Tanium Console and Interact requirements

• Allowed URLs
• Computer management groups
• Content sets
• Filter groups
• Packages
• Roles
• Saved questions
• Scheduled actions
• Sensors

Only the Administrator reserved role can export categories and dashboards.

Import Signed Content: This permission is required to import digitally signed content files.

The Administrator reserved role can export, import, update, or uninstall all Tanium solutions and content.

The Admin reserved role has this permission and can also export categories and dashboards.

• Write permission is required to create, modify, or delete the allowed URLs configurations.

• Read permission is required to export the allowed URLs configurations in CSV format.

Export Content: This permission is required to export allowed URLs configurations in JSON format.

Import Signed Content: This permission is required to import allowed URLs configurations.

The Administrator reserved role has these permissions.

Only the Administrator reserved role can access the Infrastructure page to download those files through the Tanium Console.

• Write permission is required to create, modify, or delete the isolated subnets configuration.

• Read permission is required to view the isolated subnets configuration.

Separated Subnets:

• Write permission is required to create, modify, or delete the separated subnets configuration.

• Read permission is required to view the separated subnets configuration.

The Administrator reserved role has all these permissions.

• Write permission is required to create, modify, or delete global bandwidth throttles.

• Read permission is required to view the global bandwidth throttles configuration.

Subnet Bandwidth Throttles:

• Write permission is required to create, modify, or delete site (subnet-specific) bandwidth throttles.

• Read permission is required to view the site (subnet-specific) bandwidth throttles configurations.

The Administrator reserved role has all these permissions.

Sensor read content set permissions determine which sensors are available for you to select for questions. Filter Group read content set permissions determine which computer filter groups are available for you to view and select for questions and question results.

The Tanium™ Asset module stores endpoint information that is visible in the Question Results grid to users who have the Asset Report read permission.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

In addition to the Saved Question write permission, users require the Action write and Package write permissions to add associated packages to a new saved question configuration. In addition to these three permissions, users require owner permissions for the question if they want to modify or delete the associated packages.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

Sensor read permission is required for the sensors specified in a saved question that you want to issue. Filter Group read content set permission is required for the filter groups specified in the saved question.

Ask Dynamic Questions permission is required to use the drill down feature in the saved question results grid.

Dashboard Group write permission is required to create, modify, or delete category configurations. Read Dashboard content set permissions determine which dashboards are available in categories.

The Admin reserved role Administrator and Content Administrator reserved roles can export and import categories.

Dashboard write permission is required to create, modify, or delete dashboard configurations. Saved Question read content set permissions determine which saved questions are available in dashboards.

The Admin Administrator or Content Administrator reserved role can export and import dashboards.

Note: By default, new dashboards are added to the Other Dashboards category, which is visible only to users with the Admin Administrator or Content Administrator reserved role. Therefore, only users with that role one of those roles, or the user who created the dashboard, can see the new dashboard. To make the dashboard visible to other users, you must move it to another category.

Package read content set permissions determine which packages are available for you to select for actions.

Sensor read and Saved Question read permissions on the Reserved content set are required to complete the deploy action workflow. During the workflow, these permissions allow special saved questions that TaaS the Tanium Server uses to track and report action status.

The Administrator reserved role has all these permissions.

• Action write

• Interact Module read

• Package read permission on content sets determine which packages are available for selection in actions.

• Sensor and Saved Question read permissions are required on the Reserved content set. TaaSThe Tanium Server uses special saved questions to track and report action status within the deploy action workflow. Therefore, these permissions are required to complete the action deployment workflow.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

Action read permission is required to perform the following tasks on the Scheduled Actions page:

• View actions. The visibility of specific actions (grid rows) depends on Action read permission on the content set for the associated packages.

• Export actions in CSV format. Export Content (administration) permission is required to export scheduled actions in JSON format.

• Copy action information to the clipboard.

Own Action read permission enables the same tasks as Action read but only for actions that the user owns.

Action read and write permissions are required to perform the following tasks on the Scheduled Actions page:

• View the status of, and re-download, packages that are associated with actions.

• Disable or enable actions.
• Change the action groups that actions target.
• Create copies of action configurations.
• Delete actions.

Sensor read permissions on the Reserved content set, in addition to Action read and write permissions, are required to reissue or edit actions on the Scheduled Actions page. The Reserved content set includes content that is used to ask preview questions.

Import Signed Content (administration) permission is required to import scheduled actions.

Action for Saved Question: Write permission enables users to see and use the Deploy Action button on the Question Results page, but only for saved questions that are configured with an associated package. Package read permission is not required for the associated package. If the saved question is not configured with an associated package, the Deploy Action button does not appear.

Use Action for Saved Question write permission instead of Action write permission to limit use by action users who use Tanium to execute standard operating procedures that someone else created.

The Administrator reserved role has all these permissions. The Content Administrator reserved role has all these permissions except the ability to export scheduled actions in JSON format or to import them in any format.

• Read permission is required to view and export action group configurations.

• Write permission is required to create, edit, and delete action groups.

The Administrator reserved role has these permissions.

• View action configurations. The visibility of specific actions (grid rows) depends on Action read permission on the content set for the associated packages.

• Export actions in CSV format. Export Content (administration) permission is required to export actions in JSON format.

• Copy action information to the clipboard.

• View action status, when combined with other content permissions: see View action status.

Own Action read permission enables the same tasks as Action read but only for actions that the user owns.

Action read and write permissions are required to stop actions on the Action History page.

Sensor read permissions on the Reserved content set, in addition to Action read and write permissions, are required to reissue actions on the Action History page. The Reserved content set includes content that is used to ask preview questions.

The Admin reserved role has Administrator and Content Administrator reserved roles have these permissions.

• Package: Read permission on the content sets for packages that are associated with actions is required to view files in the Action Status page.
• Sensor and Saved Question: Read permissions on the Reserved content set are required to use the Show Client Status Details button in the Action Status page.
• Sensor: Read permission on the Client Management content set is required to use the Get action log for selected machines button in the Action Status page.
• Action: Read permission is required to open the Action Status page from the Action History page. Own Action read permission enables the same ability but only for actions that the user owns.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

• Read permission on content sets is required to view the sensors that are assigned to those content sets, or to export those sensors in CSV format.

• Write permission is required to create, edit, or delete sensors.

Export Content (administration permission): This permission is required to export sensors in JSON format. The Admin reserved role has this permission.

Import Signed Content (administration permission): This permission is required to import sensors.

The Administrator and Content Administrator reserved roles have Sensor read and write permissions. The Administrator reserved role can import or export sensors in JSON format.

Global Settings (administration permission): Write permission is required to enable or disable sensor quarantine enforcement. The Administrator reserved role has this permission.

Sensor read permission or Ask Dynamic Questions permission is required to view quarantined sensors. Computer management group assignments determine on which endpoints users can manually quarantine or unquarantine sensors.

• Read permission on content sets is required to view the packages that are assigned to those content sets, or to export those packages in CSV format.

• Write permission is required to create, edit, or delete packages.

Export Content (administration permission): This permission is required to export packages in JSON format.

Import Signed Content (administration permission): This permission is required to import packages.

The Administrator reserved role has all these permissions. The Content Administrator reserved role has Package read and write permissions.

• Read permission on content sets is required to view the saved questions that are assigned to those content sets, or to export those saved questions in CSV format.

• Write permission is required to create, edit, or delete saved questions.

Export Content (administration permission): This permission is required to export saved questions in JSON format.

Import Signed Content (administration permission): This permission is required to import saved questions.

Saved Question, Action and Package: Write permissions are required to add associated packages to a new saved question. In addition to these three permissions, a user also requires owner permissions for the question to later edit or delete the associated packages: see the Visibility setting in Saved question settings.

Sensor: Read permissions on content sets determine which sensors users can select for questions.

The Administrator reserved role has all these permissions. The Content Administrator reserved role has all these permissions except the ability to export saved questions in JSON format or to import them in any format.

• Read permission is required to view the Filter Groups page. Read permission on the content sets to which the filter groups are assigned is required to:
  • View the configuration (group membership) of specific filter groups. Ask Dynamic Questions permission is also required for this activity.
  • Export filter groups in CSV format.
• Write permission is required to:
  • Create, clone, and edit filter groups. These abilities also require Ask Dynamic Questions permission.
  • Delete filter groups.

Export Content (administration permission): This permission is required to export filter groups in JSON format.

Import Signed Content (administration permission): This permission is required to import filter groups.

The Administrator reserved role has all these permissions.

All roles that have the Ask Dynamic Questions permission in Tanium Core Platform 7.3 or earlier will have the Filter Group read permission on the Default Filter Groups content set after you upgrade to version 7.4 or later.

• Allowed URLs
• Computer management groups
• Content sets
• Filter groups
• Packages
• Roles
• Saved questions
• Scheduled actions
• Sensors

The Administrator reserved role has this permission.

The Administrator reserved role has the Import Signed Content permission.

• Interact module permissions:

  • Interact show

  • Interact Module read

• Platform Content Permissions:

  • Saved Question read permission on the content sets that contain the questions that the user is allowed to issue.

  • Sensor read permission on the content sets that contain the sensors that are used in the questions that the user is allowed to issue.

The Administrator reserved role has these permissions.

To create a computer management group in which membership is based on a sensor filter, the following permissions are required in addition Computer Group write permission:

• Sensor (platform content permission): Read permission on the Reserved content set, which includes content that is used to ask preview questions
• Interact Module (module permission): Write permission

Computer groups with manually defined membership do not require the Sensor read or Interact Module write permissions.

The following permissions are required to edit the assignments of computer management groups:

• Permission Administrator and User write permissions are requiredUser: Write permission is required to edit the computer management group assignments of users.
• Permission Administrator and User Group write permissions are requiredUser Group: Write permission is required to edit the computer management group assignments of user groups.
• Permission Administrator and Persona write permissions are requiredPersona: Write permission is required to edit the computer management group assignments of personas.

Computer Group: Read permission is required to export computer management groups in CSV format.

Export Content: This permission is required to export computer groups in JSON format.

Import Signed Content: This permission is required to import computer groups.

The following permissions are required to view the assignments of computer management groups:

• User: Read permission is required to view the computer management group assignments of users.
• User Group: Read permission is required to view the computer management group assignments of user groups.
• Persona: Read permission is required to view the computer management group assignments of personas.

The Administrator reserved role has all these permissions and can import or export computer groups in JSON format.

The Permission Administrator permission provides read permissions for User, User Group, and Persona. Therefore only Permission Administrator permission is required to view the computer management group assignments of users, user groups, and personas.

The Admin reserved role has all these permissions.

• Read permission is required to:
  • View user configurations and export them in CSV format.
  • View the user group assignments of users. This ability also requires the User Group read permission.
  • View the computer management group assignments of a user.

• Write permission is required to:

  • Add a user.

  • Manage user properties.

  • Edit the computer management group assignments of a user.

  • Save changes to a user.

  • Delete a user.

  • Edit the user group assignments of users. This ability also requires the User Group write permission.

Changing the role, persona, or computer management group assignments of users requires the following permissions:

• Permission Administrator and User write permissions are required to edit the computer management group assignments of users.
• Permission Administrator, Persona write, and User write permissions are required to edit the persona assignments of users.
• Permission Administrator and User write permissions are required to edit the role assignments of users.

The Permission Administrator permission provides the User read permission. Therefore, only the Permission Administrator permission is required to view the computer management group assignments of users.

The Permission Administrator permission also provides read permissions for Role, User Group, and Persona. Therefore, only the Permission Administrator permission is required to view the role, user group, and persona assignments of users.

The Admin reserved role has all these permissions and can also export user configurations in JSON format.

Only the Administrator reserved role has all these permissions and can export users in JSON format.

The Administrator or Content Set Administrator reserved role is required to change the role assignments of users. However, a Content Set Administrator cannot manage the assignment of reserved roles.

The Administrator reserved role is required to change persona assignments.

Users cannot modify their own persona, computer group, or role assignments.

• Read permission is required to:

  • Export user group configurations in CSV format.

  • View the user assignments of user groups. This ability also requires the User read permission.

  • View the computer management group assignments of user groups.

• Write permission is required to:

  • Add a user group.

  • Edit a user group.

  • Edit the computer management group assignments of a user group.

  • Edit the user assignments of user groups. This ability also requires the User write permission.
  • Set the default user group. This ability also requires the Global Settings write permission.

  • Delete a user group.

Changing the role, persona, or computer management group assignments of user groups requires the following permissions:

• Permission Administrator and User Group write permissions are required to edit the computer management group assignments of user groups.
• Permission Administrator, Persona write, and User Group write permissions are required to edit the persona assignments of user groups.
• Permission Administrator and User Group write permissions are required to edit the role assignments of user groups.

The Permission Administrator permission provides the User Group read permission. Therefore, only the Permission Administrator permission is required to view the computer management group assignments of user groups.

The Permission Administrator permission provides read permissions for Role, User, User Group, and Persona. Therefore, only the Permission Administrator permission is required to view the role, user and persona assignments of user groups.

The Admin reserved role has all these permissions and can also export user groups in JSON format.

Only the Administrator reserved role has all these permissions and can export user groups in JSON format.

The Administrator or Content Set Administrator reserved role is required to change the role assignments of user groups. However, a Content Set Administrator cannot manage the assignment of reserved roles.

The Administrator reserved role is required to change persona assignments.

The following permissions are required to edit the user and user group assignments of personas:

• Permission Administrator, Persona write, and User write permissions are required to edit the user assignments of personas.
• Persona write and User write permissions are required to edit the user assignments of personas.
• Permission Administrator, Persona write, and User Group write permissions are required to edit the user group assignments of personas.
• Persona write and User Group write permissions are required to edit the user group assignments of personas.

Persona: Read permission is required to view and export persona configurations.

Permission Administrator permission provides read permissions for Persona, User, User Group, and Role. Therefore, only the Permission Administrator permission is required to:

• View and export persona configurations.

• View the user, user group, role, and computer management group assignments of personas.

The Admin reserved role has all these permissions.

The Administrator reserved role has all these permissions.