3.4 Computer Groups: Management versus Filter, Dynamic versus Manual
Key Takeaways
- A user can view question results from, and deploy actions to, only endpoints in a computer management group assigned to the user or persona selected for the current session.
- Roles do not control access to computer management groups; roles control which content such as sensors and packages is available, so a working setup needs both a role and a group assignment.
- Filter groups are applied as filters in questions and results and are granted through a content set and role, but they never widen visibility beyond assigned management groups.
- The reserved groups All Computers and No Computers function as both management and filter groups, live in the Reserved content set, and cannot be edited.
- Dynamic groups derive membership from a question and stay current automatically, while manual groups are an explicit list that is predictable but goes stale.
3.4 Computer Groups: Management versus Filter, Dynamic versus Manual
Quick overview: Blueprint objective RQ-3 asks you to explain manual and dynamic groups and custom tags. Computer groups answer two different questions in Tanium, and confusing them is the single most common source of "why can't I see those endpoints?" tickets. A computer management group decides which endpoints you are allowed to see and act on. A computer filter group is a convenience filter you apply to questions and results. Independently of that, a group's membership can be manual (an explicit list) or dynamic (evaluated from a question).
1. Two axes, not one
HOW MEMBERSHIP IS DEFINED
Manual Dynamic
+-------------------------+-------------------------+
WHAT THE | explicit list of | membership from a |
GROUP IS FOR | named computers | question / sensor |
| | filter |
Management | a fixed pilot ring, | "all Windows servers" |
(permissions) | a named lab | as an ownership |
| | boundary |
+-------------------------+-------------------------+
Filter | a handful of machines | "All Windows", |
(convenience) | you keep re-checking | "All Macs" |
+-------------------------+-------------------------+
The two axes are genuinely independent. A group can be manual and used for permissions; a group can be dynamic and used only as a filter; and a group can be both a management group and a filter group at once.
2. Computer management groups
A Tanium user can view question results from, and deploy actions to, only those endpoints that belong to a computer management group assigned to the user or persona selected for the current session.
That is the sentence to memorise. It is why from all machines never means the whole enterprise, and why two operators asking an identical question legitimately get different counts.
| Fact | Detail |
|---|---|
| Where managed | Administration > Permissions > Computer Groups manages groups that function exclusively as management groups |
| How access is granted | The group is assigned to a user, persona or user group. Roles do not control access to computer management groups |
| What roles control instead | Which content — sensors, packages, saved questions — is available to that user |
Permissions need both halves
Tanium's own example is worth carrying into the exam. To let a user see the processes running on data-centre endpoints you must do two separate things:
- Assign a role with
Sensorread permission on the content set containing theRunning Processessensor. - Assign a computer management group containing the data-centre endpoints.
Either one alone produces a frustrating half-failure: the right sensor with no endpoints, or the right endpoints with no permission to run the sensor.
3. Computer filter groups
Filter groups are used as filters in questions and in question results. They exist to save typing and to standardise common slices of the fleet — "All Windows", "All Macs".
| Fact | Detail |
|---|---|
| Where managed | Administration > Permissions > Filter Groups manages groups that function exclusively as filter groups |
| How access is granted | Assign the filter group to a content set, grant Filter Group permissions on that content set in a role, and assign the role to user accounts, personas or user groups |
The rule that trips people up
Users cannot receive question results from endpoints in a filter group unless those endpoints also belong to a computer management group that is assigned to them.
A filter group narrows what you already have permission to see. It never widens it. An operator who applies an "All Windows" filter group and gets fewer endpoints than expected does not have a filter problem — they have a management group problem.
4. Groups that are both
You can configure a computer group to function as both a management group and a filter group. Two reserved groups always do:
| Reserved group | Notes |
|---|---|
| All Computers | Functions as both types |
| No Computers | Functions as both types |
Both live in the Reserved content set and cannot be edited. On a fresh Tanium Server installation, the server automatically imports additional predefined computer groups that function as both filter groups and management groups.
Groups intended to serve both purposes are managed on the Administration > Permissions > Computer Groups page.
[!TIP]
No Computersis a genuinely useful object, not a curiosity. Its membership definition uses a question with anot matchesexpression and the regular expression(.*)to match empty results — that is, nothing. It is the safe default target when you want an action or policy that is defined but deliberately inert until you scope it.
5. Dynamic membership versus manual membership
Dynamic (filter-based) groups
Membership is defined by a question — a sensor plus an operator and a value. Tanium re-evaluates it, so an endpoint that is rebuilt, renamed or moved joins or leaves the group without anyone editing a list.
Typical definitions:
Operating System contains Windows ServerTanium Client IP Address is in subnet 10.20.0.0/16Custom Tags contains PCI(see section 3.5)
Strengths: self-maintaining; correct by construction; scales to fleets nobody could list by hand.
Costs: the defining sensor runs on endpoints in order to evaluate membership. Tanium explicitly warns not to lower the default Max Sensor Age or Maximum Data Age for sensors that define membership in computer management groups and filter groups, because those sensors re-evaluate constantly and a low age limit drives endpoint CPU up across the whole fleet.
Manual groups
Membership is an explicit list of specified computers.
Strengths: completely predictable; ideal for a named pilot ring, a change-advisory-board-approved wave, or a small lab where "these exact five machines" is the requirement. Costs: it goes stale. Nobody remembers to remove the decommissioned server, and nobody adds the replacement.
Choosing between them
| Requirement | Choose |
|---|---|
| "Every endpoint that matches this condition, forever" | Dynamic |
| "These specific machines, and only these, until I say otherwise" | Manual |
| "The pilot ring for this rollout" | Manual — you want it to not change under you |
| "All Windows servers, as an ownership boundary" | Dynamic |
| "Endpoints that cannot be described by any sensor value" | Manual, or tag them and go dynamic (section 3.5) |
6. Diagnosing group problems
| Symptom | Most likely cause |
|---|---|
| "I can see fewer endpoints than my colleague" | Different computer management group assignments, or a different active persona |
| "The filter group returns almost nothing" | The endpoints are in the filter group but not in a management group assigned to you |
| "I can see the endpoints but cannot run the sensor" | The role lacks read permission on the content set holding that sensor |
| "A rebuilt endpoint dropped out of the group" | Dynamic membership re-evaluated — usually correct behaviour, check the defining sensor |
| "Group membership is lagging reality" | The defining sensor's cached result is still within its age limit; do not fix this by lowering the age limit fleet-wide |
| "Endpoints appear only after several minutes" | Clients receive new definitions at registration; normal registration is a randomised 30 to 90 seconds |
An operator can see an endpoint listed in the All Windows filter group but receives no question results from it. What is the most likely cause?
What two assignments are required before a user can see the processes running on data-centre endpoints?
Which statement about the reserved computer groups All Computers and No Computers is correct?
An operator wants a pilot ring of exactly twelve named endpoints that will not change during a two-week rollout. Which group type is appropriate, and what is the trade-off?