Working with reports

Use Reporting to create and view reports with data that is collected by Tanium Data Service. Select the data that you want to include in the reports, and then add filters to limit the data in the report to endpoints in specific management groups or endpoints with specific operating systems.

View reports

You can view any report to which you have role-based access control (RBAC) permissions.

  1. From the Main menu, go to Data > Reports.
    The Reports page opens to show all reports to which you have access.
    • Use the search and filter controls above the list of reports to show only reports that match the criteria you specify. Reports must match all filters and any search text to appear in the reports grid.
      • Enter a value in the Search by text field to show results whose report name or description contains the text.
      • You can filter the reports grid by favorites, content set, author, and creation date.
    • Click next to a report to add the report to your favorites list, or click next to a report to remove the report from your favorites list. You can filter the reports to show only your favorite reports.
  2. Click the report that you want to view. When viewing a report, the following options are available:
    • Search, filter, and sort the data in the report.
      • To filter the report by a particular cell, hover over the cell, click Options Options, and click Filter by value Filter.
    • Click Refresh to show updated report data.
    • Click Expand next to the report title to view details about the report, including the description, content set, author, last updated date, and a list of dashboards that use data from the report. To edit the name, description, assigned labels, or content set for the report, click Edit next to the report name.
    • If the report contains a visualization, use the Show Visualization toggle to show and hide the visualization.
    • To copy the contents of a single cell, hover over the cell, click Options Options, and click Copy Cell Value Copy.
    • Click Save As to create a copy of the report. Labels are copied to the new report. Any filters or sorts that you added when viewing the original report are not saved.
    • Click Edit Data to edit the content of the report, including any filters. After you make changes, click Save.
    • Click Export to download a copy of the report as a CSV file. The CSV file includes the report name, headers, and table data.
    • Click Delete to delete the report. Deleting a report deletes the report configuration, but does not delete any data sources.
    • Click New Report to create a new report.
    • If the report contains the Computer Name column, you can click an endpoint to view basic details for the endpoint. From the basic details, click View Details to view additional information for the endpoint, where you can also deploy an action to the endpoint. For information. see View details for a single endpoint.

Create report

  1. From the Main menu, go to Data > Explore Data.

    Use the Explore Data page to view endpoint data and customize the columns to include in the report.

  2. In the Source Data panel, select data to include in the report as columns.

    A single report can contain up to 25 columns. You can choose to include only the columns from the sensors that you need.

    You can use the Explore Data page to view additional information about a particular endpoint with or without creating a report. To see details for an endpoint, select Computer Name under Reserved in the Source Data panel and then click the Computer Name of a specific endpoint. For more information, see View details for a single endpoint.

    • If you know which data you want to add to the report, use the Quick Select to quickly select the data.
    • If you want to browse available data, use the Available Columns list to see the available sensors and fields that you can add to the report.
      • Click Add next to a sensor name to add all sensor fields as columns to the report.
      • Click Add next to a sensor field to add the field as a column to the report.
    • To view a description and details for a source data, click Info next to the name.


    • If you select a data source that requires parameters, Reporting prompts you to choose parameters.

    • To remove a column from the report, click Remove next to the corresponding field in the Selected Columns list.
    • To remove all columns provided by a sensor, click Remove next to the sensor in the Selected Columns list.
    • To edit the name of a column, click in the column header. After you edit the name, click Apply.
    • To reorder columns, click Customize Columns and drag the column names in the desired order.

    The Source Data panel contains sensors that are registered with Tanium Data Service. To add sensors to the Source Data panel, you can register existing Tanium sensors with Tanium Data Service, or create new sensors and then register the sensors with Tanium Data Service. For more information, see Tanium Console User Guide: Manage sensor results collection.

  3. Select a column by which to flatten results.
    • By default, table data is flattened for the first column that you add to a report, but only if the column can contain multiple values in each row. If a column has only one value in each row, flattening is unnecessary and the flatten icon does not appear for that column.
    • Flattening results for a column that is sourced by a sensor flattens results for all fields that are returned by the sensor.
    • The column that is currently flattened contains a icon in the Selected Columns list in the Source Data section.
    • To change the column on which to flatten results, click next to the column data in the Selected Columns list.
    • Results must be flattened by one column. If you remove the data source for a flattened column from a report, the first column in the report becomes the flattened column.
    • If one or more dashboards use the report to supply chart data, you cannot change the flattening in the report.
    • If any dashboards use the report, you cannot save the report after you change which column is flattened.
    • For more information, see Flattened data.
  4. Add any filters in the header of the report to show only results that match the criteria that you specify. The following basic filters are available:
    Basic filters
    FilterDescription
    Computer Group

    Select one or more computer groups for which to show results from in the report. After you select an entry in the Computer Group drop-down, TaaSthe Tanium Server refreshes the report with the added filter. If the list of computer groups is long, use the typeahead within the Computer Group drop-down to quickly find computer groups.

    The Computer Group drop-down contains only the groups that are assigned to a content set for which your account has role permissions (filter groups). For information about the types of computer groups, including filter groups, see Tanium Console User Guide: Managing computer groups.

    AND/OR

    Select AND if an endpoint must match the Computer Group, Endpoint Last Seen, and OS filters to be included in the report. Select OR if an endpoint must match at least one filter to be included in the report.

    If you select more than one computer group and select AND, results must be contained in all selected computer groups to appear in the report.

    This setting has no effect if you only enter one basic filter.

    Endpoint Last SeenSelect to only show results from endpoints last seen during the date range. Options include viewing results in the last 24 hours, last 48 hours, and last 7 days.
    OSSelect an operating system for which to show results from in the report.

    To add advanced filters, click to expand the Filters section where you can configure multiple filters, including nested filters. Results are first filtered by the basic filters, and then advanced filters. Note the AND/OR option that you select for basic filters does not apply to advanced filters.

    Advanced filters
    FilterDescription
    + RowAdd one or more conditions that results must match. You can base each condition on the values in a Source column.
    + GroupingSelect this option to nest a Boolean operator and then use + Row to build the nested expression.
  5. (Optional) For each report, you can add a chart that appears above the report.
    1. Click Add Visualization.
    2. Choose a column on which to group the data.
      Group By Column

      (Optional) Select one or more report columns by which to group data on the chart. Aggregations are performed for each group that you select; the combined values of the selected groups appear as labels on the chart. This field populates from the columns in the chart. If you do not select an option, results are shown as a single aggregate.

      Aggregate

      Aggregation summarizes the data in each group. This field appears for number charts and charts with numeric columns. You can select:

      • Count - Display the number of items in the group.
      • Percentage - (Number charts only) Display the data as a percentage of the selected group divided by the total of all groups in the source column. For example, consider a column that contains 100 rows: 75 rows contain True, 20 rows contain False, and 5 rows contain N/A. If you choose to aggregate by percentage and then select False for the Group, the percentage that appears is 20% (( 20 / (75+20+5)) * 100).

      If the report contains numeric columns, you can also aggregate the data in each group based on a numeric column. The following options are available for each numeric column:

      • <column name> Average - Display the total value of all items in the group (the Sum) divided by the number of items in the group.
      • <column name> Max - Display the maximum item value in the group.
      • <column name> Min - Display the minimum item value in the group.
      • <column name> Sum - Display the total value of all items in the group.

      If a chart does not contain the Aggregate field, the results are automatically aggregated by Count.

    3. Select a chart type. Visualizations on reports can be vertical bar charts or donut charts. For more information, see Reference: Chart options in Reporting.
    4. Customize the chart settings. The available settings depend on the report and the chart type.
      Panel settings
      NameEnter a name to appear at the top of the chart. The name can have up to a maximum of 255 characters.
      DescriptionEnter a description to appear at the top of the chart, underneath the name.
      Max ResultsThe maximum number of items to display in the chart.
      Scale

      For vertical bar charts, select how to scale values on the y-axis. Options include:

      • Linear - Use consistent values on the y-axis. For example, if the minimum data point on a chart is 1, and the maximum data point is 100, the y-axis values would be 0, 20, 40, 60, 80, and 100.
      • Logarithmic - Scale the y-axis on an exponential basis. Use this option for charts that contain a large range of data points.
      SortSelect how to order the items in the chart.
      • You can order items in the chart by the name of the item, or by result (value of the item).
      • You can also toggle the sort order. Set to to sort the items in the chart in ascending order (low to high), or set to to sort the items in the chart in descending order (high to low).
      X-Axis LabelFor vertical bar charts, enter a label to display horizontally under the chart.
      Y-Axis LabelFor vertical bar charts, enter a label to display vertically to the left of the chart.
      Legend Display OptionsUse this section to customize the items that appear in the chart.
      • To exclude an item from the chart, deselect the checkbox next to the item.
      • Click the color next to any item to change the color that displays for that item. Colors can be reused by multiple items.
      Conditional FormattingExpand Conditional Formatting and click + Add to add a label to the chart when a threshold condition is met. In addition, you can apply the conditional color to the background of the chart; this setting overwrites the default background color. When you add conditional formatting, viewers can easily identify charts that need attention. You can add multiple conditions to a chart. Conditions are evaluated in descending order; the first condition that triggers a match is applied to the chart.
    5. Click Done. The visualization appears at the top of the report.
  6. When you finish the report, click Save Report, specify a name and description for the report, and assign a content set and any labels to the report.
    • The report name and content set fields are required.
    • A report is available only to users with permission to the content set.
    • Only content sets to which you have permission to assign reports appear as options.
    • You can assign one or more labels to the report for quicker access. For information on labels, see Managing labels.
  7. When you finish the report, click Save Report, specify a name and description for the report, and assign a content set to the report.
    • The report name and content set fields are required.
    • A report is available only to users with permission to the content set.
    • Only content sets to which you have permission to assign reports appear as options.
  8. Click Save.

Reporting saves the report and opens the report in view mode.

Edit report

After you create a report, you can edit the report to add and remove sources, reorder columns, change filters, change column widths, or update the report name, description and assigned content set.

For Tanium Managed reports, you can edit the content set and assign additional labels to the labels provided by Tanium. No other fields are editable. You can copy any report, including reports managed by Tanium, and then edit the new report.

  1. From the Main menu, go to Data > Reports.
  2. Click the report that you want to edit. The report opens in view mode.
  3. Click Edit Data to edit any content in the report. For options, see Create report.
  4. Click Save.
  5. (Optional) Edit the report name, description, or assigned content set.
  6. (Optional) Click Edit next to the report name to edit the report name, description, content set, and assigned labels.
  7. When finished, click Save.

Download report

You can download a report in a CSV format to a file on your local machine.

  1. From the Main menu, go to Data > Reports.
  2. Click the report to open the report, and then click Download as CSV.
  3. Enter a File Name for the report, and click Export.
    If you do not include file extension, Reporting appends a .csv extension to the file name.

The CSV file downloads to the download folder of your local browser.

Export reports through Tanium Connect

Use Connect to send reports to Connect destinations.

Before you begin

  • You must have access to Connect with the Connect Operator role.
  • You must have access to Connect with the Connect Operator or Connect Administrator role.
  • You must have a role with the Report read and Report API user permissions. Predefined roles with required permissions include Reporting Operator and Reporting User.
  • You must have Connect 5.9.65 or later and Reporting 1.7 or later.
  • You must first create a report in Reporting.

Create a connection

  1. From the Main menu, go to Modules > Connect.
  2. From the Connect Overview page, scroll to the Connections section and click Create Connection.
  3. In the General Information section, provide a name and description for the connection.
  4. In the Configuration section, select Tanium Reporting for the source.
  5. In the Report field, select the report to export.

    You can disregard the Report View field; that field will be used in a future update.

  6. For the destination, select where you want Connect to send the report. Provide any additional configuration for the type of destination you select.
  7. In the Configure Output > Format section, select an available format for the exported report.
  8. (Optional) In the Schedule section, set up a schedule to send the report.
  9. Click Save.

When the connection runs, the report is sent to the destination according to the schedule that you set. To manually export the report using the connection settings, select the connection on the Connect Overview page and click Run Now.

For more information about connections, see Tanium Connect User Guide: Managing connections.

Delete report

To delete a report that supplies data to charts on dashboards, you must first either delete the dashboards or the charts that use the report data.

Tanium Managed reports cannot be deleted.

  1. From the Main menu, go to Data > Reports.
  2. Click the report to open the report, and then click Delete.

View details for a single endpoint

When you view, create, or edit a report that contains the Computer Name column, you can click an endpoint in the column to view details for the endpoint and to deploy actions.

  1. Open a report that contains the Computer Name column.
  2. Click the name of an endpoint in the Computer Name column.
    An Endpoint Details dialog opens with basic details for the endpoint. If multiple endpoints have the same Computer Name, click Previous Previous or Next Next in the Multiple Results Found banner to find the details for a specific endpoint.
  3. Click View Details to open a page that shows a single endpoint view with detailed information.
  4. Click the tabs to navigate the categories of details.

    If some details are missing, see Tanium Reporting User Guide: Empty fields when viewing a single endpoint.

  5. (Optional) Deploy an action to the endpoint by selecting a Deploy Action option:

    Action deployment is enabled only for Online Online endpoints.