Asking Questions
A question is a request, not a report
A Tanium question is a real-time request sent to endpoints. It names one or more sensors (the data to collect), optional filters on those sensors, and a target scope (all computers or a computer group). Endpoints evaluate the sensors locally and return a row of results; the console aggregates rows into a table you can group, sort, drill into, and export. Results are a snapshot at the moment of asking - not a historical record.
Three flavors matter: an ad-hoc (single) question typed in Interact or Deploy; a saved question stored under a name for reuse; and a parameterized saved question that prompts for sensor parameters each time it is issued. Saved questions are the building blocks other modules consume - dashboards, scheduled reports, Connect streams, and dynamic computer groups.
Result states are a classic exam trap. Pending means endpoints have not yet answered. No Results means the endpoint answered but nothing matched the filter, or the sensor returned nothing - that is not the same as an error, and it is not proof the endpoint is clean. A row count of 900 out of 1,000 targeted endpoints means 100 endpoints did not answer; read that as a visibility gap, not as 100 compliant machines. Questions also expire: once a question ages out, the console stops waiting, so stale results must be re-asked rather than refreshed indefinitely.
Worked example: to find endpoints on an outdated browser, ask a question using the installed-applications sensor filtered to versions below your target, issued to the group you actually mean - then confirm the answered-endpoint count matches your expected fleet size before drawing conclusions or deploying anything.