In the Tanium™ Console, when you click a saved question, the question is issued to Tanium Clients. Saving the question syntax as a configuration object enables it to be reissued later. The configuration object can also be used throughout the platform, both by Tanium™ solution modules and by user-developed applications that use the SOAP API. For example, you can use Tanium™ Connect to configure a saved question to be run on a schedule with results sent to an external server.
- Use the Question bar to ask a dynamic question.
- Click Save this question directly under the Question bar.
- Complete the settings described in the following table.
- According to RBAC. Users must have the Read Saved Question permission for the content set to which the saved question belongs to see the saved question.
- Only the Owner and Admins. Only the object owner and users with the Administrator reserved role can see the saved question.
- Click Preview to preview the results you will get when you use the saved question.
- Click Create Saved Question.
|Name||Specify a configuration name. The name appears in saved question lists that are incorporated into Tanium Console workflows. Observe the existing naming scheme so that you and other administrators can find it easily.|
|Content Set||Assign to a content set. The list is populated with all content sets for which you have Write Saved Question permission.|
|Reissue this question every||The saved question is first issued immediately upon saving the configuration. Clients that are online at that time respond with their answers.
You can use the "reissue" option to account for machines that are not currently online but are routinely online within predictable cycles (and even unpredictable times). For example, employee laptops might be offline the moment you save the saved question configuration, but you think you are likely to find them online at least once if you were to check every 8 hours.
When reissue is selected, the saved question is reissued in the background at the interval you specify. For example, if you save the saved question configuration at 9:00 a.m. local time and specify a reissue interval of every 8 hours, the Tanium Server reissues the saved question at 5:00 p.m., 1:00 a.m., 9:00 a.m., and so on. The results are archived. This improves the data quality of "recent" responses displayed in the results grid for machines that are not online when you use Interact to issue the question.
You can use the Question History to verify that the saved questions are sent according to the reissue interval you have configured.
Specify a number and unit for the reissue interval: Minutes, Hours, Days.
Note: If you specify a reissue interval of 8 hours, the system reissues the saved question exactly every 8 hours, regardless of time changes due to daylight savings time.
|Make this question available for drilldown||Include in the Select Drilldown Question dialog box Saved Questions tab.|
|Make this question available for merging||
Include in the Select Merge Questions dialog box Saved Questions tab.
If this option is not enabled when the saved question is created, it will not be available to subsequent edits.
Note: To make a question available for potential use in a merge operation, the Tanium Server must maintain data per computer ID. In effect, this makes the question a non-counting question.
|Enable recent view on this counting question||
This option enables collection and reporting of recent data in the results grid.
Current data includes responses from machines that are currently online. Recent data may include responses from offline machines. The Tanium Server caches client responses for 7 days by default. If a client is not online when a question is issued, but the Tanium Server has a cached value for it, the "recent" cached result can be passed to the results grid. (You can change the default limit for recent with the global setting max_most_recent_age.)
This option is displayed when the question is a counting question that has exactly one sensor. It can be enabled only in the New Saved Question form, not the Edit Saved Question form.
Note: To maintain recent results, the Tanium Server must maintain data per computer ID. In effect, this makes the question a non-counting question.
|Default Tab||Specify a default tab: Question, Grid, Pie.
The Default Tab setting is saved as a user preference unless the Use these as the default for all users setting is selected.
|Default Grid Chart Zoom||Specify a data period for the initial results grid display: Current or Recent.|
|Use these as the default preferences for all users||
This option is displayed for users with the Administrator or Content Administrator roles only. The purpose is to enable an advanced user to curate the configuration for other users. Defaults are commonly understood as good choices. When this option is selected, the administrator's choices populate the initial defaults shown for subsequent users.
The subsequent users are free to modify the settings. When a non-admin user modifies the settings, their choices are preserved and will persist even when another administrator subsequently changes the default preferences.
Note: When an Administrator or Content Administrator makes changes, it does change the settings for all other Administrator or Content Administrator users. This design forces administrators to be on the same page regarding the best default settings.
|Associated Actions||Optional. Click Add Package and select a package you want to be the default when a user clicks the Deploy Action button from the results grid.|
Your question will be issued and results displayed in the results grid. Depending on the settings you configured, the saved question may appear in saved question lists that are incorporated into Tanium Console workflows.
When you save a question that has a parameterized sensor, the sensor definition, including the substituted values, is saved in an object called a temp sensor. On the endpoint, the Tanium™ Client runs the temp sensor when it computes answers to a saved question that calls it. A saved question that is reissued according to a schedule continues to use the temp sensor even if the sensor from which it was based is updated. Therefore, if a sensor is updated, and you want the saved question to use the updated code, you must re-create the saved question.
The Tanium Server maintains a copy of the saved question configuration for each user who has saved the configuration. For example:
- admin01 creates a saved question.
- user01 edits it and saves a copy.
- user02 edits it and saves a copy.
- user03 does not edit the saved question but has permission to read or edit it.
Tanium Server now has three copies—one for each user who has saved it. The per-user settings are saved in the system as metadata for the saved question configuration.
The different preferences user01 or user02 may have with respect to a saved question are applied when the user logs in. For example, if user01 settings allow the question to be included in merge operations and user02 settings do not, those differences are applied, and the users have different experiences. user03, not having saved the configuration, is subject to the admin01 settings.
When the reissue option is set, the question is issued at the interval specified by each user configuration. However, if multiple users have essentially the same management computer group rights, the Tanium Server throttles the redundant traffic. For example, if user01 and user02 both have access to the All Computers computer group and set a reissue interval every 4 hours, the Tanium Server will reissue the question only once every 4 hours, not once for each user. However, if user01 has access to only the computer group A, and user02 has access only to computer group B, the Tanium Server will reissue the question according to each user's requirements.
Last updated: 6/29/2018 2:03 PM | Feedback