its corresponding URL becomes invalid. This means that for up to 10 minutes, you can refresh the page or share the link. After 10 minutes, if you navigate to the link, Interact displays a message indicating the question has expired, and it gives you the option to copy the question text to the Question Bar so you can reissue it.

Figure  10:  Question Expired message

Question history

Use the Administration > Question History page to perform the following tasks:

  • Review a chronology of issued questions, as well as their syntax and expiration timestamps. By default, the Tanium Server maintains an entry for a question in the chronology for seven days.
  • Copy an issued question to the Question Bar to reissue it: select the question and click Load.
  • Copy the selected chronology entries to your clipboard.

Users require a role with the Read Question History (micro admin) permission to see the Question History page. However, a user with only this permission cannot load a question from the Question History page. Users who have the Administrator reserved role can see the Question History page and load a question from it.

Saved questions

After issuing a dynamic question, you can click Save this question below the Question Bar to save the question syntax as a configuration object. Tanium content packs that you import also provide predefined saved questions. You can issue saved questions manually, through Tanium modules, or through custom applications that use the Tanium XML API. For details, see Managing saved questions.

Last updated: 11/12/2019 3:19 PM | Feedback