Working with reports

Use Reporting to create and view reports with data that Tanium Data Service collects. Select the data that you want to include in the reports, and then add filters to limit the report data to endpoints in specific computer management groups or endpoints with specific operating systems (OSs).

View reports

Perform the following steps to open a report. You can access only reports that are in content sets for which you have Report read permission.

  1. From the Main menu, go to Data > Reports.

    The Reports page lists all the reports that you have permissions to access.

    Click Create Report to open the Explore Data page, where you can create a new report. See Explore data and create reports.

  2. (Optional) Use the following search and filter options to facilitate finding specific reports if the grid is long. The grid shows only the reports that match all the filters and search text that you specify.

    Report search and filter options
    Option Description

    Filter by favorites

    Use the Show buttons to toggle between showing All reports or only reports that are in your favorites list .

    Click beside a report name to add the report to your favorites list or click to remove the report from your favorites list.

    Filter by content set Select a content set to show only the reports that are assigned to that set.
    Filter by author Select a user name to show only the reports that the user created or select one of the Tanium Managed options to show only the predefined reports that Tanium provides (see Tanium-managed reports).

    Filter by creation date

    Date range

    Specify a range of report creation dates by clicking the Created on and to calendar widgets Date range.
    Search by text Enter an alphanumeric string to match by report name or description.
  3. Click a Report Name to open that report. You can then perform the following report management tasks:
    Report management tasks
    TaskDescription
    View or edit basic report settings

    To show the report description, content set assignment, and label assignments, click beside the report name. To edit these settings or the report name, click Edit beside the name, update the settings, and click Save. For details, see Report settings.

    For Tanium Managed reports, you can edit only the content set and label assignments.

    Set favorite status

    Click beside a report name to add the report to your favorites list or click to remove the report from your favorites list.
    Customize appearanceYou can control how the report presents data to suit your current workflow. For example, you can filter the data, hide charts, and collapse or expand sections. See Manage report presentation.
    Explore and manage endpointsView comprehensive details for a specific endpoint, deploy an action to the endpoint, or perform other endpoint exploration and management tasks. See Perform advanced exploration and management of endpoints.

    Copy cell

    Options Copy

    To copy the contents of a single cell, hover over the cell, click Options Options, and click Copy Cell Value Copy.
    Clone reportClick Save As and perform the steps under Clone reports.
    Create new reportClick New Report to open the Explore Data page and then perform the steps under Explore data and create reports.
    Edit report contents and filtersClick Edit Data and perform the steps under Edit reports to change which data the report includes.

    Export as CSV

    Export

    To export the report as a CSV file, click Export and perform the steps under Export reports to CSV.
    Delete reportClick Delete and perform the steps under Delete reports.

Explore data and create reports

Use the Explore Data page to view endpoint data in a grid format and add charts to help visualize the data. You can then save the view as a custom report. After you add Source Data to the view, you can explore and manage endpoints with or without saving the view as a report (see Perform advanced exploration and management of endpoints).

The Source Data panel contains sensors that are registered with Tanium Data Service (see Data sources). To add sensors to the Source Data panel, register existing Tanium sensors with Tanium Data Service or create new sensors and then register them (see Tanium Console User Guide: Manage sensor results collection).

If an existing report is similar to the report that you want to create, cloning the existing report is often easier than creating a report from scratch. See Clone reports.

  1. From the Main menu, go to Data > Explore Data.

    You can also access the Explore Data page from within an existing report (click New Report) or from the Data > Reports page (click Create Report).

  2. In the Source Data panel, select source data to include in the report as columns.

    Each report can contain up to 25 columns. Perform the following tasks to manage source selections:

    Report source data management
    Task Description

    View source details

    To view the description and details for a source, hover over Info beside its name.

    The details indicate if the source is Targetable Targetable. If you add a non-targetable Non-targetable source, you cannot use that source to target endpoints when issuing questions or creating deployments.

    Add sources

    Use one of the following options to add sources:

    • Quick Column Add: If you know the name of a particular source, enter an alphanumeric string that contains all or part of the name and then select the matching option in the dropdown.

    • Available Columns: Browse the available sensors and fields that you can add to the report. Expand Expand each category of sources to lists its sensors and fields. To add a source, click Add beside its name. To add a subset of the columns in a multi-column sensor, expand Expand the sensor and Add each column that you want to include.

    Reporting prompts you to select parameters if a source requires them.

    Remove sources

    In the Selected Columns list, click Remove beside a source name to remove it from the report, including all the columns in a multi-column sensor. Click Remove beside a particular column name to remove only that column in a multi-column sensor.

    Reorder columns

    In the report grid header, click Customize Columns and drag the column names in the desired order.

    Customize column names

    In the report grid, click in the column header, edit the name, and click Apply. The custom name applies only in the current report, not in other reports nor in the configuration of the sensor that provides the column data.

    Flatten data

    In the Selected Columns list, click beside a source name to flatten the grid data for that source. The icon indicates the column that is currently flattened. By default, data in the report grid is flattened for the first column that you add to a report. For details about flattening, including an example, see Flattened data.
  3. (Optional) Add filters in the report header to show only results that match the filter criteria. See Basic filters and Advanced filters.
  4. (Optional) Add a chart (visualization) to appear above the report data grid.
    1. Click Add Visualization.
    2. Configure the data grouping settings:
      Chart data grouping settings
      SettingDescription
      Group By Column

      (Optional) Select one or more report columns by which to group data on the chart. Reporting performs aggregations for each group that you select. The combined values of the selected groups appear as labels on the chart. Reporting automatically populates the dropdown with the grid columns. If you do not select an option, Reporting shows results as a single aggregate.

      Aggregate

      Aggregation summarizes the data in each group. This field appears for number charts and charts with numeric columns. You can select:

      • Count: Display the number of items in the group.
      • Percentage: (Number charts only) Display the data as a percentage of the selected group divided by the total of all groups in the source column. For example, consider a column that contains 100 rows: 75 rows contain True, 20 rows contain False, and 5 rows contain N/A. If you aggregate by percentage and select False for the Group, the percentage that appears is 20% based on the formula (20 / (75+20+5)) * 100.
      • <column name> [Average | Max | Min | Sum]: If the report contains numeric columns, you can also aggregate the data in each group based on a numeric column. The following options are available for each numeric column:
        • Average: Display the total value of all items in the group (the Sum) divided by the number of items in the group.
        • Max: Display the maximum item value in the group.
        • Min: Display the minimum item value in the group.
        • Sum: Display the total value of all items in the group.
      If a chart does not contain the Aggregate field, Reporting automatically aggregates the results by Count.
    3. Select a chart type: vertical bar Vertical bar chart or donut Donut chart. For more information, see Reference: Chart options in Reporting.
    4. Configure the following chart settings and click Done. The available settings depend on the report and the chart type.
      Chart panel settings
      SettingDescription
      NameEnter a name of up to 255 characters to appear at the top of the chart.
      DescriptionEnter a description to appear under the chart name.
      Max ResultsThe maximum number of items to show in the chart.
      Scale

      For vertical bar charts, select how to scale values on the y-axis. Options include:

      • Linear: Use consistent values on the y-axis. For example, if the minimum data point on a chart is 1, and the maximum data point is 100, the y-axis values would be 0, 20, 40, 60, 80, and 100.
      • Logarithmic: Scale the y-axis on an exponential basis. Use this option for charts that contain a large range of data points.
      Value Format

      Select a format for the chart values if the Aggregate is set to a percentage or numeric column value:

      • Percent: Adds % as a suffix to the values
      • None: No suffix is added

      The format selection controls only the value unit that appears in the chart and does not change the actual value.

      The format option is not available for table charts or charts in which the Aggregate is set to Count.

      SortSelect an item name or value (result) by which to sort items in the chart. Click for ascending order (low to high) or for descending order (high to low).
      Timeframe LabelFor donut charts, enter text to display under the chart.
      X-Axis LabelFor vertical bar charts, enter a label to display horizontally under the chart.
      Y-Axis LabelFor vertical bar charts, enter a label to display vertically to the left of the chart.
      Legend Display OptionsUse this section to customize the items that appear in the chart.
      • Exclude items: Clear the check box for an item to exclude that item from the chart.
      • Customize colors: Click the colored disk beside an item to change the color that the chart uses for the item. Multiple items can use the same color.
      Conditional FormattingExpand Conditional Formatting and click + Add to add a label to the chart when a threshold condition is met. You can also apply the conditional color to the chart background, which overrides the default background color. Conditional formatting enables users to can easily identify charts that need attention. You can add multiple conditions to a chart. Reporting evaluates conditions in descending order and applies the first condition that triggers a match.
  5. Click Save Report, configure the following settings, and then click Save:
    Report settings
    SettingDecription
    Report NameEnter a name of up to 255 characters to identify the report.
    Content SetAssign the report to a Content Set. The dropdown lists only the content sets for which you have Report write permission. Only users who have Report read permission for the content set can access the report.
    Description (optional)Enter a description for other users to understand the purpose and contents of the report.
    Labels (optional)Assign one or more labels to enable quicker access to the report. For information on labels, see Managing labels.

Reporting saves the report and opens it in view mode. To customize how the report presents data, see Manage report presentation.

Clone reports

If the settings and contents of an existing report are similar to the report that you want to create, cloning the existing report is often easier than creating a report from scratch. Labels are copied from the existing report to the clone. Any filters or sorting that you configured when viewing the existing report are not saved in the clone.

  1. Open the report that you want to clone. See View reports.

  2. Click Save As, configure the settings (see Report settings), and click Save.

    Reporting saves the report and opens it in view mode. To customize how the report presents data, see Manage report presentation.

  3. Click Edit Data to edit the report contents, such as data sources, charts, and filters, and then click Save. For details about editing the content, see Explore data and create reports.

Manage report presentation

After you open a report (see View reports) or add Source Data in the Explore Data page (see Explore data and create reports), you can perform the following tasks to manage how the report or page presents data to suit your current workflow.

If you configure multiple filters, the report or Explore Data page shows only the data that matches all the filters. The report or page filters first by the basic filters (see Basic filters) and then by the advanced filters (see Advanced filters).

Report presentation options
Option Description

Report settings

Click Expand beside the report name to view report details, including the description, content set, author, last updated date, and a list of dashboards that use the report data. This option applies only to existing reports, not to unsaved views that you construct in the Explore Data page.

To edit the configurable settings (report name, description, label assignments, and content set assignment), click Edit beside the report name, reconfigure the settings, and click Save. For Tanium Managed reports, you can edit only the label and content set assignments. For details on the settings, see Report settings.

Favorite

You can filter the Data > Reports page to show only your favorite reports. To include a report in the favorites list, click beside the report name. To remove a report from the favorites, click beside the report name.

Refresh

If endpoint data might have changed since you opened the report, click Refresh to show the updated data.
Sort Click a column heading to sort the grid rows based on the alphanumeric order of the values in that column.

Copy cell value

Options Copy

To copy the contents of a single cell, hover over the cell, click Options Options, and click Copy Cell Value Copy.

Show Visualization

Show visualization Hide visualization

If the report contains a chart (visualization), use the Show Visualization toggle to show Show visualization or hide Hide visualization the chart.

View as CSV

Export

Click Export to CSV Export to download a copy of the report as a CSV file, which you can then open in any application that supports the CSV format. The CSV file includes the report name, headers, and grid data. See Export reports to CSV.

Filter by value

Options Filter

To filter the report by a particular cell, hover over the cell, click Options Options, and click Filter by Value Filter. The filter condition then appears in the advanced filters section (see Advanced filters).
Filter items Enter an alphanumeric string in the Filter items field to show only the matching data values in the report grid.
Basic filters

Apply any of the following basic filters to the report data:

  • Filter Group: After you select one or more filter groups, Reporting refreshes the report to show results only from those groups. If the list of groups is long, use the search field within the Filter Group dropdown to quickly find groups. The search field shows each selected group as a pill with an X (such as Filter group). Click X to remove the group from the filters.

    Some Tanium-managed reports are associated with an action group that has filter groups as members. These reports show a pill for each member under the other basic filter fields. If you do not have RBAC permissions for one of those filter groups, the pill label is Inaccessible Group. You can remove filter groups that are members of an action group, but you cannot add an action group as a filter or restore members that you removed.

    The Filter Group dropdown contains only the groups that are assigned to a content set for which you have Filter Group read permission. For details about filter groups, see Tanium Console User Guide: Managing filter groups. For details about configuring and assigning role permissions, see Tanium Console User Guide: Managing roles. For details about action groups, see Tanium Console User Guide: Managing action groups.

  • OR/AND: Select AND if an endpoint must match all the Filter Group, Endpoint Last Seen, and OS filters for the report to include results from the endpoint. Select OR if an endpoint must match at least one of these filters for the report to include results from the endpoint.

    If you select multiple filter groups and select AND, all the selected filter groups must return the results for the report to include those results.

    This setting has no effect if you apply only one basic filter.

  • Endpoint Last Seen: Select to show results only from endpoints last seen during the date range. Options include viewing results in the last 24 hours, last 48 hours, and last 7 days. If you do not select an option, results include all data stored in Tanium Data Service for the last 30 days.
  • OS: Filter the report by endpoint OS:
    • All OSs
    • Windows Windows
    • macOS macOS
    • Linux Linux
Advanced filters

Configure filters based on data source conditions. If necessary, you can configure nested filters.

If you add a non-targetable source Non-targetable as a filter, you cannot use that source to target endpoints when issuing questions or creating deployments. To check if a source is targetable, hover over Info beside the source name in the Source Data panel.

The OR/AND option that you select for basic filters does not apply to advanced filters.

  1. Expand the Filters section. Repeat the remaining steps for each filter.
  2. Click add Add filter and select one of the following options:
    • Add Row: Add one or more conditions that results must match. For each condition, select a source, select a column if the source is a multi-column sensor, select an operator, and enter a value to match.
    • Add Group: Select this option to nest a Boolean operator and then add Add filter a row or subgroup to build the nested expression.
  3. Apply Apply the filter.

If necessary, you can edit Edit or delete Delete filters.

Perform advanced exploration and management of endpoints

After you add data sources in the Explore Data page or open a report (see Explore data and create reports), you can perform the following tasks to see more detailed information about endpoints or to manage the endpoints that provide the source data:

Endpoint exploration and management tasks
Task Description
Issue drill-down question To view additional information about endpoints by issuing a new question, select the data from the target endpoints and click Drill Down in Interact. See Investigate report data in Interact.
View Endpoint Details page To view additional information about a specific endpoint without issuing a new question, add Computer Name as source data and click the Computer Name of a specific endpoint. See Viewing and managing a single endpoint.
Open drill-down report To view additional information about endpoints that are associated with a common value (such as endpoints that are missing scan results), click the Count value for the endpoints to open a drill-down report. See Work with drill-down reports.
Deploy actions or OS patches Select the data from the target endpoints and select a Deploy Action option. See Deploy an action or patch from a report.

Edit reports

After you create a report, you can edit the report to add and remove sources, reorder columns, change filters, or change column widths. You can also update the report name, description, content set assignment, or label assignments.

For Tanium Managed reports, you can edit only the content set and label assignments. However, you can clone a report and edit all the settings of the clone. See Clone reports.

  1. Open the report that you want to edit. See View reports.
  2. To edit the report name, description, content set assignment, or label assignments, click Edit beside the name, update the settings, and click Save. For details on these settings, see Report settings.
  3. To edit the report content (such as data sources, charts, and filters), click Edit Data, edit the content, and click Save. For details about content configuration options, see Explore data and create reports.

Export reports to CSV

You can download a report as a CSV file to the computer that you use to access the Tanium Console:

  1. From the Main menu, go to Data > Reports.
  2. Click the Report Name to open the report and then click Export to CSV Export.
  3. Enter a File Name for the report, and click Export.
    If you omit the file extension, Reporting appends .csv to the file name.

Reporting exports the CSV file to the downloads folder of your local browser.

Export reports through Tanium Connect

Use Connect to send reports to Connect destinations.

Before you begin

  • Your Tanium license must include Connect.
  • You must install Connect 5.9.65 or later and Reporting 1.7 or later.
  • You must have access to Connect with the Connect Operator or Connect Administrator role.
  • You must have a role with the Report read and Report API user permissions. Predefined roles with required permissions include Reporting Operator and Reporting User.
  • Reporting must have one or more reports.

For best results, set your desired filters, flattening, column names, and column ordering in Reporting so that column customizations are not necessary when you set up an export through Connect.

Create a connection

The following steps describe the basic settings that you configure for a connection. Additional settings vary by connection destination. For details, see Tanium Connect User Guide: Managing connections.

  1. From the Main menu, go to Modules > Connect.
  2. From the Connect Overview page, scroll to the Connections section and click Create Connection.
  3. In the General Information section, enter a Name and optional Description for the connection.
  4. In the Configuration section, select Tanium Reporting (Source Data) for the Source.
  5. In the Report field, select the report to export.
    If reports have duplicate names, you can distinguish them by the author and report ID that are appended to the report names. The ID for a report appears in the browser URL field when you view the report. For example, the Patch Coverage Status report has id=default-patch-coverage-status appended to its URL. See View reports.
  6. Select the Destination where you want Connect to send the report. Provide any additional configuration for the type of destination you select.
  7. Scroll to the Configure Output section and select a Format for the exported report.
  8. (Optional) Configure a Schedule to send the report.
  9. Click Save.

When the connection runs, the report is sent to the destination according to the schedule that you set. To manually export the report using the connection settings, select the connection on the Connect Overview page and click Run Now.

Investigate report data in Interact

If a report shows data that warrants further investigation, you can issue a question to the endpoints that provided the data and analyze the results on the Interact Question Results page. For example, if the EP Management - Antivirus Health report indicates that Windows Defender is off on some endpoints, you can issue the question Get Installed Application Exists[Windows Defender] to determine if the application is installed on those endpoints. From the Question Results page, you can then investigate the data further or deploy a corrective action to the endpoints.

Question targeting

When you issue a question, Interact targets the endpoints based on report sources, configured filters, and your data selections. For example, if the report source is Operating System, you apply the filter Windows OS Type contains Workstation, and you select the result data for Windows 10 Enterprise, the question targets workstation endpoints that run Windows 10 Enterprise. Interact can apply no more than 100 filters when targeting endpoints, regardless of whether those filters are manually configured or based on selected data. For example, if the report source is Installed Applications - Name and you select a row with 50 values for that column, Interact applies each of those values as a filter for targeting. If the combination of configured filters and filters based on selected data exceeds 100, the Drill Down in Interact button is disabled.

You can issue questions only for report data and filters that are targetable, which means they derive from sources that are present on endpoints. For example, if you select data in a report that uses only Endpoint ID as a source, the Drill Down in Interact button is disabled because that source is not present on endpoints (Tanium provides the Endpoint ID data). If the report data and filters include at least one source that is targetable but other sources that are not, you can issue questions but the non-targetable sources are excluded from the endpoint targeting criteria.

When you add Source Data to a report, hover over Info beside the source name to see whether it is targetable Targetable or non-targetable Non-targetable. The non-targetable Non-targetable icon also appears when you add a non-targetable source as a filter.

Drill down in Interact

  1. Open the report that contains the data to investigate. See View reports.

    You can also investigate data in Interact through the Explore Data page. See Explore data and create reports.

  2. Select the data that you want to investigate and click Drill Down in Interact.

    The Drill Down in Interact button is disabled if the result types of all columns do not match. To check the result type of columns derived from sensors, see Tanium Console User Guide: View sensor details.

  3. Use one of the following tabs to specify a question and then click Investigate:
    Saved Questions

    Lists saved questions that are assigned to content sets for which you have Saved Question read permission. By default, the list includes only questions that have the Display this question in the list of questions that are available for drilling down setting enabled. To include questions that do not have the setting enabled, select Show all questions. For details about the setting, see Tanium Console User Guide: Display this question in the list of questions that are available for drilling down.

    To filter the list so that it includes only saved questions with Visibility is set to Only the Owner and Admins can see this object, select Hide public questions.

    Create a QuestionEnter a question using the same syntax as in the Interact Ask a Question field. For details, see Tanium Console User Guide: Issue a question through the Ask a Question field.
    Build a QuestionConstruct a question using the same fields as in the Interact Question Builder. For details, see Tanium Console User Guide: Issue a question through the Question Builder.

    A dialog notifies you if the report data or filters include non-targetable sources that the question excludes from its targeting criteria.

    After you click Investigate, the Question Results page shows the results in a new browser tab.

  4. (Optional) Use the Question Results page to explore more details about the data (such as by issuing a drill-down question) or to deploy an action to the endpoints that provided the data. For more information, see:

Deploy an action or patch from a report

If a report indicates conditions that warrant intervention on endpoints, you can deploy actions or OS patches directly from the report. For example, if the EP Management - Antivirus Health report indicates that Windows Defender is off on some endpoints, you can deploy an action that turns it on.

To deploy patches, your Tanium license must include Tanium™ Patch Tanium™ Patch 3.11 or later must be installed.

Deployment targeting

Action and patch deployments target endpoints based on report sources, configured filters, and your data selections. For example, if the report source is Operating System, you apply the filter Windows OS Type contains Workstation, and you select the results data for Windows 10 Enterprise, the deployment targets workstation endpoints that run Windows 10 Enterprise. Reporting can apply no more than 100 filters when targeting endpoints, regardless of whether those filters are manually configured or based on selected data. For example, if the report source is Installed Applications - Name and you select a row with 50 values for that column, Reporting applies each of those values as a filter for targeting. If the combination of configured filters and filters based on selected data exceeds 100, the Deploy Action button is disabled.

The deployment feature is available only for report data and filters that are targetable, which means they derive from sources that are present on endpoints. For example, if you select data in a report that uses only Endpoint ID as a source, the Deploy Action button is disabled because that source is not present on endpoints (Tanium provides the Endpoint ID data). If the report data and filters include at least one source that is targetable but other sources that are not, you can deploy an action or patches but the non-targetable sources are excluded from the deployment targeting criteria.

When you add Source Data to a report, hover over Info beside the source name to see whether it is targetable Targetable or non-targetable Non-targetable. The non-targetable Non-targetable icon also appears when you add a non-targetable source as a filter.

Deploy an action or patch

  1. Open the report that contains data from endpoints that require the action or patch. See View reports.

    You can also deploy an action or patch through the Explore Data page. See Explore data and create reports.

  2. Select the endpoints that require an action or patches.
  3. Click Deploy Action and select an option:
    The Deploy Action button is disabled if the result types of all columns do not match. To check the result type of columns derived from sensors, see Tanium Console User Guide: View sensor details.

    A dialog notifies you if the report data or filters include non-targetable sources Non-targetable that the action excludes from its targeting criteria. Click Continue to Create Deployment if you want to proceed with the deployment.

Work with drill-down reports

In reports with a Count column, each Count value is a link that opens a drill-down report for the endpoints that are associated with the value. For example, if the Patch Coverage Status report indicates that some endpoints are Missing Scan Results, you can click their Count value to open a report that contains additional information for those endpoints. ADI - Basic Inventory is the default drill-down report but you can select a different report.

Select the drill-down report

  1. From the Main menu, go to Data > Settings > Drill-down Report.

  2. Select the Report and click Save.

    Select a report that is in the Reporting content set to avoid possible user permission errors. Content set permissions in the roles that are assigned to a user determine which reports that user can open.

Open a drill-down report

  1. Open the report that contains data from the endpoints for which you want to see a drill-down report. See View reports.

    You can also open a drill-down report through the Explore Data page. See Explore data and create reports.

  2. Click the Count value for the endpoints that you want to analyze further.

    The drill-down report opens in a new browser tab.

Delete reports

Deleting a report deletes the report configuration, but does not delete any data sources. To delete a report that supplies data to charts on dashboards, you must first either delete the dashboards (see Delete dashboards) or the charts that use the report data (see Edit dashboards).

You cannot delete Tanium-managed reports.
  1. From the Main menu, go to Data > Reports.
  2. Click the Report Name to open the report, and then click Delete.