TCO flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Tanium Client

Persistent agent installed on every managed endpoint that keeps an always-on TCP session with a few neighbor clients, so questions and actions arrive in seconds instead of on a polling schedule.

Tanium Zone Server

Intermediate server between the Tanium Server and endpoint clients; it aggregates and forwards traffic so the central server handles a small number of connections rather than hundreds of thousands.

Peer-to-peer relay

Clients forward content and question traffic to a small number of neighbor clients; this chained topology lets a modest number of server connections serve an entire estate.

Tanium default client port

TCP 17472 is used by default for client-to-client and client-to-zone-server traffic, while console and API access use HTTPS on port 443.

Content set

A container for sensors, packages, saved questions, and other objects that determines which content a user group can see and use under role-based access control.

RBAC persona

A bundle that pairs a role, which defines permitted actions, with one or more content sets, which define visible content; personas are assigned to user groups.

Question

A request sent to a defined set of endpoints asking one or more sensors for values; results travel back up the chain and are cached for the question's lifetime.

Question targeting

Every question must name its answerers: either all managed computers or a specific computer group, which also bounds the endpoint workload the question creates.

Question TTL

The limited lifetime of a question; endpoints that answer before expiry contribute results, and afterwards results are stale and must be re-asked or saved.

Sensor filter

A condition on sensor output such as OS contains Server that restricts which returned rows appear in results; filtering narrows displayed rows, not endpoint work.

Question results grid

The results view showing one row per endpoint per unique combination of sensor values, with sensors as columns; rows can be drilled into and exported.

Interact module

The core console module where users type question text with sensor autocomplete, choose targets, and review live results, or save the question for reuse.

Package

A reusable bundle of files, a command line, and typed parameters that defines the work an endpoint performs; packages are deployed by creating actions.

Action

The deployment of a package to a target set of endpoints, carrying parameters, a schedule or expiration, approval state, and optional success-verification criteria.

Package parameter

A value defined in the package and supplied at deploy time, referenced positionally in the command line as $1, $2, and so on, so one package serves many cases.

Action approval

When approval is required, an authorized user must approve an action before endpoints receive it; until then the action stays pending and does not execute.

Action lifecycle states

Actions move from pending to active and then to complete, expired, or stopped; completed actions report counts of endpoints that succeeded and failed.

Action verification

A success criterion defined by a sensor and expected value; each endpoint reports pass or fail so you can confirm the change actually took effect.

Action expiration window

The action remains available until its end time, so endpoints that report late but before expiry still run it; stopping halts further distribution without undoing completed runs.

Sensor

A named, platform-specific query definition that returns data from an endpoint, such as computer name, installed applications, or running processes.

Parameterized sensor

A sensor that accepts input at ask time, such as a folder path or service name, letting one definition answer many related questions.

Multi-row sensor

A sensor that returns many rows per endpoint, such as Installed Applications or Running Processes, producing one result row per returned item.

Saved question

A named, reusable question that stores its sensors, filters, and targeting so it can be re-asked on demand, scheduled, or reused as a data source.

Scheduled saved question

A saved question configured to run at a recurring interval; each run produces a fresh result set, so the interval sets data freshness and collection cost.

Sensor content set access

Sensors live in content sets, so a user sees and can ask only sensors inside content sets assigned to them, regardless of role permissions.

Tanium Trends

The dashboarding module where boards hold panels that chart metrics over time from saved questions collected on a recurring schedule.

Trends source

The saved question plus collection interval that supplies data to one or more Trends panels; the interval determines the time granularity of the charted data.

Trends board

A single dashboard page containing multiple panels, usually grouped by a theme such as patch compliance, endpoint health, or software inventory.

Tanium Connect

A module that pulls data from Tanium sources on a schedule and delivers it to external destinations such as S3 buckets, ODBC databases, or SIEM platforms.

Client Status coverage check

A question-derived count of installed versus currently connected endpoints, used to confirm reporting coverage before trusting any compliance percentage.

Exporting question results

Question results can be exported from Interact as CSV, JSON, or XML, giving a point-in-time snapshot for offline analysis or ingestion elsewhere.