3.2 Drilling Down into Question Results
Key Takeaways
- Drilling down uses the drill-down question's sensors to filter the results you selected, so it answers 'which endpoints were behind these rows' rather than adding columns for everyone.
- You must select rows before clicking Drill Down, and consecutive rows can be selected by clicking the first checkbox, holding Shift and clicking the last.
- If the selected results include a parameterized sensor value and the drill-down question uses a sensor with a matching parameter, the dialog automatically populates that parameter.
- The Saved Questions tab lists only questions flagged as available for drilling down unless the operator selects Show all questions.
- After a drill-down you can drill down further, deploy an action, save the question, or click Copy to Question Builder for explicit refinement.
3.2 Drilling Down into Question Results
Quick overview: Drill down takes the rows you selected in the Question Results grid and asks a new question about only those endpoints. Formally, adding a drill-down question means using its sensors to filter the selected results. It is how an operator goes from "three endpoints are running something odd" to "these are their names, their logged-in users and their IP addresses" — and it is the standard way to narrow a fleet-wide result down to a set you can safely deploy an action to.
1. When to drill down
The typical scenario is targeting a smaller group of endpoints for an action. You start broad on purpose, because you do not yet know which endpoints matter, then narrow.
BROAD QUESTION SELECT ROWS DRILL DOWN
-------------- ----------- ----------
Get Chassis Type and tick the two rows add Computer Name
Operating System that matter -> now you know WHICH
from all machines endpoints those were
Tanium's own example makes the point cleanly: you might issue a question that returns chassis types and operating systems for all endpoints; to see the identities of the endpoints behind specific rows, you drill down with the Computer Name sensor.
That inversion is the thing to internalise. A counting question tells you how many. Drill-down converts a "how many" into a "which ones".
2. The workflow
- In the Question Results grid, select the results you want more information about.
- Click Drill Down.
- Choose the drill-down question from one of the tabs, then click Drill Down again.
- Interact shows the progression of results, including a new Question Results grid for the drill-down question.
From that new grid you can carry on: drill down further, deploy an action, save the question, or click Copy to Question Builder to refine the question explicitly.
Selecting rows efficiently
To select several consecutive rows for drilling down, copying, exporting or deploying actions, click the checkbox in the first row, hold Shift, and click the checkbox in the last row.
3. Choosing the drill-down question
| Tab | What it offers |
|---|---|
| Saved Questions | Saved questions in content sets for which you have Saved Question read permission. By default the list shows only questions with the available for drilling down setting enabled; tick Show all questions to see the rest |
| Create a question / Build a question | Compose a new question for this drill-down |
Parameter auto-population
If the selected results include the value of a parameterized sensor, and your drill-down question uses a sensor with a matching parameter, the Select Drill-down Question dialog automatically populates that parameter with the value from the selected results.
This is genuinely useful under pressure. Select the row showing a suspicious file path, drill down with a hashing or file-detail sensor, and the path is already in the parameter field — no retyping, no transcription errors.
4. Drill down versus merge — the distinction the exam tests
Both add information, but they move in different directions, and the mechanics differ in ways that show up as exam answers.
| Drill down | Merge | |
|---|---|---|
| What it does | Asks a new question about the endpoints behind selected rows | Adds columns to the current results |
| Row selection | Required — you select the rows first | Not required — merge operations automatically apply to all results |
| Result shape | A new Question Results grid, a narrower endpoint set | The same grid, re-displayed with one or more additional columns |
| Question type constraint | Works from counting or non-counting results | Only non-counting questions can be used in merge operations |
| Mental model | "Tell me more about these machines" | "Add another column for everyone" |
[!IMPORTANT] If an exam item describes an operator selecting specific rows and then wanting information about only those endpoints, the answer is drill down. If it describes wanting an extra attribute alongside the existing results without narrowing anything, the answer is merge.
5. A worked triage sequence
Situation: the SOC wants to know whether an unexpected process is present, and on which endpoints.
| Step | Action | Why |
|---|---|---|
| 1 | Get Running Processes from all machines | Counting question — cheap, gives a fleet distribution and surfaces outliers by their low counts |
| 2 | Scan the grid for low-count rows | A process running on 3 endpoints out of 40,000 is interesting by construction |
| 3 | Select the suspicious row, click Drill Down, add Computer Name, Last Logged In User, IP Address | Converts "3 endpoints" into three identified endpoints with context |
| 4 | Drill down again if needed, or Copy to Question Builder | Refine without starting over |
| 5 | With the narrowed set selected, Deploy Action | Action deployment from Question Results accepts up to 100 selected rows |
| 6 | Re-ask the step 1 question | Verification — the count should drop |
The step-6 loop is worth doing habitually: it is blueprint objective TA-2, verify the state of an endpoint before and after making changes, and drill-down is what makes the "before" set precise enough to act on.
6. Practical cautions
- Drill down narrows; it does not re-query the fleet. You are filtering the selected results, so an endpoint that failed to answer the original question is not going to appear now.
- Reissue before you act. Results expire after 10 minutes (30 for TDS-registered sensors). A drill-down grid you left open over lunch is not a safe targeting basis for an action.
- Mind the 100-row limit. You can select a maximum of 100 rows for one action deployment from Question Results. If your drill-down leaves 400 endpoints, target them with a computer group or a saved question instead of trying to select them by hand.
- Show all questions exists for a reason. If the saved question you want is not listed, it probably lacks the drill-down display flag rather than being unavailable to you.
What does adding a drill-down question actually do to the results an operator selected?
An operator selects a result row containing a file path returned by a parameterized sensor, then drills down using a question whose sensor takes a matching parameter. What happens?
Which statement correctly distinguishes drill down from merge in the Question Results grid?
A drill-down leaves 400 endpoints that need a remediation package. What is the correct next step?