Study guide
3.4 Computer Groups: Management versus Filter, Dynamic versus Manual
Tanium Certified Operator TCO
Track your progress as you read
Finished sections get a check mark.
1 Tanium Certified Operator Exam and Platform Foundations
1.1 The Tanium Certified Operator Exam: Blueprint, Logistics and Certification Path 1.2 Tanium Platform Components, Client Registration and Linear Chain Peering
2 Asking Questions (22% of the TCO Blueprint)
2.1 Sensors: Execution Model, Output Structure and Data Types 2.2 Parameterized Sensors and Question Parameter Syntax 2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy 2.4 Creating Saved Questions: Reissue Intervals, Merge and Drill-Down Flags, and RBAC 2.5 Defending Tanium as an Efficient User of Network Resources
3 Refining Questions (23% of the TCO Blueprint)
3.1 Targeting Endpoints: from and with Filters, Operators and Boolean Logic 3.2 Drilling Down into Question Results 3.3 Merging Questions to Add Columns 3.4 Computer Groups: Management versus Filter, Dynamic versus Manual 3.5 Custom Tags and Tag-Based Grouping
4 Taking Action (15% of the TCO Blueprint)
4.1 Packages: Anatomy, Command Syntax, Parameters and File Distribution 4.2 Deploying Actions: Entry Points, Targeting, Distribution and Approval 4.3 Verifying Endpoint State and Automating with Scheduled Recurring Actions
5 Navigation and Basic Module Functions (23% of the TCO Blueprint)
5.1 Console Layout, the Main Menu and Where Things Live 5.2 Operations Modules: Deploy, Patch, Asset, Performance and Provision 5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor 5.4 Interpreting Module-Specific Historical Results and Tanium Data Service 5.5 Choosing the Right Area: Client Status, Direct Connect and Action History 5.6 Content Sets, Roles and Personas: Why You Can See What You Can See
6 Report Generation and Data Export (17% of the TCO Blueprint)
6.1 Exporting Question Results: CSV, Headers, Flatten Rows and Copy 6.2 Creating Reusable Reports with Tanium Reporting 6.3 Dashboards, Boards and Metric Sources: Trends, Its Replacement and Migration 6.4 Scheduled Delivery and Exporting to External Systems with Tanium Connect
3.4 Computer Groups: Management versus Filter, Dynamic versus Manual
Key Takeaways Explain This Topic AI
A user can view question results from, and deploy actions to, only endpoints in a computer management group assigned to the user or persona selected for the current session.
Roles do not control access to computer management groups; roles control which content such as sensors and packages is available, so a working setup needs both a role and a group assignment.
Filter groups are applied as filters in questions and results and are granted through a content set and role, but they never widen visibility beyond assigned management groups.
The reserved groups All Computers and No Computers function as both management and filter groups, live in the Reserved content set, and cannot be edited.
Dynamic groups derive membership from a question and stay current automatically, while manual groups are an explicit list that is predictable but goes stale.
Last updated: August 2026
3.4 Computer Groups: Management versus Filter, Dynamic versus Manual
Quick overview: Blueprint objective RQ-3 asks you to explain manual and dynamic groups and custom tags . Computer groups answer two different questions in Tanium, and confusing them is the single most common source of "why can't I see those endpoints?" tickets. A computer management group decides which endpoints you are allowed to see and act on . A computer filter group is a convenience filter you apply to questions and results. Independently of that, a group's membership can be manual (an explicit list) or dynamic (evaluated from a question).
- 1. Two axes, not one HOW MEMBERSHIP IS DEFINED
- Manual Dynamic
- +-------------------------+-------------------------+
- WHAT THE | explicit list of | membership from a |
- GROUP IS FOR | named computers | question / sensor |
- | | filter |
- Management | a fixed pilot ring, | "all Windows servers" |
- (permissions) | a named lab | as an ownership |
- | | boundary |
- +-------------------------+-------------------------+
- Filter | a handful of machines | "All Windows", |
- (convenience) | you keep re-checking | "All Macs" |
- +-------------------------+-------------------------+
The two axes are genuinely independent. A group can be manual and used for permissions; a group can be dynamic and used only as a filter; and a group can be both a management group and a filter group at once.
2. Computer management groups
A Tanium user can view question results from, and deploy actions to, only those endpoints that belong to a computer management group assigned to the user or persona selected for the current session.
That is the sentence to memorise. It is why from all machines never means the whole enterprise, and why two operators asking an identical question legitimately get different counts.
Fact Detail
Where managed Administration > Permissions > Computer Groups manages groups that function exclusively as management groups
How access is granted The group is assigned to a user, persona or user group . Roles do not control access to computer management groups
- What roles control instead Which content — sensors, packages, saved questions — is available to that user
- Permissions need both halves
Tanium's own example is worth carrying into the exam. To let a user see the processes running on data-centre endpoints you must do two separate things :
Assign a role with Sensor read permission on the content set containing the Running Processes sensor.
Assign a computer management group containing the data-centre endpoints.
Either one alone produces a frustrating half-failure: the right sensor with no endpoints, or the right endpoints with no permission to run the sensor.
3. Computer filter groups
Filter groups are used as filters in questions and in question results . They exist to save typing and to standardise common slices of the fleet — "All Windows", "All Macs".
Fact Detail
Where managed Administration > Permissions > Filter Groups manages groups that function exclusively as filter groups
How access is granted Assign the filter group to a content set , grant Filter Group permissions on that content set in a role , and assign the role to user accounts, personas or user groups
The rule that trips people up
Users cannot receive question results from endpoints in a filter group unless those endpoints also belong to a computer management group that is assigned to them.
A filter group narrows what you already have permission to see. It never widens it. An operator who applies an "All Windows" filter group and gets fewer endpoints than expected does not have a filter problem — they have a management group problem.
4. Groups that are both
You can configure a computer group to function as both a management group and a filter group. Two reserved groups always do:
- Reserved group Notes
- All Computers Functions as both types
- No Computers Functions as both types
Both live in the Reserved content set and cannot be edited . On a fresh Tanium Server installation, the server automatically imports additional predefined computer groups that function as both filter groups and management groups.
Groups intended to serve both purposes are managed on the Administration > Permissions > Computer Groups page.
Tip
No Computers is a genuinely useful object, not a curiosity. Its membership definition uses a question with a not matches expression and the regular expression (.*) to match empty results — that is, nothing. It is the safe default target when you want an action or policy that is defined but deliberately inert until you scope it.
- 5. Dynamic membership versus manual membership
- Dynamic (filter-based) groups
Membership is defined by a question — a sensor plus an operator and a value. Tanium re-evaluates it, so an endpoint that is rebuilt, renamed or moved joins or leaves the group without anyone editing a list.
Typical definitions:
- Operating System contains Windows Server
- Tanium Client IP Address is in subnet 10.20.0.0/16
- Custom Tags contains PCI (see section 3.5)
Strengths: self-maintaining; correct by construction; scales to fleets nobody could list by hand. Costs: the defining sensor runs on endpoints in order to evaluate membership. Tanium explicitly warns not to lower the default Max Sensor Age or Maximum Data Age for sensors that define membership in computer management groups and filter groups, because those sensors re-evaluate constantly and a low age limit drives endpoint CPU up across the whole fleet.
Manual groups
Membership is an explicit list of specified computers.
Strengths: completely predictable; ideal for a named pilot ring, a change-advisory-board-approved wave, or a small lab where "these exact five machines" is the requirement. Costs: it goes stale. Nobody remembers to remove the decommissioned server, and nobody adds the replacement.
Choosing between them
- Requirement Choose
- "Every endpoint that matches this condition, forever" Dynamic
- "These specific machines, and only these, until I say otherwise" Manual
- "The pilot ring for this rollout" Manual — you want it to not change under you
- "All Windows servers, as an ownership boundary" Dynamic
- "Endpoints that cannot be described by any sensor value" Manual , or tag them and go dynamic (section 3.5)
- 6. Diagnosing group problems
Symptom Most likely cause
"I can see fewer endpoints than my colleague" Different computer management group assignments, or a different active persona
"The filter group returns almost nothing" The endpoints are in the filter group but not in a management group assigned to you
"I can see the endpoints but cannot run the sensor" The role lacks read permission on the content set holding that sensor
"A rebuilt endpoint dropped out of the group" Dynamic membership re-evaluated — usually correct behaviour, check the defining sensor
"Group membership is lagging reality" The defining sensor's cached result is still within its age limit; do not fix this by lowering the age limit fleet-wide
"Endpoints appear only after several minutes" Clients receive new definitions at registration; normal registration is a randomised 30 to 90 seconds