Study guide
2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy
Tanium Certified Operator TCO
Track your progress as you read
Finished sections get a check mark.
1 Tanium Certified Operator Exam and Platform Foundations
1.1 The Tanium Certified Operator Exam: Blueprint, Logistics and Certification Path 1.2 Tanium Platform Components, Client Registration and Linear Chain Peering
2 Asking Questions (22% of the TCO Blueprint)
2.1 Sensors: Execution Model, Output Structure and Data Types 2.2 Parameterized Sensors and Question Parameter Syntax 2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy 2.4 Creating Saved Questions: Reissue Intervals, Merge and Drill-Down Flags, and RBAC 2.5 Defending Tanium as an Efficient User of Network Resources
3 Refining Questions (23% of the TCO Blueprint)
3.1 Targeting Endpoints: from and with Filters, Operators and Boolean Logic 3.2 Drilling Down into Question Results 3.3 Merging Questions to Add Columns 3.4 Computer Groups: Management versus Filter, Dynamic versus Manual 3.5 Custom Tags and Tag-Based Grouping
4 Taking Action (15% of the TCO Blueprint)
4.1 Packages: Anatomy, Command Syntax, Parameters and File Distribution 4.2 Deploying Actions: Entry Points, Targeting, Distribution and Approval 4.3 Verifying Endpoint State and Automating with Scheduled Recurring Actions
5 Navigation and Basic Module Functions (23% of the TCO Blueprint)
5.1 Console Layout, the Main Menu and Where Things Live 5.2 Operations Modules: Deploy, Patch, Asset, Performance and Provision 5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor 5.4 Interpreting Module-Specific Historical Results and Tanium Data Service 5.5 Choosing the Right Area: Client Status, Direct Connect and Action History 5.6 Content Sets, Roles and Personas: Why You Can See What You Can See
6 Report Generation and Data Export (17% of the TCO Blueprint)
6.1 Exporting Question Results: CSV, Headers, Flatten Rows and Copy 6.2 Creating Reusable Reports with Tanium Reporting 6.3 Dashboards, Boards and Metric Sources: Trends, Its Replacement and Migration 6.4 Scheduled Delivery and Exporting to External Systems with Tanium Connect
2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy
Key Takeaways Explain This Topic AI
Every Tanium question has the same anatomy: a get clause naming the sensors, a from clause naming the scope, and optional filter clauses that decide which endpoints answer.
The Ask a Question field parses conversational text and suggests sensors and clauses, while the Question Builder assembles the same question explicitly through structured controls.
A counting question groups identical results with a Count column, while adding a per-endpoint sensor such as Computer Name makes the question non-counting and returns one row per endpoint.
Only non-counting questions can be used in merge operations, so a question that will not merge usually needs a per-endpoint sensor added to its get clause.
Question results expire after 10 minutes, or 30 minutes for sensors registered with Tanium Data Service, so an operator should reissue a question immediately before acting on its results.
Last updated: August 2026
2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy
Quick overview: Interact is where an operator turns an operational request into a Tanium question. Every question has the same anatomy — a get clause naming the sensors, a from clause naming the scope, and optional filters . You can express it conversationally in the Ask a Question field, or assemble it explicitly in the Question Builder . Whichever route you take, the result lands in the Question Results grid, and how that grid aggregates depends on whether your question is counting or non-counting .
1. The Interact Workspace & Question Bar NLP
The Interact Workspace is the operational command center of Tanium. At the top of Interact sits the Question Bar , which features an intelligent Natural Language Parser (NLP) engine. +---------------------------------------------------------------------------------------+
- | QUESTION BAR NLP WORKFLOW |
- +---------------------------------------------------------------------------------------+
- | Operator Input : "get computer name and ip address from all machines with os contains win" |
- | |
- | NLP Parser Steps: |
- | 1. Tokenize string into keywords: `Get`, `from`, `with`, `and`, `contains` |
- | 2. Match sensor strings to Content Catalog: |
- | - "computer name" -> `Computer Name` |
- | - "ip address" -> `IP Address` |
- | - "os" -> `Operating System` |
- | 3. Validate Filter Operator: `contains` matches String data type |
- | 4. Generate Canonical Tanium Query String |
- +---------------------------------------------------------------------------------------+
- Question Bar Features & Visual Feedback
Type-Ahead Suggestions: As the operator types, the NLP engine displays a dynamic dropdown suggesting matching sensors, computer groups, and parameter formats.
Syntax Indicators:
Green Checkmark: The query is syntactically valid and unambiguous; ready to execute.
Yellow Warning / Clarification Required: Ambiguous sensor match (e.g., typing IP matches IP Address , IP Route Details , and IPv6 Address ); clicking the desired sensor resolves ambiguity.
Red / Incomplete: Query lacks mandatory clauses, contains mismatched brackets, or has unclosed quotes.
- 2. Anatomy of a Tanium Question
- Every Tanium query adheres to a formal three-part syntactic structure: ANATOMY OF A TANIUM QUESTION
- [GET CLAUSE] [FROM CLAUSE] [WITH/WITHOUT CLAUSE]
- (What data to return) (What machines to query) (Targeting filter criteria)
- ┌──────────────────────┐ ┌──────────────────────┐ ┌─────────────────────────────────┐
- │ Get Computer Name │ │ from all machines │ │ with Operating System contains │
- │ and IP Address │ │ │ │ Windows │
- └──────────────────────┘ └──────────────────────┘ └─────────────────────────────────┘
- Detailed Clause Breakdown
The Get Clause (Data Columns):
Defines the sensors and columns returned in the live results grid.
Multiple sensors are joined using and or commas: Get Computer Name and IP Address and Disk Free Space .
Supports column selection on multi-column sensors (e.g., Get Running Processes:Process Name ).
The From Clause (Machine Scope):
Defines the baseline target scope across the enterprise.
Common targets: from all machines , from Windows Endpoints , from Datacenter Linux Servers (using pre-defined Computer Groups).
The With / Without Clause (Targeting Filter):
Restricts which endpoints across the enterprise must execute the Get clause.
with : Positive inclusion filter (e.g., with RAM > 16 GB ).
without : Negative exclusion filter (e.g., without Installed Applications contains CrowdStrike ).
The Having Clause (Row-Level Filter):
Filters the specific rows returned by a multi-row sensor on the target endpoints before output is transmitted.
3. Question Builder vs. Question Bar
While the Question Bar is ideal for rapid, conversational queries, the Question Builder provides a structured graphical interface designed for complex multi-clause logic. +---------------------------------------------------------------------------------------+
- | QUESTION BUILDER INTERFACE |
- +---------------------------------------------------------------------------------------+
- | SECTION 1: SELECT COLUMNS (Sensors) |
- | [ + Add Sensor ] ──> `Computer Name` |
- | ──> `Running Processes` [ Filter Columns: Name, PID ] |
- | |
- | SECTION 2: ROW FILTERS (having) |
- | [ Filter rows where: Running Processes:Process Name contains "powershell" ] |
- | |
- | SECTION 3: TARGETING FILTERS (with / without) |
- | Match [ ALL ▼ ] of the following: |
- | ┌─ Condition 1: `Operating System` [ contains ▼ ] "Windows Server" |
- | └─ Condition 2: `IP Address` [ is in subnet ▼ ] "10.200.0.0/16" |
- +---------------------------------------------------------------------------------------+
Feature Question Bar Question Builder
Primary Use Case Rapid ad-hoc triage and operational queries. Complex nested boolean logic and multi-row filtering.
Input Style Conversational plain text (NLP). Form-based dropdowns, condition blocks, and picker trees.
Error Handling Auto-corrects and prompts for clarification. Prevents syntax errors by constraining selections.
Advanced Filtering Requires exact syntax knowledge for having . Dedicated visual row-filtering and column-picker blocks.
4. Counting and non-counting questions
This distinction is small, easy to miss, and it changes what the grid shows you and what you are allowed to do next.
Counting question Non-counting question
What the grid shows Unique result values with a Count of how many endpoints returned exactly the same values One row per endpoint
Typical shape Get Operating System from all machines Get Computer Name and Operating System from all machines
Network cost Lower — endpoints return a small set of distinct result strings Higher — every endpoint returns its own distinct row
Merging Not available. You can use only non-counting questions in merge operations Available
Adding a sensor that is unique per endpoint — Computer Name , Computer ID , an IP address — turns a counting question into a non-counting one, because no two endpoints can share the same values any more.
Important
If the Merge button will not accept your question, the usual reason is that it is a counting question. Add Computer Name to the get clause to make it non-counting, then merge.
Counting questions are the right default for a "how is the fleet distributed?" question, because they generate far less traffic and give you a distribution at a glance. Non-counting questions are what you need when you must identify which endpoints, export a per-endpoint list, or merge in additional columns.
5. Question results are scoped by your computer management groups
One rule overrides everything you write in the from clause:
Tanium Clients return results only from endpoints that are members of computer management groups assigned to the user account or persona you used to issue the question — regardless of the from clause targeting .
So from all machines never means "all machines in the enterprise". It means "all machines I am permitted to see". Two operators can issue byte-identical questions and get different counts, and neither is wrong. Section 3.4 covers computer groups, and section 5.6 covers how personas change the scope you are operating under.
6. Question expiration and reissuing
A question's results do not live forever on the server. The question expiration period is 10 minutes , extended to 30 minutes for questions issued to collect results for sensors that are registered with Tanium Data Service . This is why the Tanium Server, when running a policy action on a schedule, first evaluates whether its cached question results have exceeded the expiration period: if they have not, it reuses the cached results; if they have, it reissues the question.
For an operator, the practical consequences are:
Leaving the Question Results page open does not keep the data fresh indefinitely; reissue when you come back to it.
A result set you are about to act on should be current. Reissue the question immediately before deploying an action so that your targeting reflects the fleet as it is now.