Viewing and managing a single endpoint

Reporting provides an Endpoint Details page where you can view comprehensive information about a single endpoint and perform management tasks on the endpoint, such as deploying actions or software. The page provides Tanium-managed tabs and you can add custom tabs.

View endpoint details

The Endpoint Details page opens in the Reporting workbench, but you can access it from many Tanium solutions:

Regardless of how you access the the Endpoint Details page, it provides the same options (see Work with endpoint details) and Tanium-managed tabs (see Tanium-managed tabs).

You require Reporting Dashboard read permission to access the Endpoint Details page. See User role requirements.

If some details are missing from a tab in the page, see Empty fields on the Endpoint Details page.

Access endpoint details from a report or the Explore Data page

You can access the Endpoint Details page when you view, create, or edit a report that contains the Computer Name column (data source):

  1. Perform one of the following steps:

    • Open a report that has the Computer Name column with an entry for the endpoint that you want to examine. See View reports.

    • Open the Explore Data page and add Computer Name as a column. See Explore data and create reports.
  2. Click Endpoint Details beside the name of the endpoint in the Computer Name column.
    An Endpoint Details dialog opens with basic details for the endpoint. If multiple endpoints have the same Computer Name, click Previous Previous or Next Next in the Multiple Results Found banner to find the details for a specific endpoint.

  3. Click View Details to open the Endpoint Details page for the endpoint.

Access endpoint details from the Console Home page

  1. Go to the Tanium Home Home page and click Search Endpoints.

  2. Show basic information about an endpoint by typing its computer name, Tanium Client IP address, or last logged-in user name without pressing Enter.

    Type a partial string to see basic information about multiple endpoints. For example, if you type 10.20.21, a dropdown list shows information about all the endpoints with an IP address that contains those digits.Search Endpoints

  3. Click the Computer Name to open the Endpoint Details page for the endpoint.

Access endpoint details from the Question Results page

  1. Issue a dynamic or saved question. See Tanium Console User Guide: Asking questions and searching endpoints.
  2. In the Question Results, click an endpoint icon Endpoint to see the details for that endpoint.
    An Endpoint Details dialog opens to display the basic information. If multiple endpoints have the same Computer Name, Tanium Client IP Address, or Last Logged in User, click Previous Back or Next Next in the Multiple Results Found banner to find the details for a specific endpoint. Endpoint Details
  3. Click View Details to open the Endpoint Details page for the endpoint.

Work with endpoint details

The Endpoint Details page provides the following options for viewing information, customizing the page or tabs, and exploring or managing endpoints:

Endpoint Details page options
Option Description
Show or hide General Info Show general information about the endpoint, such as the IP address and operating system (OS). To see more details in the tabs without having to scroll, you can hide the general information.
View status

Online Offline

 The page indicates the endpoint state:

  • Online Online: The Endpoint Details page shows current information for the endpoint. The online state is required for action deployment and screen sharing.

  • Offline Offline: The Endpoint Details page shows information that the Tanium Data Service stored when it last successfully collected data from the endpoint.
Open Screen Sharing Session If the endpoint is online Online, click this button to open a Tanium Screen Sharing session for troubleshooting on remote endpoints. For details about managing sessions, see Open Screen Sharing sessions.
Deploy Action If the endpoint is online Online, select a Deploy Action option to deploy an action to the endpoint. For the full procedure, see Deploy actions.
Open tabs Click a tab to open it. If your screen is not wide enough to show all the tabs, select More > <tab name> to open additional tabs.
Reorder tabs Click Edit and drag the listed tabs into the horizontal order that you prefer.
Show or hide tabs Click Edit and select or clear the check boxes to control which tabs the page shows.
Show or hide basic tab settings Show basic tab settings, such as the Content Set assignment and creator (Author). To see more details about the endpoint without having to scroll, you can hide the basic tab settings.
Edit basic tab settings You can edit the name, content set assignment, and description for custom tabs. You can edit only the content set assignment for Tanium Managed tabs. Click Edit beside the name of the tab that you want to modify, update the settings, and click Save. For details, see Tab settings.
Edit tab contents To edit the sections and panels in a tab, click Edit and perform the steps under Edit tabs.
Create a tab Click Add Tab + and perform the steps under Create a new tab.
Clone a tab Click Clone Tab and perform the steps under Clone a tab.
Delete a tab Click Delete and perform the steps under Delete tabs.

Tanium-managed tabs

The Endpoint Details page provides several Tanium-managed tabs that facilitate investigating and managing a single endpoint. You can identify these tabs by the Tanium Managed Tanium Managed label in their header.

The following table lists the tabs and the common use cases that they address.

Tanium-managed tabs
Tab Description
Endpoint Overview

View general information about the endpoint platform and primary user. The information is organized under category sub-tabs.

To open the ADI - Basic Inventory report for all the endpoints that have a particular custom tag assigned:
  1. Open the Endpoint Overview tab and click the Endpoint Details sub-tab.
  2. Click the tag name in the Identification Information section.
Endpoint Management

Deploy software packages or OS patches to the endpoint. See:

This tab appears only if your Tanium license includes Deploy 2.18.67 or later or Patch 3.13.47 or later is installed.

Create custom tabs

Users in your organization might perform routine workflows that require endpoint information that Tanium-managed tabs do not show on the Endpoint Details page. To facilitate such workflows, you can add custom tabs to the page through the following methods:

  • Create a new tab
  • Clone a tab: This is a quicker workflow if an existing tab has settings and content that significantly overlap what you want for the new tab.

You require Reporting Dashboard write permission to create custom tabs. See User role requirements.

Create a new tab

  1. Open the Endpoint Details page for an endpoint. See View endpoint details.
  2. Click Add Tab + besides the tab labels and configure the following settings:
    Tab settings
    SettingDescription
    Tab NameEnter a name of up to 255 characters to identify the tab.
    Content SetAssign the tab to a Content Set. The dropdown lists only the content sets for which you have Dashboard write permission. Only users who have Dashboard read permission for the content set can view the tab.
    Description (optional)Enter a description for other users to understand the purpose and contents of the tab.

  3. Click Save. Reporting saves the tab and opens it in edit mode.

    To navigate, reorder, show, or hide tabs, see Work with endpoint details.

  4. Perform the following tasks to add sections and panels to the tab, and then click Save:

Clone a tab

  1. Open the Endpoint Details page for an endpoint. See View endpoint details.
  2. Click a tab with settings and contents that are similar to the tab you want to create.
  3. Click Clone Tab, edit the settings as necessary (see Tab settings), and click Save. Reporting saves the tab and opens it in edit mode.

    To navigate, reorder, show, or hide tabs, see Work with endpoint details.

  4. Edit the sections and panels as necessary (see Edit tabs), and then click Save.

Edit tabs

You can edit an existing tab to change its settings or to add, remove, and reorder sections and panels.

You require Reporting Dashboard write permission to edit tabs. See User role requirements.

For Tanium Managed tabs, you can edit only the content set assignment. However, you can clone a Tanium Managed tab and edit all the settings of the clone. See Clone a tab.

  1. Open the Endpoint Details page for an endpoint. See View endpoint details.
  2. Click the tab that you want to edit.
  3. To edit the tab name, content set assignment, or description, click Edit beside the name, update the settings, and click Save. For details on these settings, see Tab settings.
  4. To reconfigure the tab sections and panels, click Edit and perform whichever of the following tasks are necessary.

    If adding a panel to a section is the only change that you want, you can bypass the Edit button and instead click Edit in the section and select Add <panel type>.

    The tab editor contains a grid layout to assist when you resize and move panels within the grid.

    If you resize or move panels in a section, the section might automatically resize vertically to match the largest height of panels.

    Tab editing tasks
    TaskDescription
    Add sectionsSee Add sections.
    Edit section namesType over the existing name for a section to rename it. The name can have up to 255 characters.
    Add panels

    Add one or more panels to each section:

    Edit panelsClick Edit at the top of a sensor details panel or text panel and then configure the settings as you do when adding those panel types. You cannot edit a preconfigured panel.
    Move sectionsSelect Reorder Sections, and then click and drag sections into the desired order.
    Move panelsClick the white space in a panel, and then drag the panel to the desired location. When you release the mouse button, the panel snaps to the nearest coordinates on the design grid.
    Resize panelsClick and drag any panel corner or panel edge midpoint. When you release the mouse button, the panel snaps to the nearest coordinates on the design grid. The size of the panel determines how much data it shows. To show more data, enlarge the panel.
    Delete sectionsClick Delete beside the section name to delete the section and any panels in it.
    Delete panelsClick Delete Delete at the top of the panel.
  5. Click Save when you finish editing the tab.

Any changes that you make to the tab are not saved until you click Save.

Add sections

Within a tab, a section is a collapsible division by which to group panels. A tab can contain multiple sections, and each section can contain multiple panels. A tab requires at least one section. If you add a panel to a tab without a section, Reporting automatically creates a section for the panel.

You cannot add sections or panels to Tanium Managed tabs. However, you can clone a Tanium Managed tab and add sections and panels to the clone. See Clone a tab.

  1. Open the Endpoint Details page for an endpoint. See View endpoint details.
  2. Open the tab where you want to add sections, and then click Edit.
  3. At the top of the tab, select Add > Add Section.
  4. Scroll to the bottom of the tab to find the new section.
  5. Enter a section name of up to 255 characters.
  6. Add one more panels to the section:
  7. Click Save when you finish editing the tab.

Add text panels

A text panel contains static text that provides context to a tab or a section within a tab. For example, you can add a text panel to explain the purpose and contents of a tab to other users.

  1. Open the Endpoint Details page for an endpoint. See View endpoint details.
  2. Open the tab where you want to add panels, and then click Edit.

  3. Perform one of the following steps based on where you want to add the panel:

    • Bottom section: At the top of the tab, select Add > Add Text Panel.
    • Any other section: In the section where you want the panel, select Add > Add Text Panel.

  4. Configure the following settings in the Edit Text dialog to compose the panel text, and then click Done.

    Text panel settings
    Setting Description
    Syntax Use the dropdown to select the syntax of selected text, or to enter new text with that syntax.
    B To apply bold formatting to text, select it and click B.

    Add Link

    To add a link, click Add Link , enter the Text to display, enter the Link URL, and click Save. The link can be absolute or relative. The icon that renders with the link indicates if the link is external or links to another page in the Tanium Console.

    For security, a confirmation prompt appears when a user clicks an external link in the Console. If the link targets a Console page for which the user does not have access permissions, the link renders as static text.

    Add Metric

    To add metrics to the panel:

    1. Click Add Metric , enter a name and value for the metric, and specify any optional fields.

    2. If you are finished adding metrics, click Apply to add the metric to the text panel and to close the Edit Metric dialog. If you want to add another metric, click Add to add the metric to the text panel but keep the Edit Metric dialog open.

    To include multiple metrics in a horizontal row, select the Metric Set option from the dropdown menu on the Edit Text dialog. A shaded row appears in the dialog. Click the row, and then click Add Metric . When you add metrics, click Add to add another metric to the row.
  5. Click Save when you finish editing the tab.

Add preconfigured panels

Tanium supplies a gallery of preconfigured panels with information that might be useful to repeat across many custom tabs. For example, you can add the Maintenance Windows panel to multiple tabs where it is useful for users to know the schedules for software deployment.

  1. Open the Endpoint Details page for an endpoint. See View endpoint details.
  2. Open the tab where you want to add panels, and then click Edit.

  3. Perform one of the following steps based on where you want to add the panel:

    • Bottom section: At the top of the tab, select Add > Add Preconfigured Panel.
    • Any other section: In the section where you want the panel, select Add > Add Preconfigured Panel.
  4. Select panels to add and then click Add Panels.

    Filter the list of panels by entering a text string containing all or part of a panel name in the Filter items field at the top of the Add Preconfigured Panels dialog.

  5. Click Save when you finish editing the tab.

Add sensor details panels

When you create a custom tab, add a sensor details panel to include endpoint information that preconfigured panels do not provide. You select which sensors (data sources) provide the information in a sensor details panel.

  1. Open the Endpoint Details page for an endpoint. See View endpoint details.
  2. Open the tab where you want to add panels, and then click Edit.

  3. Perform one of the following steps based on where you want to add the panel:

    • Bottom section: At the top of the tab, select Add > Add Sensor Details Panel.
    • Any other section: In the section where you want the panel, select Add > Add Sensor Details Panel.
  4. In the Source Data panel, add sources to the panel as columns. Perform any of the following tasks to manage source selections:
    Sensor details source data
    TaskDescription

    View source details

    To view the description and details for a source, hover over Info beside its name.

    Add sources

    Use one of the following options to add sources:

    • Quick Column Add: If you know the name of a particular source, enter a text string with all or part of its name and select the matching option in the dropdown.
    • Available Columns: Browse the available sensors and fields that you can add to the report. Expand Expand each category of sources to lists its sensors and fields. To add a source, click Add beside its name. To add a subset of the columns in a multi-column sensor, expand Expand the sensor and Add each column that you want to include.

    Reporting prompts you to select parameters if a source requires them.

    Remove sources

    		In the Selected Columns list, click Remove beside a source name to remove it from the report, including all the columns in a multi-column sensor. Click Remove beside a particular column name to remove only that column in a multi-column sensor.
    Reorder columnsIn the list of sources under Panel Name, drag the column names in the desired order.
  5. Enter a Panel Name and click Done.
  6. Click Save when you finish editing the tab.

Deploy actions

The Endpoint Details page provides information that can help you determine if an endpoint requires an action. If the endpoint is Online Online, you can deploy the action directly from the page.

Interact Execute action permission is required to deploy actions.

Quarantine actions are available only if you install the Tanium™ Quarantine solution. For the full requirements and OS-specific details, see Tanium Threat Response User Guide: Isolating endpoints.

  1. Open the Endpoint Details page for the endpoint. See View endpoint details.
  2. Deploy an action to the endpoint by selecting a Deploy Action option at the top of the page. The available actions vary by endpoint OS.
    ActionOperating SystemDescription
    RebootAllReboot the endpoint.
    QuarantineWindows, macOS

    • Windows endpoint: Quarantine an endpoint on which the Windows IPsec Policy Agent is running.

    • macOS endpoint: Quarantine an endpoint that has Packet Filter (PF) software installed.

    Quarantine with IPTablesLinuxQuarantine an endpoint that supports the iptables module.
    Quarantine with SELinux PolicyLinuxQuarantine an endpoint that supports SELinux policies.
    All ActionsAllOpen the Action Deployment page, where you can configure a custom action. See Tanium Console User Guide: Deploying actions.

Open Screen Sharing sessions

Open a Screen Sharing session to remotely view and control an endpoint for investigating and troubleshooting issues on it. Screen Sharing is particularly useful for IT help desk technicians to determine root causes that the endpoint user cannot determine. The endpoint must be Online Online to establish a Screen Sharing session.

You must set up Screen Sharing before you can open a session. For details, see Tanium Direct Connect User Guide: Opening screen sharing sessions.

  1. Open the Endpoint Details page for the endpoint. See View endpoint details.
  2. Click Open Screen Sharing Session to connect to the endpoint.
  3. (Windows endpoints only) Select Ask the endpoint user for permission to start an attended session or clear the check box to start an unattended session.
  4. (Optional) Select or clear Record session if this option was configured during the Screen Sharing setup.

  5. Click Open to start the session.

    Tanium Cloud The Tanium Server deploys an action to the endpoint that includes an executable file that connects to ScreenMeet services. Establishing connections can take between one and three minutes. If you initiated an attended session that is on the computer of an end user, the user must accept the session on the computer before you can continue.

    When the connection is established, your screen switches to ScreenMeet in Tanium. You can use Support Tools in ScreenMeet to run Windows commands, tasks, tools, and so on.

    To configure ScreenMeet settings or perform other Screen Sharing tasks, see Tanium Direct Connect User Guide: Opening screen sharing sessions.

  6. Click End Screen Sharing when you finish the session.

Delete tabs

When you delete a tab, any panels and sections in the tab are also deleted.

You cannot delete Tanium Managed tabs.

You require Reporting Dashboard write permission to delete custom tabs.

  1. Open the Endpoint Details page for an endpoint. See View endpoint details.
  2. Open the tab that you want to delete, and then click Delete.