Working with reports

Use Reporting to create and view reports with data that Tanium Data Service collects. Select the data that you want to include in the reports, and then add filters to limit the report data to endpoints in specific computer management groups or endpoints with specific operating systems (OSs).

View reports

Perform the following steps to open a report. You can access only reports that are in content sets for which you have Report read permission.

1. From the Main menu, go to Data > Reports.

   The Reports page lists all the reports that you have permissions to access.

   Click Create Report to open the Explore Data page, where you can create a new report. See Explore data and create reports.

2. (Optional) Use the following search and filter options to facilitate finding specific reports if the grid is long. The grid shows only the reports that match all the filters and search text that you specify.

   Report search and filter options

   Option	Description
   Filter by favorites	Use the Show buttons to toggle between showing All reports or only reports that are in your favorites list . Click beside a report name to add the report to your favorites list or click to remove the report from your favorites list.
   Filter by content set	Select a content set to show only the reports that are assigned to that set.
   Filter by author	Select a user name to show only the reports that the user created or select one of the Tanium Managed options to show only the predefined reports that Tanium provides (see Tanium-managed reports).
   Filter by creation date	Specify a range of report creation dates by clicking the Created on and to calendar widgets .
   Search by text	Enter an alphanumeric string to match by report name or description.

3. Click a Report Name to open that report. You can then perform the following report management tasks:

   Report management tasks

   Task	Description
   View or edit basic report settings	To show the report description, content set assignment, and label assignments, click beside the report name. To edit these settings or the report name, click Edit beside the name, update the settings, and click Save. For details, see Report settings. For Tanium Managed reports, you can edit only the content set and label assignments.
   Set favorite status	Click beside a report name to add the report to your favorites list or click to remove the report from your favorites list.
   Customize appearance	You can control how the report presents data to suit your current workflow. For example, you can filter the data, hide charts, and collapse or expand sections. See Manage report presentation.
   Explore and manage endpoints	View comprehensive details for a specific endpoint, deploy an action to the endpoint, or perform other endpoint exploration and management tasks. See Perform advanced exploration and management of endpoints.
   Copy cell	To copy the contents of a single cell, hover over the cell, click Options , and click Copy Cell Value .
   Clone report	Click Save As and perform the steps under Clone reports.
   Create new report	Click New Report to open the Explore Data page and then perform the steps under Explore data and create reports.
   Edit report contents and filters	Click Edit Data and perform the steps under Edit reports to change which data the report includes.
   Export as CSV	To export the report as a CSV file, click and perform the steps under Export reports to CSV.
   Delete report	Click Delete and perform the steps under Delete reports.

Explore data and create reports

Use the Explore Data page to view endpoint data in a grid format and add charts to help visualize the data. You can then save the view as a custom report. After you add Source Data to the view, you can explore and manage endpoints with or without saving the view as a report (see Perform advanced exploration and management of endpoints).

1. From the Main menu, go to Data > Explore Data.

   You can also access the Explore Data page from within an existing report (click New Report) or from the Data > Reports page (click Create Report).

2. In the Source Data panel, select source data to include in the report as columns.

   Each report can contain up to 25 columns. Perform the following tasks to manage source selections:

   Report source data management

   Task	Description
   View source details	To view the description and details for a source, hover over Info beside its name. The details indicate if the source is Targetable . If you add a non-targetable source, you cannot use that source to target endpoints when issuing questions or creating deployments.
   Add sources	Use one of the following options to add sources: Quick Column Add: If you know the name of a particular source, enter an alphanumeric string that contains all or part of the name and then select the matching option in the dropdown. Available Columns: Browse the available sensors and fields that you can add to the report. Expand each category of sources to lists its sensors and fields. To add a source, click Add beside its name. To add a subset of the columns in a multi-column sensor, expand the sensor and Add each column that you want to include. Reporting prompts you to select parameters if a source requires them.
   Remove sources	In the Selected Columns list, click Remove beside a source name to remove it from the report, including all the columns in a multi-column sensor. Click Remove beside a particular column name to remove only that column in a multi-column sensor.
   Reorder columns	In the report grid header, click Customize Columns and drag the column names in the desired order.
   Customize column names	In the report grid, click in the column header, edit the name, and click Apply. The custom name applies only in the current report, not in other reports nor in the configuration of the sensor that provides the column data.
   Flatten data	In the Selected Columns list, click beside a source name to flatten the grid data for that source. The icon indicates the column that is currently flattened. By default, data in the report grid is flattened for the first column that you add to a report. For details about flattening, including an example, see Flattened data.

3. (Optional) Add filters in the report header to show only results that match the filter criteria. See Basic filters and Advanced filters.
4. (Optional) Add a chart (visualization) to appear above the report data grid.
   1. Click Add Visualization.
   2. Configure the data grouping settings:

      Chart data grouping settings

      Setting	Description
      Group By Column	(Optional) Select one or more report columns by which to group data on the chart. Reporting performs aggregations for each group that you select. The combined values of the selected groups appear as labels on the chart. Reporting automatically populates the dropdown with the grid columns. If you do not select an option, Reporting shows results as a single aggregate.
      Aggregate	Aggregation summarizes the data in each group. This field appears for number charts and charts with numeric columns. You can select: Count: Display the number of items in the group. Percentage: (Number charts only) Display the data as a percentage of the selected group divided by the total of all groups in the source column. For example, consider a column that contains 100 rows: 75 rows contain True, 20 rows contain False, and 5 rows contain N/A. If you aggregate by percentage and select False for the Group, the percentage that appears is 20% based on the formula (20 / (75+20+5)) * 100. <column name> [Average | Max | Min | Sum]: If the report contains numeric columns, you can also aggregate the data in each group based on a numeric column. The following options are available for each numeric column: Average: Display the total value of all items in the group (the Sum) divided by the number of items in the group. Max: Display the maximum item value in the group. Min: Display the minimum item value in the group. Sum: Display the total value of all items in the group. If a chart does not contain the Aggregate field, Reporting automatically aggregates the results by Count.

   3. Select a chart type: vertical bar or donut . For more information, see Reference: Chart options in Reporting.
   4. Configure the following chart settings and click Done. The available settings depend on the report and the chart type.

      Chart panel settings

      Setting	Description
      Name	Enter a name of up to 255 characters to appear at the top of the chart.
      Description	Enter a description to appear under the chart name.
      Max Results	The maximum number of items to show in the chart.
      Scale	For vertical bar charts, select how to scale values on the y-axis. Options include: Linear: Use consistent values on the y-axis. For example, if the minimum data point on a chart is 1, and the maximum data point is 100, the y-axis values would be 0, 20, 40, 60, 80, and 100. Logarithmic: Scale the y-axis on an exponential basis. Use this option for charts that contain a large range of data points.
      Value Format	Select a format for the chart values if the Aggregate is set to a percentage or numeric column value: Percent: Adds % as a suffix to the values None: No suffix is added The format selection controls only the value unit that appears in the chart and does not change the actual value. The format option is not available for table charts or charts in which the Aggregate is set to Count.
      Sort	Select an item name or value (result) by which to sort items in the chart. Click for ascending order (low to high) or for descending order (high to low).
      Timeframe Label	For donut charts, enter text to display under the chart.
      X-Axis Label	For vertical bar charts, enter a label to display horizontally under the chart.
      Y-Axis Label	For vertical bar charts, enter a label to display vertically to the left of the chart.
      Legend Display Options	Use this section to customize the items that appear in the chart. Exclude items: Clear the check box for an item to exclude that item from the chart. Customize colors: Click the colored disk beside an item to change the color that the chart uses for the item. Multiple items can use the same color.
      Conditional Formatting	Expand Conditional Formatting and click + Add to add a label to the chart when a threshold condition is met. You can also apply the conditional color to the chart background, which overrides the default background color. Conditional formatting enables users to can easily identify charts that need attention. You can add multiple conditions to a chart. Reporting evaluates conditions in descending order and applies the first condition that triggers a match.

5. Click Save Report, configure the following settings, and then click Save:

   Report settings

   Setting	Decription
   Report Name	Enter a name of up to 255 characters to identify the report.
   Content Set	Assign the report to a Content Set. The dropdown lists only the content sets for which you have Report write permission. Only users who have Report read permission for the content set can access the report.
   Description (optional)	Enter a description for other users to understand the purpose and contents of the report.
   Labels (optional)	Assign one or more labels to enable quicker access to the report. For information on labels, see Managing labels.

Reporting saves the report and opens it in view mode. To customize how the report presents data, see Manage report presentation.

Clone reports

If the settings and contents of an existing report are similar to the report that you want to create, cloning the existing report is often easier than creating a report from scratch. Labels are copied from the existing report to the clone. Any filters or sorting that you configured when viewing the existing report are not saved in the clone.

1. Open the report that you want to clone. See View reports.

2. Click Save As, configure the settings (see Report settings), and click Save.

   Reporting saves the report and opens it in view mode. To customize how the report presents data, see Manage report presentation.

3. Click Edit Data to edit the report contents, such as data sources, charts, and filters, and then click Save. For details about editing the content, see Explore data and create reports.

Manage report presentation

After you open a report (see View reports) or add Source Data in the Explore Data page (see Explore data and create reports), you can perform the following tasks to manage how the report or page presents data to suit your current workflow.

If you configure multiple filters, the report or Explore Data page shows only the data that matches all the filters. The report or page filters first by the basic filters (see Basic filters) and then by the advanced filters (see Advanced filters).

Report presentation options

Option	Description
Report settings	Click Expand beside the report name to view report details, including the description, content set, author, last updated date, and a list of dashboards that use the report data. This option applies only to existing reports, not to unsaved views that you construct in the Explore Data page. To edit the configurable settings (report name, description, label assignments, and content set assignment), click Edit beside the report name, reconfigure the settings, and click Save. For Tanium Managed reports, you can edit only the label and content set assignments. For details on the settings, see Report settings.
Favorite	You can filter the Data > Reports page to show only your favorite reports. To include a report in the favorites list, click beside the report name. To remove a report from the favorites, click beside the report name.
Refresh	If endpoint data might have changed since you opened the report, click Refresh to show the updated data.
Sort	Click a column heading to sort the grid rows based on the alphanumeric order of the values in that column.
Copy cell value	To copy the contents of a single cell, hover over the cell, click Options , and click Copy Cell Value .
Show Visualization	If the report contains a chart (visualization), use the Show Visualization toggle to show or hide the chart.
View as CSV	Click Export to CSV to download a copy of the report as a CSV file, which you can then open in any application that supports the CSV format. The CSV file includes the report name, headers, and grid data. See Export reports to CSV.
Filter by value	To filter the report by a particular cell, hover over the cell, click Options , and click Filter by Value . The filter condition then appears in the advanced filters section (see Advanced filters).
Filter items	Enter an alphanumeric string in the Filter items field to show only the matching data values in the report grid.
Basic filters	Apply any of the following basic filters to the report data: Filter Group: After you select one or more filter groups, Reporting refreshes the report to show results only from those groups. If the list of groups is long, use the search field within the Filter Group dropdown to quickly find groups. The search field shows each selected group as a pill with an X (such as ). Click X to remove the group from the filters. Some Tanium-managed reports are associated with an action group that has filter groups as members. These reports show a pill for each member under the other basic filter fields. If you do not have RBAC permissions for one of those filter groups, the pill label is Inaccessible Group. You can remove filter groups that are members of an action group, but you cannot add an action group as a filter or restore members that you removed. The Filter Group dropdown contains only the groups that are assigned to a content set for which you have Filter Group read permission. For details about filter groups, see Tanium Console User Guide: Managing filter groups. For details about configuring and assigning role permissions, see Tanium Console User Guide: Managing roles. For details about action groups, see Tanium Console User Guide: Managing action groups. OR/AND: Select AND if an endpoint must match all the Filter Group, Endpoint Last Seen, and OS filters for the report to include results from the endpoint. Select OR if an endpoint must match at least one of these filters for the report to include results from the endpoint. If you select multiple filter groups and select AND, all the selected filter groups must return the results for the report to include those results. This setting has no effect if you apply only one basic filter. Endpoint Last Seen: Select to show results only from endpoints last seen during the date range. Options include viewing results in the last 24 hours, last 48 hours, and last 7 days. If you do not select an option, results include all data stored in Tanium Data Service for the last 30 days. OS: Filter the report by endpoint OS: All OSs Windows macOS Linux
Advanced filters	Configure filters based on data source conditions. If necessary, you can configure nested filters. If you add a non-targetable source as a filter, you cannot use that source to target endpoints when issuing questions or creating deployments. To check if a source is targetable, hover over Info beside the source name in the Source Data panel. The OR/AND option that you select for basic filters does not apply to advanced filters. Expand the Filters section. Repeat the remaining steps for each filter. Click add and select one of the following options: Add Row: Add one or more conditions that results must match. For each condition, select a source, select a column if the source is a multi-column sensor, select an operator, and enter a value to match. Add Group: Select this option to nest a Boolean operator and then add a row or subgroup to build the nested expression. Apply the filter. If necessary, you can edit or delete filters.

Perform advanced exploration and management of endpoints

After you add data sources in the Explore Data page or open a report (see Explore data and create reports), you can perform the following tasks to see more detailed information about endpoints or to manage the endpoints that provide the source data:

Edit reports

After you create a report, you can edit the report to add and remove sources, reorder columns, change filters, or change column widths. You can also update the report name, description, content set assignment, or label assignments.

For Tanium Managed reports, you can edit only the content set and label assignments. However, you can clone a report and edit all the settings of the clone. See Clone reports.

1. Open the report that you want to edit. See View reports.
2. To edit the report name, description, content set assignment, or label assignments, click Edit beside the name, update the settings, and click Save. For details on these settings, see Report settings.
3. To edit the report content (such as data sources, charts, and filters), click Edit Data, edit the content, and click Save. For details about content configuration options, see Explore data and create reports.

Export reports through Tanium Connect

Use Connect to send reports to Connect destinations.

Before you begin

• Your Tanium license must include Connect.
• You must install Connect 5.9.65 or later and Reporting 1.7 or later.
• You must have access to Connect with the Connect Operator or Connect Administrator role.
• You must have a role with the Report read and Report API user permissions. Predefined roles with required permissions include Reporting Operator and Reporting User.
• Reporting must have one or more reports.

For best results, set your desired filters, flattening, column names, and column ordering in Reporting so that column customizations are not necessary when you set up an export through Connect.

Create a connection

The following steps describe the basic settings that you configure for a connection. Additional settings vary by connection destination. For details, see Tanium Connect User Guide: Managing connections.

1. From the Main menu, go to Modules > Connect.
2. From the Connect Overview page, scroll to the Connections section and click Create Connection.
3. In the General Information section, enter a Name and optional Description for the connection.
4. In the Configuration section, select Tanium Reporting (Source Data) for the Source.
5. In the Report field, select the report to export.
   If reports have duplicate names, you can distinguish them by the author and report ID that are appended to the report names. The ID for a report appears in the browser URL field when you view the report. For example, the Patch Coverage Status report has id=default-patch-coverage-status appended to its URL. See View reports.
6. Select the Destination where you want Connect to send the report. Provide any additional configuration for the type of destination you select.
7. Scroll to the Configure Output section and select a Format for the exported report.
8. (Optional) Configure a Schedule to send the report.
9. Click Save.

When the connection runs, the report is sent to the destination according to the schedule that you set. To manually export the report using the connection settings, select the connection on the Connect Overview page and click Run Now.

Investigate report data in Interact

If a report shows data that warrants further investigation, you can issue a question to the endpoints that provided the data and analyze the results on the Interact Question Results page. For example, if the EP Management - Antivirus Health report indicates that Windows Defender is off on some endpoints, you can issue the question Get Installed Application Exists[Windows Defender] to determine if the application is installed on those endpoints. From the Question Results page, you can then investigate the data further or deploy a corrective action to the endpoints.

Question targeting

When you issue a question, Interact targets the endpoints based on report sources, configured filters, and your data selections. For example, if the report source is Operating System, you apply the filter Windows OS Type contains Workstation, and you select the result data for Windows 10 Enterprise, the question targets workstation endpoints that run Windows 10 Enterprise. Interact can apply no more than 100 filters when targeting endpoints, regardless of whether those filters are manually configured or based on selected data. For example, if the report source is Installed Applications - Name and you select a row with 50 values for that column, Interact applies each of those values as a filter for targeting. If the combination of configured filters and filters based on selected data exceeds 100, the Drill Down in Interact button is disabled.

You can issue questions only for report data and filters that are targetable, which means they derive from sources that are present on endpoints. For example, if you select data in a report that uses only Endpoint ID as a source, the Drill Down in Interact button is disabled because that source is not present on endpoints (Tanium provides the Endpoint ID data). If the report data and filters include at least one source that is targetable but other sources that are not, you can issue questions but the non-targetable sources are excluded from the endpoint targeting criteria.

When you add Source Data to a report, hover over Info beside the source name to see whether it is targetable or non-targetable . The non-targetable icon also appears when you add a non-targetable source as a filter.

Drill down in Interact

1. Open the report that contains the data to investigate. See View reports.

   You can also investigate data in Interact through the Explore Data page. See Explore data and create reports.

2. Select the data that you want to investigate and click Drill Down in Interact.

   The Drill Down in Interact button is disabled if the result types of all columns do not match. To check the result type of columns derived from sensors, see Tanium Console User Guide: View sensor details.

3. Use one of the following tabs to specify a question and then click Investigate:

   Saved Questions	Lists saved questions that are assigned to content sets for which you have Saved Question read permission. By default, the list includes only questions that have the Display this question in the list of questions that are available for drilling down setting enabled. To include questions that do not have the setting enabled, select Show all questions. For details about the setting, see Tanium Console User Guide: Display this question in the list of questions that are available for drilling down. To filter the list so that it includes only saved questions with Visibility is set to Only the Owner and Admins can see this object, select Hide public questions.
   Create a Question	Enter a question using the same syntax as in the Interact Ask a Question field. For details, see Tanium Console User Guide: Issue a question through the Ask a Question field.
   Build a Question	Construct a question using the same fields as in the Interact Question Builder. For details, see Tanium Console User Guide: Issue a question through the Question Builder.

   A dialog notifies you if the report data or filters include non-targetable sources that the question excludes from its targeting criteria.

   After you click Investigate, the Question Results page shows the results in a new browser tab.

4. (Optional) Use the Question Results page to explore more details about the data (such as by issuing a drill-down question) or to deploy an action to the endpoints that provided the data. For more information, see:

• Tanium Console User Guide: Managing question results

• Tanium Console User Guide: Deploying actions

Deploy an action or patch from a report

If a report indicates conditions that warrant intervention on endpoints, you can deploy actions or OS patches directly from the report. For example, if the EP Management - Antivirus Health report indicates that Windows Defender is off on some endpoints, you can deploy an action that turns it on.

To deploy patches, your Tanium license must include Tanium™ Patch Tanium™ Patch 3.11 or later must be installed.

Deployment targeting

Action and patch deployments target endpoints based on report sources, configured filters, and your data selections. For example, if the report source is Operating System, you apply the filter Windows OS Type contains Workstation, and you select the results data for Windows 10 Enterprise, the deployment targets workstation endpoints that run Windows 10 Enterprise. Reporting can apply no more than 100 filters when targeting endpoints, regardless of whether those filters are manually configured or based on selected data. For example, if the report source is Installed Applications - Name and you select a row with 50 values for that column, Reporting applies each of those values as a filter for targeting. If the combination of configured filters and filters based on selected data exceeds 100, the Deploy Action button is disabled.

The deployment feature is available only for report data and filters that are targetable, which means they derive from sources that are present on endpoints. For example, if you select data in a report that uses only Endpoint ID as a source, the Deploy Action button is disabled because that source is not present on endpoints (Tanium provides the Endpoint ID data). If the report data and filters include at least one source that is targetable but other sources that are not, you can deploy an action or patches but the non-targetable sources are excluded from the deployment targeting criteria.

When you add Source Data to a report, hover over Info beside the source name to see whether it is targetable or non-targetable . The non-targetable icon also appears when you add a non-targetable source as a filter.

Deploy an action or patch

1. Open the report that contains data from endpoints that require the action or patch. See View reports.

   You can also deploy an action or patch through the Explore Data page. See Explore data and create reports.

2. Select the endpoints that require an action or patches.
3. Click Deploy Action and select an option:
   • Create Platform Package Deployment: Select this option to deploy an action. For the steps to deploy the action, see Tanium Console User Guide: Deploying actions.
   • Create Patch Deployment: Select this option to deploy patches. For the steps to create a patch deployment, see Tanium Patch User Guide: Create a deployment to install patches.
   The Deploy Action button is disabled if the result types of all columns do not match. To check the result type of columns derived from sensors, see Tanium Console User Guide: View sensor details.

   A dialog notifies you if the report data or filters include non-targetable sources that the action excludes from its targeting criteria. Click Continue to Create Deployment if you want to proceed with the deployment.

Work with drill-down reports

In reports with a Count column, each Count value is a link that opens a drill-down report for the endpoints that are associated with the value. For example, if the Patch Coverage Status report indicates that some endpoints are Missing Scan Results, you can click their Count value to open a report that contains additional information for those endpoints. ADI - Basic Inventory is the default drill-down report but you can select a different report.

Select the drill-down report

1. From the Main menu, go to Data > Settings > Drill-down Report.

2. Select the Report and click Save.

   Select a report that is in the Reporting content set to avoid possible user permission errors. Content set permissions in the roles that are assigned to a user determine which reports that user can open.

Open a drill-down report

1. Open the report that contains data from the endpoints for which you want to see a drill-down report. See View reports.

   You can also open a drill-down report through the Explore Data page. See Explore data and create reports.

2. Click the Count value for the endpoints that you want to analyze further.

   The drill-down report opens in a new browser tab.

Delete reports

Deleting a report deletes the report configuration, but does not delete any data sources. To delete a report that supplies data to charts on dashboards, you must first either delete the dashboards (see Delete dashboards) or the charts that use the report data (see Edit dashboards).

1. From the Main menu, go to Data > Reports.
2. Click the Report Name to open the report, and then click Delete.