Tanium Console and Interact requirements

Read Global Bandwidth Throttles permission is required to view the global bandwidth throttles configuration.

Write Subnet Bandwidth Throttles permission is required to create, modify, or delete site (subnet-specific) bandwidth throttles.

Read Subnet Bandwidth Throttles permission is required to view the site (subnet-specific) bandwidth throttles configurations.

The Admin Administrator reserved role has all these permissions.

Read Sensor content set permissions determine which sensors are available for you to select for questions. Read Filter Group content set permissions determine which computer filter groups are available for you to view and select for questions and question results.

The Tanium™ Asset module stores endpoint information that is visible in the Question Results grid to users who have the Asset Report Read permission.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

Read Sensor permission is required for the sensors specified in a saved question that you want to issue. Read Filter Group content set permission is required for the filter groups specified in the saved question.

Ask Dynamic Questions permission is required to use the drill down feature in the saved question results grid.

Write Dashboard permission is required to create, modify, or delete dashboard configurations. Read Saved Question content set permissions determine which saved questions are available in dashboards.

The Admin Administrator or Content Administrator reserved role can export and import dashboards.

Note: By default, new dashboards are added to the Other Dashboards category, which is visible only to users with the Admin Administrator or Content Administrator reserved role. Therefore, only users with that role one of those roles, or the user who created the dashboard, can see the new dashboard. To make the dashboard visible to other users, you must move it to another category.

Write Action permission:

• Enables users to see rows for actions that they issued. Users can see rows for actions that others issued if the users have Read Action permission on the content set for the underlying package.
• Enables users to see and use the Deploy Action button on the Question Results grid for dynamic questions and saved questions.
• Enables users to export specific scheduled actions for which they have Write Action permission.
• Implies the Read Own Action, Read Package, and Show Preview permissions.

Write Action for Saved Question permission:

• Enables users to see the Scheduled Actions page, but the only rows are for the actions that the user has deployed.
• Enables users to see and use the Deploy Action button on the Question Results grid, but only for saved questions that are configured with an associated package. The Read Package permission is not required for the associated package. If the saved question is not configured with an associated package, the Deploy Action button does not appear.

Tip: Use the Write Action for Saved Question permission instead of the Write Action permission to limit use by action users who use Tanium to execute standard operating procedures that someone else created.

Read Sensor and Read Saved Question permissions are required on the Reserved content set for users to deploy, edit, or check the status of actions. The Reserved content set includes content used to ask preview and polling questions.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions, and can export or import the complete scheduled actions configuration.

The Admin reserved role has Administrator and Content Administrator reserved roles have this permission, and can export the action history.

The Admin reserved role has Administrator and Content Administrator reserved roles have this permission, and can export or import the complete packages configuration.

Write Filter Group permission is required to create, clone, edit, and delete filter groups. To create or clone filter groups, the Ask Dynamic Question permission is also required. The Write Filter Group permission implies the Read Filter Group permission.

The Admin reserved role has Administrator and Content Administrator reserved roles have these permissions.

All roles that have the Ask Dynamic Question permission in Tanium Core Platform 7.3 or earlier will have the Read Filter Group permission on the Default Filter Groups content set after you upgrade to version 7.4 or later.

Users who have the Admin Administrator reserved role can see the Question History page, load a question from the page, and export the question history.

Permission Administrator permission also implies the Read Role permission, which is required to view the role assignments of users, user groups, and personas.

Grant Role is one of the permissions that are required to edit role assignments. It is not an explicit permission. The Permission Administrator permission implies the Grant Role permission. Editing role assignments requires the following combined permissions:

• Permission Administrator and Write User permissions are required to edit the role assignments of users.
• Permission Administrator and Write User Group permissions are required to edit the role assignments of user groups.
• Permission Administrator and Write Persona permissions are required to edit the role assignments of personas.

Note that a Content Set Administrator cannot manage the assignment of reserved roles to users and user groups.

Reader User permission is required to export user configurations.

Write User and Write User Group permissions are required to change the user group assignments of users.

Write Computer Group and Write User permissions are required to edit the computer management group assignments of users.

Changing the role, persona, or computer management group assignments of users requires the following permissions:

• Permission Administrator, Write Computer Group, and Write User permissions are required to edit the computer management group assignments of users.
• Permission Administrator, Write Persona, and Write User permissions are required to edit the persona assignments of users.
• Permission Administrator and Write User permissions are required to edit the role assignments of users.

The Admin reserved role has all these permissions and can export user configurations.

Only the Administrator reserved role has all of these permissions. The Administrator and Content Set Administrator reserved roles can export user configurations.

The Administrator or Content Set Administrator reserved role is required to change the role assignment. However, a Content Set Administrator cannot manage the assignment of reserved roles.

The Administrator reserved role is required to change persona assignments.

Users cannot modify their own persona, computer group, or role assignment.

Read Persona permission is required to view persona configurations.

Changing the user, user group, computer management group, and role assignments of personas requires the following permissions:

• Permission Administrator, Write Persona, and Write User permissions are required to edit the user assignments of personas.
• Permission Administrator, Write Persona, and Write User Group permissions are required to edit the user group assignments of personas.
• Permission Administrator, Write Persona, and Write Computer Group permissions are required to edit the computer management group assignments of personas.
• Permission Administrator and Write Persona permissions are required to edit the role assignments of personas.

The Admin reserved role has all these permissions and can export persona configurations.