2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy

2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy

Quick overview: Interact is where an operator turns an operational request into a Tanium question. Every question has the same anatomy — a get clause naming the sensors, a from clause naming the scope, and optional filters. You can express it conversationally in the Ask a Question field, or assemble it explicitly in the Question Builder. Whichever route you take, the result lands in the Question Results grid, and how that grid aggregates depends on whether your question is counting or non-counting.

---

1. The Interact Workspace & Question Bar NLP

The Interact Workspace is the operational command center of Tanium. At the top of Interact sits the Question Bar, which features an intelligent Natural Language Parser (NLP) engine.

+---------------------------------------------------------------------------------------+
|                             QUESTION BAR NLP WORKFLOW                                 |
+---------------------------------------------------------------------------------------+
|  Operator Input : "get computer name and ip address from all machines with os contains win"  |
|                                                                                       |
|  NLP Parser Steps:                                                                    |
|  1. Tokenize string into keywords: `Get`, `from`, `with`, `and`, `contains`           |
|  2. Match sensor strings to Content Catalog:                                          |
|     - "computer name" -> `Computer Name`                                              |
|     - "ip address"    -> `IP Address`                                                 |
|     - "os"            -> `Operating System`                                           |
|  3. Validate Filter Operator: `contains` matches String data type                     |
|  4. Generate Canonical Tanium Query String                                            |
+---------------------------------------------------------------------------------------+

Question Bar Features & Visual Feedback

• Type-Ahead Suggestions: As the operator types, the NLP engine displays a dynamic dropdown suggesting matching sensors, computer groups, and parameter formats.
• Syntax Indicators:
  • Green Checkmark: The query is syntactically valid and unambiguous; ready to execute.
  • Yellow Warning / Clarification Required: Ambiguous sensor match (e.g., typing IP matches IP Address, IP Route Details, and IPv6 Address); clicking the desired sensor resolves ambiguity.
  • Red / Incomplete: Query lacks mandatory clauses, contains mismatched brackets, or has unclosed quotes.

---

2. Anatomy of a Tanium Question

Every Tanium query adheres to a formal three-part syntactic structure:

                         ANATOMY OF A TANIUM QUESTION
                         
         [GET CLAUSE]             [FROM CLAUSE]             [WITH/WITHOUT CLAUSE]
      (What data to return)    (What machines to query)     (Targeting filter criteria)
    ┌──────────────────────┐  ┌──────────────────────┐  ┌─────────────────────────────────┐
    │ Get Computer Name    │  │ from all machines    │  │ with Operating System contains  │
    │ and IP Address       │  │                      │  │ Windows                         │
    └──────────────────────┘  └──────────────────────┘  └─────────────────────────────────┘

Detailed Clause Breakdown

1. The Get Clause (Data Columns):
   • Defines the sensors and columns returned in the live results grid.
   • Multiple sensors are joined using and or commas: Get Computer Name and IP Address and Disk Free Space.
   • Supports column selection on multi-column sensors (e.g., Get Running Processes:Process Name).
2. The From Clause (Machine Scope):
   • Defines the baseline target scope across the enterprise.
   • Common targets: from all machines, from Windows Endpoints, from Datacenter Linux Servers (using pre-defined Computer Groups).
3. The With / Without Clause (Targeting Filter):
   • Restricts which endpoints across the enterprise must execute the Get clause.
   • with: Positive inclusion filter (e.g., with RAM > 16 GB).
   • without: Negative exclusion filter (e.g., without Installed Applications contains CrowdStrike).
4. The Having Clause (Row-Level Filter):
   • Filters the specific rows returned by a multi-row sensor on the target endpoints before output is transmitted.

---

3. Question Builder vs. Question Bar

While the Question Bar is ideal for rapid, conversational queries, the Question Builder provides a structured graphical interface designed for complex multi-clause logic.

+---------------------------------------------------------------------------------------+
|                               QUESTION BUILDER INTERFACE                              |
+---------------------------------------------------------------------------------------+
|  SECTION 1: SELECT COLUMNS (Sensors)                                                  |
|  [ + Add Sensor ] ──> `Computer Name`                                                 |
|                   ──> `Running Processes` [ Filter Columns: Name, PID ]               |
|                                                                                       |
|  SECTION 2: ROW FILTERS (having)                                                      |
|  [ Filter rows where: Running Processes:Process Name contains "powershell" ]          |
|                                                                                       |
|  SECTION 3: TARGETING FILTERS (with / without)                                        |
|  Match [ ALL ▼ ] of the following:                                                    |
|  ┌─ Condition 1: `Operating System` [ contains ▼ ] "Windows Server"                  |
|  └─ Condition 2: `IP Address` [ is in subnet ▼ ] "10.200.0.0/16"                      |
+---------------------------------------------------------------------------------------+

---

---

4. Counting and non-counting questions

This distinction is small, easy to miss, and it changes what the grid shows you and what you are allowed to do next.

Adding a sensor that is unique per endpoint — Computer Name, Computer ID, an IP address — turns a counting question into a non-counting one, because no two endpoints can share the same values any more.

[!IMPORTANT] If the Merge button will not accept your question, the usual reason is that it is a counting question. Add Computer Name to the get clause to make it non-counting, then merge.

Counting questions are the right default for a "how is the fleet distributed?" question, because they generate far less traffic and give you a distribution at a glance. Non-counting questions are what you need when you must identify which endpoints, export a per-endpoint list, or merge in additional columns.

---

5. Question results are scoped by your computer management groups

One rule overrides everything you write in the from clause:

Tanium Clients return results only from endpoints that are members of computer management groups assigned to the user account or persona you used to issue the question — regardless of the from clause targeting.

So from all machines never means "all machines in the enterprise". It means "all machines I am permitted to see". Two operators can issue byte-identical questions and get different counts, and neither is wrong. Section 3.4 covers computer groups, and section 5.6 covers how personas change the scope you are operating under.

---

6. Question expiration and reissuing

A question's results do not live forever on the server. The question expiration period is 10 minutes, extended to 30 minutes for questions issued to collect results for sensors that are registered with Tanium Data Service. This is why the Tanium Server, when running a policy action on a schedule, first evaluates whether its cached question results have exceeded the expiration period: if they have not, it reuses the cached results; if they have, it reissues the question.

For an operator, the practical consequences are:

• Leaving the Question Results page open does not keep the data fresh indefinitely; reissue when you come back to it.
• A result set you are about to act on should be current. Reissue the question immediately before deploying an action so that your targeting reflects the fleet as it is now.