Tanium Console and Interact requirements

• Allowed URLs
• Computer management groups
• Content sets
• Filter groups
• Packages
• Roles
• Saved questions
• Scheduled actions
• Sensors

Only the Administrator reserved role can export categories and dashboards.

Import Signed Content: This permission is required to import digitally signed content files.

The Administrator reserved role can export, import, update, or uninstall all Tanium solutions and content.

The Admin reserved role has this permission and can also export categories and dashboards.

• Write permission is required to create, modify, or delete the allowed URLs configurations.

• Read permission is required to export the allowed URLs configurations in CSV format.

Export Content: This permission is required to export allowed URLs configurations in JSON format.

Import Signed Content: This permission is required to import allowed URLs configurations.

The Administrator reserved role has these permissions.

Only the Administrator reserved role can access the Infrastructure Configuration Files page to download those files through the Tanium Console.

• Write permission is required to create, modify, or delete the isolated subnets configuration.

• Read permission is required to view the isolated subnets configuration.

Separated Subnets:

• Write permission is required to create, modify, or delete the separated subnets configuration.

• Read permission is required to view the separated subnets configuration.

The Administrator reserved role has all these permissions.

• Write permission is required to create, modify, or delete global bandwidth throttles.

• Read permission is required to view the global bandwidth throttles configuration.

Subnet Bandwidth Throttles:

• Write permission is required to create, modify, or delete site (subnet-specific) bandwidth throttles.

• Read permission is required to view the site (subnet-specific) bandwidth throttles configurations.

The Administrator reserved role has all these permissions.

Read Sensor content set permissions determine which sensors are available for you to select for questions. Read Filter Group content set permissions determine which computer filter groups are available for you to view and select for questions and question results.

The Tanium™ Asset module stores endpoint information that is visible in the Question Results grid to users who have the Asset Report Read permission.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

In addition to the Write Saved Question permission, users require the Write Action and Write Package permissions to add associated packagesactions to a new saved question configuration. In addition to these three permissions, users require owner permissions for the question if they want to modify or delete the associated packagesactions.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

Read Sensor permission is required for the sensors specified in a saved question that you want to issue. Read Filter Group content set permission is required for the filter groups specified in the saved question.

Ask Dynamic Questions permission is required to use the drill down feature in the saved question results grid.

Write Dashboard Group permission is required to create, modify, or delete category configurations. Read Dashboard content set permissions determine which dashboards are available in categories.

The Admin reserved role Administrator and Content Administrator reserved roles can export and import categories.

Write Dashboard permission is required to create, modify, or delete dashboard configurations. Read Saved Question content set permissions determine which saved questions are available in dashboards.

The Admin Administrator or Content Administrator reserved role can export and import dashboards.

Note: By default, new dashboards are added to the Other Dashboards category, which is visible only to users with the Admin Administrator or Content Administrator reserved role. Therefore, only users with that role one of those roles, or the user who created the dashboard, can see the new dashboard. To make the dashboard visible to other users, you must move it to another category.

Read Package content set permissions determine which packages are available for you to select for actions.

Read Sensor and Read Saved Question permissions on the Reserved content set are required to complete the deploy action workflow. During the workflow, these permissions allow special saved questions that TaaS the Tanium Server uses to track and report action status.

The Administrator reserved role has all these permissions.

Package: Read permission on content sets determine which packages are available for selection in actions.

Sensor and Saved Question: Read permissions are required on the Reserved content set. TaaS The Tanium Server uses special saved questions to track action status and report action status within the deploy action workflow. Therefore, these permissions are required to complete the workflow.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

• Read permission is required to view the Scheduled Actions page. Read permission on the content sets for the underlying packages determines the specific actions (grid rows) that you can view, export, and copy (to your clipboard) and the package files that you can re-download.

• Write permission:

  • Enables users to see rows for actions that they issued. Users who have Action read permission on the content set for the underlying package can see rows for actions that others issued.
  • Enables users to see and use the Deploy Action button on the Question Results page for dynamic questions and saved questions.
  • Enables users to export scheduled actions in CSV format.
  • Implies the Own Action read, Package read, and Show Preview permissions.

Export Content: This permission is required to export scheduled actions in JSON format.

Import Signed Content: This permission is required to import scheduled actions.

Action for Saved Question: Write permission enables users to:

• See the Scheduled Actions page, but the only rows are for the actions that the user has deployed.
• See and use the Deploy Action button on the Question Results page, but only for saved questions that are configured with an associated package. Package read permission is not required for the associated package. If the saved question is not configured with an associated package, the Deploy Action button does not appear.

Use Action for Saved Question write permission instead of Action write permission to limit use by action users who use Tanium to execute standard operating procedures that someone else created.

Sensor and Saved Question: Read permissions are required on the Reserved content set for users to deploy, edit, or check the status of actions. The Reserved content set includes content used to ask preview and polling questions.

The Administrator reserved role has all these permissions. The Content Administrator reserved role has all these permissions except the ability to export scheduled actions in JSON format or to import them in any format.

• Read permission is required to view and export action groups in the Actions > Scheduled ActionsActions > Scheduled Actions page.

• Write permission is required to create, edit, and delete action groups.

The Administrator reserved role has these permissions.

• Read permission is required to view the Action History page

• Read permission on the content sets for the underlying packages determines the specific actions (grid rows) that you can view, export, and copy (to your clipboard).

The Admin reserved role has Administrator and Content Administrator reserved roles have these permissions.

• Saved Question: Read permission (regardless of content sets) is required to view the Action StatusAction Summary page of an action in the Action History page.
• Package: Read permission on the content set for the underlying package is required to view files in the Action StatusAction Summary page.
• Sensor and Saved Question: Read permissions on the Reserved content set are required to view and use the Show Client Status Details button in the Action StatusAction Summary page.
• Sensor: Read permission on the Client Management content set is required to view and use the Get action log for selected machines button in the Action StatusAction Summary page.

The Admin reserved role has Administrator and Content Administrator reserved roles have all these permissions.

• Read permission on content sets is required to view the sensors that are assigned to those content sets, or to export those sensors in CSV format.

• Write permission is required to create, edit, or delete sensors.

Export Content (administrationmicro admin permission): This permission is required to export sensors in JSON format. The Admin reserved role has this permission.

Import Signed Content (micro admin permission): This permission is required to import sensors.

The Administrator and Content Administrator reserved roles have Sensor read and write permissions. The Administrator reserved role can import or export sensors in JSON format.

Global Settings (micro admin permission): Write permission is required to enable or disable sensor quarantine enforcement. The Administrator reserved role has this permission.

Sensor read permission or Ask Dynamic Questions permission is required to view quarantined sensors. Computer management group assignments determine on which endpoints users can manually quarantine or unquarantine sensors.

• Read permission on content sets is required to view the packages that are assigned to those content sets, or to export those packages in CSV format.

• Write permission is required to create, edit, or delete packages.

Export Content (administrationmicro admin permission): This permission is required to export packages in JSON format.

Import Signed Content (micro admin permission): This permission is required to import packages.

The Administrator reserved role has all these permissions. The Content Administrator reserved role has Package read and write permissions.

• Read permission on content sets is required to view the saved questions that are assigned to those content sets, or to export those saved questions in CSV format.

• Write permission is required to create, edit, or delete saved questions.

Export Content (administrationmicro admin permission): This permission is required to export saved questions in JSON format.

Import Signed Content (micro admin permission): This permission is required to import saved questions.

Saved Question, Action and Package: Write permissions are required to add associated packagesactions to a new saved question. In addition to these three permissions, a user also requires owner permissions for the question to later edit or delete the associated packagesactions: see the Visibility setting in Saved question settings.

Sensor: Read permissions on content sets determine which sensors users can select for questions.

The Administrator reserved role has all these permissions. The Content Administrator reserved role has all these permissions except the ability to export saved questions in JSON format or to import them in any format.

• Read permission is required to view the Filter Groups page. Read permission on the content sets to which the filter groups are assigned is required to:
  • View the configuration (group membership) of specific filter groups. Ask Dynamic Questions permission is also required for this activity.
  • Export filter groups in CSV format.
• Write permission is required to:
  • Create, clone, and edit filter groups. These abilities also require Ask Dynamic Questions permission.
  • Delete filter groups.

Export Content (administrationmicro admin permission): This permission is required to export filter groups in JSON format.

Import Signed Content (micro admin permission): This permission is required to import filter groups.

Computer Group write permission implies Filter Group write permission. Computer Group read permission also implies Filter Group read permission.

The Administrator reserved role has all these permissions.

All roles that have the Ask Dynamic Questions permission in Tanium Core Platform 7.3 or earlier will have the Filter Group read permission on the Default Filter Groups content set after you upgrade to version 7.4 or later.

• Allowed URLs
• Computer management groups
• Content sets
• Filter groups
• Packages
• Roles
• Saved questions
• Scheduled actions
• Sensors

The Administrator reserved role has this permission.

The Administrator reserved role has the Import Signed Content permission.

• Interact module permissions:

  • Ask Dynamic Questions

  • Interact show

  • Interact Module read

• Platform Content Permissions:

  • Saved Question read permission on the content sets that contain the questions that the user is allowed to issue.

  • Sensor read permission on the content sets that contain the sensors that are used in the questions that the user is allowed to issue.

The Administrator reserved role has these permissions and can also issue questions from the Action History page.

To create a computer management group or filter group in which membership is based on a sensor filter, the following permissions are required in addition Computer Group write permission:

• Sensor (platform contentadvanced): Read permission on the Reserved content set, which includes content that is used to ask preview questions
• Interact Module (module): Write permission

Computer groups with manually defined membership do not require the Sensor read or Interact Module write permissions.

The following permissions are required to edit the assignments of computer management groups:

• Permission Administrator and User write permissions are requiredUser: Write permission is required to edit the computer management group assignments of users.
• Permission Administrator and User Group write permissions are requiredUser Group: Write permission is required to edit the computer management group assignments of user groups.
• Permission Administrator and Persona write permissions are requiredPersona: Write permission is required to edit the computer management group assignments of personas.

Computer Group: Read permission is required to export computer management groups in CSV format. This permission implies the Filter Group (advanced) read permission, which is required to see filter groups, use them for filtering questions or question results, and export filter groups in CSV format.

Export Content: This permission is required to export computer groups in JSON format.

Import Signed Content: This permission is required to import computer groups.

The following permissions are required to view the assignments of computer management groups:

• User: Read permission is required to view the computer management group assignments of users.
• User Group: Read permission is required to view the computer management group assignments of user groups.
• Persona: Read permission is required to view the computer management group assignments of personas.

The Administrator reserved role has all these permissions and can import or export computer groups in JSON format.

The Permission Administrator permission implies read permissions for User, User Group, and Persona. Therefore only Permission Administrator permission is required to view the computer management group assignments of users, user groups, and personas.

The Admin reserved role has all these permissions and can export all computer groups in CSV or JSON format.

• Read permission is required to:
  • View user configurations and export them in CSV format.
  • View the user group assignments of users. This ability also requires the User Group read permission.
  • View the computer management group assignments of a user.

• Write permission is required to:

  • Add a user.

  • Manage user properties.

  • Edit the computer management group assignments of a user.

  • Save changes to a user.

  • Delete a user.

  • Edit the user group assignments of users. This ability also requires the User Group write permission.

Changing the role, persona, or computer management group assignments of users requires the following permissions:

• Permission Administrator and User write permissions are required to edit the computer management group assignments of users.
• Permission Administrator, Persona write, and User write permissions are required to edit the persona assignments of users.
• Permission Administrator and User write permissions are required to edit the role assignments of users.

The Permission Administrator permission implies the User read permission. Therefore, only the Permission Administrator permission is required to view the computer management group assignments of users.

The Permission Administrator permission also implies read permissions for Role, User Group, and Persona. Therefore, only the Permission Administrator permission is required to view the role, user group, and persona assignments of users.

The Admin reserved role has all these permissions and can also export user configurations in JSON format.

Only the Administrator reserved role has all these permissions and can export users in JSON format.

The Administrator or Content Set Administrator reserved role is required to change the role assignments of users. However, a Content Set Administrator cannot manage the assignment of reserved roles.

The Administrator reserved role is required to change persona assignments.

Users cannot modify their own persona, computer group, or role assignments.

• Read permission is required to:

  • Export user group configurations in CSV format.

  • View the user assignments of user groups. This ability also requires the User read permission.

  • View the computer management group assignments of user groups.

• Write permission is required to:

  • Add a user group.

  • Edit a user group.

  • Edit the computer management group assignments of a user group.

  • Edit the user assignments of user groups. This ability also requires the User write permission.
  • Set the default user group. This ability also requires the Global Settings write permission.

  • Delete a user group.

Changing the role, persona, or computer management group assignments of user groups requires the following permissions:

• Permission Administrator and User Group write permissions are required to edit the computer management group assignments of user groups.
• Permission Administrator, Persona write, and User Group write permissions are required to edit the persona assignments of user groups.
• Permission Administrator and User Group write permissions are required to edit the role assignments of user groups.

The Permission Administrator permission implies the User Group read permission. Therefore, only the Permission Administrator permission is required to view the computer management group assignments of user groups.

The Permission Administrator permission implies read permissions for Role, User, User Group, and Persona. Therefore, only the Permission Administrator permission is required to view the role, user and persona assignments of user groups.

The Admin reserved role has all these permissions and can also export user groups in JSON format.

Only the Administrator reserved role has all these permissions and can export user groups in JSON format.

The Administrator or Content Set Administrator reserved role is required to change the role assignments of user groups. However, a Content Set Administrator cannot manage the assignment of reserved roles.

The Administrator reserved role is required to change persona assignments.

The following permissions are required to edit the user, user group, computer management group, and role assignments of personas:

• Permission Administrator, Persona write, and User write permissions are required to edit the user assignments of personas.
• Permission Administrator, Persona write, and User Group write permissions are required to edit the user group assignments of personas.
• Permission Administrator and Persona write permissions are required to edit the computer management group assignments of personas.
• Permission Administrator and Persona write permissions are required to edit the role assignments of personas.

Permission Administrator and Persona read permissions are required to view and export persona configurations.

Permission Administrator permission implies read permissions for Persona, User, User Group, and Role. Therefore, only the Permission Administrator permission is required to view the user, user group, role, and computer management group assignments of personas.

The Admin reserved role has all these permissions.