Minimum Tanium Client Version: 7.9.4
Everything documented here is available from that release onward, except where a page names a later one.
The Tanium Scripting Language (TSL) is based on Starlark, a dialect of Python, with extensions for the Tanium Platform. A TSL interpreter is embedded within the Tanium Client, which defines additional domain-specific functions and data types beyond those provided by the core language.
TSL is dynamically typed, with high-level data types, first-class functions with lexical scope, and automatic memory management. Its syntax is a strict subset of Python and its semantics are almost a subset of that language, so the data types, statements, and expressions will be familiar to any Python programmer. It is intended not for writing applications but for scripts: programs are short-lived and their main result is structured data.
TSL is deliberately small. There are no user-defined types, no inheritance, no reflection, and no explicit memory management. As a Tanium extension it supports a constrained form of Python-style exception handling - try / except / raise / finally - but user-defined exception classes are not permitted.
Scripts run under bounds imposed by the runtime, either on iterations or on time. The interpreter may be invoked concurrently from many threads without the possibility of a data race, because shared data structures become immutable through freezing.
- Specification: the language itself - lexical elements, data types, name binding, expressions, statements, and the grammar reference.
- Standard library: one page per module, documenting the functions, types, values, and exceptions each provides.
- Execution contexts: which modules are loaded for a given use case, such as a sensor or an action.
Two rules cover the annotations on these pages, and both are written so that the plain page is the ordinary case:
- Functions and modules are available in all execution contexts unless otherwise noted. Each module page opens with the contexts that load it, and a function available in fewer contexts than its module carries an Available in contexts line.
- APIs are present in every client release this reference covers unless otherwise noted. An API added since Tanium Client 7.9.4, where version tracking starts, carries an Added in version line. Not all versions ship as a release; if none carries the number, the first release above it is the one to look for.