TCO study plan
TCO · Give each week a clear focus.
8 weeks · About 6 hours per week
Tanium Platform Fundamentals
Label the core components of a Tanium deployment (client, server, module server, zone server, console) and state what each one does
Trace the path a question travels from console to endpoints and back, describing the peer-to-peer / linear-chain distribution model
Explain how the Tanium Client communicates and why that design keeps query load low at scale
Define the platform vocabulary (sensor, question, saved question, package, action, action group) in your own words
Your checkpoint
One-page architecture diagram you drew yourself plus a 15-term glossary, scored at 80% or higher on a self-written 15-question recall quiz
Tanium Platform Fundamentals & Asking Questions
Write 10 natural-language questions in the console that select specific sensors and return results from a small test group
Apply filters and filter groups to narrow a question's target set, then verify the result count changes as expected
Identify the parts of a question (selected sensors, source/target, filters) and predict which columns the answer grid will show
Distinguish a live question from a saved question and explain when to save one
Your checkpoint
A log of 10 questions you wrote, each with the exact syntax, the filter used, and one sentence on why you chose it
Asking Questions
Decompose questions into sensor selection, targeting, and filtering and rebuild them from scratch without notes
Predict the exact columns and row set a given question will return before running it, then check your prediction
Explain how question results are aggregated and how to read totals, counts, and per-row detail
Answer 25 scenario-style questions about choosing the right question for a stated goal, reviewing every miss
Your checkpoint
A prediction log of 20 questions (predicted vs. actual result) with a written explanation for each mismatch
Asking Questions & Deploying Actions and Packages
Describe the anatomy of a package (files, command, parameters) and what makes a package safe to re-run
Build a simple package and deploy an action against a small test group, then confirm success from the action's status view
Choose appropriate action groups and approval settings for a given deployment scenario
Compare when to use a package-based action versus a saved question for a stated outcome
Your checkpoint
One working package you authored, plus a written run report showing targeting, status results, and what you would change on a re-run
Deploying Actions and Packages & Sensors and Saved Questions
Sequence the deployment workflow end to end: identify need, select sensors, build package, target, schedule, verify
Set and interpret action parameters, timeouts, and scheduling options and explain the risk of each choice
Read a sensor definition and explain what data it returns and how its columns are produced
Author a custom sensor from an existing command or script and validate its output on a test endpoint
Your checkpoint
A deployment checklist you wrote covering targeting, scheduling, and verification, validated by running one scheduled action and documenting the outcome
Sensors and Saved Questions
Differentiate sensors, saved questions, and dashboards by what each one stores and when each one refreshes
Convert a frequently used ad hoc question into a saved question with a clear name, description, and owner
Diagnose common sensor failures (permissions, timeouts, unsupported platform) and describe the first troubleshooting step for each
Organize saved questions into a logical naming and grouping scheme another admin could follow
Your checkpoint
A library of 8 saved questions with names, descriptions, and intended audience, plus a troubleshooting table covering 5 failure modes
Monitoring and Reporting Basics & Tanium Platform Fundamentals
Build a report or dashboard from existing saved questions and explain what each panel answers
Interpret trend data over time and distinguish a snapshot from a monitored state
Revisit platform fundamentals by re-explaining the architecture diagram without notes and correcting any errors
Answer 30 mixed practice questions across all five domains and categorize each miss by domain
Your checkpoint
One dashboard with at least three panels, plus a scored practice set with a miss-list grouped by domain
Tanium Platform Fundamentals & Asking Questions & Deploying Actions and Packages & Sensors and Saved Questions & Monitoring and Reporting Basics
Retake missed questions from weeks 3, 6, and 7 and clear every item you previously got wrong
Time yourself on two full-length practice sets and record your score and pacing per domain
Rebuild the two weakest deliverables (question log, package, or saved-question library) from memory
Write a one-page cheat sheet of the 20 facts you were most likely to forget
Your checkpoint
Two timed practice scores at or above your target pass mark, plus a final one-page cheat sheet and a zero-item miss list
Milestones
Week 2: You can draw the platform architecture from memory and write a filtered question that returns the expected result set on the first try
Week 4: You have built and successfully deployed at least one package to a test group and can explain each status you saw
Week 6: You have a working library of at least 8 named saved questions and can diagnose 5 common sensor failure modes
Week 8: Two timed practice sets completed with scores at or above your target pass mark and no unresolved items on your miss list