Working with reports

Use Reporting to create and view reports with data that Tanium Data Service collects. Select the data that you want to include in the reports, and then add filters to limit the report data to endpoints in specific computer groups or endpoints with specific operating systems (OSs). For an overview of reports, including Tanium-managed reports and flattening report data, see Reports.

View reports

Perform the following steps to open a report. You can access only reports that are in content sets for which you have Report read permission.

1. From the Main menu, go to Data > Reports.

   The Reports page lists all the reports that you have permissions to access.

   The page shows basic settings for each report, such as the Report Name and Content Set. If a report has a description, labels, and associated dashboards, click Expand beside the Report Name to see these additional settings. To see the additional settings for all reports, click Expand in the column heading. Associated dashboards are dashboards that use the report as a chart source (see Chart data sources). For details on other basic settings, see Report settings.

2. (Optional) Use the following search and filter options to facilitate finding specific reports if the grid is long. The grid shows only the reports that match all the filters and search text that you specify.

   Report search and filter options

   Option	Description
   Filter by labels	Select Labels to show only the reports to which those labels are assigned. You can also use the Labels panel to add, edit, or delete labels. See Managing labels.
   Filter by favorites	Use the Show buttons to toggle between showing All reports or only reports that are in your favorites list . Click beside a report name to add the report to your favorites list or click to remove the report from your favorites list.
   Filter by content set	Select a content set to show only the reports that are assigned to that set.
   Filter by author	Select a user name to show only the reports that the user created or select one of the Tanium Managed options to show only the predefined reports that Tanium provides (see Tanium-managed reports).
   Filter by creation date	Specify a range of report creation dates by clicking the Created on and to calendar widgets .
   Search by text	Enter an alphanumeric string to match by report name or description.

3. Click a Report Name to open that report. You can then perform the following report management tasks:

   Report management tasks

   Task	Description
   View or edit basic report settings	Click beside the report name to show the report description, content set assignment, label assignments, author (creator), creation date/time, date/time of the last update, and the dashboards that use the report. Each dashboard name is a link that opens the dashboard. Perform the following steps to edit the report name, description, content set assignment, or label assignments. For Tanium Managed reports, the only allowed edits are assigning a different content set and adding labels. Click Edit beside the report name. Update the settings and click Save.
   Set favorite status	Click beside a report name to add the report to your favorites list or click to remove the report from your favorites list.
   Customize filters and appearance	You can control how the report presents data to suit your current workflow. For example, you can filter the data, hide charts, and collapse or expand sections. See Manage report filters and presentation.
   Explore and manage a single endpoint	View comprehensive details for a specific endpoint, deploy an action to the endpoint, or perform other endpoint exploration and management tasks. See Perform advanced exploration and management of endpoints.
   Copy cell	To copy the contents of a single cell, hover over the cell, click Options , and click Copy Cell Value .
   Clone report	Click Save As and perform the steps under Clone reports.
   Create new report	Click New Report to open the Explore Data page and then perform the steps under Explore data and create reports.
   Edit report contents	Click Edit Data and perform the steps under Edit reports to change the data sources and charts that the report includes. The Edit Data button appears only for custom reports that are in a content set for which you have Report write permission. For other reports, see Explore data.
   Explore data	Click Explore Data to open the Explore Data page with all the report settings applied. You can then modify the settings to add, remove, or filter data without altering the original report. You can save the modified settings as a new report if you have Report write permission for one or more content sets (see Explore data and create reports). The Explore Data button appears only for reports that match one of the following conditions: The report is in a content set for which you have Report read permission but not write permission. The report is Tanium managed. For other reports, see Edit report contents.
   Export as CSV	To export the report as a CSV file, click and perform the steps under Export reports in CSV format.
   Export as JSON	To export the report as a JSON file to the downloads folder of your local browser, select Export > Report Definition as JSON. For details, see Export reports in JSON format. To import report configurations from a JSON file into another Tanium Cloud instanceTanium Server, see Import reports.
   Delete report	Click Delete and perform the steps under Delete reports.

Explore data and create reports

Use the Explore Data page to view endpoint data in a grid format and add charts to help visualize the data. You can then save the view as a custom report. After you add Source Data to the view, you can explore and manage endpoints with or without saving the view as a report (see Perform advanced exploration and management of endpoints). The Source Data panel contains sensors that are registered with Tanium Data Service (see Data sources). To add sensors to the panel, register existing Tanium sensors with Tanium Data Service or create new sensors and then register them (see Tanium Interact User Guide: Managing Tanium Data Service).

1. From the Main menu, go to Data > Explore Data.
   You can also access the Explore Data page from:

   • An existing report: Click New Report or (in a non-editable report) click Explore Data.
   • The Data > Reports page: Click Create Report.

2. In the Source Data panel, select source data to include in the report as columns.

   Each report can contain up to 25 columns. Perform the following tasks to manage source selections:

   Report source data management

   Task	Description
   View source details	To view the description and details for a source, hover over Info beside its name. The details indicate if the source is Targetable . If you add a non-targetable source, you cannot use that source to target endpoints when issuing questions or creating deployments.
   Add sources	Use one of the following options to add sources: Quick Column Add: If you know the name of a particular source, enter an alphanumeric string that contains all or part of the name and then select the matching option in the dropdown. Available Columns: Browse the available sensors and fields that you can add to the report. Expand each category of sources to lists its sensors and fields. To add a source, click Add beside its name. To add a subset of the columns in a multi-column sensor, expand the sensor and Add each column that you want to include. Reporting prompts you to select parameters if a source requires them.
   Remove sources	In the Selected Columns list, click Remove beside a source name to remove it from the report, including all the columns in a multi-column sensor. Click Remove beside a particular column name to remove only that column in a multi-column sensor.
   Reorder columns	In the report grid header, click Customize Columns and drag the column names in the desired order.
   Customize column names	In the report grid, click in the column header, edit the name, and click Apply. The custom name applies only in the current report, not in other reports nor in the configuration of the sensor that provides the column data.
   Flatten data	In the Selected Columns list, click beside a source name to flatten the grid data for that source. The icon indicates the column that is currently flattened. By default, data in the report grid is flattened for the first column that you add to a report. For details about flattening, including an example, see Flattened data.

3. (Optional) Configure the filtering and presentation options if necessary. For example, add filters to show only results that match the filter criteria. See Manage report filters and presentation.

4. (Optional) Add a chart (visualization) to appear above the report data grid.

   Every dashboard chart derives its data from a report. However, the settings that you configure for a chart in that report have no effect on the settings that you configure for the dashboard chart. For details about dashboard charts, see Add chart panels.

   1. Click Add Visualization.
   2. Configure the data grouping settings:

      Chart data grouping settings

      Setting	Description
      Group By Column	(Optional) Select one or more report columns by which to group data on the chart. Reporting performs aggregations for each group that you select. The combined values of the selected groups appear as labels on the chart. Reporting automatically populates the dropdown with the report columns. If you do not select an option, Reporting shows results as a single aggregate.
      Aggregate	Aggregation summarizes the data in each group. This field appears for number charts and charts with numeric columns. You can select: Count: Display the number of items in the group. Reporting automatically aggregates the results by Count if you do not select an Aggregate. Percentage: (Number charts only) Display the data as a percentage of the selected group divided by the total of all groups in the source column. For example, consider a column that contains 100 rows: 75 rows contain True, 20 rows contain False, and 5 rows contain N/A. If you aggregate by percentage and select False for the Group, the percentage that appears is 20% based on the formula (20 / (75+20+5)) * 100. <column name> [Average | Max | Min | Sum]: If the report contains numeric columns, you can also aggregate the data in each group based on a numeric column. The following options are available for each numeric column: Average: Display the total value of all items in the group (the Sum) divided by the number of items in the group. Max: Display the maximum item value in the group. Min: Display the minimum item value in the group. Sum: Display the total value of all items in the group.

   3. Select a chart type: vertical bar or donut . For more information, see Chart types.
   4. Configure the following chart settings and click Done. The available settings depend on the report and the chart type.

      Chart panel settings

      Setting	Description
      Name	Enter a name of up to 255 characters to appear at the top of the chart.
      Description	Enter a description to appear under the chart name.
      Max Results	The maximum number of items to show in the chart.
      Scale	For vertical bar charts, select how to scale values on the y-axis: Linear: Use consistent values on the y-axis. For example, if the minimum data point on a chart is 1, and the maximum data point is 100, the y-axis values would be 0, 20, 40, 60, 80, and 100. Logarithmic: Scale the y-axis on an exponential basis. Use this option for charts that contain a large range of data points.
      Value Format	Select a format for the chart values if the Aggregate is set to a percentage or numeric column value: Percent: Adds % as a suffix to the values None: No suffix is added The format selection controls only the value unit that appears in the chart and does not change the actual value. The format option is not available for table charts or charts in which the Aggregate is set to Count.
      Sort	Select an item name or value (result) by which to sort items in the chart. Click for ascending order (low to high) or for descending order (high to low).
      Timeframe Label	For donut charts, enter text to display under the chart.
      X-Axis Label	For vertical bar charts, enter a label to display horizontally under the chart.
      Y-Axis Label	For vertical bar charts, enter a label to display vertically to the left of the chart.
      Legend Display Options	Use this section to customize the items that appear in the chart. Exclude items: Clear the check box for an item to exclude that item from the chart. Customize colors: Click the colored disk beside an item to change the color that the chart uses for the item. Multiple items can use the same color.
      Conditional Formatting	Conditional formatting helps users identify issues that need attention. If chart data matches the specified threshold, the chart shows a label and (optionally) background color that indicates the issue severity. In the following example, risk scores match the Needs Improvement threshold: If you add multiple conditions to a chart, Reporting evaluates them in descending order: it applies the first condition that matches the corresponding threshold. If you specify exclusions in the Legend Display Options, Reporting still evaluates the excluded items and applies conditional formatting if they match thresholds. To add conditional formatting: Expand the Conditional Formatting section and click + Add. Click the severity color dropdown and select a severity level for the label to show: Select Apply Color to Panel to apply the color to the chart background or clear the check box to retain the default background color. Click Assign to apply your selections. In the Select Group dropdown, select the result on which to base the condition. Reporting populates the dropdown based on the Group By Column setting. Select an Operator (such as < Less Than) for matching the condition. Enter the condition threshold and select the threshold units (such as Count).

5. Click Save Report, configure the following settings, and then click Save:

   Report settings

   Setting	Decription
   Report Name	Enter a name of up to 255 characters to identify the report.
   Content Set	Assign the report to a Content Set. The dropdown lists only the content sets for which you have Report write permission. Only users who have Report read permission for the content set can access the report.
   Description (optional)	Enter a description for other users to understand the purpose and contents of the report.
   Labels (optional)	Assign one or more labels to use when filtering the Reports page by labels. If the list of labels is long, use the search field within the dropdown to quickly find labels. The search field shows each selected label as a pill with an X. Click X within a pill to unassign that label or click the X to the right of all the pills to unassign all labels. To simultaneously create and assign a label, type its name in the Labels search field and select Create <name> in the dropdown. For information on labels, see Managing labels.

Reporting saves the report and opens it in view mode.

Clone reports

If the settings and contents of an existing report are similar to the report that you want to create, cloning the existing report is often easier than creating a report from scratch. Labels are copied from the existing report to the clone. Any filters or sorting that you configured when viewing the existing report are not saved in the clone.

1. Open the report that you want to clone. See View reports.

2. Click Save As, configure the settings (see Report settings), and click Save.

   Reporting saves the report and opens it in view mode.

3. Edit the filters or other presentation options if necessary. See Manage report filters and presentation.
4. Click Edit Data to edit the report contents (data sources and charts), and then click Save. For details about editing the content, see Explore data and create reports.

Manage report filters and presentation

After you open a report (see View reports) or add Source Data in the Explore Data page (see Explore data and create reports), you can configure the following options to filter the data that the report or page presents or to control how it presents data.

An existing report enters edit mode when you change presentation options other than the exceptions that the following table specifies. After you finish making changes in edit mode, you can Save your changes or Revert to the last saved version of the report.

If you configure multiple filters, the report or Explore Data page shows only the data that matches all the filters. Reporting filters first by the basic filters (see Basic filters) and then by the advanced filters (see Advanced filters).

If you do not have permission to edit a report, or if the report is Tanium managed, you can click Explore Data to copy the report settings to the Explore Data page. There you can edit presentation settings and (optionally) save the settings as a new report without altering the original report. See Explore data.

Report filters and presentation options

Option	Description
Report settings	Click Expand beside the report name to show the report description, content set assignment, label assignments, author (creator), creation date/time, date/time of the last update, and the dashboards that use the report. This option applies only to existing reports, not to unsaved views that you construct in the Explore Data page. You cannot save the expanded view of the settings; the next time you open the report, the settings are hidden (collapsed). To edit the report name, description, content set assignment, or label assignments, see View or edit basic report settings.
Favorite	You can filter the Data > Reports page to show only your favorite reports. To include a report in the favorites list, click beside the report name. To remove a report from the favorites, click beside the report name. Reporting saves any change to the favorite status without opening the report in edit mode and requiring you to manually save it.
Refresh	If endpoint data might have changed since you opened the report, click Refresh to show the updated data. You cannot save the refreshed view of the data; the next time you open the report, it shows any changes to the data since the last time you viewed it. To save the current data as a CSV file, see Export reports in CSV format.
Sort	Click a column heading to sort the grid rows based on the alphanumeric order of the values in that column. You can sort in descending or ascending order.
Change column widths	To expand or shrink the width of a column, hover over the right-side column border in the column header until the icon appears and then click and drag the border.
Show Visualization	If the report contains a chart (visualization), use the Show Visualization toggle to show or hide the chart. You cannot save your selection; the next time you open the report, it shows the chart.
Filter by value	To filter the report by a particular cell, hover over the cell, click Options , and click Filter by Value . The filter condition then appears in the advanced filters section (see Advanced filters).
Filter items	Enter an alphanumeric string in the Filter items field to show only the matching data values in the report grid. You cannot save this filter; the next time you open the report, it does not apply the string that you entered the last time.
Clear Filters	Clear all the basic and advanced filters except the Filter items entry.
Basic filters	Apply any of the following basic filters to the report data: Filter Group: After you select one or more filter groups, Reporting refreshes the report to show results only from those groups. If the list of groups is long, use the search field within the Filter Group dropdown to quickly find groups. The search field shows each selected group as a pill with an X (such as ). Click X to remove the group from the filters. Some Tanium-managed reports are associated with an action group that has filter groups as members. These reports show a pill for each member under the other basic filter fields. If you do not have RBAC permissions for one of those filter groups, the pill label is Inaccessible Group. You can remove filter groups that are members of an action group, but you cannot add an action group as a filter or restore members that you removed. The Filter Group dropdown contains only the groups that are assigned to a content set for which you have Filter Group read permission. For details about filter groups, see Tanium Console User Guide: Managing filter groups. For details about configuring and assigning role permissions, see Tanium Console User Guide: Managing roles. For details about action groups, see Tanium Console User Guide: Managing action groups. OR/AND: Select AND if an endpoint must match all the Filter Group, Endpoint Last Seen, and OS filters for the report to include results from the endpoint. Select OR if an endpoint must match at least one of these filters for the report to include results from the endpoint. If you select multiple filter groups and select AND, all the selected filter groups must return the results for the report to include those results. This setting has no effect if you apply only one basic filter. Endpoint Last Seen: Select to show results only from endpoints last seen during the date range. Options include viewing results in the last 24 hours, last 48 hours, and last 7 days. If you do not select an option, results include all data stored in Tanium Data Service for the last 30 days. OS: Filter the report by endpoint OS: All OSs Windows macOS Linux
Advanced filters	Configure filters based on data source conditions. If necessary, you can configure nested filters. If you add a non-targetable source as a filter, you cannot use that source to target endpoints when issuing questions or creating deployments. To check if a source is targetable, hover over Info beside the source name in the Source Data panel. The OR/AND option that you select for basic filters does not apply to advanced filters. Expand the Filters section. Repeat the remaining steps for each filter. Click add and select one of the following options: Add Row: Add one or more conditions that results must match. For each condition, select a source, select a column if the source is a multi-column sensor, select an operator, and enter a value to match. Add Group: Select this option to nest a Boolean operator and then add a row or subgroup to build the nested expression. Apply the filter. If necessary, you can edit or delete filters.

Perform advanced exploration and management of endpoints

After you add data sources in the Explore Data page or open a report (see Explore data and create reports), you can perform the following tasks to see more detailed information about endpoints or to manage the endpoints that provide the source data:

Edit reports

Limitations when editing report attributes

You can edit the contents (data sources and charts), data filters, presentation, and basic settings of a custom report.

The following limitations apply when you edit reports:

• Tanium-managed reports: The only allowed edits for Tanium-managed reports are assigning a different content set and adding labels. However, the following alternatives are available for editing other settings:

  • Clone the report, edit the settings of the clone, and save it as a new report. See Clone reports.

  • Copy the report settings to the Explore Data page, where you can edit and save the settings as a new report without altering the original report. See Explore data.

  If you remove Tanium-assigned labels from a Tanium-managed report, those labels are restored the next time you update or re-import Reporting. However, you can remove labels that another user assigned to a Tanium-managed report.

  For details on Tanium-managed reports, see Tanium-managed reports.

• Content sets: You cannot edit reports that are in a content set for which you do not have Report write permission. However, if you have that permission for other content sets, you can copy the report settings to the Explore Data page, edit the settings, and save them as a new report.

• Dashboard panels: If a report provides data for a dashboard panel and has a Group By Column selection, you cannot perform the following edits:

  • Remove the data source that the panel uses for the Group By Column or Aggregate selections. See Panel settings: basic.

  • Select a different sensor for flattening data. See Flattened data.

  To determine if dashboards use a report, see View or edit basic report settings. From basic report settings, you can open the associated dashboards to view their chart settings.

Edit a report

1. From the Main menu, go to Data > Reports and click the Report Name of the report.
2. To edit basic setting, click Edit beside the report name, update the settings, and click Save. For details on these settings, see Report settings.
3. To edit presentation options, see Manage report filters and presentation.
4. To edit report contents, click Edit Data, edit the data sources and charts, and click Save. For details about data sources and charts, see Explore data and create reports.

Export reports in JSON format

You can export reports configurations as a JSON file to the downloads folder of your local browser. You can then import the file into another Tanium Cloud instanceTanium Server (see Import reports).

1. From the Main menu, go to Data > Reports.

2. Select the reports to export and select Export > Report Definition as JSON (single report) or click Export Report Definitions (multiple reports).

   The Export > Report Definition as JSON option is available within a report also if you open the report.

The exported file has the name report_definition_export_<month_day_year>.json.

Import reports

You can import report configurations that are stored in a JSON file.

You require a role with the Report write permission to import reports. The predefined roles that have this permission are Reporting Operator and Reporting User.

1. Copy the JSON file to a system that is accessible from the computer that you use to sign in to Tanium Console.

2. From the Main menu, go to Data > Reports and click Import.
3. Perform one of the following steps:
• Drag and drop the JSON file to the Import a Report.json File dialog.
• Click Browse for File, select the JSON file, and click Open.
4. Review the list of reports in the File Contents, optionally clear any reports that you do not want to import, and click Import.

   If the file has no issues to resolve, the import proceeds and you can skip the next step. If the file has any issues that block the import, perform the next step to resolve them.

5. Resolve any issues in the file and click Import again:
• Name conflicts: If the JSON file contains reports with the same names and content set assignments as reports that already exist on Tanium Cloudthe Tanium Server, select one of the following options:
  • Skip Import to omit the report from the import process.

  • Overwrite Existing to replace the existing report with the imported report. This option is not available if:

    • The existing report is Tanium managed.
    • The imported report uses sensors that are not present in the environment where you perform the import.
    • The imported report provides data for a dashboard panel, has a Group By Column selection, and either of the following conditions apply:

      • The imported report does not include the data source that the dashboard panel uses for the Group By Column or Aggregate selections. See Panel settings: basic.

      • The imported report uses a different sensor for flattening data than the existing report. See Flattened data.

  • Import As New to import the report and retain its current name, notwithstanding that an existing report has the same name.
  • Rename the report that you are importing. When you select this option, a text field appears where you specify the new name.
• Invalid content set: If the report is assigned to a content set that does not exist on Tanium Cloudthe Tanium Server, select one of the following options:
  • Skip Import to omit the report from the import process.
  • Update Content Set to assign a valid content set. When you select this option, a dropdown appears for you to select a content set. The dropdown lists only the content sets for which you have role permissions.

If a report panel requires a sensor that does not exist on Tanium Cloudthe Tanium Server or that is not registered with Tanium Data Service, a message indicates the sensor is missing. You can proceed with the import but it omits that panel. To import missing sensors, see Tanium Console User Guide: Import sensors.

Explore report data in Interact

If a report or the Explore Data page shows data that warrants further exploration, you can issue a question to the endpoints that provided the data and analyze the results on the Interact Question Results page. For example, if the EP Management - Antivirus Health report indicates that Windows Defender is off on some endpoints, you can issue the question Get Installed Application Exists[Windows Defender] to determine if the application is installed on those endpoints. From the Question Results page, you can then explore the data further or deploy a corrective action to the endpoints.

Question targeting

When you issue a question, Interact targets the endpoints based on report sources, configured filters, and your data selections. For example, if the report source is Operating System, you apply the filter Windows OS Type contains Workstation, and you select the result data for Windows 10 Enterprise, the question targets workstation endpoints that run Windows 10 Enterprise. Interact can apply no more than 100 filters when targeting endpoints, regardless of whether those filters are manually configured or based on selected data. For example, if the report source is Installed Applications - Name and you select a row with 50 values for that column, Interact applies each of those values as a filter for targeting. If the combination of configured filters and filters based on selected data exceeds 100, the Drill Down in Interact button is disabled.

Targetable sources

You can issue questions only for report data and filters that are targetable, which means they derive from sources that are present on endpoints. For example, if you select data in a report that uses only Endpoint ID as a source, the Drill Down in Interact button is disabled because that source is not present on endpoints (Tanium provides the Endpoint ID data). If the report data and filters include at least one source that is targetable but other sources that are not, you can issue questions but the non-targetable sources are excluded from the endpoint targeting criteria.

When you add Source Data to a report, hover over Info beside the source name to see whether it is targetable or non-targetable . The non-targetable icon also appears when you add a non-targetable source as a filter.

Result types

The Drill Down in Interact button is disabled if a report includes results from a multi-column sensor in which the result type is not the same across all columns. For example, you cannot issue a question if a sensor returns both text and numeric results.

Question targeting does not require result types to match among different sensors. For example, you can issue a question from a report with two sensors if all the columns in one sensor have text values and all the columns in the other sensor have numeric values.

To check the result type of columns derived from sensors, see Tanium Console User Guide: View sensor details.

Drill down in Interact

1. Perform one of the following steps:

   • Open an existing report that contains the data to explore. See View reports.

   • Show the data to explore on the Explore Data page. See Explore data and create reports.

2. Select the data that you want to explore and click Drill Down in Interact.
3. Use one of the following tabs to specify a question and then click Drill Down:

   Saved Questions	Select a saved question from the list. The list includes questions only if they are assigned to content sets for which you have Saved Question read permission. By default, the list includes only questions that have the Display this question in the list of questions that are available for drilling down setting enabled. To include questions that do not have the setting enabled, select Show all questions. For details about the setting, see Tanium Console User Guide: Display this question in the list of questions that are available for drilling down. To filter the list so that it includes only saved questions with Visibility is set to Only the Owner and Admins can see this object, select Hide public questions. Hover over the information icon for a question to see its syntax.
   Create a Question	Enter a question using the same syntax as in the Interact Ask a Question field. For details, see Tanium Console User Guide: Issue a question through the Ask a Question field.
   Build a Question	Construct a question using the same fields as in the Interact Question Builder. For details, see Tanium Console User Guide: Issue a question through the Question Builder.

   A dialog notifies you if the report data or filters include non-targetable sources that the question excludes from its targeting criteria.

   After you click Drill Down, the Question Results page shows the results in a new browser tab.

4. (Optional) Use the Question Results page to explore more details about the data (such as by issuing a drill-down question) or to deploy an action to the endpoints that provided the data. For more information, see:

• Tanium Console User Guide: Managing question results

• Tanium Console User Guide: Deploying actions

Deploy an action or patch

If a report or the Explore Data page indicates conditions that warrant intervention on endpoints, you can deploy actions or OS patches directly from the report. For example, if the EP Management - Antivirus Health report indicates that Windows Defender is off on some endpoints, you can deploy an action that turns it on.

To deploy patches, your Tanium license must include Tanium™ Patch Tanium™ Patch 3.11 or later must be installed.

Deployment targeting

Action and patch deployments target endpoints based on report sources, configured filters, and your data selections. For example, if the report source is Operating System, you apply the filter Windows OS Type contains Workstation, and you select the results data for Windows 10 Enterprise, the deployment targets workstation endpoints that run Windows 10 Enterprise. Reporting can apply no more than 100 filters when targeting endpoints, regardless of whether those filters are manually configured or based on selected data. For example, if the report source is Installed Applications - Name and you select a row with 50 values for that column, Reporting applies each of those values as a filter for targeting. If the combination of configured filters and filters based on selected data exceeds 100, the Deploy Action button is disabled.

Targetable sources

The deployment feature is available only for report data and filters that are targetable, which means they derive from sources that are present on endpoints. For example, if you select data in a report that uses only Endpoint ID as a source, the Deploy Action button is disabled because that source is not present on endpoints (Tanium provides the Endpoint ID data). If the report data and filters include at least one source that is targetable but other sources that are not, you can deploy an action or patches but the non-targetable sources are excluded from the deployment targeting criteria.

When you add Source Data to a report, hover over Info beside the source name to see whether it is targetable or non-targetable . The non-targetable icon also appears when you add a non-targetable source as a filter.

Result types

The Deploy Action button is disabled if a report includes results from a multi-column sensor in which the result type is not the same across all columns. For example, you cannot deploy an action if a sensor returns both text and numeric results.

Action targeting does not require result types to match among different sensors. For example, you can deploy an action from a report with two sensors if all the columns in one sensor have text values and all the columns in the other sensor have numeric values.

To check the result type of columns derived from sensors, see Tanium Console User Guide: View sensor details.

Deploy an action or patch

1. Perform one of the following steps:

   • Open an existing report that contains data from endpoints that require the action or patch. See View reports.

   • Configure the Explore Data page to show data from endpoints that require the action or patch. See Explore data and create reports.

2. Select the endpoints that require an action or patch.

3. Click Deploy Action and select an option:

   • Create Platform Package Deployment: Select this option to deploy an action. For the steps to deploy the action, see Tanium Console User Guide: Deploying actions.
   • Create Patch Deployment: Select this option to deploy patches. For the steps to create a patch deployment, see Tanium Patch User Guide: Create a deployment to install patches.

   After you select an option, the deployment configuration page opens in a new browser tab.

   A dialog notifies you if the report data or filters include non-targetable sources that the action excludes from its targeting criteria. Click Continue to Create Deployment if you want to proceed with the deployment.

Work with drill-down reports

In reports with a Count column, each Count value is a link that opens a drill-down report for the endpoints that are associated with the value. For example, if the Patch Coverage Status report indicates that some endpoints are Missing Scan Results, you can click their Count value to open a report that contains additional information for those endpoints. ADI - Basic Inventory is the default drill-down report but you can select a different report.

Select the drill-down report

1. From the Main menu, go to Data > Settings > Drill-down Report.

2. Select the Report and click Save.

   Select a report that is in the Reporting content set to avoid possible user permission errors. Content set permissions in the roles that are assigned to a user determine which reports that user can open.

Open a drill-down report

1. Open the report that contains data from the endpoints for which you want to see a drill-down report. See View reports.

   You can also open a drill-down report through the Explore Data page. See Explore data and create reports.

2. Click the Count value for the endpoints that you want to analyze further.

   The drill-down report opens in a new browser tab.

Delete reports

Deleting a report deletes the report configuration, but does not delete any data sources. To delete a report that supplies data to charts on dashboards, you must first either delete the dashboards (see Delete dashboards) or the charts that use the report data (see Edit dashboards).

1. From the Main menu, go to Data > Reports.
2. Click the Report Name to open the report, and then click Delete.