Tanium 6.x: Drill Down

Asking a question such as Get Disk Free Space from all machines will return results quickly.

While scrolling through the list, there is a D drive that appears to be completely full. From this screen, if an operator wants to know more about which machine this is, they should Drill Down by double clicking and choosing a Saved Question. Because of the frequency of use for this purpose, Saved Questions used for Drill Downs can be sorted to the top by putting a space in front of the name. In this example, General Information is a question that has the leading space.

Select_drill_down.png
 

Hit Load to see the Drill Down.

Noteworthy things about Drill Downs are that an operator may multi-select rows to Drill Down on, and that multi-select capability exists in the Drill Down box as well. Answers can be drilled into as many times as necessary. Drill Down allows an operator to keep the original questions broad and to keep the number of columns down in the original question. Later in this document, Drill Downs will prove to be useful as one way to target machines for actions.

Have more questions? Submit a request