Other resources

Release Notes

Support Knowledge Base
(login required)


The addition of Tanium™ Trends to your Tanium™ deployment gives you visibility into the history of key pieces of information about your enterprise IT estate, coordination with real-time status for those same indicators, and the ability to close the loop by deploying necessary action on any endpoint—all without leaving your Tanium Console session.


The Trends solution makes it easy for you to:

  • Collect data and present impactful visualizations of historical counts for numerous key pieces of information related to hardware and software inventory, resource utilization, operational hygiene, and endpoint security posture.
  • Create organized collections of Trend boards and visualization panels.
  • Customize the chart type, date or date range, color scheme, and text for each panel.
  • Harmonize the result strings returned by sensors so that uniform measurements and units are presented in graphs.
  • Bucket disparate numeric results into a suitable number of data ranges.
  • Set data condition thresholds that trigger visual status indicators (for example, red, yellow, or green panel backgrounds).
  • Publish Trend boards to a standalone HTML file that can be distributed to stakeholders or published on an internal web server.
  • Navigate from historical trends to current, real-time status for the same key question, returned in the familiar results grid, where you can use the merge and drill-down features to examine the details.
  • Open the question in Tanium™ Interact so that you can deploy actions and schedule them as necessary.


Trends is designed to enable insights based on historical data but to keep the amount of data retained over time small and manageable. This data model has the following limitations:

  • Trends stores 1 day counts. It is designed to track a single answer from an endpoint per day, not multiple answers.
  • Trends stores counts for only the 1,000 most common result rows per data source per day. A result row aggregates results with matching strings or numbers, so tracking the top 1,000 occurrences affords sufficient visibility into the items you want to track in most cases.
  • Trends stores aggregate counts. It is not designed to drill down to past point-in-time data on specific endpoints, although it is possible to drill down on the current data set. For example, you cannot use Trends to see what OS patch a specific computer was running on a specific date in the past. Instead, you can use Trends to drill down from the insights afforded by the aggregate counts to the most recent results about OS patches, and from recent results, you can drill down to results for specific computers.
  • Trends stores only data that was mined by the Tanium Client. It is not designed to be a big data warehouse for heterogeneous data sources.

About Trends data

Learn about how Tanium data is collected in Trends so that the visualization panels you design have the significance you expect.

Types of sensors

Trends data are counts of the answers returned when sensors are run on the Tanium Client. Most—but not all—sensors return results that can be meaningfully counted. For example, the question Get Running Applications from all machines returns counts of the application versions found in running processes on enterprise endpoints.

Figure  1:  Results grid counts

A Trends question can poll only one sensor. It can be a single column sensor, a multicolumn sensor, or a parameterized sensor, but the question can ask for results from only one sensor.

Avoid basing Trends reports on sensors that return unique strings, like Computer Name or IP address. There is little value in aggregate counts of these answers.

Figure  2:  Sensors that return unique strings do not trend well

Sensors that return unique numeric counts are okay. Numeric results can be bucketed into numeric ranges and counted. For example, the results for Get Disk Space Free from all machines includes a wide range of unique counts and may even include a wide range of data units. When you configure data settings in a Trends panel, you can set post-collection data transformation options to extract data and harmonize the result strings and to bucket numeric results into value ranges.

Figure  3:  Sensors that return unique numeric counts are okay

Before you create a Trends data source configuration for a key indicator you want to track, use Interact to ask the question and review the sensor result strings. Evaluate whether the sensor result strings can be meaningfully counted and whether question filters or post-collection data extraction or bucketing of numeric result strings is called for.

If you modify a sensor that is used in Trends, it may affect the meaning of Trends graphs. Be careful to examine the changes to sensors in content packs and solution modules before you import them. If the data collected is substantially different, we recommend you create a new Trends data source and corresponding Trend board and/or panel.

How Trends data is collected

A saved question configured in a Trends data source is issued every five hours. The frequency is designed to get responses from machines that may be offline sometimes during a one day period but are online at one of the times the saved question is issued.

For each data source, Trends uses Tanium™ Connect to run a data-gathering connection once a day. The saved question is issued one more time as a function of the Connect job. The top 1,000 result rows are stored in an Elasticsearch data store on the Module Server host computer.

Trends sets the schedule for the Connect jobs with randomness to avoid traffic spikes. If the Connect job is scheduled to run at an inopportune time, you can reschedule it. However, it is better to keep to a routine schedule to avoid unseasonal comparisons. The data becomes more insightful when you measure load every day at noon, for example, and not some days at noon and some days at midnight.

Results are reported in Trends as aggregate 1 day counts based on timestamps of the collected data. The time and date clock is based on the Module Server host computer UTC time (not the local time zone adjusted time). A panel configured to show Chassis Type on December 31 includes the counts of the responses collected by the associated Connect connection job that ran on December 31 UTC time.

The Trends Connect job is scheduled to run once a day. It is also possible to run the job on demand. If the data is collected more than once a day, the daily count is resolved to the last data collected that day. To avoid unseasonal comparisons, we recommend you keep to the routine schedule and not run the connection on demand unless there is good reason to do so, such as the scheduled connection fails.

Answers from online and offline machines

The Tanium Client is deployed to a broad spectrum of enterprise assets, including infrastructure servers, employee workstations, and employee laptops. In the examples below, machines M01 to M04 are infrastructure servers that are almost always online; machines M05 to M10 are employee workstations or laptops that may be online or offline according to employee schedules and habits.

When the Tanium Server issues a saved question, a machine that is online sends its "current" response to the question; if the machine is offline, the Tanium Server may have a "recent" value for it. The Tanium Server tallies counts for both types of answers.

In Trends, online/current and offline/recent relate back to the time the Connect job was run. In the following example, the Connect job for machines requiring reboot is run at 9:00 UTC, and the data for "online only" and "online and recent" are tallied at that point in time.

Note that the time of day a Connect job is scheduled to run may have an impact on the count recorded, depending on business practices such as maintenance operations. For example, suppose the Connect job were run at 2:00 UTC, and that 2:00 UTC is during a daily maintenance window where maintenance processes might put more machines in a state requiring reboot. The counts would routinely be higher.

Figure  4:  Online/offline counts for a yes/no saved question

In the next example, the Connect job for "free disk space" is run at 23:30 UTC. The results are numeric, but are tallied no differently from the Boolean string results in the previous example. The results reported are not sums or averages of the multiple polls. The online/current and offline/recent counts reported relate back to the time the Connect job was run. In this case, the data collected at 23:30 UTC.

Numeric results can be bucketed into ranges. Note that it is possible for a result to fall into different buckets over the course of a day, or when tallying "only online" and "online and recent" counts.

Figure  5:  Online/offline counts for a numeric saved question

About the Trends configuration

Trends configuration involves the following objects:


We recommend you import the gallery to get started with Trends. The gallery is a collection of Trend boards, panels, and associated data sources. It is designed by subject matter experts to give you a starting place to explore how a variety of types of Tanium questions can be used to identify trends in resource utilization, operational hygiene, and endpoint security posture.

data source

A data source is a configuration that specifies the question being tracked with Trends. The data source configuration sets up the saved question and associated Connect connection. You do not directly configure the saved question or connection used by Trends. When creating the Trends objects to track a new piece of information, you create the data source before you create the panel that references it.


A Trend board is an organizer for a collection of panels. A Trend board can have multiple sections and each section can contain multiple panels. The configuration consists of displayed titles and text and the selection of member panels.


A single panel contains a single visualization based on a single data source. You can customize the chart type, date or date range, color scheme, and more.

Last updated: 4/3/2018 4:06 PM | Feedback