Tanium GraphQL API Gateway
Tanium™ API Gateway provides a single and stable API integration point for various Tanium solutions. It is designed for Tanium partners and customers interested in building integrated solutions with the Tanium™ Core Platform.
API Endpoints
https://<customername>-api.cloud.tanium.com/plugin/products/gateway/graphqlVersion:
Current
Release Comparison:
Getting Started
Visit the Documentation Site to find helpful information such as...
- Overview and Requirements
- Installation and Troubleshooting Instructions
- Lots of Helpful Example Queries!
New to GraphQL?
GraphQL is a query language for APIs. Visit graphql.org to learn all about it.
Need Deprecated Content?
Alternate version of the Schema Documentation
that includes deprecated queries and fields
Queries
action
Description
Finds the identified action.
Stability Level: 3 - Stable
Response
Returns an
Action
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
query action($ref: IdRefInput!) {
action(ref: $ref) {
id
name
comment
expireSeconds
creationTime
startTime
expirationTime
distributeSeconds
status
stoppedFlag
targets {
...ActionTargetsFragment
}
package {
...PackageRefFragment
}
scheduledAction {
...ScheduledActionFragment
}
stopped
creator {
...PrincipalFragment
}
approver {
...PrincipalFragment
}
metadata {
...MetadataFragment
}
results {
...ActionResultsFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"action": {
"id": 4,
"name": "abc123",
"comment": "abc123",
"expireSeconds": 123,
"creationTime": "10:15:30Z",
"startTime": "10:15:30Z",
"expirationTime": "10:15:30Z",
"distributeSeconds": 987,
"status": "OPEN",
"stoppedFlag": false,
"targets": ActionTargets,
"package": PackageRef,
"scheduledAction": ScheduledAction,
"stopped": false,
"creator": Principal,
"approver": Principal,
"metadata": [Metadata],
"results": ActionResults
}
}
}
actionGroup
Description
Returns an action group that matches the specified input.
Stability Level: 3 - Stable
Response
Returns an
ActionGroup
Arguments
| Name | Description |
|---|---|
ref -
NamedRefInput!
|
The reference data the action group must match to be returned. Stability Level: 3 - Stable |
Example
Query
query actionGroup($ref: NamedRefInput!) {
actionGroup(ref: $ref) {
id
name
visibility
userGroups {
...NamedRefFragment
}
computerGroups {
...ComputerGroupFragment
}
any
}
}
Variables
{"ref": NamedRefInput}
Response
{
"data": {
"actionGroup": {
"id": "4",
"name": "xyz789",
"visibility": "ADMIN",
"userGroups": [NamedRef],
"computerGroups": [ComputerGroup],
"any": true
}
}
}
actionGroups
Description
Stability Level: 3 - Stable
Response
Returns an
ActionGroupConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the action groups after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n action groups from the list. This has a maximum value of 5,000.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the action groups before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n action groups from the list. This must be given if Stability Level: 3 - Stable |
Example
Query
query actionGroups(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int
) {
actionGroups(
after: $after,
first: $first,
before: $before,
last: $last
) {
edges {
...ActionGroupEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123
}
Response
{
"data": {
"actionGroups": {
"edges": [ActionGroupEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
actions
Description
Returns the matching actions.
Stability Level: 1.2 - Experimental (Release Candidate)
Response
Returns an
ActionConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the actions after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n actions from the list. This has a maximum value of 200.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the actions before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n actions from the list. This must be given if Stability Level: 3 - Stable |
filter -
FieldFilter
|
Returns only the actions matching the filter. The filter must be either a simple filter or a compound filter with a single set of simple child filters which all must match. The paths which support filtering include: This filter does not support the Stability Level: 3 - Stable |
Example
Query
query actions(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: FieldFilter
) {
actions(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter
) {
edges {
...ActionEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123,
"filter": FieldFilter
}
Response
{
"data": {
"actions": {
"edges": [ActionEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
assetProductEndpoints
Description
Retrieves endpoints based on Asset software inventory and usage.
Use of this field requires the Asset solution.
Use of this field requires the Tanium permission asset api user read.
Stability Level: 3 - Stable
Response
Returns an
AssetProductEndpointConnection
Arguments
| Name | Description |
|---|---|
filter -
AssetProductEndpointsFilter
|
Filter endpoints by the given criteria. Stability Level: 3 - Stable |
after -
Cursor
|
Returns endpoints after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns the first n endpoints from the list. Stability Level: 3 - Stable |
Example
Query
query assetProductEndpoints(
$filter: AssetProductEndpointsFilter,
$after: Cursor,
$first: Int
) {
assetProductEndpoints(
filter: $filter,
after: $after,
first: $first
) {
edges {
...AssetProductEndpointEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalCount
}
}
Variables
{
"filter": AssetProductEndpointsFilter,
"after": Cursor,
"first": 987
}
Response
{
"data": {
"assetProductEndpoints": {
"edges": [AssetProductEndpointEdge],
"pageInfo": PageInfo,
"totalCount": 987
}
}
}
assetProducts
Description
Retrieves product usage for assets and endpoints.
Use of this field requires the Asset solution.
Use of this field requires the Tanium permission asset api user read.
Stability Level: 3 - Stable
Response
Returns an
AssetProductConnection
Arguments
| Name | Description |
|---|---|
filter -
AssetProductsFilter
|
Filter products by the given criteria. Stability Level: 3 - Stable |
after -
Cursor
|
Returns products after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns the first n products from the list. Stability Level: 3 - Stable |
Example
Query
query assetProducts(
$filter: AssetProductsFilter,
$after: Cursor,
$first: Int
) {
assetProducts(
filter: $filter,
after: $after,
first: $first
) {
edges {
...AssetProductEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalCount
}
}
Variables
{
"filter": AssetProductsFilter,
"after": Cursor,
"first": 123
}
Response
{
"data": {
"assetProducts": {
"edges": [AssetProductEdge],
"pageInfo": PageInfo,
"totalCount": 987
}
}
}
computerGroup
Description
Returns a computer group that matches the specified input.
Stability Level: 3 - Stable
Response
Returns a
ComputerGroup
Arguments
| Name | Description |
|---|---|
ref -
NamedRefInput!
|
The reference data the computer group must match to be returned. Stability Level: 3 - Stable |
Example
Query
query computerGroup($ref: NamedRefInput!) {
computerGroup(ref: $ref) {
id
name
managementRightsEnabled
filterEnabled
contentSet {
...NamedRefFragment
}
contentSetV2 {
...TaniumPlatformContentSetFragment
}
type
expression
modifiedTime
}
}
Variables
{"ref": NamedRefInput}
Response
{
"data": {
"computerGroup": {
"id": 4,
"name": "abc123",
"managementRightsEnabled": false,
"filterEnabled": false,
"contentSet": NamedRef,
"contentSetV2": TaniumPlatformContentSet,
"type": "STANDARD",
"expression": "abc123",
"modifiedTime": "10:15:30Z"
}
}
}
computerGroups
Description
Returns all computer groups matching the specified input.
Stability Level: 3 - Stable
Response
Returns a
ComputerGroupConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the computer groups after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n computer groups from the list. This has a maximum value of 5,000.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the computer groups before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n computer groups from the list. This must be given if Stability Level: 3 - Stable |
filter -
ComputerGroupsFilter
|
Returns only the computer groups matching the filter. Stability Level: 3 - Stable |
Example
Query
query computerGroups(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: ComputerGroupsFilter
) {
computerGroups(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter
) {
edges {
...ComputerGroupEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123,
"filter": ComputerGroupsFilter
}
Response
{
"data": {
"computerGroups": {
"edges": [ComputerGroupEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
connectConnection
Description
Returns the connection that matches the referenced ID.
Use of this field requires the Connect solution.
Use of this field requires the Tanium permission Connect - Read.
Stability Level: 1.2 - Experimental (Release Candidate)
Response
Returns a
ConnectConnection
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 1.2 - Experimental (Release Candidate) |
Example
Query
query connectConnection($ref: IdRefInput!) {
connectConnection(ref: $ref) {
id
displayName
description
currentRun {
...ConnectRunFragment
}
pastRuns {
...ConnectRunConnectionFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"connectConnection": {
"id": "4",
"displayName": "abc123",
"description": "abc123",
"currentRun": ConnectRun,
"pastRuns": ConnectRunConnection
}
}
}
connectConnections
Description
Returns the matching connections.
Use of this field requires the Connect solution.
Use of this field requires the Tanium permission Connect - Read.
Stability Level: 1.2 - Experimental (Release Candidate)
Response
Returns a
ConnectGraphConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Stability Level: 1.2 - Experimental (Release Candidate) |
first -
Int
|
Stability Level: 1.2 - Experimental (Release Candidate). Default = 20 |
before -
Cursor
|
Stability Level: 1.2 - Experimental (Release Candidate) |
last -
Int
|
Stability Level: 1.2 - Experimental (Release Candidate) |
Example
Query
query connectConnections(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int
) {
connectConnections(
after: $after,
first: $first,
before: $before,
last: $last
) {
edges {
...ConnectConnectionEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123
}
Response
{
"data": {
"connectConnections": {
"edges": [ConnectConnectionEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
connectRun
Description
Returns the connection run that matches the referenced connection run ID.
Use of this field requires the Connect solution.
Use of this field requires the Tanium permission Connect - Read.
Stability Level: 1.2 - Experimental (Release Candidate)
Response
Returns a
ConnectRun
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 1.2 - Experimental (Release Candidate) |
Example
Query
query connectRun($ref: IdRefInput!) {
connectRun(ref: $ref) {
id
connectionID
status
createdTime
updatedTime
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"connectRun": {
"id": "4",
"connectionID": "4",
"status": "Starting",
"createdTime": "10:15:30Z",
"updatedTime": "10:15:30Z"
}
}
}
connectRuns
Description
Returns all connection runs started from a given connection configuration.
Use of this field requires the Connect solution.
Use of this field requires the Tanium permission Connect - Read.
Stability Level: 1.2 - Experimental (Release Candidate)
Response
Returns a
ConnectRunConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Stability Level: 1.2 - Experimental (Release Candidate) |
first -
Int
|
Stability Level: 1.2 - Experimental (Release Candidate). Default = 20 |
before -
Cursor
|
Stability Level: 1.2 - Experimental (Release Candidate) |
last -
Int
|
Stability Level: 1.2 - Experimental (Release Candidate) |
Example
Query
query connectRuns(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int
) {
connectRuns(
after: $after,
first: $first,
before: $before,
last: $last
) {
edges {
...ConnectRunEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 987
}
Response
{
"data": {
"connectRuns": {
"edges": [ConnectRunEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
}
}
currentUserContext
Description
Returns the current user and selected persona.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
TaniumPlatformUserContext!
Example
Query
query currentUserContext {
currentUserContext {
user {
...TaniumPlatformUserFragment
}
persona {
...TaniumPlatformUserPersonaFragment
}
}
}
Response
{
"data": {
"currentUserContext": {
"user": TaniumPlatformUser,
"persona": TaniumPlatformUserPersona
}
}
}
directConnectConnectionStatus
Description
Checks the status of a direct connection.
The input requires a direct endpoint connection opened using directConnectOpen.
Use of this field requires the Direct Connect solution.
Stability Level: 3 - Stable
Response
Returns a
DirectConnectConnectionStatusPayload!
Arguments
| Name | Description |
|---|---|
input -
DirectConnectConnectionStatusInput!
|
Stability Level: 3 - Stable |
Example
Query
query directConnectConnectionStatus($input: DirectConnectConnectionStatusInput!) {
directConnectConnectionStatus(input: $input) {
status
}
}
Variables
{"input": DirectConnectConnectionStatusInput}
Response
{"data": {"directConnectConnectionStatus": {"status": "UNKNOWN"}}}
directConnectEndpoint
Description
Obtains data from the specified endpoint using an open Direct Connect connection.
The input requires a direct endpoint connection opened using directConnectOpen.
Use of this field requires the Direct Connect solution.
Stability Level: 3 - Stable
Response
Returns a
DirectConnect
Arguments
| Name | Description |
|---|---|
input -
DirectConnectEndpointInput!
|
Stability Level: 3 - Stable |
Example
Query
query directConnectEndpoint($input: DirectConnectEndpointInput!) {
directConnectEndpoint(input: $input) {
performance {
...DirectConnectPerfFragment
}
processes {
...DirectConnectProcessesFragment
}
alerts {
...DirectConnectAlertsFragment
}
}
}
Variables
{"input": DirectConnectEndpointInput}
Response
{
"data": {
"directConnectEndpoint": {
"performance": DirectConnectPerf,
"processes": DirectConnectProcesses,
"alerts": DirectConnectAlerts
}
}
}
directEndpoint
Description
Obtains data from the specified endpoint using a Direct Connect connection.
Use of this field requires the Direct Connect solution.
Stability Level: 2 - Legacy Use directConnectEndpoint instead. The directConnect APIs provide better support for tracking connections that take longer to establish.
Response
Returns a
DirectConnect
Arguments
| Name | Description |
|---|---|
input -
OpenDirectConnectionInput!
|
Stability Level: 3 - Stable |
Example
Query
query directEndpoint($input: OpenDirectConnectionInput!) {
directEndpoint(input: $input) {
performance {
...DirectConnectPerfFragment
}
processes {
...DirectConnectProcessesFragment
}
alerts {
...DirectConnectAlertsFragment
}
}
}
Variables
{"input": OpenDirectConnectionInput}
Response
{
"data": {
"directEndpoint": {
"performance": DirectConnectPerf,
"processes": DirectConnectProcesses,
"alerts": DirectConnectAlerts
}
}
}
discoverInterface
Description
Returns the Discover interface that matches the referenced ID.
Use of this field requires the Tanium permission Discover Asset - Read.
Note: If location permissions are defined, the user will also require the User Group - Read permission and only the interfaces in locations allowed by the user's group membership will be returned. Otherwise, if the user has the Discover Location Permissions - Write permission they will see all interfaces regardless of group membership.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
DiscoverInterface
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
query discoverInterface($ref: IdRefInput!) {
discoverInterface(ref: $ref) {
id
macAddress
manufacturer
hostnames
ipAddresses
labels {
...DiscoverLabelFragment
}
osPlatform
openPorts
discoveryMethods
lastSeenTime
computerId
natIPAddresses
osGeneration
profiles {
...DiscoverProfileFragment
}
cloudInstances {
...DiscoverCloudInstanceFragment
}
cloudTags {
...DiscoverCloudTagFragment
}
firstSeenTime
firstManagedTime
lastManagedTime
lastDiscoveredTime
isManaged
isUnmanageable
isIgnored
satellites {
...DiscoverSatelliteFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"discoverInterface": {
"id": "4",
"macAddress": "xyz789",
"manufacturer": "abc123",
"hostnames": ["abc123"],
"ipAddresses": ["xyz789"],
"labels": [DiscoverLabel],
"osPlatform": "xyz789",
"openPorts": [987],
"discoveryMethods": ["ARP"],
"lastSeenTime": "10:15:30Z",
"computerId": "abc123",
"natIPAddresses": ["abc123"],
"osGeneration": "abc123",
"profiles": [DiscoverProfile],
"cloudInstances": [DiscoverCloudInstance],
"cloudTags": [DiscoverCloudTag],
"firstSeenTime": "10:15:30Z",
"firstManagedTime": "10:15:30Z",
"lastManagedTime": "10:15:30Z",
"lastDiscoveredTime": "10:15:30Z",
"isManaged": true,
"isUnmanageable": false,
"isIgnored": true,
"satellites": [DiscoverSatellite]
}
}
}
discoverInterfaces
Description
Returns the matching Discover interfaces.
Use of this field requires the Tanium permission Discover Asset - Read.
Note: If location permissions are defined, the user will also require the User Group - Read permission and only the interfaces in locations allowed by the user's group membership will be returned. Otherwise, if the user has the Discover Location Permissions - Write permission they will see all interfaces regardless of group membership.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
DiscoverInterfaceConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the Discover interfaces after the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
first -
Int
|
Returns the first n Discover interfaces from the list.
Stability Level: 1.1 - Experimental (Active Development). Default = |
before -
Cursor
|
Returns the Discover interfaces before the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
last -
Int
|
Returns the last n Discover interfaces from the list. Stability Level: 1.1 - Experimental (Active Development) |
filter -
FieldFilter
|
Returns only the Discover interfaces matching the filter. Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
query discoverInterfaces(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: FieldFilter
) {
discoverInterfaces(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter
) {
edges {
...DiscoverInterfaceEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123,
"filter": FieldFilter
}
Response
{
"data": {
"discoverInterfaces": {
"edges": [DiscoverInterfaceEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
}
}
discoverLabel
Description
Returns the Discover label that matches the referenced name.
Use of this field requires the Tanium permission Discover Asset - Read.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
DiscoverLabel
Arguments
| Name | Description |
|---|---|
ref -
NamedOnlyRefInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
query discoverLabel($ref: NamedOnlyRefInput!) {
discoverLabel(ref: $ref) {
name
type
createdTime
modifiedTime
}
}
Variables
{"ref": NamedOnlyRefInput}
Response
{
"data": {
"discoverLabel": {
"name": "xyz789",
"type": "STANDARD",
"createdTime": "10:15:30Z",
"modifiedTime": "10:15:30Z"
}
}
}
discoverLabels
Description
Returns the matching Discover labels.
Use of this field requires the Tanium permission Discover Asset - Read.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
DiscoverLabelConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the Discover labels after the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
first -
Int
|
Returns the first n Discover labels from the list.
Stability Level: 1.1 - Experimental (Active Development). Default = |
before -
Cursor
|
Returns the Discover labels before the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
last -
Int
|
Returns the last n Discover labels from the list. Stability Level: 1.1 - Experimental (Active Development) |
filter -
FieldFilter
|
Returns only the Discover labels matching the filter. Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
query discoverLabels(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: FieldFilter
) {
discoverLabels(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter
) {
edges {
...DiscoverLabelEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 987,
"filter": FieldFilter
}
Response
{
"data": {
"discoverLabels": {
"edges": [DiscoverLabelEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
emailServerSummaries
Description
Returns summary information for matching email servers, required to retrieve and use an email server to send emails. The response contains summary information only for email servers that are enabled to send emails.
Use of this field requires the Email solution.
Use of this field requires the Tanium permission Email Send.
Note: Only return summaries for email servers in content sets to which the user has the Email Send permission.
Stability Level: 1.0 - Experimental (Early Development)
Response
Returns an
EmailServerSummaryConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the email server summaries after the given cursor. Stability Level: 1.0 - Experimental (Early Development) |
first -
Int
|
Returns up to the first n email server summaries from the list. This has a maximum value of 100.
Stability Level: 1.0 - Experimental (Early Development). Default = |
Example
Query
query emailServerSummaries(
$after: Cursor,
$first: Int
) {
emailServerSummaries(
after: $after,
first: $first
) {
edges {
...EmailServerSummaryEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{"after": Cursor, "first": 20}
Response
{
"data": {
"emailServerSummaries": {
"edges": [EmailServerSummaryEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
}
}
emailServerSummary
Description
Returns summary information for the email server matching the ID, required to retrieve and use an email server to send emails. The response contains the matching email server summary information only if the email server is enabled to send emails.
Use of this field requires the Email solution.
Use of this field requires the Tanium permission Email Send.
Note: Only returns a summary if the email server is in a content set to which the user has the Email Send permission.
Stability Level: 1.0 - Experimental (Early Development)
Response
Returns an
EmailServerSummary
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 1.0 - Experimental (Early Development) |
Example
Query
query emailServerSummary($ref: IdRefInput!) {
emailServerSummary(ref: $ref) {
id
name
description
fromAddress
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"emailServerSummary": {
"id": 4,
"name": "abc123",
"description": "abc123",
"fromAddress": "abc123"
}
}
}
endpointCounts
Description
Returns the count of endpoints matching the input sensor column values. Requests might return an array of field values for a given column. For example, if you define the Installed Application sensor in EndpointCountsInput.sensors, the results include multiple applications per row count. For the Installed Application sensor Name column, the values field returns an array of multiple applications.
Stability Level: 1.0 - Experimental (Early Development)
Response
Returns an
EndpointCountsConnection
Arguments
| Name | Description |
|---|---|
input -
EndpointCountsInput!
|
Stability Level: 1.0 - Experimental (Early Development) |
Example
Query
query endpointCounts($input: EndpointCountsInput!) {
endpointCounts(input: $input) {
edges {
...EndpointCountsEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
collectionInfo {
...EndpointCountsCollectionInfoFragment
}
}
}
Variables
{"input": EndpointCountsInput}
Response
{
"data": {
"endpointCounts": {
"edges": [EndpointCountsEdge],
"pageInfo": PageInfo,
"totalRecords": 123,
"collectionInfo": EndpointCountsCollectionInfo
}
}
}
endpointIdChanges
Description
Changed endpoint IDs from Tanium Data Service for the given namespace and timespan.
Stability Level: 3 - Stable
Response
Returns an
EndpointIdChangesPayload!
Arguments
| Name | Description |
|---|---|
after -
Time!
|
The date and time of the oldest record to retrieve. Retrieve records newer than this time. Stability Level: 3 - Stable |
namespace -
String
|
Tanium Data Service (TDS) namespace to search against. If no value is specified, the TDS default namespace is used. Example: unmanaged_user_specified Stability Level: 3 - Stable |
Example
Query
query endpointIdChanges(
$after: Time!,
$namespace: String
) {
endpointIdChanges(
after: $after,
namespace: $namespace
) {
changes {
...EndpointIdChangeFragment
}
before
}
}
Variables
{
"after": "10:15:30Z",
"namespace": "xyz789"
}
Response
{
"data": {
"endpointIdChanges": {
"changes": [EndpointIdChange],
"before": "10:15:30Z"
}
}
}
endpoints
Description
Returns the matching endpoints from the specified source. The cursors in the returned connections are usable for 5 minutes after the most recent request in the cursored results, with a maximum lifetime of 1 hour.
Stability Level: 3 - Stable
Response
Returns an
EndpointConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the endpoints after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n endpoints from the list. This has a maximum value of 5,000.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the endpoints before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n endpoints from the list. This must be given if Stability Level: 3 - Stable |
filter -
EndpointFieldFilter
|
Returns only the endpoints matching the filter. Stability Level: 3 - Stable |
sort -
[EndpointFieldSort!]
|
Sorts the endpoints. Define up to one sort field. If no sort is provided, the endpoints order is undefined and should not be relied on. Stability Level: 3 - Stable |
source -
EndpointSource
|
Describes the data source from which to retrieve the endpoints. This defaults to the Tanium Data Service source in the default Tanium endpoint namespace. Stability Level: 3 - Stable |
refresh -
Cursor
|
Refreshes the endpoints collection identified by the given cursor, if possible. If so, this will invalidate the collection identified by the given cursor and return a new collection with new cursor values. Otherwise, the existing collection will remain available. This accepts a cursor returned by the Stability Level: 3 - Stable |
Example
Query
query endpoints(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: EndpointFieldFilter,
$sort: [EndpointFieldSort!],
$source: EndpointSource,
$refresh: Cursor
) {
endpoints(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter,
sort: $sort,
source: $source,
refresh: $refresh
) {
edges {
...EndpointEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
collectionInfo {
...EndpointCollectionInfoFragment
}
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123,
"filter": EndpointFieldFilter,
"sort": [EndpointFieldSort],
"source": EndpointSource,
"refresh": Cursor
}
Response
{
"data": {
"endpoints": {
"edges": [EndpointEdge],
"pageInfo": PageInfo,
"totalRecords": 987,
"collectionInfo": EndpointCollectionInfo
}
}
}
myAPITokens
Description
Returns the API tokens for the current user.
Stability Level: 3 - Stable
Response
Returns an
APITokenQueryPayload!
Example
Query
query myAPITokens {
myAPITokens {
tokens {
...APITokenFragment
}
error {
...SystemErrorFragment
}
}
}
Response
{
"data": {
"myAPITokens": {
"tokens": [APIToken],
"error": SystemError
}
}
}
now
Description
The current server time. Useful to test your ability to query the server.
Stability Level: 3 - Stable
Response
Returns a
Time!
Example
Query
query now {
now
}
Response
{"data": {"now": "10:15:30Z"}}
packageSpecs
Description
Returns the matching package specs. The cursors in the returned connections are usable for 5 minutes after the most recent request in the cursored results, with a maximum lifetime of 1 hour.
Stability Level: 3 - Stable
Response
Returns a
PackageSpecConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the package specs after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n package specs from the list. This has a maximum value of 5,000.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the package specs before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n package specs from the list. This must be given if Stability Level: 3 - Stable |
filter -
FieldFilter
|
Returns only the package specs matching the filter. Stability Level: 3 - Stable |
Example
Query
query packageSpecs(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: FieldFilter
) {
packageSpecs(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter
) {
edges {
...PackageSpecEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123,
"filter": FieldFilter
}
Response
{
"data": {
"packageSpecs": {
"edges": [PackageSpecEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
}
}
packages
Description
Returns the matching packages.
Stability Level: 2 - Legacy Use packageSpecs instead, which has improved pagination and parameter support.
Response
Returns a
PackagePagination
Arguments
| Name | Description |
|---|---|
paginationId -
String
|
The ID of the paginated results. Stability Level: 3 - Stable |
page -
Int
|
The page of records to return.
Stability Level: 3 - Stable. Default = |
perPage -
Int
|
The number of records to return.
Stability Level: 3 - Stable. Default = |
filterSet -
String
|
The name of the filter set to return. Stability Level: 3 - Stable |
Example
Query
query packages(
$paginationId: String,
$page: Int,
$perPage: Int,
$filterSet: String
) {
packages(
paginationId: $paginationId,
page: $page,
perPage: $perPage,
filterSet: $filterSet
) {
items {
...PackageFragment
}
pageInfo {
...PaginationInfoWithIDFragment
}
}
}
Variables
{
"paginationId": "xyz789",
"page": 1,
"perPage": 100,
"filterSet": "abc123"
}
Response
{
"data": {
"packages": {
"items": [Package],
"pageInfo": PaginationInfoWithID
}
}
}
patchDefinitions
Description
Returns the matching patch definitions.
Use of this field requires the Patch solution.
Use of this field requires the Tanium permission Patch Show.
Stability Level: 1.0 - Experimental (Early Development)
Response
Returns a
PatchDefinitionConnection!
Arguments
| Name | Description |
|---|---|
filter -
PatchDefinitionFieldFilter
|
Returns only patch definitions matching the filter. Stability Level: 1.0 - Experimental (Early Development) |
after -
Cursor
|
Returns the patch definitions after the given cursor. Stability Level: 1.0 - Experimental (Early Development) |
first -
Int
|
Returns the first n patch definitions from the list.
Stability Level: 1.0 - Experimental (Early Development). Default = |
before -
Cursor
|
Returns the patch definitions before the given cursor. Stability Level: 1.0 - Experimental (Early Development) |
last -
Int
|
Returns the last n patch definitions from the list. Stability Level: 1.0 - Experimental (Early Development) |
sort -
PatchDefinitionFieldSort!
|
Sorts the patch definitions.
Stability Level: 1.0 - Experimental (Early Development). Default = |
Example
Query
query patchDefinitions(
$filter: PatchDefinitionFieldFilter,
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$sort: PatchDefinitionFieldSort!
) {
patchDefinitions(
filter: $filter,
after: $after,
first: $first,
before: $before,
last: $last,
sort: $sort
) {
edges {
...PatchDefinitionEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"filter": PatchDefinitionFieldFilter,
"after": Cursor,
"first": 100,
"before": Cursor,
"last": 123,
"sort": {"field": "releaseDate", "order": "desc"}
}
Response
{
"data": {
"patchDefinitions": {
"edges": [PatchDefinitionEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
}
}
patchDeployment
Description
Returns the Patch deployment that matches the referenced ID.
Use of this field requires the Patch solution.
Use of this field requires the Tanium permission Patch Deployment - Read.
Stability Level: 1.0 - Experimental (Early Development)
Response
Returns a
PatchDeployment
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 1.0 - Experimental (Early Development) |
Example
Query
query patchDeployment($ref: IdRefInput!) {
patchDeployment(ref: $ref) {
id
name
type
platform
contentSet {
...IdRefFragment
}
description
contentDeploymentType
patchLists {
...PatchListRefFragment
}
patches {
...IdRefFragment
}
targets {
...PatchTargetsFragment
}
schedule {
...PatchScheduleFragment
}
downloadImmediately
overrideBlocklists
restart
notifications {
...PatchNotificationsFragment
}
author {
...TaniumPlatformUserFragment
}
createdTime
updatedTime
stoppedTime
status
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"patchDeployment": {
"id": "4",
"name": "xyz789",
"type": "INSTALL",
"platform": "WINDOWS",
"contentSet": IdRef,
"description": "xyz789",
"contentDeploymentType": "MANUAL_SELECTION",
"patchLists": [PatchListRef],
"patches": [IdRef],
"targets": PatchTargets,
"schedule": PatchSchedule,
"downloadImmediately": true,
"overrideBlocklists": true,
"restart": true,
"notifications": PatchNotifications,
"author": TaniumPlatformUser,
"createdTime": "10:15:30Z",
"updatedTime": "10:15:30Z",
"stoppedTime": "10:15:30Z",
"status": "INACTIVE"
}
}
}
playbook
Description
Returns the playbook that matches the ID and revision. If revision is not defined, returns the most recent revision of the playbook that matches the ID.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Read.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
Playbook
Arguments
| Name | Description |
|---|---|
ref -
IDRevisionRefInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
query playbook($ref: IDRevisionRefInput!) {
playbook(ref: $ref) {
id
revision
deleted
contentSet {
...TaniumPlatformContentSetFragment
}
name
description
steps {
...PlaybookStepFragment
}
startingStep {
...PlaybookStepFragment
}
notificationSettings {
...PlaybookNotificationSettingsFragment
}
createdTime
updatedTime
schedules {
...PlaybookScheduleConnectionFragment
}
runs {
...PlaybookRunConnectionFragment
}
canRun
currentUserHasActiveRun
activeRunsCount
disabledSchedulesCount
nextSchedule {
...PlaybookScheduleFragment
}
author {
...TaniumPlatformUserFragment
}
lastModifiedBy {
...TaniumPlatformUserFragment
}
}
}
Variables
{"ref": IDRevisionRefInput}
Response
{
"data": {
"playbook": {
"id": 4,
"revision": 123,
"deleted": false,
"contentSet": TaniumPlatformContentSet,
"name": "xyz789",
"description": "xyz789",
"steps": [PlaybookStep],
"startingStep": PlaybookStep,
"notificationSettings": PlaybookNotificationSettings,
"createdTime": "10:15:30Z",
"updatedTime": "10:15:30Z",
"schedules": PlaybookScheduleConnection,
"runs": PlaybookRunConnection,
"canRun": false,
"currentUserHasActiveRun": true,
"activeRunsCount": 987,
"disabledSchedulesCount": 123,
"nextSchedule": PlaybookSchedule,
"author": TaniumPlatformUser,
"lastModifiedBy": TaniumPlatformUser
}
}
}
playbookRun
Description
Returns the playbook run that matches the ID.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Read.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookRun
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
query playbookRun($ref: IdRefInput!) {
playbookRun(ref: $ref) {
id
playbook {
...PlaybookFragment
}
schedule {
...PlaybookScheduleFragment
}
scheduleStartTime
startTime
endTime
createdTime
runAs {
...TaniumPlatformUserContextFragment
}
status
events {
...PlaybookRunEventFragment
}
steps {
...PlaybookRunStepFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"playbookRun": {
"id": "4",
"playbook": Playbook,
"schedule": PlaybookSchedule,
"scheduleStartTime": "10:15:30Z",
"startTime": "10:15:30Z",
"endTime": "10:15:30Z",
"createdTime": "10:15:30Z",
"runAs": TaniumPlatformUserContext,
"status": "NOT_STARTED",
"events": [PlaybookRunEvent],
"steps": [PlaybookRunStep]
}
}
}
playbookRuns
Description
Returns the matching playbook runs.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Read.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookRunConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the playbook runs after the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
first -
Int
|
Returns the first n playbook runs from the list. This has a maximum value of 500.
Stability Level: 1.1 - Experimental (Active Development). Default = |
before -
Cursor
|
Returns the playbook runs before the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
last -
Int
|
Returns the last
n playbook runs from the list. This must be given if Stability Level: 1.1 - Experimental (Active Development) |
filter -
PlaybookRunFieldFilter
|
Returns only the playbook runs matching the filter. Stability Level: 1.1 - Experimental (Active Development) |
sort -
PlaybookRunFieldSort!
|
Sorts the playbook runs.
Stability Level: 1.1 - Experimental (Active Development). Default = |
Example
Query
query playbookRuns(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: PlaybookRunFieldFilter,
$sort: PlaybookRunFieldSort!
) {
playbookRuns(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter,
sort: $sort
) {
edges {
...PlaybookRunEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123,
"filter": PlaybookRunFieldFilter,
"sort": {"field": "status", "order": "asc"}
}
Response
{
"data": {
"playbookRuns": {
"edges": [PlaybookRunEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
playbookSchedule
Description
Returns the playbook schedule that matches the ID.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Read.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookSchedule
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
query playbookSchedule($ref: IdRefInput!) {
playbookSchedule(ref: $ref) {
id
revision
playbook {
...PlaybookFragment
}
taskArgumentOverrides {
...PlaybookStepTaskArgumentOverrideFragment
}
cron
enabled
scheduledBy {
...TaniumPlatformUserContextFragment
}
nextRunTime
createdTime
updatedTime
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"playbookSchedule": {
"id": "4",
"revision": 987,
"playbook": Playbook,
"taskArgumentOverrides": [
PlaybookStepTaskArgumentOverride
],
"cron": CronExpression,
"enabled": false,
"scheduledBy": TaniumPlatformUserContext,
"nextRunTime": "10:15:30Z",
"createdTime": "10:15:30Z",
"updatedTime": "10:15:30Z"
}
}
}
playbookSchedules
Description
Returns the matching playbook schedules.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Read.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookScheduleConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the playbook schedules after the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
first -
Int
|
Returns the first n playbook schedules from the list. This has a maximum value of 500.
Stability Level: 1.1 - Experimental (Active Development). Default = |
filter -
PlaybookScheduleFieldFilter
|
Returns only the playbook schedules matching the filter. Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
query playbookSchedules(
$after: Cursor,
$first: Int,
$filter: PlaybookScheduleFieldFilter
) {
playbookSchedules(
after: $after,
first: $first,
filter: $filter
) {
edges {
...PlaybookScheduleEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"filter": PlaybookScheduleFieldFilter
}
Response
{
"data": {
"playbookSchedules": {
"edges": [PlaybookScheduleEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
playbooks
Description
Returns the matching playbooks.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Read.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the playbooks after the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
first -
Int
|
Returns the first n playbooks from the list. This has a maximum value of 500.
Stability Level: 1.1 - Experimental (Active Development). Default = |
before -
Cursor
|
Returns the playbooks before the given cursor. Stability Level: 1.1 - Experimental (Active Development) |
last -
Int
|
Returns the last
n playbooks from the list. This must be given if Stability Level: 1.1 - Experimental (Active Development) |
filter -
PlaybookFieldFilter
|
Returns only the playbooks matching the filter. Stability Level: 1.1 - Experimental (Active Development) |
sort -
PlaybookFieldSort!
|
Sorts the playbooks.
Stability Level: 1.1 - Experimental (Active Development). Default = |
Example
Query
query playbooks(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: PlaybookFieldFilter,
$sort: PlaybookFieldSort!
) {
playbooks(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter,
sort: $sort
) {
edges {
...PlaybookEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123,
"filter": PlaybookFieldFilter,
"sort": {"field": "name", "order": "asc"}
}
Response
{
"data": {
"playbooks": {
"edges": [PlaybookEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
report
Description
Returns the report that matches the referenced ID.
Use of this field requires the Reporting solution.
Stability Level: 3 - Stable
Response
Returns a
Report
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
query report($ref: IdRefInput!) {
report(ref: $ref) {
id
name
description
contentSet {
...NamedRefFragment
}
labels
createdTime
author {
...PrincipalFragment
}
modifiedTime
lastModifiedBy {
...PrincipalFragment
}
moduleName
favorite
viewDetails {
...ReportViewFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"report": {
"id": 4,
"name": "xyz789",
"description": "abc123",
"contentSet": NamedRef,
"labels": ["abc123"],
"createdTime": "10:15:30Z",
"author": Principal,
"modifiedTime": "10:15:30Z",
"lastModifiedBy": Principal,
"moduleName": "abc123",
"favorite": false,
"viewDetails": ReportView
}
}
}
reportExport
Description
Exports the definition of the identified report. The exported definition can be used with the API Gateway reportImport mutation to recreate the report in a different Tanium environment.
Use of this field requires the Reporting solution.
Stability Level: 3 - Stable
Response
Returns a
ReportExportPayload!
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
query reportExport($ref: IdRefInput!) {
reportExport(ref: $ref) {
reportDefinition
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"reportExport": {
"reportDefinition": "xyz789"
}
}
}
reportResultData
Description
Retrieves data for the specified report, including details of the report definition. The cursors in the returned connections are usable for 5 minutes after the most recent request in the cursored results, with a maximum lifetime of 15 minutes.
Use of this field requires the Reporting solution.
Stability Level: 3 - Stable
Response
Returns a
ReportResultDataConnection
Arguments
| Name | Description |
|---|---|
id -
ID!
|
The unique identifier of the report to retrieve result data for. Stability Level: 3 - Stable |
after -
Cursor
|
Returns the report result data records after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n report result data records from the list. This has a maximum value of 5,000.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the report result data records before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n report result data records from the list. This must be given if Stability Level: 3 - Stable |
refresh -
Cursor
|
Refreshes the report result data collection identified by the given cursor, if possible. If so, this will invalidate the collection identified by the given cursor and return a new collection with new cursor values. Otherwise, the existing collection will remain available. Stability Level: 3 - Stable |
summarize -
Boolean!
|
Summarize the results by combining duplicate rows. Include the
Stability Level: 3 - Stable. Default = |
Example
Query
query reportResultData(
$id: ID!,
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$refresh: Cursor,
$summarize: Boolean!
) {
reportResultData(
id: $id,
after: $after,
first: $first,
before: $before,
last: $last,
refresh: $refresh,
summarize: $summarize
) {
viewDetails {
...ReportViewFragment
}
edges {
...ReportResultDataEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
collectionInfo {
...ReportResultDataCollectionInfoFragment
}
}
}
Variables
{
"id": 4,
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 123,
"refresh": Cursor,
"summarize": false
}
Response
{
"data": {
"reportResultData": {
"viewDetails": ReportView,
"edges": [ReportResultDataEdge],
"pageInfo": PageInfo,
"totalRecords": 123,
"collectionInfo": ReportResultDataCollectionInfo
}
}
}
reports
Description
Returns the matching reports.
Use of this field requires the Reporting solution.
Stability Level: 3 - Stable
Response
Returns a
ReportConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the reports after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n reports from the list. This has a maximum value of 5,000.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the reports before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n reports from the list. This must be given if Stability Level: 3 - Stable |
filter -
ReportFieldFilter
|
Returns only the reports matching the filter. Stability Level: 3 - Stable |
Example
Query
query reports(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: ReportFieldFilter
) {
reports(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter
) {
edges {
...ReportEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 987,
"filter": ReportFieldFilter
}
Response
{
"data": {
"reports": {
"edges": [ReportEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
}
}
scheduledAction
Description
Finds the identified scheduled action.
Stability Level: 3 - Stable
Response
Returns a
ScheduledAction
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
query scheduledAction($ref: IdRefInput!) {
scheduledAction(ref: $ref) {
id
targets {
...ActionTargetsFragment
}
package {
...PackageRefFragment
}
distributeSeconds
expireSeconds
endTime
issueSeconds
startTime
name
comment
approved
issueCount
lastStartTime
nextStartTime
status
creator {
...PrincipalFragment
}
approver {
...PrincipalFragment
}
metadata {
...MetadataFragment
}
lastAction {
...ActionFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"scheduledAction": {
"id": "4",
"targets": ActionTargets,
"package": PackageRef,
"distributeSeconds": 987,
"expireSeconds": 123,
"endTime": "10:15:30Z",
"issueSeconds": 987,
"startTime": "10:15:30Z",
"name": "xyz789",
"comment": "xyz789",
"approved": true,
"issueCount": 123,
"lastStartTime": "10:15:30Z",
"nextStartTime": "10:15:30Z",
"status": "ENABLED",
"creator": Principal,
"approver": Principal,
"metadata": [Metadata],
"lastAction": Action
}
}
}
scheduledActions
Description
Returns the matching scheduled actions. The cursors in the returned connections are usable for 5 minutes after the most recent request in the cursored results, with a maximum lifetime of 1 hour.
Stability Level: 3 - Stable
Response
Returns a
ScheduledActionConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the scheduled actions after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n scheduled actions from the list. This has a maximum value of 5,000.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the scheduled actions before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n scheduled actions from the list. This must be given if Stability Level: 3 - Stable |
filter -
FieldFilter
|
Returns only the scheduled actions matching the filter. The filter must be either a simple filter or a compound filter with a single set of simple child filters which all must match. The paths which support filtering include: This filter does not support the Stability Level: 3 - Stable |
Example
Query
query scheduledActions(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: FieldFilter
) {
scheduledActions(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter
) {
edges {
...ScheduledActionEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 20,
"before": Cursor,
"last": 987,
"filter": FieldFilter
}
Response
{
"data": {
"scheduledActions": {
"edges": [ScheduledActionEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
}
}
sensors
Description
Returns the matching sensors. The cursors in the returned connections are usable for 5 minutes after the most recent request in the cursored results, with a maximum lifetime of 1 hour.
Stability Level: 3 - Stable
Response
Returns a
SensorConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the sensors after the given cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n sensors from the list. This has a maximum value of 5,000.
Stability Level: 3 - Stable. Default = |
before -
Cursor
|
Returns the sensors before the given cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last
n sensors from the list. This must be given if Stability Level: 3 - Stable |
filter -
FieldFilter
|
Returns only the sensors matching the filter. Stability Level: 3 - Stable |
includeHidden -
Boolean!
|
Whether to include hidden sensors in the results.
Stability Level: 3 - Stable. Default = |
Example
Query
query sensors(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int,
$filter: FieldFilter,
$includeHidden: Boolean!
) {
sensors(
after: $after,
first: $first,
before: $before,
last: $last,
filter: $filter,
includeHidden: $includeHidden
) {
edges {
...SensorEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalRecords
}
}
Variables
{
"after": Cursor,
"first": 2000,
"before": Cursor,
"last": 123,
"filter": FieldFilter,
"includeHidden": false
}
Response
{
"data": {
"sensors": {
"edges": [SensorEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
}
}
softwareDeployment
Description
Returns the details of software package deployments. If you specify a deployment ID, this returns the details of that deployment. If you do not specify a deployment ID, this returns the details of all deployments.
Use of this field requires the Deploy solution.
Stability Level: 3 - Stable
Response
Returns
[SoftwareDeploymentDetails!]!
Arguments
| Name | Description |
|---|---|
id -
ID
|
The ID of a software package deployment, such as the ID returned by Stability Level: 3 - Stable |
Example
Query
query softwareDeployment($id: ID) {
softwareDeployment(id: $id) {
ID
name
errors {
...SoftwareDeploymentErrorCountFragment
}
status {
...SoftwareDeploymentStatusFragment
}
}
}
Variables
{"id": "4"}
Response
{
"data": {
"softwareDeployment": [
{
"ID": "4",
"name": "abc123",
"errors": [SoftwareDeploymentErrorCount],
"status": SoftwareDeploymentStatus
}
]
}
}
softwarePackages
Description
Returns the software package catalog from Deploy.
Use of this field requires the Deploy solution.
Stability Level: 3 - Stable
Response
Returns a
SoftwarePackageConnection
Arguments
| Name | Description |
|---|---|
after -
Cursor
|
Returns the software packages after the cursor. Stability Level: 3 - Stable |
first -
Int
|
Returns up to the first n software packages from the list. Stability Level: 3 - Stable |
before -
Cursor
|
Returns the software packages before the cursor. Stability Level: 3 - Stable |
last -
Int
|
Returns up to the last n software packages from the list. Stability Level: 3 - Stable |
Example
Query
query softwarePackages(
$after: Cursor,
$first: Int,
$before: Cursor,
$last: Int
) {
softwarePackages(
after: $after,
first: $first,
before: $before,
last: $last
) {
edges {
...SoftwarePackageEdgeFragment
}
pageInfo {
...PageInfoFragment
}
totalCount
}
}
Variables
{
"after": Cursor,
"first": 123,
"before": Cursor,
"last": 123
}
Response
{
"data": {
"softwarePackages": {
"edges": [SoftwarePackageEdge],
"pageInfo": PageInfo,
"totalCount": 987
}
}
}
Mutations
actionCreate
Description
Creates an action.
Stability Level: 3 - Stable
Response
Returns an
ActionCreatePayload!
Arguments
| Name | Description |
|---|---|
input -
ActionCreateInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation actionCreate($input: ActionCreateInput!) {
actionCreate(input: $input) {
action {
...ActionFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": ActionCreateInput}
Response
{
"data": {
"actionCreate": {
"action": Action,
"error": SystemError
}
}
}
actionGroupCreate
Description
Creates an action group from the given input.
Stability Level: 3 - Stable
Response
Returns an
ActionGroupCreatePayload!
Arguments
| Name | Description |
|---|---|
input -
ActionGroupCreateInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation actionGroupCreate($input: ActionGroupCreateInput!) {
actionGroupCreate(input: $input) {
group {
...ActionGroupFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": ActionGroupCreateInput}
Response
{
"data": {
"actionGroupCreate": {
"group": ActionGroup,
"error": SystemError
}
}
}
actionGroupDelete
Description
Deletes an action group with the given input.
Stability Level: 3 - Stable
Response
Returns an
ActionGroupDeletePayload!
Arguments
| Name | Description |
|---|---|
ref -
NamedRefInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation actionGroupDelete($ref: NamedRefInput!) {
actionGroupDelete(ref: $ref) {
id
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": NamedRefInput}
Response
{
"data": {
"actionGroupDelete": {"id": 4, "error": SystemError}
}
}
actionPerform
Description
Creates the actions or scheduled actions necessary to perform the request. This can run a specific package or a registered operation.
Stability Level: 3 - Stable
Response
Returns an
ActionPerformPayload!
Arguments
| Name | Description |
|---|---|
input -
ActionPerformInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation actionPerform($input: ActionPerformInput!) {
actionPerform(input: $input) {
scheduledActions {
...ActionPerformPlatformFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": ActionPerformInput}
Response
{
"data": {
"actionPerform": {
"scheduledActions": [ActionPerformPlatform],
"error": SystemError
}
}
}
actionStop
Description
Stops an action in progress.
Stability Level: 3 - Stable
Response
Returns an
ActionStopPayload!
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation actionStop($ref: IdRefInput!) {
actionStop(ref: $ref) {
id
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{"data": {"actionStop": {"id": 4, "error": SystemError}}}
apiTokenGrant
Description
Creates an API token for the current user.
If you specify a persona, the created token uses the persona's permissions.
Use a unique token for each process. For example, when integrating ServiceNow and Splunk, ensure both services have unique tokens. In another example: when implementing multiple ServiceNow instances or when implementing multiple connections from one ServiceNow instance to Tanium Server, ensure each has its own token. When a token expires or is rotated for any process, that token stops working for any other processes that use it.
Stability Level: 3 - Stable
Response
Returns an
APITokenGrantPayload!
Arguments
| Name | Description |
|---|---|
input -
APITokenGrantInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation apiTokenGrant($input: APITokenGrantInput!) {
apiTokenGrant(input: $input) {
token {
...APITokenFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": APITokenGrantInput}
Response
{
"data": {
"apiTokenGrant": {
"token": APIToken,
"error": SystemError
}
}
}
apiTokenRevoke
Description
Deletes the API token with the specified ID.
Stability Level: 3 - Stable
Response
Returns an
APITokenRevokePayload!
Arguments
| Name | Description |
|---|---|
input -
APITokenRevokeInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation apiTokenRevoke($input: APITokenRevokeInput!) {
apiTokenRevoke(input: $input) {
error {
...SystemErrorFragment
}
}
}
Variables
{"input": APITokenRevokeInput}
Response
{"data": {"apiTokenRevoke": {"error": SystemError}}}
apiTokenRotate
Description
Rotates the API token with the specified token string. The original API token is no longer valid after rotation. The input tokenString must belong to the user submitting the request or the response returns an error.
The new API token maintains applicable properties of the original API token, including persona, trusted IP addresses and notes. If you integrate your Tanium deployment with another platform such as ServiceNow or Splunk, use the Tanium API to configure the integration to automatically rotate its tokens before their expiration.
Use of this field requires the Tanium permission Token - Use.
Stability Level: 3 - Stable
Response
Returns an
APITokenRotatePayload!
Arguments
| Name | Description |
|---|---|
input -
APITokenRotateInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation apiTokenRotate($input: APITokenRotateInput!) {
apiTokenRotate(input: $input) {
token {
...APITokenFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": APITokenRotateInput}
Response
{
"data": {
"apiTokenRotate": {
"token": APIToken,
"error": SystemError
}
}
}
assetProducts
Description
Changes product usage gathering metrics
Use of this field requires the Asset solution.
Use of this field requires the Tanium permission asset api user write.
Stability Level: 3 - Stable
Response
Returns an
AssetProductsPayload
Arguments
| Name | Description |
|---|---|
input -
[AssetProductsInput!]!
|
Stability Level: 3 - Stable |
Example
Query
mutation assetProducts($input: [AssetProductsInput!]!) {
assetProducts(input: $input) {
products {
...AssetProductsResultFragment
}
}
}
Variables
{"input": [AssetProductsInput]}
Response
{
"data": {
"assetProducts": {"products": [AssetProductsResult]}
}
}
assetsImport
Description
Creates or updates assets for the Asset solution.
Use of this field requires the Asset solution.
Use of this field requires the Tanium permission asset api user write.
Stability Level: 3 - Stable
Response
Returns an
AssetsImportPayload!
Arguments
| Name | Description |
|---|---|
input -
AssetsImportInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation assetsImport($input: AssetsImportInput!) {
assetsImport(input: $input) {
assets {
...AssetImportPayloadFragment
}
}
}
Variables
{"input": AssetsImportInput}
Response
{
"data": {
"assetsImport": {"assets": [AssetImportPayload]}
}
}
closeDirectConnection
Description
Closes an open Direct Connect connection.
The input requires a direct endpoint connection opened using openDirectConnection.
Use of this field requires the Direct Connect solution.
Stability Level: 2 - Legacy Use directConnectClose instead. The directConnect APIs provide better support for tracking connections that take longer to establish.
Response
Returns a
CloseDirectConnectionPayload!
Arguments
| Name | Description |
|---|---|
input -
CloseDirectConnectionInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation closeDirectConnection($input: CloseDirectConnectionInput!) {
closeDirectConnection(input: $input) {
result
}
}
Variables
{"input": CloseDirectConnectionInput}
Response
{"data": {"closeDirectConnection": {"result": false}}}
computerGroupCreate
Description
Creates a standard computer group from the given input.
Stability Level: 3 - Stable
Response
Returns a
ComputerGroupCreatePayload!
Arguments
| Name | Description |
|---|---|
input -
ComputerGroupCreateInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation computerGroupCreate($input: ComputerGroupCreateInput!) {
computerGroupCreate(input: $input) {
group {
...ComputerGroupFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": ComputerGroupCreateInput}
Response
{
"data": {
"computerGroupCreate": {
"group": ComputerGroup,
"error": SystemError
}
}
}
computerGroupDelete
Description
Deletes a computer group with the given input.
Stability Level: 3 - Stable
Response
Returns a
ComputerGroupDeletePayload!
Arguments
| Name | Description |
|---|---|
ref -
NamedRefInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation computerGroupDelete($ref: NamedRefInput!) {
computerGroupDelete(ref: $ref) {
id
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": NamedRefInput}
Response
{
"data": {
"computerGroupDelete": {"id": 4, "error": SystemError}
}
}
connectConnectionStart
Description
Starts a connection run.
Use of this field requires the Connect solution.
Use of this field requires the Tanium permission Connect - Run.
Stability Level: 1.2 - Experimental (Release Candidate)
Response
Returns a
ConnectConnectionStartPayload!
Arguments
| Name | Description |
|---|---|
input -
ConnectConnectionStartInput!
|
Stability Level: 1.2 - Experimental (Release Candidate) |
Example
Query
mutation connectConnectionStart($input: ConnectConnectionStartInput!) {
connectConnectionStart(input: $input) {
run {
...ConnectRunFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": ConnectConnectionStartInput}
Response
{
"data": {
"connectConnectionStart": {
"run": ConnectRun,
"error": SystemError
}
}
}
connectConnectionStop
Description
Stops an in-progress connection run. This has no effect on connection runs that are not in progress.
Use of this field requires the Connect solution.
Use of this field requires the Tanium permission Connect - Run.
Stability Level: 1.2 - Experimental (Release Candidate)
Response
Returns a
ConnectConnectionStopPayload!
Arguments
| Name | Description |
|---|---|
input -
ConnectConnectionStopInput!
|
Stability Level: 1.2 - Experimental (Release Candidate) |
Example
Query
mutation connectConnectionStop($input: ConnectConnectionStopInput!) {
connectConnectionStop(input: $input) {
run {
...ConnectRunFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": ConnectConnectionStopInput}
Response
{
"data": {
"connectConnectionStop": {
"run": ConnectRun,
"error": SystemError
}
}
}
directConnectClose
Description
Closes an open Direct Connect connection.
The input requires a direct endpoint connection opened using directConnectOpen.
Use of this field requires the Direct Connect solution.
Use of this field requires the Tanium permission Direct Connect Session Write.
Stability Level: 3 - Stable
Response
Returns a
DirectConnectClosePayload!
Arguments
| Name | Description |
|---|---|
input -
DirectConnectCloseInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation directConnectClose($input: DirectConnectCloseInput!) {
directConnectClose(input: $input) {
result
}
}
Variables
{"input": DirectConnectCloseInput}
Response
{"data": {"directConnectClose": {"result": false}}}
directConnectOpen
Description
Initiates a Direct Connect connection with an endpoint, returning a connection ID which you can use for Direct Connect queries.
A response will be returned within 25 seconds. If the connection has not been successfully established within that time frame, you can use the directConnectConnectionStatus query with the returned connection ID to poll for readiness.
An open connection is closed after 5 minutes of inactivity.
Connections opened with directConnectOpen are compatible with stable Direct Connect APIs, including directConnectEndpoint, directConnectPing, directConnectProcessTerminate, and directConnectClose.
Connections opened with directConnectOpen are not compatible with legacy Direct Connect APIs, including directEndpoint, pingDirectConnection, killProcess, and closeDirectConnection.
Use of this field requires the Direct Connect solution.
Use of this field requires the Tanium permission Direct Connect Session Write.
Stability Level: 3 - Stable
Response
Returns a
DirectConnectOpenPayload!
Arguments
| Name | Description |
|---|---|
input -
DirectConnectOpenInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation directConnectOpen($input: DirectConnectOpenInput!) {
directConnectOpen(input: $input) {
connectionID
status
}
}
Variables
{"input": DirectConnectOpenInput}
Response
{
"data": {
"directConnectOpen": {
"connectionID": "4",
"status": "UNKNOWN"
}
}
}
directConnectPing
Description
Performs a ping to an endpoint using an open Direct Connect connection.
The input requires a direct endpoint connection opened using directConnectOpen.
Use of this field requires the Direct Connect solution.
Use of this field requires the Tanium permission Direct Connect Session Write.
Stability Level: 3 - Stable
Response
Returns a
DirectConnectPingPayload!
Arguments
| Name | Description |
|---|---|
input -
DirectConnectPingInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation directConnectPing($input: DirectConnectPingInput!) {
directConnectPing(input: $input) {
result
}
}
Variables
{"input": DirectConnectPingInput}
Response
{"data": {"directConnectPing": {"result": false}}}
directConnectProcessTerminate
Description
Terminates the specified process on an endpoint using an open Direct Connect connection.
The input requires a direct endpoint connection opened using directConnectOpen.
Use of this field requires the Direct Connect, Performance solutions.
Use of this field requires the Tanium permission Performance Kill Process.
Stability Level: 3 - Stable
Response
Returns a
DirectConnectProcessTerminatePayload!
Arguments
| Name | Description |
|---|---|
input -
DirectConnectProcessTerminateInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation directConnectProcessTerminate($input: DirectConnectProcessTerminateInput!) {
directConnectProcessTerminate(input: $input) {
result
}
}
Variables
{"input": DirectConnectProcessTerminateInput}
Response
{"data": {"directConnectProcessTerminate": {"result": false}}}
discoverInterfaceAddLabel
Description
Adds standard labels to specific Discover interfaces.
Use of this field requires the Tanium permission Discover Tag - Write.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
DiscoverInterfaceAddLabelPayload!
Arguments
| Name | Description |
|---|---|
input -
DiscoverInterfaceAddLabelInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation discoverInterfaceAddLabel($input: DiscoverInterfaceAddLabelInput!) {
discoverInterfaceAddLabel(input: $input) {
cursor
success
error {
...SystemErrorFragment
}
}
}
Variables
{"input": DiscoverInterfaceAddLabelInput}
Response
{
"data": {
"discoverInterfaceAddLabel": {
"cursor": Cursor,
"success": true,
"error": SystemError
}
}
}
discoverInterfaceRemoveLabel
Description
Removes standard labels from specific Discover interfaces.
Use of this field requires the Tanium permission Discover Tag - Write.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
DiscoverInterfaceAddLabelPayload!
Arguments
| Name | Description |
|---|---|
input -
DiscoverInterfaceRemoveLabelInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation discoverInterfaceRemoveLabel($input: DiscoverInterfaceRemoveLabelInput!) {
discoverInterfaceRemoveLabel(input: $input) {
cursor
success
error {
...SystemErrorFragment
}
}
}
Variables
{"input": DiscoverInterfaceRemoveLabelInput}
Response
{
"data": {
"discoverInterfaceRemoveLabel": {
"cursor": Cursor,
"success": true,
"error": SystemError
}
}
}
discoverLabelCreate
Description
Creates a Discover label from the given input.
Use of this field requires one of the following Tanium permissions: Discover Tag - Write, Discover Location Permissions - Write.
Note: Discover Location Permissions - Write is required when there is at least one Location Permission defined in Discover. Otherwise, Discover Tag - Write is required.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
DiscoverLabelCreatePayload!
Arguments
| Name | Description |
|---|---|
input -
DiscoverLabelCreateInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation discoverLabelCreate($input: DiscoverLabelCreateInput!) {
discoverLabelCreate(input: $input) {
label {
...DiscoverLabelFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": DiscoverLabelCreateInput}
Response
{
"data": {
"discoverLabelCreate": {
"label": DiscoverLabel,
"error": SystemError
}
}
}
discoverLabelDelete
Description
Deletes a Discover label with the given input.
Use of this field requires one of the following Tanium permissions: Discover Tag - Write, Discover Location Permissions - Write.
Note: Discover Location Permissions - Write is required when there is at least one Location Permission defined in Discover. Otherwise, Discover Tag - Write is required.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
DiscoverLabelDeletePayload!
Arguments
| Name | Description |
|---|---|
ref -
NamedOnlyRefInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation discoverLabelDelete($ref: NamedOnlyRefInput!) {
discoverLabelDelete(ref: $ref) {
name
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": NamedOnlyRefInput}
Response
{
"data": {
"discoverLabelDelete": {
"name": "xyz789",
"error": SystemError
}
}
}
emailSend
Description
Submits a request to the Tanium Email service to send an email using a selected email server.
Use of this field requires the Email solution.
Use of this field requires the Tanium permission Email Send.
Stability Level: 1.0 - Experimental (Early Development)
Response
Returns an
EmailSendPayload!
Arguments
| Name | Description |
|---|---|
input -
EmailSendInput!
|
Stability Level: 1.0 - Experimental (Early Development) |
Example
Query
mutation emailSend($input: EmailSendInput!) {
emailSend(input: $input) {
queuedTime
error {
...SystemErrorFragment
}
}
}
Variables
{"input": EmailSendInput}
Response
{
"data": {
"emailSend": {
"queuedTime": "10:15:30Z",
"error": SystemError
}
}
}
killProcess
Description
Terminates the specified process on an endpoint using a Direct Connect connection.
The input requires a direct endpoint connection opened using openDirectConnection.
Use of this field requires the Direct Connect solution.
Stability Level: 2 - Legacy Use directConnectProcessTerminate instead. The directConnect APIs provide better support for tracking connections that take longer to establish.
Response
Returns a
KillProcessPayload!
Arguments
| Name | Description |
|---|---|
input -
KillProcessInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation killProcess($input: KillProcessInput!) {
killProcess(input: $input) {
result
}
}
Variables
{"input": KillProcessInput}
Response
{"data": {"killProcess": {"result": false}}}
manageSoftware
Description
Creates a new Deploy software package deployment to install, update, or remove a software package.
Use of this field requires the Deploy solution.
Stability Level: 3 - Stable
Response
Returns a
SoftwareDeploymentDetails!
Arguments
| Name | Description |
|---|---|
operation -
SoftwareOperation!
|
The operation to perform. Stability Level: 3 - Stable |
softwarePackageID -
ID!
|
The ID of the software package in Deploy. Stability Level: 3 - Stable |
target -
SoftwareTarget
|
The endpoints on which to perform the operation. Stability Level: 3 - Stable |
start -
Time!
|
The date and time at which the operation runs on the endpoints. Stability Level: 3 - Stable |
end -
Time!
|
The date and time after which endpoints will not run the operation. Operations that started might continue running after this time. Stability Level: 3 - Stable |
description -
String
|
A description of the operation. Stability Level: 3 - Stable |
Example
Query
mutation manageSoftware(
$operation: SoftwareOperation!,
$softwarePackageID: ID!,
$target: SoftwareTarget,
$start: Time!,
$end: Time!,
$description: String
) {
manageSoftware(
operation: $operation,
softwarePackageID: $softwarePackageID,
target: $target,
start: $start,
end: $end,
description: $description
) {
ID
name
errors {
...SoftwareDeploymentErrorCountFragment
}
status {
...SoftwareDeploymentStatusFragment
}
}
}
Variables
{
"operation": "INSTALL",
"softwarePackageID": "4",
"target": SoftwareTarget,
"start": "10:15:30Z",
"end": "10:15:30Z",
"description": "xyz789"
}
Response
{
"data": {
"manageSoftware": {
"ID": "4",
"name": "xyz789",
"errors": [SoftwareDeploymentErrorCount],
"status": SoftwareDeploymentStatus
}
}
}
openDirectConnection
Description
Establishes a Direct Connect connection with an endpoint, returning a connection ID which you can use for Direct Connect queries.
The connection is closed after 2 minutes of inactivity.
Connections opened with openDirectConnection are compatible with legacy Direct Connect APIs, including directEndpoint, pingDirectConnection, killProcess, and closeDirectConnection.
Connections opened with openDirectConnection are not compatible with stable Direct Connect APIs, including directConnectEndpoint, directConnectPing, directConnectProcessTerminate, and directConnectClose.
Use of this field requires the Direct Connect solution.
Stability Level: 2 - Legacy Use directConnectOpen instead. The directConnect APIs provide better support for tracking connections that take longer to establish.
Response
Returns an
OpenDirectConnectionPayload!
Arguments
| Name | Description |
|---|---|
input -
OpenDirectConnectionInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation openDirectConnection($input: OpenDirectConnectionInput!) {
openDirectConnection(input: $input) {
connectionID
}
}
Variables
{"input": OpenDirectConnectionInput}
Response
{"data": {"openDirectConnection": {"connectionID": 4}}}
patchCreateDeployment
Description
Creates a Patch deployment.
Use of this field requires the Patch solution.
Use of this field requires all of the following Tanium permissions: Patch Deployment - Execute, Patch Deployment - Write.
Stability Level: 1.0 - Experimental (Early Development)
Response
Returns a
PatchCreateDeploymentPayload!
Arguments
| Name | Description |
|---|---|
input -
PatchCreateDeploymentInput!
|
Stability Level: 1.0 - Experimental (Early Development) |
Example
Query
mutation patchCreateDeployment($input: PatchCreateDeploymentInput!) {
patchCreateDeployment(input: $input) {
deployment {
...PatchDeploymentFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": PatchCreateDeploymentInput}
Response
{
"data": {
"patchCreateDeployment": {
"deployment": PatchDeployment,
"error": SystemError
}
}
}
patchStopDeployment
Description
Stops the in-progress Patch deployment that matches the reference ID, or prevents the future-scheduled Patch deployment that matches the reference ID from starting at the start time. This has no effect on finished deployments.
Use of this field requires the Patch solution.
Use of this field requires all of the following Tanium permissions: Patch Deployment - Execute, Patch Deployment - Write.
Stability Level: 1.0 - Experimental (Early Development)
Response
Returns a
PatchStopDeploymentPayload!
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 1.0 - Experimental (Early Development) |
Example
Query
mutation patchStopDeployment($ref: IdRefInput!) {
patchStopDeployment(ref: $ref) {
deployment {
...PatchDeploymentFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"patchStopDeployment": {
"deployment": PatchDeployment,
"error": SystemError
}
}
}
ping
Description
Returns true. Useful to test your ability to issue commands to the server.
Stability Level: 3 - Stable
Response
Returns a
Boolean!
Example
Query
mutation ping {
ping
}
Response
{"data": {"ping": false}}
pingDirectConnection
Description
Performs a ping to an endpoint using a Direct Connect connection.
The input requires a direct endpoint connection opened using openDirectConnection.
Use of this field requires the Direct Connect solution.
Stability Level: 2 - Legacy Use directConnectPing instead. The directConnect APIs provide better support for tracking connections that take longer to establish.
Response
Returns a
PingDirectConnectionPayload!
Arguments
| Name | Description |
|---|---|
input -
PingDirectConnectionInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation pingDirectConnection($input: PingDirectConnectionInput!) {
pingDirectConnection(input: $input) {
result
}
}
Variables
{"input": PingDirectConnectionInput}
Response
{"data": {"pingDirectConnection": {"result": false}}}
playbookPerformOperation
Description
Performs an operation enumerated in PlaybookOperation on a playbook.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Write.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookPerformOperationPayload!
Arguments
| Name | Description |
|---|---|
input -
PlaybookPerformOperationInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation playbookPerformOperation($input: PlaybookPerformOperationInput!) {
playbookPerformOperation(input: $input) {
playbook {
...PlaybookFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": PlaybookPerformOperationInput}
Response
{
"data": {
"playbookPerformOperation": {
"playbook": Playbook,
"error": SystemError
}
}
}
playbookPreview
Description
Returns the result of creating a playbook, but does not create a new playbook. Use this to preview and verify playbook configuration before using mutation.playbookUpsert to create a new playbook.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Write.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookUpsertPayload!
Arguments
| Name | Description |
|---|---|
input -
PlaybookUpsertInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation playbookPreview($input: PlaybookUpsertInput!) {
playbookPreview(input: $input) {
playbook {
...PlaybookFragment
}
isNewRecord
error {
...SystemErrorFragment
}
}
}
Variables
{"input": PlaybookUpsertInput}
Response
{
"data": {
"playbookPreview": {
"playbook": Playbook,
"isNewRecord": false,
"error": SystemError
}
}
}
playbookRunPerformOperation
Description
Performs an operation enumerated in PlaybookRunOperation on a playbook run.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Execute.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookRunPerformOperationPayload!
Arguments
| Name | Description |
|---|---|
input -
PlaybookRunPerformOperationInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation playbookRunPerformOperation($input: PlaybookRunPerformOperationInput!) {
playbookRunPerformOperation(input: $input) {
playbookRun {
...PlaybookRunFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": PlaybookRunPerformOperationInput}
Response
{
"data": {
"playbookRunPerformOperation": {
"playbookRun": PlaybookRun,
"error": SystemError
}
}
}
playbookSchedulePerformOperation
Description
Performs an operation enumerated in PlaybookScheduleOperation on a playbook schedule. Enabling a schedule requires the Automate Playbook Execute permission. Disabling or deleting a schedule created by another user, or created by your user with a different active persona, requires the Automate Playbook Write permission. Disabling or deleting a schedule you created with your currently active persona requires either the Automate Playbook Execute or Automate Playbook Write permission.
Use of this field requires the Automate solution.
Use of this field requires one of the following Tanium permissions: Automate Playbook Write, Automate Playbook Execute.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookSchedulePerformOperationPayload!
Arguments
| Name | Description |
|---|---|
input -
PlaybookSchedulePerformOperationInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation playbookSchedulePerformOperation($input: PlaybookSchedulePerformOperationInput!) {
playbookSchedulePerformOperation(input: $input) {
playbookSchedule {
...PlaybookScheduleFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": PlaybookSchedulePerformOperationInput}
Response
{
"data": {
"playbookSchedulePerformOperation": {
"playbookSchedule": PlaybookSchedule,
"error": SystemError
}
}
}
playbookScheduleUpsert
Description
Upserts a playbook schedule based on the playbook schedule id. If a playbook schedule matches the id, updates the existing playbook schedule. If no playbook schedule matches the id, creates a new playbook schedule.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Execute.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookScheduleUpsertPayload!
Arguments
| Name | Description |
|---|---|
input -
PlaybookScheduleUpsertInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation playbookScheduleUpsert($input: PlaybookScheduleUpsertInput!) {
playbookScheduleUpsert(input: $input) {
playbookSchedule {
...PlaybookScheduleFragment
}
isNewRecord
error {
...SystemErrorFragment
}
}
}
Variables
{"input": PlaybookScheduleUpsertInput}
Response
{
"data": {
"playbookScheduleUpsert": {
"playbookSchedule": PlaybookSchedule,
"isNewRecord": true,
"error": SystemError
}
}
}
playbookStart
Description
Starts a playbook.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Execute.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookStartPayload!
Arguments
| Name | Description |
|---|---|
input -
PlaybookStartInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation playbookStart($input: PlaybookStartInput!) {
playbookStart(input: $input) {
playbookRun {
...PlaybookRunFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": PlaybookStartInput}
Response
{
"data": {
"playbookStart": {
"playbookRun": PlaybookRun,
"error": SystemError
}
}
}
playbookUpsert
Description
Upserts a playbook based on the playbook id. If a playbook matches the id, updates the existing playbook. If no playbook matches the id, creates a new playbook.
Use of this field requires the Automate solution.
Use of this field requires the Tanium permission Automate Playbook Write.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
PlaybookUpsertPayload!
Arguments
| Name | Description |
|---|---|
input -
PlaybookUpsertInput!
|
Stability Level: 1.1 - Experimental (Active Development) |
Example
Query
mutation playbookUpsert($input: PlaybookUpsertInput!) {
playbookUpsert(input: $input) {
playbook {
...PlaybookFragment
}
isNewRecord
error {
...SystemErrorFragment
}
}
}
Variables
{"input": PlaybookUpsertInput}
Response
{
"data": {
"playbookUpsert": {
"playbook": Playbook,
"isNewRecord": false,
"error": SystemError
}
}
}
reportDelete
Description
Deletes a report.
Use of this field requires the Reporting solution.
Use of this field requires the Tanium permission Report Write.
Stability Level: 1.2 - Experimental (Release Candidate)
Response
Returns a
ReportDeletePayload!
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation reportDelete($ref: IdRefInput!) {
reportDelete(ref: $ref) {
id
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"reportDelete": {
"id": "4",
"error": SystemError
}
}
}
reportImport
Description
Imports a report definition that was previously exported using the API Gateway reportExport query.
Use of this field requires the Reporting solution.
Stability Level: 3 - Stable
Response
Returns a
ReportImportPayload!
Arguments
| Name | Description |
|---|---|
input -
ReportImportInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation reportImport($input: ReportImportInput!) {
reportImport(input: $input) {
report {
...ReportFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": ReportImportInput}
Response
{
"data": {
"reportImport": {
"report": Report,
"error": SystemError
}
}
}
reportingDashboardDelete
Description
Deletes a Reporting dashboard.
Use of this field requires the Reporting solution.
Use of this field requires the Tanium permission Dashboard Write.
Stability Level: 1.1 - Experimental (Active Development)
Response
Returns a
ReportingDashboardDeletePayload!
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation reportingDashboardDelete($ref: IdRefInput!) {
reportingDashboardDelete(ref: $ref) {
id
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"reportingDashboardDelete": {
"id": "4",
"error": SystemError
}
}
}
scheduledActionApprove
Description
Approves a pending scheduled action.
Stability Level: 3 - Stable
Response
Returns a
ScheduledActionApprovePayload!
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation scheduledActionApprove($ref: IdRefInput!) {
scheduledActionApprove(ref: $ref) {
id
approved
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"scheduledActionApprove": {
"id": "4",
"approved": true,
"error": SystemError
}
}
}
scheduledActionCreate
Description
Creates a scheduled action.
Stability Level: 3 - Stable
Response
Returns a
ScheduledActionCreatePayload!
Arguments
| Name | Description |
|---|---|
input -
ScheduledActionCreateInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation scheduledActionCreate($input: ScheduledActionCreateInput!) {
scheduledActionCreate(input: $input) {
scheduledAction {
...ScheduledActionFragment
}
error {
...SystemErrorFragment
}
}
}
Variables
{"input": ScheduledActionCreateInput}
Response
{
"data": {
"scheduledActionCreate": {
"scheduledAction": ScheduledAction,
"error": SystemError
}
}
}
scheduledActionDelete
Description
Deletes a scheduled action.
Stability Level: 3 - Stable
Response
Returns a
ScheduledActionDeletePayload!
Arguments
| Name | Description |
|---|---|
ref -
IdRefInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation scheduledActionDelete($ref: IdRefInput!) {
scheduledActionDelete(ref: $ref) {
id
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": IdRefInput}
Response
{
"data": {
"scheduledActionDelete": {
"id": "4",
"error": SystemError
}
}
}
sensorHarvest
Description
Manages the registration of a sensor for harvest by TDS.
Note that when registering a sensor for harvest, the system must verify that the sensor is valid for harvest. This analysis may take several minutes. To accommodate this, the response may contain a cursor instead of a success or an error. When a response contains a cursor, the caller must call the mutation again with the cursor added to the input in order to poll for the terminal response.
It is not necessary to poll for the terminal response in order for a harvest to be successful, but it is not guaranteed that a harvest is successful unless the caller obtains a terminal successful response.
Stability Level: 3 - Stable
Response
Returns a
SensorHarvestPayload!
Arguments
| Name | Description |
|---|---|
input -
SensorHarvestInput!
|
Stability Level: 3 - Stable |
Example
Query
mutation sensorHarvest($input: SensorHarvestInput!) {
sensorHarvest(input: $input) {
cursor
success
error {
...SystemErrorFragment
}
}
}
Variables
{"input": SensorHarvestInput}
Response
{
"data": {
"sensorHarvest": {
"cursor": Cursor,
"success": false,
"error": SystemError
}
}
}
threatResponseAlertResolve
Description
Resolves the identified Threat Response alert.
Use of this field requires the Threat Response solution.
Stability Level: 3 - Stable
Response
Returns a
ThreatResponseAlertResolvePayload!
Arguments
| Name | Description |
|---|---|
ref -
ThreatResponseAlertRef!
|
Stability Level: 3 - Stable |
Example
Query
mutation threatResponseAlertResolve($ref: ThreatResponseAlertRef!) {
threatResponseAlertResolve(ref: $ref) {
resolved
guid
error {
...SystemErrorFragment
}
}
}
Variables
{"ref": ThreatResponseAlertRef}
Response
{
"data": {
"threatResponseAlertResolve": {
"resolved": true,
"guid": 4,
"error": SystemError
}
}
}
Types
APIToken
Description
An authentication token that a user can use to make requests.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique identifier of the API token. Stability Level: 3 - Stable |
tokenString -
String
|
The API token string value. This response field contains the string value only when the request creates or rotates a token, and otherwise does not contain a value. Stability Level: 3 - Stable |
trustedIPAddresses -
[String!]!
|
The list of trusted IP addresses in CIDR format that can use the API token. Examples: 92.0.2.0/24, 198.51.100.10 Stability Level: 3 - Stable |
notes -
String!
|
The notes for the API token. Stability Level: 3 - Stable |
persona -
Persona
|
The persona associated with the API token. Stability Level: 3 - Stable |
expiration -
Time!
|
The time at which the API token expires and is no longer valid. Stability Level: 3 - Stable |
lastUsed -
Time!
|
The time at which the API token was last used. Stability Level: 3 - Stable |
created -
Time!
|
The time at which the token was created or last rotated. Stability Level: 3 - Stable |
Example
{
"id": 4,
"tokenString": "xyz789",
"trustedIPAddresses": ["xyz789"],
"notes": "abc123",
"persona": Persona,
"expiration": "10:15:30Z",
"lastUsed": "10:15:30Z",
"created": "10:15:30Z"
}
APITokenGrantInput
Description
A request to create an API token for the current user.
Fields
| Input Field | Description |
|---|---|
trustedIPAddresses -
[String!]!
|
The list of trusted IP addresses in CIDR format that can use the API token. Examples: 92.0.2.0/24, 198.51.100.10 Stability Level: 3 - Stable |
expiresInDays -
Int
|
The number of days before the API token expires. Stability Level: 3 - Stable |
personaName -
String
|
The persona associated with the API token. Stability Level: 3 - Stable |
notes -
String
|
The notes for the usage of the API token. Stability Level: 3 - Stable |
Example
{
"trustedIPAddresses": ["abc123"],
"expiresInDays": 123,
"personaName": "abc123",
"notes": "abc123"
}
APITokenGrantPayload
Description
A response to a request to create an API token.
Fields
| Field Name | Description |
|---|---|
token -
APIToken
|
The token created by the request. Stability Level: 3 - Stable |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"token": APIToken,
"error": SystemError
}
APITokenQueryPayload
Description
A response to a request to query API tokens.
Fields
| Field Name | Description |
|---|---|
tokens -
[APIToken!]
|
API tokens returned by the request. Stability Level: 3 - Stable |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"tokens": [APIToken],
"error": SystemError
}
APITokenRevokeInput
Description
A request to revoke an API token.
Fields
| Input Field | Description |
|---|---|
id -
ID!
|
The unique identifier of the API token to revoke. Stability Level: 3 - Stable |
Example
{"id": "4"}
APITokenRevokePayload
Description
A response to a request to revoke an API token.
Fields
| Field Name | Description |
|---|---|
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{"error": SystemError}
APITokenRotateInput
Description
A request to create an API token for the current user.
Fields
| Input Field | Description |
|---|---|
tokenString -
String!
|
The token string of the API token to rotate. Stability Level: 3 - Stable |
Example
{"tokenString": "xyz789"}
APITokenRotatePayload
Description
A response to a request to rotate an API token.
Fields
| Field Name | Description |
|---|---|
token -
APIToken
|
The token created by the request. Stability Level: 3 - Stable |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"token": APIToken,
"error": SystemError
}
Action
Description
An action.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The ID of the action. Stability Level: 3 - Stable |
name -
String!
|
The name of the action. Stability Level: 3 - Stable |
comment -
String!
|
A short description of the action. Stability Level: 3 - Stable |
expireSeconds -
Int
|
The time for which the action is active. Stability Level: 3 - Stable |
creationTime -
Time
|
The time at which the action was created. Stability Level: 3 - Stable |
startTime -
Time
|
The time at which the action started. Stability Level: 3 - Stable |
expirationTime -
Time
|
The time at which the action expired. Stability Level: 3 - Stable |
distributeSeconds -
Int
|
The time over which to distribute actions to endpoints in batches, to prevent spikes in network traffic or other resource consumption. Stability Level: 3 - Stable |
status -
ActionStatus
|
The status of the action. Stability Level: 3 - Stable |
stoppedFlag -
Boolean
|
Indicates the action is stopped. Stability Level: 3 - Stable |
targets -
ActionTargets!
|
The endpoints on which the action runs. Stability Level: 3 - Stable |
package -
PackageRef!
|
The package containing the action script and any other files. Stability Level: 3 - Stable |
scheduledAction -
ScheduledAction
|
The scheduled action that created this action. Stability Level: 3 - Stable |
stopped -
Boolean!
|
Indicates the action is stopped. Stability Level: 3 - Stable |
creator -
Principal!
|
The action's creator. Stability Level: 3 - Stable |
approver -
Principal
|
The action's approver, if any. Stability Level: 3 - Stable |
metadata -
[Metadata!]!
|
The Tanium server metadata about the action. Stability Level: 3 - Stable |
results -
ActionResults!
|
The results of running the action. Stability Level: 3 - Stable |
Example
{
"id": 4,
"name": "abc123",
"comment": "abc123",
"expireSeconds": 987,
"creationTime": "10:15:30Z",
"startTime": "10:15:30Z",
"expirationTime": "10:15:30Z",
"distributeSeconds": 123,
"status": "OPEN",
"stoppedFlag": false,
"targets": ActionTargets,
"package": PackageRef,
"scheduledAction": ScheduledAction,
"stopped": true,
"creator": Principal,
"approver": Principal,
"metadata": [Metadata],
"results": ActionResults
}
ActionActionGroupInput
Description
Identifies an existing action group.
Define one, and only one, of either name or id. If you define name and id, only the id is used to identify the action group, and the name is ignored.
Example
{"id": 4, "name": "abc123"}
ActionConnection
Description
A page of action edges.
Fields
| Field Name | Description |
|---|---|
edges -
[ActionEdge!]!
|
The list of action edges. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the action collection. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of action records available. Stability Level: 3 - Stable |
Example
{
"edges": [ActionEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
ActionCreateInput
Description
A request to create an action.
Fields
| Input Field | Description |
|---|---|
targets -
ActionTargetsInput!
|
The endpoints on which the action runs. Stability Level: 3 - Stable |
package -
PackageRefInput!
|
The package containing the action script and any other files. Stability Level: 3 - Stable |
schedule -
ActionScheduleInput
|
The schedule on which the action runs. By default, the action runs immediately. Stability Level: 3 - Stable |
name -
String
|
The action name. Note that actions are not required to have unique names. Stability Level: 3 - Stable |
comment -
String
|
A short description. Stability Level: 3 - Stable |
Example
{
"targets": ActionTargetsInput,
"package": PackageRefInput,
"schedule": ActionScheduleInput,
"name": "abc123",
"comment": "xyz789"
}
ActionCreatePayload
Description
The result of creating an action.
Fields
| Field Name | Description |
|---|---|
action -
Action
|
The newly created action. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"action": Action,
"error": SystemError
}
ActionEdge
ActionGroup
Description
Defines which endpoints are the targets for actions.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique identifier of the action group. Stability Level: 3 - Stable |
name -
String!
|
The assigned name of the action group. Stability Level: 3 - Stable |
visibility -
ActionGroupVisibility!
|
Defines which visibility setting to use. Stability Level: 3 - Stable |
userGroups -
[NamedRef!]
|
Defines which user groups can see the action group. This applies only when visibility is set to Stability Level: 3 - Stable |
computerGroups -
[ComputerGroup!]!
|
The set of computer groups that the action group targets. Stability Level: 3 - Stable |
any -
Boolean!
|
Specifies whether an endpoint must be a member in any or all computer groups defined in computerGroups. Stability Level: 3 - Stable |
Example
{
"id": "4",
"name": "abc123",
"visibility": "ADMIN",
"userGroups": [NamedRef],
"computerGroups": [ComputerGroup],
"any": false
}
ActionGroupConnection
Description
A page of action group edges.
Fields
| Field Name | Description |
|---|---|
edges -
[ActionGroupEdge!]!
|
The list of action group edges. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the action group collection. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of action group records available. Stability Level: 3 - Stable |
Example
{
"edges": [ActionGroupEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
ActionGroupCreateInput
Description
Creates an action group from the given input.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The assigned name of the action group. Stability Level: 3 - Stable |
visibility -
ActionGroupVisibility!
|
Defines which visibility setting to use. Stability Level: 3 - Stable |
userGroups -
[NamedRefInput!]
|
Defines which user groups can see the action group. This applies only when visibility is set to Stability Level: 3 - Stable |
computerGroups -
[NamedRefInput!]!
|
The set of computer groups that the action group targets. Stability Level: 3 - Stable |
any -
Boolean!
|
Specifies whether an endpoint must be a member in any or all computer groups defined in computerGroups. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"visibility": "ADMIN",
"userGroups": [NamedRefInput],
"computerGroups": [NamedRefInput],
"any": true
}
ActionGroupCreatePayload
Description
A response to a request to create an action group.
Fields
| Field Name | Description |
|---|---|
group -
ActionGroup
|
The action group created by the request. Stability Level: 3 - Stable |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"group": ActionGroup,
"error": SystemError
}
ActionGroupDeletePayload
Description
A response to a request to delete an action group.
Fields
| Field Name | Description |
|---|---|
id -
ID
|
The unique identifier of the deleted action group. Stability Level: 3 - Stable |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"id": "4",
"error": SystemError
}
ActionGroupEdge
Description
An action group within a page.
Fields
| Field Name | Description |
|---|---|
node -
ActionGroup!
|
The action group. Stability Level: 3 - Stable |
cursor -
Cursor!
|
The cursor of this edge within the collection. Stability Level: 3 - Stable |
Example
{
"node": ActionGroup,
"cursor": Cursor
}
ActionGroupVisibility
Description
Defines the visibility of action groups.
Values
| Enum Value | Description |
|---|---|
|
|
Only admins can see this action group. Stability Level: 3 - Stable |
|
|
All users can see this action group. Stability Level: 3 - Stable |
|
|
Only specific user groups can see this action group. Stability Level: 3 - Stable |
Example
"ADMIN"
ActionOperationChangeClientSettingInput
Description
A request to change a Tanium Client setting on an endpoint.
Fields
| Input Field | Description |
|---|---|
name -
ActionOperationChangeClientSettingName!
|
The name of the client setting to change. Stability Level: 3 - Stable |
value -
String!
|
The new client setting value. Stability Level: 3 - Stable |
Example
{
"name": "LogVerbosityLevel",
"value": "xyz789"
}
ActionOperationChangeClientSettingName
Description
A Tanium Client setting name.
Values
| Enum Value | Description |
|---|---|
|
|
Sets the amount of logging. Stability Level: 3 - Stable |
|
|
Randomizes sensor execution (useful for VDI environments). The maximum randomization value is 3600 seconds. Note that this does not affect intrinsic sensors like Stability Level: 3 - Stable |
|
|
Enables encryption and protection of sensor queries in sensor.db, NodeState, and ActionManager state. Stability Level: 3 - Stable |
|
|
The hot cache to cold cache setting percentage. Stability Level: 3 - Stable |
Example
"LogVerbosityLevel"
ActionOperationCollectActiveDirectoryInfoInput
Description
A request to collect Active Directory information on an endpoint.
Fields
| Input Field | Description |
|---|---|
minimumMinutesBetweenRuns -
Int
|
The minimum number of minutes to allow between collection runs. This must be a non-negative number. Stability Level: 3 - Stable |
Example
{"minimumMinutesBetweenRuns": 123}
ActionOperationInput
Description
A request to perform a registered operation. You can choose only one operation.
Fields
| Input Field | Description |
|---|---|
addTags -
[String!]
|
Adds the set of custom tags to the endpoints. Tags may not contain whitespace or the This uses the Stability Level: 3 - Stable |
removeTags -
[String!]
|
Removes the set of custom tags from the endpoints. Tags may not contain whitespace or the This uses the Stability Level: 3 - Stable |
changeClientSetting -
ActionOperationChangeClientSettingInput
|
Changes the specified Tanium Client setting on the endpoints. The string value must be coercible to the correct type for the named setting. This uses the Stability Level: 3 - Stable |
startService -
String
|
Starts the named service on the endpoints. This uses the Stability Level: 3 - Stable |
stopService -
String
|
Stops the named service on the endpoints. This uses the Stability Level: 3 - Stable |
restartService -
String
|
Restarts the named service on the endpoints. This uses the Stability Level: 3 - Stable |
reboot -
ActionOperationRebootInput
|
Reboots the endpoints. This uses the Stability Level: 3 - Stable |
collectActiveDirectoryInfo -
ActionOperationCollectActiveDirectoryInfoInput
|
Collects Active Directory information about the endpoints. This is only available for Windows and Mac operating systems. This uses the Stability Level: 3 - Stable |
Example
{
"addTags": ["xyz789"],
"removeTags": ["abc123"],
"changeClientSetting": ActionOperationChangeClientSettingInput,
"startService": "abc123",
"stopService": "abc123",
"restartService": "abc123",
"reboot": ActionOperationRebootInput,
"collectActiveDirectoryInfo": ActionOperationCollectActiveDirectoryInfoInput
}
ActionOperationRebootInput
Description
A request to reboot an endpoint.
Fields
| Input Field | Description |
|---|---|
randomDelaySeconds -
Int
|
Specifies the total potential number of seconds to delay before rebooting. The actual delay on each endpoint will be randomly chosen. This must be a non-negative number. Stability Level: 3 - Stable |
Example
{"randomDelaySeconds": 987}
ActionPerformInput
Description
A request to create the actions or scheduled actions necessary to run a package or a registered operation. Exactly one of package or operation must be given.
If an operation is specified, an action or scheduled action will be created for each set of endpoint operating systems supported by the underlying packages. If the targets input specifies any platforms, they must be included in the set of operating systems supported by the operation's packages.
The schedule field controls the schedule on which the actions run, including if it runs only once or recurs.
The top-level result of performing an action are always scheduled actions for consistency, even if they only create a single action.
Fields
| Input Field | Description |
|---|---|
targets -
ActionTargetsInput!
|
The endpoints on which the actions run. Stability Level: 3 - Stable |
package -
PackageRefInput
|
The package containing the action script and any other files. Stability Level: 3 - Stable |
operation -
ActionOperationInput
|
The single registered operation to run. Operations are abstractions declared atop one or more packages that perform the same logical job on various endpoint operating systems. Stability Level: 3 - Stable |
schedule -
ActionPerformScheduleInput
|
The schedule on which the actions run. Stability Level: 3 - Stable |
name -
String
|
The action name. Note that actions are not required to have unique names. Stability Level: 3 - Stable |
comment -
String
|
A short description. Stability Level: 3 - Stable |
Example
{
"targets": ActionTargetsInput,
"package": PackageRefInput,
"operation": ActionOperationInput,
"schedule": ActionPerformScheduleInput,
"name": "abc123",
"comment": "xyz789"
}
ActionPerformPayload
Description
The result of performing an action.
Fields
| Field Name | Description |
|---|---|
scheduledActions -
[ActionPerformPlatform!]
|
The list of scheduled actions and the operating systems on which they run, if known. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"scheduledActions": [ActionPerformPlatform],
"error": SystemError
}
ActionPerformPlatform
Description
A scheduled action and the operating systems on which it runs.
Fields
| Field Name | Description |
|---|---|
platforms -
[EndpointPlatform!]
|
The list of operating systems on which the scheduled action runs. This is only populated for actions performed for a registered operation. Stability Level: 3 - Stable |
scheduledAction -
ScheduledAction!
|
The scheduled action. Stability Level: 3 - Stable |
Example
{
"platforms": ["Unknown"],
"scheduledAction": ScheduledAction
}
ActionPerformScheduleInput
Description
The schedule on which the action should run.
Fields
| Input Field | Description |
|---|---|
distributeSeconds -
Int
|
The time over which to distribute actions to endpoints in batches, to prevent spikes in network traffic or other resource consumption. A value of Stability Level: 3 - Stable |
expireSeconds -
Int
|
The time for which any given action is active. This both defaults to and must be greater than or equal to either the package's expiration time or the sum of the package's command timeout and the Stability Level: 3 - Stable |
reissueSeconds -
Int
|
The time between recurring action runs. If this is Stability Level: 3 - Stable |
startTime -
Time
|
The start time of the action. This defaults to the current time. Stability Level: 3 - Stable |
endTime -
Time
|
The end time of a scheduled action. If Stability Level: 3 - Stable |
Example
{
"distributeSeconds": 123,
"expireSeconds": 987,
"reissueSeconds": 123,
"startTime": "10:15:30Z",
"endTime": "10:15:30Z"
}
ActionResults
Description
The results of an action.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique ID of the action. Stability Level: 3 - Stable |
waiting -
Int!
|
The number of endpoints waiting to run the action. Stability Level: 3 - Stable |
downloading -
Int!
|
The number of endpoints downloading the action package. Stability Level: 3 - Stable |
running -
Int!
|
The number of endpoints currently running the action. Stability Level: 3 - Stable |
waitingToRetry -
Int!
|
The number of endpoints waiting to retry a failed action run. Stability Level: 3 - Stable |
completed -
Int!
|
The number of endpoints that have completed the action. Stability Level: 3 - Stable |
expired -
Int!
|
The number of endpoints for which the action has expired. Stability Level: 3 - Stable |
failed -
Int!
|
The number of endpoints for which the action run failed. Stability Level: 3 - Stable |
pendingVerification -
Int!
|
The number of endpoints waiting to verify the action. Stability Level: 3 - Stable |
verified -
Int!
|
The number of endpoints that have verified the action. Stability Level: 3 - Stable |
failedVerification -
Int!
|
The number of endpoints that failed to verify the action. Stability Level: 3 - Stable |
Example
{
"id": 4,
"waiting": 987,
"downloading": 987,
"running": 987,
"waitingToRetry": 123,
"completed": 123,
"expired": 987,
"failed": 123,
"pendingVerification": 123,
"verified": 123,
"failedVerification": 987
}
ActionScheduleInput
Description
The schedule on which the action should run.
Fields
| Input Field | Description |
|---|---|
distributeSeconds -
Int
|
The time over which to distribute actions to endpoints in batches, to prevent spikes in network traffic or other resource consumption. A value of Stability Level: 3 - Stable |
expireSeconds -
Int
|
The time for which the action is active. This both defaults to and must be greater than or equal to either the package's expiration time or the sum of the package's command timeout and the Stability Level: 3 - Stable |
startTime -
Time
|
The start time of the action. This defaults to the current time. Stability Level: 3 - Stable |
Example
{
"distributeSeconds": 123,
"expireSeconds": 987,
"startTime": "10:15:30Z"
}
ActionStatus
Description
The action status values.
Values
| Enum Value | Description |
|---|---|
|
|
The action is in progress. Stability Level: 3 - Stable |
|
|
The action is not yet started. Stability Level: 3 - Stable |
|
|
The action is stopped. Stability Level: 3 - Stable |
|
|
The action reached its expiration time and is no longer active. Stability Level: 3 - Stable |
Example
"OPEN"
ActionStopPayload
Description
The result of stopping an action.
Fields
| Field Name | Description |
|---|---|
id -
ID
|
The ID of the action. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"id": "4",
"error": SystemError
}
ActionTargetGroupInput
Description
Identifies or describes a target group. Exactly one of id, name, or filter must be specified. The first two fields (id, name) identify an existing group. The last field (filter) describes a transient group, created for this action.
If you define name and id, only the id is used to identify the computer group, and the name is ignored.
Fields
| Input Field | Description |
|---|---|
id -
ID
|
The ID of the group. Stability Level: 3 - Stable |
name -
String
|
The name of the group. Stability Level: 3 - Stable |
filter -
ComputerGroupFilter
|
The filter describing the endpoints that comprise the group. Stability Level: 3 - Stable |
Example
{
"id": "4",
"name": "abc123",
"filter": ComputerGroupFilter
}
ActionTargets
Description
The endpoints on which an action runs. An endpoint must belong to both groups in order to run the action.
Example
{
"actionGroup": NamedRef,
"targetGroup": NamedRef
}
ActionTargetsInput
Description
The endpoints on which an action runs. Each field describes a condition; the action runs on only the endpoints that satisfy every condition.
Fields
| Input Field | Description |
|---|---|
actionGroup -
ActionActionGroupInput
|
Identifies the existing action group to which the endpoints must belong. This defaults to the Stability Level: 3 - Stable |
targetGroup -
ActionTargetGroupInput
|
Identifies or describes the target group to which the endpoints must belong. This defaults to the Stability Level: 3 - Stable |
platforms -
[EndpointPlatform!]
|
Specifies the set of endpoint operating systems on which the action runs ( Stability Level: 3 - Stable |
endpoints -
[ID!]
|
Specifies a set of 25 or fewer identified endpoints on which the action runs. Retrieve endpoint IDs using the Stability Level: 3 - Stable |
Example
{
"actionGroup": ActionActionGroupInput,
"targetGroup": ActionTargetGroupInput,
"platforms": ["Unknown"],
"endpoints": [4]
}
Any
Description
An untyped value.
Example
Any
Asset
Description
A generic asset, such as an endpoint.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique ID. This is reasonably guaranteed to be stable. |
name -
String!
|
The assigned name of the asset. Example: workstation-1.company.com |
serialNumber -
String!
|
The serial number provided by the manufacturer. Example: 123ABC1 |
manufacturer -
String!
|
The asset manufacturer. Example: Dell |
model -
String!
|
The asset model. Example: OptiPlex 7050 |
configurationItem -
ConfigurationItem
|
The CMDB reference IDs for the asset. Use of this field requires the Atlas solution. Stability Level: 0 - Deprecated |
Possible Types
| Asset Types |
|---|
Example
{
"id": 4,
"name": "abc123",
"serialNumber": "xyz789",
"manufacturer": "abc123",
"model": "abc123",
"configurationItem": ConfigurationItem
}
AssetImportPayload
Description
Result for a single asset import.
Fields
| Field Name | Description |
|---|---|
id -
Int
|
The unique asset ID. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
index -
Int!
|
Index from the Use of this field requires the Asset solution. Stability Level: 3 - Stable |
status -
AssetImportStatus!
|
Status of the asset import. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
error -
String
|
Reason for Error/Failure. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"id": 987,
"index": 123,
"status": "NoChange",
"error": "abc123"
}
AssetImportStatus
Description
Status of a given asset's import.
Values
| Enum Value | Description |
|---|---|
|
|
Asset import is successful. Existing asset did not update. Stability Level: 3 - Stable |
|
|
Asset import is successful, updated an existing asset. Stability Level: 3 - Stable |
|
|
Asset import is successful, created a new asset. Stability Level: 3 - Stable |
|
|
Asset import is unsuccessful, key(s) became invalid because of conversions. Stability Level: 3 - Stable |
|
|
Asset import is unsuccessful, key(s) is missing or empty. Stability Level: 3 - Stable |
|
|
Asset import is unsuccessful, already imported in this mutation. Stability Level: 3 - Stable |
|
|
Asset import is unsuccessful. Stability Level: 3 - Stable |
Example
"NoChange"
AssetProduct
Description
The Asset product.
Fields
| Field Name | Description |
|---|---|
vendor -
String!
|
The product vendor name. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
name -
String!
|
The product name. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
installation -
AssetProductInstallation
|
Product installation details. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
tracking -
AssetProductTracking
|
Product tracking details. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
usage -
AssetProductUsage
|
Product usage details. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
versions -
[AssetProductVersion!]
|
Product version details. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"vendor": "abc123",
"name": "abc123",
"installation": AssetProductInstallation,
"tracking": AssetProductTracking,
"usage": AssetProductUsage,
"versions": [AssetProductVersion]
}
AssetProductConnection
Description
A page of product edges.
Fields
| Field Name | Description |
|---|---|
edges -
[AssetProductEdge]!
|
The list of Asset product edges. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about this Asset product page. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
totalCount -
Int!
|
The total count of returned records. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"edges": [AssetProductEdge],
"pageInfo": PageInfo,
"totalCount": 987
}
AssetProductEdge
Description
A product within a page.
Fields
| Field Name | Description |
|---|---|
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
node -
AssetProduct!
|
The Asset product. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"cursor": Cursor,
"node": AssetProduct
}
AssetProductEndpoint
Description
The Asset product endpoint.
Fields
| Field Name | Description |
|---|---|
id -
Int
|
Asset ID. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
eid -
Int
|
Endpoint ID (eid). Use of this field requires the Asset solution. Stability Level: 3 - Stable |
computerName -
String
|
The computer Name. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
computerId -
String
|
The computer ID. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
serialNumber -
String
|
The serial number. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
endpointFingerprint -
String
|
The Endpoint Fingerprint. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
osPlatform -
String
|
The OS platform. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
operatingSystem -
String
|
The Operating System. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
servicePack -
String
|
The service pack. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
manufacturer -
String
|
The manufacturer. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
ipAddress -
String
|
The IP address. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
userName -
String
|
The user name. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
createdAt -
Time
|
When asset record was created. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
updatedAt -
Time
|
When asset record was last updated. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"id": 987,
"eid": 987,
"computerName": "xyz789",
"computerId": "xyz789",
"serialNumber": "xyz789",
"endpointFingerprint": "abc123",
"osPlatform": "xyz789",
"operatingSystem": "xyz789",
"servicePack": "abc123",
"manufacturer": "xyz789",
"ipAddress": "xyz789",
"userName": "xyz789",
"createdAt": "10:15:30Z",
"updatedAt": "10:15:30Z"
}
AssetProductEndpointConnection
Description
A page of product endpoint edges.
Fields
| Field Name | Description |
|---|---|
edges -
[AssetProductEndpointEdge]!
|
The list of Asset product edges. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about this Asset product page. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
totalCount -
Int!
|
The total count of returned records. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"edges": [AssetProductEndpointEdge],
"pageInfo": PageInfo,
"totalCount": 987
}
AssetProductEndpointEdge
Description
A product endpoint within a page.
Fields
| Field Name | Description |
|---|---|
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
node -
AssetProductEndpoint!
|
The Asset product. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"cursor": Cursor,
"node": AssetProductEndpoint
}
AssetProductEndpointsFilter
Description
Describes an asset product endpoint value filter. Records with field values matching the filter are included in the query results. Asset product endpoint filters may be single or compound. Any filter that is not valid causes the query to return an error.
For a single filter definition with one set of fields, if an endpoint record matches any filter condition, it satisfies the filter.
For a compound filter with multiple filter sets, an endpoint record must match every filter set to satisfy the filter, but can match any single filter condition within a filter set.
Fields
| Input Field | Description |
|---|---|
vendor -
String
|
The product vendor name must match. Stability Level: 3 - Stable |
name -
String
|
The product name must match. Stability Level: 3 - Stable |
version -
String
|
The product version must match. Stability Level: 3 - Stable |
usage -
AssetProductUsageEnum
|
The product usage must match. Stability Level: 3 - Stable |
Example
{
"vendor": "xyz789",
"name": "abc123",
"version": "xyz789",
"usage": "NotInstalled"
}
AssetProductInstallation
Description
Product installation metrics.
Fields
| Field Name | Description |
|---|---|
installedCount -
Int
|
The total number of product installations. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
usedCount -
Int
|
The number of product installations on which usage was detected in the reporting period by the Tanium Client. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
unusedCount -
Int
|
The number of product installations on which usage was not detected in the reporting period by the Tanium Client. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
pendingUsage -
Int
|
The number of product installations on which the product is installed but the Tanium Client has not yet reported any usage. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"installedCount": 123,
"usedCount": 123,
"unusedCount": 123,
"pendingUsage": 123
}
AssetProductState
Description
The product tracking state.
Values
| Enum Value | Description |
|---|---|
|
|
Asset is actively tracking the product. Stability Level: 3 - Stable |
|
|
Asset is not actively tracking the product. Stability Level: 3 - Stable |
|
|
Asset is ignoring the product tracking. Stability Level: 3 - Stable |
Example
"Tracked"
AssetProductTracking
Description
Product tracking metrics.
Fields
| Field Name | Description |
|---|---|
state -
AssetProductState
|
The current product tracking state. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
reportingPeriodDays -
Int
|
The number of days that the Tanium Client reports for product usage. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
normalMinutesUsedPerDay -
Int
|
Average minutes per day over the reporting period for normal usage. The default normal usage threshold is 60 minutes. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
highMinutesUsedPerDay -
Int
|
Average minutes per day over the reporting period for high usage. The default high usage threshold is 240 minutes. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
baselinePeriodDays -
Int
|
The minimum number of days before a newly installed product starts reporting usage in Asset. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"state": "Tracked",
"reportingPeriodDays": 123,
"normalMinutesUsedPerDay": 987,
"highMinutesUsedPerDay": 123,
"baselinePeriodDays": 987
}
AssetProductTrackingInput
Description
Product tracking metrics input.
Fields
| Input Field | Description |
|---|---|
state -
AssetProductState!
|
The current product tracking state. Stability Level: 3 - Stable |
reportingPeriodDays -
Int!
|
The number of days that the Tanium Client reports for product usage. Stability Level: 3 - Stable |
normalMinutesUsedPerDay -
Int!
|
Average minutes per day over the reporting period for normal usage. The default normal usage threshold is 60 minutes. Stability Level: 3 - Stable |
highMinutesUsedPerDay -
Int!
|
Average minutes per day over the reporting period for high usage. The default high usage threshold is 240 minutes. Stability Level: 3 - Stable |
baselinePeriodDays -
Int!
|
The minimum number of days before a newly installed product starts reporting usage in Asset. Stability Level: 3 - Stable |
Example
{
"state": "Tracked",
"reportingPeriodDays": 123,
"normalMinutesUsedPerDay": 123,
"highMinutesUsedPerDay": 987,
"baselinePeriodDays": 987
}
AssetProductUsage
Description
Product usage metrics.
Fields
| Field Name | Description |
|---|---|
usageNotDetected -
Int!
|
Number of assets where product usage was not detected. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
notInstalled -
Int!
|
Number of assets where the product was not installed. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
baselining -
Int!
|
Number of assets where the product is newly installed and not yet reporting usage. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
limited -
Int!
|
Number of assets where product usage level is limited. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
normal -
Int!
|
Number of assets where product usage level is normal. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
high -
Int!
|
Number of assets where product usage level is high. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"usageNotDetected": 987,
"notInstalled": 123,
"baselining": 123,
"limited": 987,
"normal": 123,
"high": 123
}
AssetProductUsageEnum
Description
The product usage values.
Values
| Enum Value | Description |
|---|---|
|
|
Product not installed. Stability Level: 3 - Stable |
|
|
Product usage not detected. Stability Level: 3 - Stable |
|
|
Product is newly installed and not yet reporting usage. Stability Level: 3 - Stable |
|
|
Product usage level is limited. Stability Level: 3 - Stable |
|
|
Product usage level is normal. Stability Level: 3 - Stable |
|
|
Product usage level is high. Stability Level: 3 - Stable |
Example
"NotInstalled"
AssetProductVersion
Description
Product version metrics.
Example
{"version": "abc123", "installs": 987}
AssetProductsFilter
Description
Describes a filter for Asset product field values. Records with field values matching the filter are included in the query results. Software installed on an endpoint must match every included filter condition to satisfy the filter.
Fields
| Input Field | Description |
|---|---|
vendors -
[String!]
|
The product vendor name must match one of the specified values. Stability Level: 3 - Stable |
search -
String
|
The product vendor name or product name must contain the specified value. Stability Level: 3 - Stable |
states -
[AssetProductState!]
|
The product tracking state must match one of the specified values (Tracked, Cataloged, or Ignored). Stability Level: 3 - Stable |
Example
{
"vendors": ["xyz789"],
"search": "abc123",
"states": ["Tracked"]
}
AssetProductsInput
Description
Input for mutating product tracking gathering metrics.
Fields
| Input Field | Description |
|---|---|
vendor -
String!
|
The product vendor name. Stability Level: 3 - Stable |
name -
String!
|
The product name. Stability Level: 3 - Stable |
tracking -
AssetProductTrackingInput!
|
Product tracking details. Stability Level: 3 - Stable |
Example
{
"vendor": "abc123",
"name": "abc123",
"tracking": AssetProductTrackingInput
}
AssetProductsPayload
Fields
| Field Name | Description |
|---|---|
products -
[AssetProductsResult!]
|
Assets Products Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{"products": [AssetProductsResult]}
AssetProductsResult
Description
The Asset product mutation result.
Fields
| Field Name | Description |
|---|---|
vendor -
String
|
The product vendor name. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
name -
String
|
The product name. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
tracking -
AssetProductTracking
|
Product tracking details. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{
"vendor": "xyz789",
"name": "abc123",
"tracking": AssetProductTracking
}
AssetsImportInput
Description
Input fields for creating or updating assets.
Example
{
"sourceName": "abc123",
"json": "xyz789"
}
AssetsImportPayload
Description
Results for an asset import.
Fields
| Field Name | Description |
|---|---|
assets -
[AssetImportPayload!]
|
Assets to create or update. Use of this field requires the Asset solution. Stability Level: 3 - Stable |
Example
{"assets": [AssetImportPayload]}
AutomateTaskArgument
Description
All Automate task arguments.
Example
AutomateTaskArgumentDeployAction
AutomateTaskArgumentConfirmation
Description
The argument for a task that requires a user confirmation.
Fields
| Field Name | Description |
|---|---|
instruction -
String
|
The instruction. This is generally in Markdown format. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"instruction": "abc123"}
AutomateTaskArgumentConfirmationInput
Description
Input for the Confirmation task argument.
Fields
| Input Field | Description |
|---|---|
instruction -
String
|
The step instruction. This is generally in Markdown format. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"instruction": "abc123"}
AutomateTaskArgumentDeployAction
Description
The argument for a task that deploys a Tanium action to the targeted endpoints.
Fields
| Field Name | Description |
|---|---|
package -
PackageRef!
|
The Tanium package to deploy. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
actionGroup -
NamedRef!
|
The action group used to issue the action. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
actionDuration -
MonotonicDuration
|
The duration for how long the action remains open. The task waits for this duration before evaluating the task completion percentage. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
completionPercentage -
Float!
|
The percentage of targeted endpoints required to complete the task. The task stops if this completion criteria is not met. The percentage is evaluated after the action is closed and there are no more pending endpoints. This must be a number between Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"package": PackageRef,
"actionGroup": NamedRef,
"actionDuration": MonotonicDuration,
"completionPercentage": 123.45
}
AutomateTaskArgumentDeployActionInput
Description
Input for the Deploy Action task argument.
Fields
| Input Field | Description |
|---|---|
actionGroup -
ActionActionGroupInput!
|
The action group used by the step. Stability Level: 1.1 - Experimental (Active Development) |
package -
PackageRefInput!
|
The name of the Tanium package to deploy. Stability Level: 1.1 - Experimental (Active Development) |
actionDuration -
MonotonicDurationInput
|
The duration for how long the action remains open. The Deploy Action step waits for this duration before evaluating the step completion percentage. This duration must be equal to or greater than the sum of the package download timeout and command timeout. For example, if the package download timeout is 600 seconds and the package command timeout is 60 seconds, this value must be at least 660 seconds. If this is not defined, the action runs for the sum of the package download timeout and package command timeout (the minimal possible duration). Stability Level: 1.1 - Experimental (Active Development) |
completionPercentage -
Float!
|
The percentage of targeted endpoints required to complete the task. The task stops if this completion criteria is not met. The percentage is evaluated after the action is closed and there are no more pending endpoints. This must be a number between Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"actionGroup": ActionActionGroupInput,
"package": PackageRefInput,
"actionDuration": MonotonicDurationInput,
"completionPercentage": 987.65
}
AutomateTaskArgumentInput
Description
Automate task arguments. Define one, and only one, of the fields.
Fields
| Input Field | Description |
|---|---|
instruction -
AutomateTaskArgumentInstructionInput
|
Input arguments for the Instruction task. Stability Level: 1.1 - Experimental (Active Development) |
confirmation -
AutomateTaskArgumentConfirmationInput
|
Input arguments for the Confirmation task. Stability Level: 1.1 - Experimental (Active Development) |
wait -
AutomateTaskArgumentWaitInput
|
Input arguments for the Wait task. Stability Level: 1.1 - Experimental (Active Development) |
verifyCondition -
AutomateTaskArgumentVerifyConditionInput
|
Input arguments for the Verify Condition task. Stability Level: 1.1 - Experimental (Active Development) |
deployAction -
AutomateTaskArgumentDeployActionInput
|
Input arguments for the Deploy Action task. Stability Level: 1.1 - Experimental (Active Development) |
patchInstallDeployment -
AutomateTaskArgumentPatchInstallDeploymentInput
|
Input arguments for the Patch Install Deployment task. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"instruction": AutomateTaskArgumentInstructionInput,
"confirmation": AutomateTaskArgumentConfirmationInput,
"wait": AutomateTaskArgumentWaitInput,
"verifyCondition": AutomateTaskArgumentVerifyConditionInput,
"deployAction": AutomateTaskArgumentDeployActionInput,
"patchInstallDeployment": AutomateTaskArgumentPatchInstallDeploymentInput
}
AutomateTaskArgumentInstruction
Description
The argument for a task that displays an instruction to the user.
Fields
| Field Name | Description |
|---|---|
instruction -
String!
|
The instruction. This is generally in Markdown format. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"instruction": "xyz789"}
AutomateTaskArgumentInstructionInput
Description
Input for the Instruction task argument.
Fields
| Input Field | Description |
|---|---|
instruction -
String!
|
The step instruction. This is generally in Markdown format. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"instruction": "xyz789"}
AutomateTaskArgumentPatchInstallDeployment
Description
The argument for a task that creates a Patch install deployment to the targeted endpoints.
Fields
| Field Name | Description |
|---|---|
patchDeploymentConfig -
PlaybookStepPatchInstallDeploymentConfig!
|
The Patch deployment configuration. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
deploymentDuration -
MonotonicDuration!
|
The duration for how long the patch deployment remains open. The Patch Install Deployment task waits for this duration before it starts to evaluate the task completion percentage. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
completionPercentage -
Float!
|
The percentage of targeted endpoints required to complete the task. The task stops if this completion criteria is not met. The percentage is evaluated after the patch deployment is closed. This must be a number between Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"patchDeploymentConfig": PlaybookStepPatchInstallDeploymentConfig,
"deploymentDuration": MonotonicDuration,
"completionPercentage": 123.45
}
AutomateTaskArgumentPatchInstallDeploymentInput
Description
Input for the Patch Install Deployment task argument.
Fields
| Input Field | Description |
|---|---|
patchDeploymentConfig -
PlaybookStepPatchInstallDeploymentConfigInput!
|
The Patch deployment configuration. Stability Level: 1.1 - Experimental (Active Development) |
deploymentDuration -
MonotonicDurationInput!
|
The duration for how long the Patch deployment remains open. The Patch Install Deployment task waits for this duration before it starts to evaluate the task completion percentage. Stability Level: 1.1 - Experimental (Active Development) |
completionPercentage -
Float!
|
The percentage of targeted endpoints required to complete the task. The task stops if this completion criteria is not met. The percentage is evaluated after the patch deployment is closed. This must be a number between Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"patchDeploymentConfig": PlaybookStepPatchInstallDeploymentConfigInput,
"deploymentDuration": MonotonicDurationInput,
"completionPercentage": 987.65
}
AutomateTaskArgumentVerifyCondition
Description
The argument for a task that evaluates the percentage of endpoints returned after targeting endpoints. The task is successful if the percentage matches or exceeds the defined successPercentage condition. The task fails if the percentage is below the defined successPercentage condition. Later playbook steps cannot inherit targeting from steps that reference an AutomateTaskArgumentVerifyCondition task argument.
Fields
| Field Name | Description |
|---|---|
endpointFilter -
[EndpointTargeting!]!
|
The endpoint filtering applied to restrict the returned endpoints. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
successPercentage -
Float!
|
The threshold percentage of filtered endpoints, compared to the total number of targeted endpoints, required for the task to proceed. This must be a number between Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"endpointFilter": [EndpointTargeting],
"successPercentage": 987.65
}
AutomateTaskArgumentVerifyConditionInput
Description
Input for the Verify Condition task argument.
Fields
| Input Field | Description |
|---|---|
endpointFilter -
ComputerGroupFilter!
|
The computer group filtering, used to refine returned endpoints results. Stability Level: 1.1 - Experimental (Active Development) |
successPercentage -
Float!
|
The threshold percentage of filtered endpoints, compared to the total number of targeted endpoints, required for the step to proceed. This must be a number between Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"endpointFilter": ComputerGroupFilter,
"successPercentage": 987.65
}
AutomateTaskArgumentWait
Description
The argument for a task that waits the specified time duration.
Fields
| Field Name | Description |
|---|---|
duration -
MonotonicDuration!
|
The monotonic wait duration. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"duration": MonotonicDuration}
AutomateTaskArgumentWaitInput
Description
Input for the Wait task argument.
Fields
| Input Field | Description |
|---|---|
duration -
MonotonicDurationInput!
|
The monotonic wait duration. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"duration": MonotonicDurationInput}
AutomateTaskLinkedResources
Description
Linked resources that contain details on the entities.
Fields
| Field Name | Description |
|---|---|
questionText -
String
|
The Tanium question text. Example: Get Computer Name and Action Statuses contains 123 from all machines with ( Action Statuses contains "123:Completed." or Action Statuses contains "123:Verified." ) Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"questionText": "xyz789"}
AutomateTaskProgress
Description
The progress of an Automate task.
Fields
| Field Name | Description |
|---|---|
state -
AutomateTaskProgressState!
|
The progress state. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
count -
Int!
|
The number of entities that are in this state. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
details -
AutomateTaskLinkedResources
|
The linked resources that contain details on the entities that are in this state. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
collectedTime -
Time!
|
The time that the count of entities in this state was collected. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"state": "UNKNOWN",
"count": 123,
"details": AutomateTaskLinkedResources,
"collectedTime": "10:15:30Z"
}
AutomateTaskProgressState
Description
The playbook run step progress states.
Values
| Enum Value | Description |
|---|---|
|
|
The state of an entity is unknown. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The state of an entity is completed. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The state of an entity is pending. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The state of an entity is failed. Stability Level: 1.1 - Experimental (Active Development) |
Example
"UNKNOWN"
Boolean
Description
The Boolean scalar type represents true or false.
CloseDirectConnectionInput
Description
A request to close a Direct Connect connection to an endpoint.
Fields
| Input Field | Description |
|---|---|
connectionID -
ID!
|
The ID of the connection to close. Stability Level: 3 - Stable |
Example
{"connectionID": 4}
CloseDirectConnectionPayload
Description
A response to a request to close a Direct Connect connection to an endpoint.
Fields
| Field Name | Description |
|---|---|
result -
Boolean!
|
Indicates that the connection is closed. Stability Level: 3 - Stable |
Example
{"result": false}
ComputerGroup
Description
Defines a set of endpoints that is managed as a group.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique identifier of the computer group. Stability Level: 3 - Stable |
name -
String!
|
The assigned name of the computer group. Stability Level: 3 - Stable |
managementRightsEnabled -
Boolean!
|
Indicates that this is a computer management group. Stability Level: 3 - Stable |
filterEnabled -
Boolean!
|
Indicates that this is a computer filter group. Stability Level: 3 - Stable |
contentSet -
NamedRef
|
The content set assigned to the filter group. The content set controls access to the filter group.
Stability Level: 2 - Legacy Use |
contentSetV2 -
TaniumPlatformContentSet
|
The content set assigned to the filter group. The content set controls access to the filter group. Stability Level: 1.2 - Experimental (Release Candidate) |
type -
ComputerGroupType!
|
The type of the computer group. Stability Level: 3 - Stable |
expression -
String!
|
A sensor filter expression used to define membership in the computer group, such as Stability Level: 3 - Stable |
modifiedTime -
Time
|
When the computer group was last modified, or the creation time if the computer group was not modified since creation. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"id": 4,
"name": "abc123",
"managementRightsEnabled": true,
"filterEnabled": true,
"contentSet": NamedRef,
"contentSetV2": TaniumPlatformContentSet,
"type": "STANDARD",
"expression": "xyz789",
"modifiedTime": "10:15:30Z"
}
ComputerGroupConnection
Description
A page of computer group edges.
Fields
| Field Name | Description |
|---|---|
edges -
[ComputerGroupEdge!]!
|
The list of computer group edges. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the computer group collection. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of computer group records available. Stability Level: 3 - Stable |
Example
{
"edges": [ComputerGroupEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
ComputerGroupCreateInput
Description
A request to create a standard computer group.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The assigned name of the computer group. Stability Level: 3 - Stable |
managementRightsEnabled -
Boolean!
|
Indicates that this is a computer management group. Stability Level: 3 - Stable |
contentSetRef -
NamedRefInput
|
The content set to which this computer group belongs. This defines the computer group as a filter group. Stability Level: 3 - Stable |
filter -
ComputerGroupFilter!
|
The filter condition that must be met for a computer to be part of this group. Stability Level: 3 - Stable |
Example
{
"name": "xyz789",
"managementRightsEnabled": false,
"contentSetRef": NamedRefInput,
"filter": ComputerGroupFilter
}
ComputerGroupCreatePayload
Description
A response to a request to create a standard computer group.
Fields
| Field Name | Description |
|---|---|
group -
ComputerGroup
|
The standard computer group created by the request. Stability Level: 3 - Stable |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"group": ComputerGroup,
"error": SystemError
}
ComputerGroupDeletePayload
Description
A response to a request to delete a computer group.
Fields
| Field Name | Description |
|---|---|
id -
ID
|
The unique identifier of the deleted computer group. Stability Level: 3 - Stable |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{"id": 4, "error": SystemError}
ComputerGroupEdge
Description
A computer group within a page.
Fields
| Field Name | Description |
|---|---|
node -
ComputerGroup!
|
The computer group. Stability Level: 3 - Stable |
cursor -
Cursor!
|
The cursor of this edge within the collection. Stability Level: 3 - Stable |
Example
{
"node": ComputerGroup,
"cursor": Cursor
}
ComputerGroupFilter
Description
An object containing the conditions for membership in a standard computer group.
Fields
| Input Field | Description |
|---|---|
memberOf -
EndpointFieldFilterComputerGroup
|
The computer group to which the endpoint must belong in order to pass the filter. Stability Level: 3 - Stable |
sensor -
EndpointFieldFilterSensor
|
The sensor whose reading is used as the basis for the filter. Stability Level: 3 - Stable |
op -
FieldFilterOp!
|
The operator by which to compare the specified value to the field value. Note that not all operators are valid for all fields or data sources. If the operator is not valid, the query returns an error. Stability Level: 3 - Stable |
negated -
Boolean!
|
Indicates that the filter is negated. Records with field values matching the filter are excluded from the query results. Stability Level: 3 - Stable |
value -
String
|
The constant value to compare with the field value, expressed as a string. If this value cannot be interpreted as a valid value for the field type, the query returns an error. Stability Level: 3 - Stable |
filters -
[ComputerGroupFilter!]
|
Describes the set of filters which comprise this compound filter. Stability Level: 3 - Stable |
any -
Boolean!
|
Indicates that if any of the filters comprising this compound filter passes, the compound filter passes. This defaults to Stability Level: 3 - Stable |
Example
{
"memberOf": EndpointFieldFilterComputerGroup,
"sensor": EndpointFieldFilterSensor,
"op": "EQ",
"negated": false,
"value": "xyz789",
"filters": [ComputerGroupFilter],
"any": false
}
ComputerGroupType
Description
The computer group type values.
Values
| Enum Value | Description |
|---|---|
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
Example
"STANDARD"
ComputerGroupsFilter
Description
Describes a filter for computer groups.
Fields
| Input Field | Description |
|---|---|
type -
ComputerGroupType
|
The type of the computer group. Stability Level: 3 - Stable |
managementRightsEnabled -
Boolean
|
Indicates that this is a computer management group. Stability Level: 3 - Stable |
filterEnabled -
Boolean
|
Indicates that this is a computer filter group. Stability Level: 3 - Stable |
Example
{"type": "STANDARD", "managementRightsEnabled": false, "filterEnabled": true}
ConfigurationItem
Description
The CMDB reference IDs for an asset.
Fields
| Field Name | Description |
|---|---|
entityID -
ID!
|
The unique ID of an asset entity record in the CMDB. Stability Level: 3 - Stable |
entityClassIDs -
[ID!]!
|
The unique IDs of the class records of an asset in the CMDB. Stability Level: 3 - Stable |
namespace -
String!
|
The namespace of an asset entity record in the CMDB. Examples: tds, discover Stability Level: 3 - Stable |
Example
{
"entityID": 4,
"entityClassIDs": ["4"],
"namespace": "abc123"
}
ConnectConnection
Description
A connection found in a Connect service.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The connection's unique ID. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
displayName -
String!
|
The connection's unique display name. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
description -
String
|
The connection description. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
currentRun -
ConnectRun
|
The connection's currently active run, if any. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
pastRuns -
ConnectRunConnection
|
The collection of this connection's previous runs. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"id": "4",
"displayName": "xyz789",
"description": "xyz789",
"currentRun": ConnectRun,
"pastRuns": ConnectRunConnection
}
ConnectConnectionEdge
Description
A connection within a page.
Fields
| Field Name | Description |
|---|---|
node -
ConnectConnection!
|
The connection. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"node": ConnectConnection,
"cursor": Cursor
}
ConnectConnectionStartInput
Description
The input of starting a connection run.
Fields
| Input Field | Description |
|---|---|
connectionID -
ID!
|
The ID of the connection to start. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{"connectionID": 4}
ConnectConnectionStartPayload
Description
The result of starting a connection.
Fields
| Field Name | Description |
|---|---|
run -
ConnectRun
|
The connection run that was created. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"run": ConnectRun,
"error": SystemError
}
ConnectConnectionStopInput
Description
The input of stopping an in-progress connection run.
Fields
| Input Field | Description |
|---|---|
connectRunID -
ID!
|
The ID of the connection run input to stop. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{"connectRunID": 4}
ConnectConnectionStopPayload
Description
The result of stopping an in-progress connection run.
Fields
| Field Name | Description |
|---|---|
run -
ConnectRun
|
The connection run that stopped. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"run": ConnectRun,
"error": SystemError
}
ConnectGraphConnection
Description
A page of connection edges.
Fields
| Field Name | Description |
|---|---|
edges -
[ConnectConnectionEdge!]!
|
The list of connections. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
pageInfo -
PageInfo!
|
Information about the connection collection. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
totalRecords -
Int!
|
The total number of connection records available. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"edges": [ConnectConnectionEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
ConnectRun
Description
A connection run found in a Connect service.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The connection run ID. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
connectionID -
ID!
|
The ID of the connection from which this connection run was generated. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
status -
ConnectRunStatus!
|
The connection run status. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
createdTime -
Time!
|
The time at which the connection run was created. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
updatedTime -
Time!
|
The time at which the connection run was most recently modified. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"id": "4",
"connectionID": 4,
"status": "Starting",
"createdTime": "10:15:30Z",
"updatedTime": "10:15:30Z"
}
ConnectRunConnection
Description
A page of connection run edges.
Fields
| Field Name | Description |
|---|---|
edges -
[ConnectRunEdge!]!
|
The list of connection run edges. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
pageInfo -
PageInfo!
|
Information about this connection run page. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
totalRecords -
Int!
|
The total number of connection run records available. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"edges": [ConnectRunEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
ConnectRunEdge
Description
A connection run within a page.
Fields
| Field Name | Description |
|---|---|
node -
ConnectRun!
|
The connection run. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Connect solution. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"node": ConnectRun,
"cursor": Cursor
}
ConnectRunStatus
Description
The status of the last connection run.
Values
| Enum Value | Description |
|---|---|
|
|
The connection run is starting. Stability Level: 1.2 - Experimental (Release Candidate) |
|
|
The connection run is waiting to start. Stability Level: 1.2 - Experimental (Release Candidate) |
|
|
The connection run is in progress. Stability Level: 1.2 - Experimental (Release Candidate) |
|
|
The connection run finished successfully. Stability Level: 1.2 - Experimental (Release Candidate) |
|
|
The connection run failed with an error. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
"Starting"
ConnectedState
Description
The set of connected states of wireless adapters.
Values
| Enum Value | Description |
|---|---|
|
|
The wireless adapter is connected. Stability Level: 3 - Stable |
|
|
The wireless adapter is disconnected. Stability Level: 3 - Stable |
|
|
The wireless adapter connected state is unknown. Stability Level: 3 - Stable |
Example
"CONNECTED"
Connection
CronExpression
Description
A cron expression string used for scheduling.
Example
CronExpression
Cursor
Description
A relay pagination cursor, which is an opaque string that specifies a record within a connection.
Example
Cursor
Date
Description
A string date in RFC 3339 long-date format.
Example
"2007-12-03"
DateTimeComponent
Example
DateTimeComponent
DefaultRangeEnd
Fields
| Field Name | Description |
|---|---|
model -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
parameterType -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
type -
DateTimeComponent
|
Stability Level: 3 - Stable |
interval -
Int
|
Stability Level: 3 - Stable |
intervalCount -
Int
|
Stability Level: 3 - Stable |
unixTimeStamp -
Int
|
Stability Level: 3 - Stable |
Example
{
"model": ParameterDefinitionType,
"parameterType": ParameterDefinitionType,
"type": DateTimeComponent,
"interval": 987,
"intervalCount": 987,
"unixTimeStamp": 987
}
DirectConnect
Description
Data from an endpoint, obtained using a Direct Connect connection.
Fields
| Field Name | Description |
|---|---|
performance -
DirectConnectPerf
|
Performance data from the endpoint. Stability Level: 3 - Stable |
processes -
DirectConnectProcesses
|
Processes running on the endpoint. Stability Level: 3 - Stable |
alerts -
DirectConnectAlerts
|
Performance alerts from the endpoint. Stability Level: 3 - Stable |
Example
{
"performance": DirectConnectPerf,
"processes": DirectConnectProcesses,
"alerts": DirectConnectAlerts
}
DirectConnectAlertScope
Description
Defines a window of time for filtering performance alerts.
Example
{
"startTime": "10:15:30Z",
"endTime": "10:15:30Z"
}
DirectConnectAlerts
Description
Performance alerts from an endpoint.
Fields
| Field Name | Description |
|---|---|
all -
[EndpointAlert!]
|
All performance alerts for the endpoint. Stability Level: 3 - Stable |
Arguments
|
|
Example
{"all": [EndpointAlert]}
DirectConnectCloseInput
Description
A request to close a Direct Connect connection to an endpoint.
Fields
| Input Field | Description |
|---|---|
connectionID -
ID!
|
The ID of the connection to close. Stability Level: 3 - Stable |
Example
{"connectionID": 4}
DirectConnectClosePayload
Description
A response to a request to close a Direct Connect connection to an endpoint.
Fields
| Field Name | Description |
|---|---|
result -
Boolean!
|
Indicates that the connection was closed. Stability Level: 3 - Stable |
Example
{"result": false}
DirectConnectConnectionStatus
Description
The set of statuses for a Direct Connect connection.
Values
| Enum Value | Description |
|---|---|
|
|
The connection state is unknown. Stability Level: 3 - Stable |
|
|
The connection is open and ready for use. Stability Level: 3 - Stable |
|
|
The connection is being established. Stability Level: 3 - Stable |
|
|
This connection has encountered an error. Stability Level: 3 - Stable |
|
|
This connection was not found. The connection may have expired and been closed after 5 minutes of inactivity. Stability Level: 3 - Stable |
Example
"UNKNOWN"
DirectConnectConnectionStatusInput
Description
A request to get the status for a Direct Connect connection.
Fields
| Input Field | Description |
|---|---|
connectionID -
ID!
|
The ID of the connection to check. Stability Level: 3 - Stable |
Example
{"connectionID": 4}
DirectConnectConnectionStatusPayload
Description
A response to a request to get the status for a Direct Connect connection.
Fields
| Field Name | Description |
|---|---|
status -
DirectConnectConnectionStatus!
|
The current status of the connection. Stability Level: 3 - Stable |
Example
{"status": "UNKNOWN"}
DirectConnectEndpointInput
Description
A request to get data from an endpoint using an open Direct Connect connection.
Fields
| Input Field | Description |
|---|---|
connectionID -
ID!
|
The ID of the connection to use. Stability Level: 3 - Stable |
Example
{"connectionID": "4"}
DirectConnectOpenInput
Description
A request to initiate a Direct Connect connection to an endpoint.
Fields
| Input Field | Description |
|---|---|
endpointID -
ID!
|
The ID of the endpoint. Stability Level: 3 - Stable |
Example
{"endpointID": "4"}
DirectConnectOpenPayload
Description
A response to a request to initiate a Direct Connect connection to an endpoint.
Fields
| Field Name | Description |
|---|---|
connectionID -
ID!
|
A connection ID, used for Direct Connect requests. Stability Level: 3 - Stable |
status -
DirectConnectConnectionStatus!
|
The status of the connection. Stability Level: 3 - Stable |
Example
{"connectionID": "4", "status": "UNKNOWN"}
DirectConnectPerf
Description
Performance data from an endpoint.
Fields
| Field Name | Description |
|---|---|
cpuUsagePercent -
Float!
|
The current CPU usage as a percent from 0 to 100. Stability Level: 3 - Stable |
memoryUsedPercent -
Float!
|
The current memory usage as a percent from 0 to 100. Stability Level: 3 - Stable |
_dev_query -
[EndpointMetric!]
|
Raw PromQL queries. Stability Level: 1.2 - Experimental (Release Candidate) |
Arguments
|
|
Example
{
"cpuUsagePercent": 987.65,
"memoryUsedPercent": 123.45,
"_dev_query": [EndpointMetric]
}
DirectConnectPingInput
Description
A request to ping an endpoint over a Direct Connect connection (for example, to test connectivity).
Fields
| Input Field | Description |
|---|---|
connectionID -
ID!
|
The ID of the connection to ping. Stability Level: 3 - Stable |
Example
{"connectionID": 4}
DirectConnectPingPayload
Description
A response to a request to ping an endpoint over a Direct Connect connection.
Fields
| Field Name | Description |
|---|---|
result -
Boolean!
|
Indicates that the ping is acknowledged. Stability Level: 3 - Stable |
Example
{"result": true}
DirectConnectProcessTerminateInput
Description
A request to terminate a process running on an endpoint.
Fields
| Input Field | Description |
|---|---|
connectionID -
ID!
|
The ID of the Direct Connect connection to the endpoint on which the process is running. Stability Level: 3 - Stable |
pid -
Int!
|
The ID of the process to terminate. Stability Level: 3 - Stable |
name -
String!
|
The name of the process to terminate. Stability Level: 3 - Stable |
signal -
Signal!
|
The signal to use when terminating the process. Stability Level: 3 - Stable |
Example
{
"connectionID": 4,
"pid": 987,
"name": "xyz789",
"signal": "SIGINT"
}
DirectConnectProcessTerminatePayload
Description
A response to a request to terminate a process.
Fields
| Field Name | Description |
|---|---|
result -
Boolean!
|
Indicates that the process is terminated. Stability Level: 3 - Stable |
Example
{"result": true}
DirectConnectProcesses
Description
Processes running on an endpoint.
Fields
| Field Name | Description |
|---|---|
all -
[Process!]
|
All processes running on the endpoint. Stability Level: 3 - Stable |
Example
{"all": [Process]}
DiscoverCloudInstance
Description
A Discover cloud instance.
Fields
| Field Name | Description |
|---|---|
id -
String
|
The identifier of the cloud instance. Stability Level: 1.1 - Experimental (Active Development) |
imageId -
String
|
The identifier of the cloud instance image. Stability Level: 1.1 - Experimental (Active Development) |
type -
String
|
The type of the cloud instance. Stability Level: 1.1 - Experimental (Active Development) |
state -
String
|
The state of the cloud instance. Stability Level: 1.1 - Experimental (Active Development) |
launchTime -
Time
|
The time that the cloud instance was launched. Stability Level: 1.1 - Experimental (Active Development) |
zone -
String
|
The data center where the cloud instance is hosted. Stability Level: 1.1 - Experimental (Active Development) |
provider -
String
|
The provider of the cloud instance. Stability Level: 1.1 - Experimental (Active Development) |
networkId -
String
|
The network identifier of the cloud instance. Stability Level: 1.1 - Experimental (Active Development) |
account -
String
|
The account associated with the cloud instance. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": "abc123",
"imageId": "xyz789",
"type": "abc123",
"state": "abc123",
"launchTime": "10:15:30Z",
"zone": "xyz789",
"provider": "xyz789",
"networkId": "xyz789",
"account": "abc123"
}
DiscoverCloudTag
Description
A Discover cloud tag associated with an interface and assigned to an instance.
Example
{
"name": "abc123",
"value": "abc123"
}
DiscoverInterface
Description
An interface found in a Discover network scan.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique identifier of the interface. Stability Level: 1.1 - Experimental (Active Development) |
macAddress -
String
|
The MAC address of the interface. Stability Level: 1.1 - Experimental (Active Development) |
manufacturer -
String
|
The manufacturer of the interface. Stability Level: 1.1 - Experimental (Active Development) |
hostnames -
[String!]
|
The hostnames associated with the interface. Stability Level: 1.1 - Experimental (Active Development) |
ipAddresses -
[String!]
|
The IP addresses associated with the interface. Stability Level: 1.1 - Experimental (Active Development) |
labels -
[DiscoverLabel!]!
|
The labels associated with the interface. Stability Level: 1.1 - Experimental (Active Development) |
osPlatform -
String
|
The platform of the operating system associated with the interface. Stability Level: 1.1 - Experimental (Active Development) |
openPorts -
[Int!]
|
The interface open ports. If this value is null, the network scan did not identify open ports for this interface. Stability Level: 1.1 - Experimental (Active Development) |
discoveryMethods -
[DiscoveryMethod!]!
|
The discovery methods by which this interface has been scanned. Stability Level: 1.1 - Experimental (Active Development) |
lastSeenTime -
Time!
|
The time the interface was last found with any discovery method. This value is not used to flag an interface as Lost. Stability Level: 1.1 - Experimental (Active Development) |
computerId -
String
|
The Tanium Client computer ID of the managed interface. If this value is null and Stability Level: 1.1 - Experimental (Active Development) |
natIPAddresses -
[String!]
|
The network address translation (NAT) IP addresses associated with the interface. Stability Level: 1.1 - Experimental (Active Development) |
osGeneration -
String
|
The generation of the operating system associated with the interface. Stability Level: 1.1 - Experimental (Active Development) |
profiles -
[DiscoverProfile!]!
|
The profiles that have scanned this interface. Stability Level: 1.1 - Experimental (Active Development) |
cloudInstances -
[DiscoverCloudInstance!]!
|
The cloud instances where this interface is hosted. Stability Level: 1.1 - Experimental (Active Development) |
cloudTags -
[DiscoverCloudTag!]!
|
The cloud tags associated with the interface. Stability Level: 1.1 - Experimental (Active Development) |
firstSeenTime -
Time!
|
The time the interface was first seen. Stability Level: 1.1 - Experimental (Active Development) |
firstManagedTime -
Time
|
The time the interface was first managed. If this value is Stability Level: 1.1 - Experimental (Active Development) |
lastManagedTime -
Time
|
The last time the interface was returned as a managed interface. Stability Level: 1.1 - Experimental (Active Development) |
lastDiscoveredTime -
Time
|
The time the interface was last discovered. By default, if an interface has not been identified as managed for at least 24 hours, has been identified as unmanaged in the past 4 hours by an active discovery method, and has a Stability Level: 1.1 - Experimental (Active Development) |
isManaged -
Boolean!
|
Whether this interface is managed by Tanium and has the Tanium Client installed. Stability Level: 1.1 - Experimental (Active Development) |
isUnmanageable -
Boolean!
|
Whether this interface has been marked as unmanageable. Stability Level: 1.1 - Experimental (Active Development) |
isIgnored -
Boolean!
|
Whether this interface has been marked as ignored by a user or automatic label. Stability Level: 1.1 - Experimental (Active Development) |
satellites -
[DiscoverSatellite!]!
|
The satellites that returned data about this interface in scans. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": 4,
"macAddress": "xyz789",
"manufacturer": "xyz789",
"hostnames": ["abc123"],
"ipAddresses": ["xyz789"],
"labels": [DiscoverLabel],
"osPlatform": "abc123",
"openPorts": [987],
"discoveryMethods": ["ARP"],
"lastSeenTime": "10:15:30Z",
"computerId": "xyz789",
"natIPAddresses": ["abc123"],
"osGeneration": "xyz789",
"profiles": [DiscoverProfile],
"cloudInstances": [DiscoverCloudInstance],
"cloudTags": [DiscoverCloudTag],
"firstSeenTime": "10:15:30Z",
"firstManagedTime": "10:15:30Z",
"lastManagedTime": "10:15:30Z",
"lastDiscoveredTime": "10:15:30Z",
"isManaged": true,
"isUnmanageable": false,
"isIgnored": false,
"satellites": [DiscoverSatellite]
}
DiscoverInterfaceAddLabelInput
Description
A request to add one or more standard labels to specific Discover interfaces.
Fields
| Input Field | Description |
|---|---|
names -
[String!]!
|
The unique names of the standard labels to add. Stability Level: 1.1 - Experimental (Active Development) |
ids -
[ID!]!
|
The unique identifiers of the interfaces to add the labels to. Stability Level: 1.1 - Experimental (Active Development) |
cursor -
Cursor
|
The cursor value from a previous 'discoverInterfaceAddLabel' request. Add a cursor value if a prior Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"names": ["xyz789"],
"ids": [4],
"cursor": Cursor
}
DiscoverInterfaceAddLabelPayload
Description
A response to a request to add one or more standard labels to specific Discover interfaces.
Fields
| Field Name | Description |
|---|---|
cursor -
Cursor
|
Indicates the request is not complete and provides an identifier for subsequent calls to determine the request's terminal state. Stability Level: 1.1 - Experimental (Active Development) |
success -
Boolean
|
Indicates the request completed successfully or failed. Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"cursor": Cursor,
"success": true,
"error": SystemError
}
DiscoverInterfaceConnection
Description
A page of Discover interface edges.
Fields
| Field Name | Description |
|---|---|
edges -
[DiscoverInterfaceEdge!]!
|
The list of Discover interface edges. Stability Level: 1.1 - Experimental (Active Development) |
pageInfo -
PageInfo!
|
Information about the Discover interface collection. Stability Level: 1.1 - Experimental (Active Development) |
totalRecords -
Int!
|
The total number of Discover interface records available. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"edges": [DiscoverInterfaceEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
DiscoverInterfaceEdge
Description
A Discover interface within a page.
Fields
| Field Name | Description |
|---|---|
node -
DiscoverInterface!
|
The Discover interface. Stability Level: 1.1 - Experimental (Active Development) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"node": DiscoverInterface,
"cursor": Cursor
}
DiscoverInterfaceRemoveLabelInput
Description
A request to remove one or more standard labels from specific Discover interfaces.
Fields
| Input Field | Description |
|---|---|
names -
[String!]!
|
The unique names of the standard labels to add. Stability Level: 1.1 - Experimental (Active Development) |
ids -
[ID!]!
|
The unique identifiers of the interfaces to remove the labels from. Stability Level: 1.1 - Experimental (Active Development) |
cursor -
Cursor
|
The cursor value from a previous Add a cursor value if a prior Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"names": ["abc123"],
"ids": [4],
"cursor": Cursor
}
DiscoverLabel
Description
A Discover label, used to tag interfaces found during Discover network scans.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The unique name for the label. Stability Level: 1.1 - Experimental (Active Development) |
type -
DiscoverLabelType!
|
The type of the label. Stability Level: 1.1 - Experimental (Active Development) |
createdTime -
Time!
|
The time at which the label was created. Stability Level: 1.1 - Experimental (Active Development) |
modifiedTime -
Time!
|
The time at which the label was most recently modified. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"name": "abc123",
"type": "STANDARD",
"createdTime": "10:15:30Z",
"modifiedTime": "10:15:30Z"
}
DiscoverLabelConnection
Description
A page of Discover label edges.
Fields
| Field Name | Description |
|---|---|
edges -
[DiscoverLabelEdge!]!
|
The list of Discover label edges. Stability Level: 1.1 - Experimental (Active Development) |
pageInfo -
PageInfo!
|
Information about the Discover label collection. Stability Level: 1.1 - Experimental (Active Development) |
totalRecords -
Int!
|
The total number of Discover label records available. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"edges": [DiscoverLabelEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
DiscoverLabelCreateInput
Description
A request to create a standard Discover label.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The assigned name of the label. Note that labels are required to have unique names. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"name": "xyz789"}
DiscoverLabelCreatePayload
Description
A response to a request to create a Discover label.
Fields
| Field Name | Description |
|---|---|
label -
DiscoverLabel
|
The newly created label. If the request fails, this is Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"label": DiscoverLabel,
"error": SystemError
}
DiscoverLabelDeletePayload
Description
A response to a request to delete a Discover label.
Fields
| Field Name | Description |
|---|---|
name -
String
|
The name of the deleted label. If the request fails, this is Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"name": "xyz789",
"error": SystemError
}
DiscoverLabelEdge
Description
A Discover label within a page.
Fields
| Field Name | Description |
|---|---|
node -
DiscoverLabel!
|
The Discover label. Stability Level: 1.1 - Experimental (Active Development) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"node": DiscoverLabel,
"cursor": Cursor
}
DiscoverLabelType
Description
The Discover label type.
Values
| Enum Value | Description |
|---|---|
|
|
The label can be manually associated with interfaces. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The label is automatically associated with interfaces based on conditions. Note that the addition or removal of automatic labels through the API Gateway is not supported at this time. Stability Level: 1.1 - Experimental (Active Development) |
Example
"STANDARD"
DiscoverProfile
Description
A Discover profile definition used to scan networks.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the profile. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"name": "abc123"}
DiscoverSatellite
Description
An endpoint configured as a satellite to scan remote subnets.
Example
{
"id": "abc123",
"name": "xyz789"
}
DiscoveryMethod
Description
The method by which an interface was discovered.
Values
| Enum Value | Description |
|---|---|
|
|
The interface was discovered by using the Address Resolution Protocol (ARP) cache. This method is part of a distributed level 1 scan. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The interface was discovered using interface connections discovery. This method is part of a distributed level 1 scan. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The interface was discovered using targeted pings. This method is part of a distributed level 2 scan. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The interface was discovered using Nmap to perform host discovery. This method is part of a distributed level 3 or 4 scan. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The interface was discovered using the Stability Level: 1.1 - Experimental (Active Development) |
|
|
The interface was found in an Amazon EC2 centralized scan from the Tanium Module server. Centralized scans are not available in Tanium Cloud deployments. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The interface was discovered using an Nmap scan from the Tanium Module Server to an unmanaged environment. This is a centralized scan method, and equivalent to a distributed level 4 scan. Centralized scans are not available in Tanium Cloud deployments. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The interface was discovered using an Nmap scan run from an endpoint configured as a satellite. This is a satellite scan method, and equivalent to a distributed level 4 scan. Stability Level: 1.1 - Experimental (Active Development) |
Example
"ARP"
Edge
Description
A record within a page.
Fields
| Field Name | Description |
|---|---|
cursor -
Cursor!
|
The cursor of this record. Stability Level: 3 - Stable |
Possible Types
| Edge Types |
|---|
Example
{"cursor": Cursor}
EmailBodyType
Description
Email body content type.
Values
| Enum Value | Description |
|---|---|
|
|
The body content type is unspecified. Stability Level: 1.0 - Experimental (Early Development) |
|
|
The body content type is plain text. Stability Level: 1.0 - Experimental (Early Development) |
|
|
The body content type is HTML. Stability Level: 1.0 - Experimental (Early Development) |
Example
"UNSPECIFIED"
EmailSendInput
Description
A request to send an email.
Fields
| Input Field | Description |
|---|---|
id -
ID!
|
A client-generated UUID for this email. If multiple requests are submitted to send an email with the same UUID, only one email is sent. Stability Level: 1.0 - Experimental (Early Development) |
subject -
String!
|
The email subject. Stability Level: 1.0 - Experimental (Early Development) |
body -
String!
|
The email body. Stability Level: 1.0 - Experimental (Early Development) |
bodyType -
EmailBodyType!
|
The email body type. Stability Level: 1.0 - Experimental (Early Development) |
toAddresses -
[String!]
|
The email To field recipient addresses. Stability Level: 1.0 - Experimental (Early Development) |
ccAddresses -
[String!]
|
The email Cc field recipient addresses. Stability Level: 1.0 - Experimental (Early Development) |
bccAddresses -
[String!]
|
The email Bcc field recipient addresses. Stability Level: 1.0 - Experimental (Early Development) |
emailServer -
IdRefInput!
|
The ID of the email server to use to send the email. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"id": "4",
"subject": "abc123",
"body": "abc123",
"bodyType": "UNSPECIFIED",
"toAddresses": ["xyz789"],
"ccAddresses": ["xyz789"],
"bccAddresses": ["abc123"],
"emailServer": IdRefInput
}
EmailSendPayload
Description
The result of submitting a request to send an email.
Fields
| Field Name | Description |
|---|---|
queuedTime -
Time
|
The time that the email was received by the Tanium Email service and queued for sending. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"queuedTime": "10:15:30Z",
"error": SystemError
}
EmailServerSummary
Description
A summary of the information required to retrieve and use an email server to send emails.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The email server ID. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
name -
String!
|
The email server name. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
description -
String
|
The email server description. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
fromAddress -
String
|
The email server From sender address. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"id": "4",
"name": "abc123",
"description": "abc123",
"fromAddress": "xyz789"
}
EmailServerSummaryConnection
Description
A page of email server summary edges.
Fields
| Field Name | Description |
|---|---|
edges -
[EmailServerSummaryEdge!]!
|
The list of email server summary edges. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
pageInfo -
PageInfo!
|
Information about the email server summary collection. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
totalRecords -
Int!
|
The total number of email server summary records available. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"edges": [EmailServerSummaryEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
EmailServerSummaryEdge
Description
An email server summary within a page.
Fields
| Field Name | Description |
|---|---|
node -
EmailServerSummary!
|
The email server summary. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Email solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"node": EmailServerSummary,
"cursor": Cursor
}
Endpoint
Description
An endpoint managed by the Tanium Client.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique ID. This is reasonably guaranteed to be stable. Virtual Sensor: Endpoint ID, Column: ID Use of this field requires the Interact solution. Stability Level: 3 - Stable |
eidFirstSeen -
Time
|
The datetime an endpoint was first seen. Virtual Sensor: EID First Seen Stability Level: 3 - Stable |
eidLastSeen -
Time
|
The datetime an endpoint was last seen. Virtual Sensor: EID Last Seen Stability Level: 3 - Stable |
namespace -
String!
|
The endpoint namespace. The standard Tanium endpoint namespace is an empty string. Virtual Sensor: Endpoint ID, Column: Namespace Use of this field requires the Interact solution. Stability Level: 3 - Stable |
computerID -
String!
|
The Tanium Client computer ID. This is temporally unique but not stable. Example: 4202979704 Sensor: Computer ID Stability Level: 3 - Stable |
systemUUID -
String!
|
The UUID of the endpoint hardware. Note that this has no real guarantee of uniqueness across platforms and a strong possibility of duplicates within platforms (for virtual endpoints in particular). Sensor: System UUID Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
name -
String!
|
The assigned name of the endpoint. Example: workstation-1.example.com Sensor: Computer Name Stability Level: 3 - Stable |
domainName -
String!
|
The domain name of the endpoint. Example: intra.example.com Sensor: Domain Name Stability Level: 3 - Stable |
serialNumber -
String!
|
The serial number provided by the manufacturer. Sensor: Computer Serial Number Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
manufacturer -
String!
|
The manufacturer of the endpoint. Example: Dell Sensor: Manufacturer Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
model -
String!
|
The model of the endpoint. Example: OptiPlex 7050 Sensor: Model Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
ipAddress -
String!
|
The IP addresses of the endpoint. Example: 192.168.1.1 Sensor: Tanium Client IP Address Stability Level: 3 - Stable |
ipAddresses -
[String!]
|
The current IP addresses of this endpoint. Examples: 192.168.1.1, 192.168.1.2 Sensor: IP Address Stability Level: 3 - Stable |
macAddresses -
[String!]
|
The MAC addresses for all IP enabled network connections. Examples: 00:0C:29:68:6A:D8, 11:22:33:44:55:66 Sensor: MAC Address Stability Level: 3 - Stable |
primaryUser -
EndpointUser!
|
The primary user of the endpoint. Stability Level: 3 - Stable |
lastLoggedInUser -
String!
|
The name of the user that last signed in to the endpoint. Sensor: Last Logged In User Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
isVirtual -
Boolean
|
Indicates that the endpoint is virtual. Sensor: Is Virtual Stability Level: 3 - Stable |
isEncrypted -
Boolean
|
Indicates that the endpoint storage is encrypted, such as with BitLocker on Windows or FileVault on Mac OS. Sensor: Storage Encryption Status, Column: Encryption Status Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
chassisType -
String!
|
The machine or chassis type of the endpoint. Examples: MacBookPro16,1, Server, Virtual Sensor: Chassis Type Stability Level: 3 - Stable |
os -
EndpointOS!
|
The operating system details of the endpoint. Stability Level: 3 - Stable |
disks -
[EndpointDisk!]
|
The disk space details per drive on the endpoint. Stability Level: 3 - Stable |
memory -
Memory!
|
The memory details of the endpoint. Stability Level: 3 - Stable |
processor -
Processor!
|
The processor details of the endpoint. Stability Level: 3 - Stable |
networking -
Networking!
|
The networking details of the endpoint. Stability Level: 3 - Stable |
eventCounts -
EndpointEventCounts!
|
The number of performance events on the endpoint. Use of this field requires the Performance solution. Stability Level: 3 - Stable |
services -
[EndpointService!]!
|
The details of services on the endpoint. These are only available for Windows platforms. Stability Level: 3 - Stable |
installedApplications -
[EndpointInstalledApplication!]!
|
The software applications installed on the endpoint, regardless of provenance. This field allows a filter argument. You can use the filter to restrict the items returned in this field. This also restricts the returned endpoints to those with matching items in this field, unless the The filter must be either a simple filter, or a compound filter with a single set of simple child filters. An endpoint is returned only if it matches the simple filter, or all filters within the compound filter. The filter supports the following operations: Sensor: Installed Applications Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Arguments
|
|
deployedSoftwarePackages -
[EndpointDeploySoftwarePackage!]!
|
The Deploy software packages that are deployed or deployable on the endpoint. This field allows a filter argument. You can use the filter to restrict the items returned in this field. This also restricts the returned endpoints to those with matching items in this field, unless the The filter must be either a simple filter, or a compound filter with a single set of simple child filters. An endpoint is returned only if it matches the simple filter, or all filters within the compound filter. The filter supports the following operations: Sensor: Deploy - Software Packages Use of this field requires the Deploy solution. Stability Level: 3 - Stable |
Arguments
|
|
sensorReadings -
EndpointSensorReadings!
|
Returns readings from the list of named sensors, which can include parameterized sensors. If the sensors are not available from the data source, the query returns an error. Hidden columns are not included unless they are specified in the list of sensor columns, or the This field allows a filter argument for each requested sensor. You can use the filter to restrict the items returned in this field. This also restricts the returned endpoints to those with matching items in this field, unless the Use Use Stability Level: 3 - Stable |
Arguments
|
|
sensorReading -
EndpointSensorReading
|
Returns a reading from the named sensor, which can be a parameterized sensor. If the sensor is not available from the data source, the query returns an error. If the sensor has multiple columns, exactly one column must be specified. You can specify a hidden sensor column. This field allows a filter argument for the requested sensor. You can use the filter to restrict the items returned in this field. This also restricts the returned endpoints to those with matching items in this field, unless the Use Use Stability Level: 1.1 - Experimental (Active Development) |
Arguments
|
|
compliance -
EndpointCompliance
|
The state of the endpoint's compliance with security policies. Use of this field requires the Comply solution. Stability Level: 3 - Stable |
discover -
EndpointDiscover
|
The Discover details. Stability Level: 3 - Stable |
sentinel -
EndpointSentinel!
|
The Microsoft Sentinel details of the endpoint. Use of this field requires the Core Content, Core Content - SCCM solutions. Stability Level: 3 - Stable |
Example
{
"id": 4,
"eidFirstSeen": "10:15:30Z",
"eidLastSeen": "10:15:30Z",
"namespace": "abc123",
"computerID": "xyz789",
"systemUUID": "xyz789",
"name": "abc123",
"domainName": "xyz789",
"serialNumber": "xyz789",
"manufacturer": "xyz789",
"model": "xyz789",
"ipAddress": "xyz789",
"ipAddresses": ["abc123"],
"macAddresses": ["abc123"],
"primaryUser": EndpointUser,
"lastLoggedInUser": "abc123",
"isVirtual": true,
"isEncrypted": true,
"chassisType": "xyz789",
"os": EndpointOS,
"disks": [EndpointDisk],
"memory": Memory,
"processor": Processor,
"networking": Networking,
"eventCounts": EndpointEventCounts,
"services": [EndpointService],
"installedApplications": [EndpointInstalledApplication],
"deployedSoftwarePackages": [
EndpointDeploySoftwarePackage
],
"sensorReadings": EndpointSensorReadings,
"sensorReading": EndpointSensorReading,
"compliance": EndpointCompliance,
"discover": EndpointDiscover,
"sentinel": EndpointSentinel
}
EndpointAlert
Description
A performance alert triggered on an endpoint.
Fields
| Field Name | Description |
|---|---|
schema -
Int!
|
Stability Level: 3 - Stable |
key -
String
|
Stability Level: 3 - Stable |
type -
String
|
Stability Level: 3 - Stable |
ref -
String
|
Stability Level: 3 - Stable |
topProcessesExpr -
String
|
Stability Level: 3 - Stable |
labels -
Map
|
Stability Level: 3 - Stable |
pendingAt -
Time
|
Stability Level: 3 - Stable |
start -
Time
|
Stability Level: 3 - Stable |
resolvedAt -
Time
|
Stability Level: 3 - Stable |
leadup -
Int
|
Stability Level: 3 - Stable |
value -
Float
|
Stability Level: 3 - Stable |
firing -
Boolean
|
Stability Level: 3 - Stable |
evidenceToGather -
[String!]
|
Stability Level: 3 - Stable |
evidence -
[EndpointAlertEvidence!]
|
Stability Level: 3 - Stable |
Example
{
"schema": 123,
"key": "xyz789",
"type": "abc123",
"ref": "abc123",
"topProcessesExpr": "xyz789",
"labels": Map,
"pendingAt": "10:15:30Z",
"start": "10:15:30Z",
"resolvedAt": "10:15:30Z",
"leadup": 123,
"value": 123.45,
"firing": false,
"evidenceToGather": ["abc123"],
"evidence": [EndpointAlertEvidence]
}
EndpointAlertEvidence
Description
Evidence collected as part of a performance alert on an endpoint.
Fields
| Field Name | Description |
|---|---|
name -
String
|
Stability Level: 3 - Stable |
value -
String
|
Stability Level: 3 - Stable |
values -
[EndpointAlertEvidenceValues]
|
Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"value": "abc123",
"values": [EndpointAlertEvidenceValues]
}
EndpointAlertEvidenceValues
EndpointCollectionInfo
Description
Information about the endpoint results that populate an EndpointConnection.
Fields
| Field Name | Description |
|---|---|
active -
Boolean!
|
Indicates results may still continue to accumulate in the underlying collection, and you may refresh the cursor if the paginated results are insufficient. Stability Level: 3 - Stable |
success -
Boolean!
|
Indicates the results in the paginated connection satisfy the criteria specified by the query's data source argument. See Stability Level: 3 - Stable |
expectedTotal -
Int
|
The number of endpoints expected to evaluate the query, if available. Note that not all of these endpoints might actually contribute to the results, and that this total might be smaller or larger than the total number of endpoints that responded. Stability Level: 3 - Stable |
respondedTotal -
Int
|
The number of endpoints that have evaluated the query, if known. Stability Level: 3 - Stable |
contributedTotal -
Int!
|
The number of endpoints that have contributed results to the query. This is a subset of the Stability Level: 3 - Stable |
respondedPercentage -
Float
|
The number of endpoints that have evaluated the query divided by the number of endpoints expected to evaluate the query. This is equivalent to Stability Level: 3 - Stable |
startCursor -
Cursor
|
The cursor for the beginning of the collection. This will be populated even if the collection is empty, as long as the collection has the possibility of being refreshed with new results. To use it, pass it as the Stability Level: 3 - Stable |
question -
EndpointQuestion
|
Information about the question used to implement this query, if one was used. This is returned only for queries using the Tanium Server data source. This is null for queries using the Tanium Data Service data source. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"active": true,
"success": false,
"expectedTotal": 987,
"respondedTotal": 987,
"contributedTotal": 123,
"respondedPercentage": 987.65,
"startCursor": Cursor,
"question": EndpointQuestion
}
EndpointCompliance
Description
The state of an endpoint's compliance with security policies.
Fields
| Field Name | Description |
|---|---|
cveFindings -
[EndpointComplianceCveFinding!]
|
The list of all vulnerability findings on the endpoint. This field allows a filter argument. You can use the filter to restrict the items returned in this field. This also restricts the returned endpoints to those with matching items in this field, unless the The filter must be either a simple filter, or a compound filter with a single set of simple child filters. An endpoint is returned only if it matches the simple filter, or all filters within the compound filter. The filter supports the following operations: Note that the absoluteFirstFoundDate, firstFound, lastFound, and lastScanDate fields are not supported in the filter. Sensor: Comply - CVE Findings Virtual Sensor: Comply - Vulnerability Findings Details, Column: Check ID Stability Level: 3 - Stable |
Arguments
|
|
complianceFindings -
[EndpointComplianceComplianceFinding!]
|
The list of all compliance findings on the endpoint. This field allows a filter argument. You can use the filter to restrict the items returned in this field. This also restricts the returned endpoints to those with matching items in this field, unless the The filter must be either a simple filter, or a compound filter with a single set of simple child filters. An endpoint is returned only if it matches the simple filter, or all filters within the compound filter. The filter supports the following operations: Note that the firstFoundDate and lastScanDate fields are not supported in the filter. Sensor: Comply - Compliance Findings Virtual Sensor: Comply - Compliance Findings Details, Column: Check ID Stability Level: 3 - Stable |
Arguments
|
|
Example
{
"cveFindings": [EndpointComplianceCveFinding],
"complianceFindings": [
EndpointComplianceComplianceFinding
]
}
EndpointComplianceComplianceFinding
Description
A compliance issue found on an endpoint.
Fields
| Field Name | Description |
|---|---|
id -
String
|
The ID of the compliance finding. Sensor: Comply - Compliance Findings, Column: Check ID Virtual Sensor: Comply - Compliance Findings Details, Column: Check ID Stability Level: 3 - Stable |
excepted -
Boolean
|
Indicates whether the finding is an excepted finding. Virtual Sensor: Comply - Compliance Findings Details, Column: Excepted Stability Level: 1.2 - Experimental (Release Candidate) |
state -
String
|
The state of the compliance issue. Sensor: Comply - Compliance Findings, Column: State Virtual Sensor: Comply - Compliance Findings Details, Column: State Stability Level: 3 - Stable |
category -
String
|
The category of the compliance issue. Sensor: Comply - Compliance Findings, Column: Category Virtual Sensor: Comply - Compliance Findings Details, Column: Category Stability Level: 3 - Stable |
ruleId -
String
|
The ID of the rule violated by the compliance issue. Sensor: Comply - Compliance Findings, Column: Rule ID Virtual Sensor: Comply - Compliance Findings Details, Column: Rule ID Stability Level: 3 - Stable |
standard -
String
|
The standard violated by the compliance issue. Sensor: Comply - Compliance Findings, Column: Standard Virtual Sensor: Comply - Compliance Findings Details, Column: Standard Stability Level: 3 - Stable |
standardVersion -
String
|
The version of the standard violated by the compliance issue. Sensor: Comply - Compliance Findings, Column: Standard Version Virtual Sensor: Comply - Compliance Findings Details, Column: Standard Version Stability Level: 3 - Stable |
profile -
String
|
The profile violated by the compliance issue. Sensor: Comply - Compliance Findings, Column: Profile Virtual Sensor: Comply - Compliance Findings Details, Column: Profile Stability Level: 3 - Stable |
profileVersion -
String
|
The version of the profile violated by the compliance issue. Sensor: Comply - Compliance Findings, Column: Profile Version Virtual Sensor: Comply - Compliance Findings Details, Column: Profile Version Stability Level: 3 - Stable |
rule -
String
|
The rule violated by the compliance issue. Sensor: Comply - Compliance Findings, Column: Rule Virtual Sensor: Comply - Compliance Findings Details, Column: Rule Stability Level: 3 - Stable |
firstFoundDate -
Date
|
The date on which the compliance issue was first found on the endpoint. If the compliance finding state changes, this updates to the new discovery date. Sensor: Comply - Compliance Findings - First Found, Column: First Found - Date Sensor: Comply - Compliance Findings - First Found, Column: First Found - Check ID Stability Level: 3 - Stable |
lastScanDate -
Date
|
The date on which the compliance issue was last scanned for on the endpoint. Sensor: Comply - Compliance Findings - Last Scan, Column: Last Scan - Date Sensor: Comply - Compliance Findings - Last Scan, Column: Last Scan - Check ID Stability Level: 3 - Stable |
Example
{
"id": "abc123",
"excepted": true,
"state": "abc123",
"category": "abc123",
"ruleId": "abc123",
"standard": "xyz789",
"standardVersion": "xyz789",
"profile": "xyz789",
"profileVersion": "abc123",
"rule": "abc123",
"firstFoundDate": "2007-12-03",
"lastScanDate": "2007-12-03"
}
EndpointComplianceCveFinding
Description
A vulnerability finding on an endpoint.
Fields
| Field Name | Description |
|---|---|
cveId -
String
|
The ID of the CVE. Sensor: Comply - CVE Findings, Column: Check ID Virtual Sensor: Comply - Vulnerability Findings Details, Column: Check ID Stability Level: 3 - Stable |
excepted -
Boolean
|
Indicates whether the finding is an excepted finding. Virtual Sensor: Comply - Vulnerability Findings Details, Column: Excepted Stability Level: 1.2 - Experimental (Release Candidate) |
scanType -
String
|
The method used to discover the finding. Examples: ras, sbom, oval Virtual Sensor: Comply - Vulnerability Findings Details, Column: Scan Type Stability Level: 1.2 - Experimental (Release Candidate) |
cvssScore -
Float
|
The CVSS v2 score of the CVE. Sensor: Comply - CVE Findings, Column: CVSS Score Virtual Sensor: Comply - Vulnerability Findings Details, Column: CVSS Score Stability Level: 3 - Stable |
severity -
String
|
The CVSS v2 severity of the CVE. Sensor: Comply - CVE Findings, Column: Severity Virtual Sensor: Comply - Vulnerability Findings Details, Column: Severity Stability Level: 3 - Stable |
cvssScoreV3 -
Float
|
The CVSS v3 score of the CVE. Sensor: Comply - CVE Findings, Column: CVSS v3 Base Score Virtual Sensor: Comply - Vulnerability Findings Details, Column: CVSS v3 Base Score Stability Level: 3 - Stable |
severityV3 -
String
|
The CVSS v3 severity of the CVE. Sensor: Comply - CVE Findings, Column: CVSS v3 Severity Virtual Sensor: Comply - Vulnerability Findings Details, Column: CVSS v3 Severity Stability Level: 3 - Stable |
cveYear -
String
|
The year in which the CVE ID was reserved, or the year in which the CVE became public. Sensor: Comply - CVE Findings, Column: CVE Year Virtual Sensor: Comply - Vulnerability Findings Details, Column: CVE Year Stability Level: 3 - Stable |
summary -
String
|
A brief summary of the CVE. Sensor: Comply - CVE Findings, Column: Summary Virtual Sensor: Comply - Vulnerability Findings Details, Column: Summary Stability Level: 3 - Stable |
firstFound -
Date
|
The date on which the CVE was first found on the endpoint. If the CVE is remediated, then detected on this endpoint at a later date, the date updates to the later detection date. Sensor: Comply - CVE Findings - First Found, Column: First Found - Date Sensor: Comply - CVE Findings - First Found, Column: First Found - CVE Stability Level: 3 - Stable |
lastFound -
Date
|
The date on which the CVE was last found on the endpoint. Sensor: Comply - CVE Findings - Last Found, Column: Last Found - Date Sensor: Comply - CVE Findings - Last Found, Column: Last Found - CVE Stability Level: 3 - Stable |
absoluteFirstFoundDate -
Date
|
The date on which the CVE was first found on the endpoint. If the CVE is remediated, then detected on this endpoint at a later date, this date does not change. Sensor: Comply - CVE Findings - Absolute First Found, Column: Absolute First Found - Date Sensor: Comply - CVE Findings - Absolute First Found, Column: Absolute First Found - CVE Stability Level: 3 - Stable |
lastScanDate -
Date
|
The date on which the CVE was last scanned for on the endpoint. Sensor: Comply - CVE Findings - Last Scan, Column: Last Scan - Date Sensor: Comply - CVE Findings - Last Scan, Column: Last Scan - CVE Stability Level: 3 - Stable |
isCisaKev -
Boolean
|
Indicates whether the CVE is included in the CISA Known Exploited Vulnerabilities (KEV) catalog. Virtual Sensor: Comply - Vulnerability Findings Details, Column: Is CISA KEV Stability Level: 1.2 - Experimental (Release Candidate) |
cisaVendor -
String
|
The vendor or project name associated with the vulnerability. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CISA Vendor Stability Level: 1.2 - Experimental (Release Candidate) |
cisaProduct -
String
|
The product associated with the vulnerability. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CISA Product Stability Level: 1.2 - Experimental (Release Candidate) |
cisaVulnerabilityName -
String
|
The vulnerability name. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CISA Vulnerability Name Stability Level: 1.2 - Experimental (Release Candidate) |
cisaDateAdded -
Date
|
The date the vulnerability was added to the CISA KEV catalog. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CISA Date Added Stability Level: 1.2 - Experimental (Release Candidate) |
cisaShortDescription -
String
|
A short description of the vulnerability. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CISA Short Description Stability Level: 1.2 - Experimental (Release Candidate) |
cisaRequiredAction -
String
|
The action listed to address the vulnerability. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CISA Required Action Stability Level: 1.2 - Experimental (Release Candidate) |
cisaDueDate -
Date
|
The due date for taking the action listed. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CISA Due Date Stability Level: 1.2 - Experimental (Release Candidate) |
cisaNotes -
String
|
Additional notes about the vulnerability. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CISA Notes Stability Level: 1.2 - Experimental (Release Candidate) |
cpes -
[String!]
|
A list of Common Platform Enumerations (CPE) for this CVE. Virtual Sensor: Comply - Vulnerability Findings Details, Column: CPEs Stability Level: 1.2 - Experimental (Release Candidate) |
affectedProducts -
[String!]
|
A list of products that this CVE is known to affect. These products might not be installed on the endpoint. Virtual Sensor: Comply - Vulnerability Findings Details, Column: Products Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"cveId": "xyz789",
"excepted": true,
"scanType": "xyz789",
"cvssScore": 987.65,
"severity": "xyz789",
"cvssScoreV3": 987.65,
"severityV3": "xyz789",
"cveYear": "xyz789",
"summary": "abc123",
"firstFound": "2007-12-03",
"lastFound": "2007-12-03",
"absoluteFirstFoundDate": "2007-12-03",
"lastScanDate": "2007-12-03",
"isCisaKev": true,
"cisaVendor": "abc123",
"cisaProduct": "abc123",
"cisaVulnerabilityName": "abc123",
"cisaDateAdded": "2007-12-03",
"cisaShortDescription": "xyz789",
"cisaRequiredAction": "abc123",
"cisaDueDate": "2007-12-03",
"cisaNotes": "xyz789",
"cpes": ["xyz789"],
"affectedProducts": ["abc123"]
}
EndpointConnection
Description
A page of endpoint edges.
Fields
| Field Name | Description |
|---|---|
edges -
[EndpointEdge!]!
|
The list of endpoint edges. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the endpoint collection. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of endpoint records available. Stability Level: 3 - Stable |
collectionInfo -
EndpointCollectionInfo!
|
Information about the endpoint results that contribute to the collection. Stability Level: 3 - Stable |
Example
{
"edges": [EndpointEdge],
"pageInfo": PageInfo,
"totalRecords": 987,
"collectionInfo": EndpointCollectionInfo
}
EndpointCountColumn
Description
A sensor column and value associated with an endpoint count.
Fields
| Field Name | Description |
|---|---|
sensor -
EndpointSensorReadingRef!
|
The sensor with which an endpoint count is associated. This sensor is one of the sensors defined in Stability Level: 1.0 - Experimental (Early Development) |
columnName -
String!
|
The sensor column name associated with the sensor if its a multi-column sensor. For a single-column sensor, this field denotes the sensorName. Examples: Name, Version, FileExists Stability Level: 1.0 - Experimental (Early Development) |
values -
[String!]!
|
The values associated with Requests might return an array of field values for a given column. For example, if you define the Installed Applications sensor in Examples: Windows 10 Enterprise, example_hostname, 1.2.10,1.3.5,1.5.18 Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"sensor": EndpointSensorReadingRef,
"columnName": "xyz789",
"values": ["abc123"]
}
EndpointCountRow
Description
An endpoint count that matches sensor column values.
Fields
| Field Name | Description |
|---|---|
columns -
[EndpointCountColumn!]!
|
The sensor columns and values associated with a count of endpoints matching these values. Stability Level: 1.0 - Experimental (Early Development) |
count -
Int!
|
The count of endpoints that match this set of sensor columns and values. Stability Level: 1.0 - Experimental (Early Development) |
Example
{"columns": [EndpointCountColumn], "count": 123}
EndpointCountsCollectionInfo
Description
Information about the endpoint count results that populate an EndpointCountsConnection.
Fields
| Field Name | Description |
|---|---|
active -
Boolean!
|
Indicates counts might continue to increase in the underlying data, and you can refresh the cursor if the paginated results are insufficient. Stability Level: 1.0 - Experimental (Early Development) |
success -
Boolean!
|
Indicates the results in the paginated connection satisfy the criteria specified by the query's data source argument. See Stability Level: 1.0 - Experimental (Early Development) |
expectedTotal -
Int
|
The number of endpoints expected to evaluate the query, if available. Note that not all of these endpoints might actually contribute to the results, and that this total might be smaller or larger than the total number of endpoints that responded. Stability Level: 1.0 - Experimental (Early Development) |
respondedTotal -
Int
|
The number of endpoints that have evaluated the query, if known. Stability Level: 1.0 - Experimental (Early Development) |
contributedTotal -
Int!
|
The number of endpoints that have contributed results to the query. This is a subset of the Stability Level: 1.0 - Experimental (Early Development) |
respondedPercentage -
Float
|
The number of endpoints that have evaluated the query divided by the number of endpoints expected to evaluate the query. This is equivalent to Stability Level: 1.0 - Experimental (Early Development) |
startCursor -
Cursor
|
The cursor for the beginning of the collection. This will be populated even if the collection is empty, as long as the collection has the possibility of being refreshed with new results. To use it, pass it as the Stability Level: 1.0 - Experimental (Early Development) |
question -
EndpointQuestion
|
Information about the question used to implement this query, if one was used. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"active": true,
"success": false,
"expectedTotal": 123,
"respondedTotal": 987,
"contributedTotal": 987,
"respondedPercentage": 123.45,
"startCursor": Cursor,
"question": EndpointQuestion
}
EndpointCountsConnection
Description
A page of endpoint count edges.
Fields
| Field Name | Description |
|---|---|
edges -
[EndpointCountsEdge!]!
|
The list of endpoint count edges. Stability Level: 1.0 - Experimental (Early Development) |
pageInfo -
PageInfo!
|
Information about the endpoint count collection. Stability Level: 1.0 - Experimental (Early Development) |
totalRecords -
Int!
|
The total number of endpoint count records available. Stability Level: 1.0 - Experimental (Early Development) |
collectionInfo -
EndpointCountsCollectionInfo!
|
Information about the endpoint count results that contribute to the collection. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"edges": [EndpointCountsEdge],
"pageInfo": PageInfo,
"totalRecords": 123,
"collectionInfo": EndpointCountsCollectionInfo
}
EndpointCountsEdge
Description
An endpoint count within a page.
Fields
| Field Name | Description |
|---|---|
node -
EndpointCountRow!
|
The endpoint count row. Stability Level: 1.0 - Experimental (Early Development) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"node": EndpointCountRow,
"cursor": Cursor
}
EndpointCountsInput
Description
A request to retrieve the count of endpoints matching the input sensor column values.
Fields
| Input Field | Description |
|---|---|
after -
Cursor
|
Returns the endpoint counts after the given cursor. Stability Level: 1.0 - Experimental (Early Development) |
first -
Int!
|
Returns up to the first n endpoint counts from the list. This has a maximum value of 1,000. Stability Level: 1.0 - Experimental (Early Development) |
before -
Cursor
|
Returns the endpoint counts before the given cursor. Stability Level: 1.0 - Experimental (Early Development) |
last -
Int
|
Returns up to the last
n endpoint counts from the list. This must be given if Stability Level: 1.0 - Experimental (Early Development) |
filter -
EndpointFieldFilter
|
Returns only endpoint counts including endpoints matching this filter. The Stability Level: 1.0 - Experimental (Early Development) |
sensors -
[EndpointSensorRef!]!
|
Defines which sensors are selected as the basis for the endpoint counts. The Stability Level: 1.0 - Experimental (Early Development) |
source -
EndpointCountsSource!
|
Describes the data source from which to retrieve the endpoint counts. The Stability Level: 1.0 - Experimental (Early Development) |
refresh -
Cursor
|
Refreshes the endpoint counts collection identified by the given cursor, if possible. If so, this will invalidate the collection identified by the given cursor and return a new collection with new cursor values. Otherwise, the existing collection will remain available. This accepts a cursor returned by the This is primarily intended for use with the Tanium Server data source, where endpoint sensor readings might accumulate for up to ten minutes after the original query response. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"after": Cursor,
"first": 123,
"before": Cursor,
"last": 123,
"filter": EndpointFieldFilter,
"sensors": [EndpointSensorRef],
"source": EndpointCountsSource,
"refresh": Cursor
}
EndpointCountsSource
Description
The data source from which to retrieve endpoints for the endpointCounts query.
Fields
| Input Field | Description |
|---|---|
ts -
EndpointSourceTS!
|
The Tanium Server data source. Stability Level: 1.0 - Experimental (Early Development) |
Example
{"ts": EndpointSourceTS}
EndpointDeploySoftwarePackage
Description
A Deploy software package that is deployed or deployable on an endpoint.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The ID of the software package. Sensor: Deploy - Software Packages, Column: Software Package ID Use of this field requires the Deploy solution. Stability Level: 3 - Stable |
vendor -
String!
|
The name of the software vendor that produced the package. Sensor: Deploy - Software Packages, Column: Vendor Use of this field requires the Deploy solution. Stability Level: 3 - Stable |
name -
String!
|
The name of the software package. Sensor: Deploy - Software Packages, Column: Name Use of this field requires the Deploy solution. Stability Level: 3 - Stable |
version -
String!
|
The version of the software package. Sensor: Deploy - Software Packages, Column: Version Use of this field requires the Deploy solution. Stability Level: 3 - Stable |
gallery -
String!
|
If Examples: Yes, No Sensor: Deploy - Software Packages, Column: Is Gallery Package Use of this field requires the Deploy solution. Stability Level: 3 - Stable |
applicability -
String!
|
Indicates the applicability of the software package to the endpoint. Examples: Installed, Install Eligible, Not Applicable Sensor: Deploy - Software Packages, Column: Applicability Use of this field requires the Deploy solution. Stability Level: 3 - Stable |
Example
{
"id": 4,
"vendor": "abc123",
"name": "abc123",
"version": "abc123",
"gallery": "xyz789",
"applicability": "abc123"
}
EndpointDiscover
Description
The details found by Discover.
Fields
| Field Name | Description |
|---|---|
discoverMethod -
String
|
The Discover Method Name. Example: ping Virtual Sensor: Discover Method Use of this field requires the Discover solution. Stability Level: 3 - Stable |
discoverProfile -
String
|
The Discover Method Profile. Example: Distributed Ping Virtual Sensor: Discover Profile Use of this field requires the Discover solution. Stability Level: 3 - Stable |
natIpAddress -
String
|
The IP Address of this client as seen from the Tanium Server. Example: 192.168.1.1 Sensor: NAT IP Address Use of this field requires the Discover solution. Stability Level: 3 - Stable |
openPorts -
[Int!]
|
The top 1000 (according to Nmap) open TCP ports. Examples: 1234, 2345 Sensor: Open Ports Use of this field requires the Discover solution. Stability Level: 3 - Stable |
Example
{
"discoverMethod": "xyz789",
"discoverProfile": "xyz789",
"natIpAddress": "xyz789",
"openPorts": [123]
}
EndpointDisk
Description
The disk space details of a volume.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The disk drive name. Sensor: Disk Total Space Stability Level: 3 - Stable |
free -
String
|
The amount of free disk space per drive. Example: 40 GB Sensor: Disk Free Space Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
total -
String
|
The amount of total disk space per drive. Example: 100 GB Sensor: Disk Total Space Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
usedPercentage -
String
|
The percentage of used disk space per drive. Example: 24% Sensor: Disk Used Percentage Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
usedSpace -
String
|
The amount of used disk space per drive. Example: 40 GB Sensor: Disk Used Space Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"free": "xyz789",
"total": "xyz789",
"usedPercentage": "xyz789",
"usedSpace": "xyz789"
}
EndpointEdge
EndpointEventCounts
Description
The number of performance events on an endpoint.
Fields
| Field Name | Description |
|---|---|
cpu -
Int!
|
The number of CPU performance events on the endpoint in the last 24 hours. Sensor: Performance - Event Category Match Count Use of this field requires the Performance solution. Stability Level: 3 - Stable |
memory -
Int!
|
The number of memory performance events on the endpoint in the last 24 hours. Sensor: Performance - Event Category Match Count Use of this field requires the Performance solution. Stability Level: 3 - Stable |
disk -
Int!
|
The number of disk performance events on the endpoint in the last 24 hours. Sensor: Performance - Event Category Match Count Use of this field requires the Performance solution. Stability Level: 3 - Stable |
network -
Int!
|
The count of network performance events on the endpoint in the last 24 hours. Sensor: Performance - Event Category Match Count Use of this field requires the Performance solution. Stability Level: 3 - Stable |
appCrash -
Int!
|
The count of application crash performance events on the endpoint in the last 24 hours. Sensor: Performance - Event Category Match Count Use of this field requires the Performance solution. Stability Level: 3 - Stable |
all -
Int!
|
The count of all performance events on the endpoint in the last 24 hours. Sensor: Performance - Event Category Match Count Use of this field requires the Performance solution. Stability Level: 3 - Stable |
Example
{
"cpu": 987,
"memory": 123,
"disk": 123,
"network": 987,
"appCrash": 987,
"all": 123
}
EndpointFieldFilter
Description
Describes a filter for endpoint field values. Records with field values matching the filter are included in the query results. Field filters may be single or compound, and have different argument requirements. Any filter that is not valid causes the query to return an error.
Simple filters have three distinct forms:
path,value, andopproperties describe a filter on the value of a field in the schemasensor,value, andopproperties describe a filter on the value of an arbitrary sensor readingmemberOfproperty describes a filter to a computer group
Compound filters have a single form:
filters, andanyproperties
Fields
| Input Field | Description |
|---|---|
path -
String
|
The dot notation path to the field to filter, such as "cpu.manufacturer", where the field on which the filter argument is declared is the root of the path. If the path does not resolve to a field, the query returns an error. Stability Level: 3 - Stable |
maxAge -
Int
|
This value overrides the sensor default maximum age setting. Setting this value lower than the sensor default maximum age setting increases resource usage on endpoints. Setting this value to very small periods of time might cause excessive resource usage on endpoints and frequent sensor evaluation. This is only applicable with the Tanium Server data source. For more information, see Tanium Console User Guide: Max Sensor Age Stability Level: 3 - Stable |
memberOf -
EndpointFieldFilterComputerGroup
|
The computer group to which the endpoint must belong in order to pass the filter. Stability Level: 3 - Stable |
sensor -
EndpointFieldFilterSensor
|
The sensor whose reading is used as the basis for the filter. Stability Level: 3 - Stable |
op -
FieldFilterOp!
|
The operator by which to compare the specified value to the field value. Note that not all operators are valid for all fields or data sources. If the operator is not valid, the query returns an error. Stability Level: 3 - Stable |
negated -
Boolean!
|
Indicates that the filter is negated. Records with field values matching the filter are excluded from the query results. Stability Level: 3 - Stable |
value -
String
|
The constant value to compare with the field value, expressed as a string. If this value cannot be interpreted as a valid value for the field type, the query returns an error. Stability Level: 3 - Stable |
filters -
[EndpointFieldFilter!]
|
Describes the set of filters which comprise this compound filter. Stability Level: 3 - Stable |
any -
Boolean!
|
Indicates that if any of the filters comprising this compound filter passes, the compound filter passes. This defaults to Stability Level: 3 - Stable |
Example
{
"path": "abc123",
"maxAge": 123,
"memberOf": EndpointFieldFilterComputerGroup,
"sensor": EndpointFieldFilterSensor,
"op": "EQ",
"negated": true,
"value": "xyz789",
"filters": [EndpointFieldFilter],
"any": false
}
EndpointFieldFilterComputerGroup
Description
Identifies the computer group to which an endpoint must belong to be included by a filter.
Define one, and only one, of either name or id. If you define name and id, only the id is used to identify the computer group, and the name is ignored.
Example
{"name": "xyz789", "id": 4}
EndpointFieldFilterSensor
Description
Identifies the sensor whose readings are used as the basis for a filter.
Fields
| Input Field | Description |
|---|---|
name -
String
|
The name of the sensor. Stability Level: 3 - Stable |
column -
String
|
The name of the column of the sensor results, if the sensor returns multiple columns. Stability Level: 3 - Stable |
params -
[EndpointFieldFilterSensorParam!]
|
The values of the parameters to the sensor, if needed. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"column": "xyz789",
"params": [EndpointFieldFilterSensorParam]
}
EndpointFieldFilterSensorParam
EndpointFieldSort
Description
Describes a sort order for endpoint field values. Endpoints will be sorted by the specified field, in the specified order. Any sort that is not valid causes the query to return an error.
Exactly one of path or sensor must be provided.
Fields
| Input Field | Description |
|---|---|
path -
String
|
The dot notation path to the field to sort by, such as "cpu.manufacturer", where the field on which the sort argument is declared is the root of the path. If the path does not resolve to a field, the query returns an error. Examples: computerID, ipAddress, name, processor.consumption Stability Level: 1.2 - Experimental (Release Candidate) |
sensor -
EndpointFieldSortSensor
|
The sensor whose reading is used as the basis for the sort. Stability Level: 1.2 - Experimental (Release Candidate) |
order -
SortOrder!
|
The order in which to sort the field values. Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"path": "xyz789",
"sensor": EndpointFieldSortSensor,
"order": "asc"
}
EndpointFieldSortSensor
Description
Identifies the sensor whose readings are used as the basis for a sort.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The sensor name. Stability Level: 3 - Stable |
column -
String
|
For multi-column sensors, the name of the sensor results column. For single-column sensors, this field must be null. Stability Level: 3 - Stable |
params -
[EndpointFieldFilterSensorParam!]
|
The parameter values to use for a parameterized sensor. For unparameterized sensors, this field must be null. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"column": "abc123",
"params": [EndpointFieldFilterSensorParam]
}
EndpointIdChange
EndpointIdChangesPayload
Description
The endpoint IDs changes.
Fields
| Field Name | Description |
|---|---|
changes -
[EndpointIdChange!]!
|
The list of endpoint ID changes. Stability Level: 3 - Stable |
before -
Time!
|
The date and time of the last record returned. Using this timestamp as the Stability Level: 3 - Stable |
Example
{
"changes": [EndpointIdChange],
"before": "10:15:30Z"
}
EndpointInstalledApplication
Description
A software application installed on an endpoint.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the application. Sensor: Installed Applications, Column: Name Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
version -
String!
|
The version of the application. Sensor: Installed Applications, Column: Version Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
silentUninstallString -
String!
|
The silent uninstall string for the application. Sensor: Installed Applications, Column: Silent Uninstall String Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
uninstallable -
Boolean
|
Indicates whether the application can be uninstalled. Sensor: Installed Applications, Column: Uninstallable Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"version": "xyz789",
"silentUninstallString": "abc123",
"uninstallable": false
}
EndpointMetric
Description
A metric recorded on an endpoint.
Fields
| Field Name | Description |
|---|---|
metric -
EndpointMetricInfo
|
The metric details. Stability Level: 3 - Stable |
value -
Any
|
The value of the metric. This is not yet well-typed. Stability Level: 3 - Stable |
values -
Any
|
The values of the metric. This is not yet well-typed. Stability Level: 3 - Stable |
Example
{
"metric": EndpointMetricInfo,
"value": Any,
"values": Any
}
EndpointMetricInfo
Description
The details of a metric recorded on an endpoint.
Fields
| Field Name | Description |
|---|---|
name -
String
|
The name of the metric. Stability Level: 3 - Stable |
Example
{"name": "xyz789"}
EndpointOS
Description
The operating system details of an endpoint.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the operating system. This name may be localized. Example: Windows Server 2008 R2 Enterprise Sensor: Operating System Stability Level: 3 - Stable |
platform -
EndpointPlatform!
|
The platform of the operating system. Example: Windows Sensor: OS Platform Stability Level: 3 - Stable |
generation -
String!
|
The generation of the operating system. Examples: Windows 10, Windows Server 2008 R2, Red Hat Enterprise Linux Server 6, Mac OS X 10.14 Sensor: Operating System Generation Stability Level: 3 - Stable |
language -
String!
|
The language of the operating system. Example: en-US Sensor: Operating System Language, Column: Language Packs Installed Stability Level: 3 - Stable |
windows -
EndpointWindowsOS
|
The details of the Windows operating system. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"platform": "Unknown",
"generation": "xyz789",
"language": "xyz789",
"windows": EndpointWindowsOS
}
EndpointPlatform
Description
The set of endpoint platforms.
Values
| Enum Value | Description |
|---|---|
|
|
The endpoint platform is unknown. Stability Level: 3 - Stable |
|
|
The endpoint is running Microsoft Windows. Stability Level: 3 - Stable |
|
|
The endpoint is running Linux. Stability Level: 3 - Stable |
|
|
The endpoint is running macOS. Stability Level: 3 - Stable |
|
|
The endpoint is running Oracle Solaris. Stability Level: 3 - Stable |
|
|
The endpoint is running IBM AIX. Stability Level: 3 - Stable |
Example
"Unknown"
EndpointQuestion
Description
An endpoint question.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique question identifier. Stability Level: 3 - Stable |
consoleURL -
String
|
The URL of the Question Results page for this question in the Tanium Console. This value only populates for environments that run in Tanium Cloud. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": "4",
"consoleURL": "xyz789"
}
EndpointSensorReading
Description
The data collected from reading a single sensor column.
The values field always contains the raw string values read by the sensor. Other fields, such as floatValues, might be queried to convert the values to a different type, depending on the sensor's result type. If value type conversion fails, such as if the sensor reads [no results] for an endpoint and the floatValues field is queried, the converted value is null. The original value is available at the same index in the values field. If you convert a sensor value to a data type that is not applicable to the sensor result type, such as a non-numeric sensor value to a floatValues field, the response returns an error.
Fields
| Field Name | Description |
|---|---|
values -
[String!]!
|
The raw values read by the sensor. Stability Level: 3 - Stable |
floatValues -
[Float]
|
The float values read by the sensor. Only valid when the sensor's result type is If value type conversion fails, such as if the sensor reads Stability Level: 3 - Stable |
Example
{
"values": ["abc123"],
"floatValues": [987.65]
}
EndpointSensorReadingColumn
Description
A column collected in a sensor reading.
Fields
| Field Name | Description |
|---|---|
sensor -
EndpointSensorReadingRef!
|
The sensor which provided the column. Stability Level: 3 - Stable |
name -
String!
|
The name of the column. Stability Level: 3 - Stable |
values -
[String!]!
|
The values read by the sensor. Stability Level: 3 - Stable |
Example
{
"sensor": EndpointSensorReadingRef,
"name": "xyz789",
"values": ["abc123"]
}
EndpointSensorReadingRef
Description
Identifies a sensor that was read.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the sensor. Examples: Operating System, Computer Name, Installed Applications Stability Level: 3 - Stable |
params -
[EndpointSensorReadingRefParam!]
|
The parameter values to use for a parameterized sensor. For un-parameterized sensors, this field must be null. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"params": [EndpointSensorReadingRefParam]
}
EndpointSensorReadingRefParam
EndpointSensorReadings
Description
The data collected from reading a set of sensors.
Fields
| Field Name | Description |
|---|---|
columns -
[EndpointSensorReadingColumn!]!
|
The columns collected from reading a set of sensors. Stability Level: 3 - Stable |
Example
{"columns": [EndpointSensorReadingColumn]}
EndpointSensorRef
Description
Identifies a sensor to read.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The name of the sensor. Stability Level: 3 - Stable |
params -
[EndpointSensorRefParam!]
|
The list of sensor parameters. Stability Level: 3 - Stable |
maxAge -
Int
|
This value overrides the sensor default maximum age setting. Setting this value lower than the sensor default maximum age setting increases resource usage on endpoints. Setting this value to very small periods of time might cause excessive resource usage on endpoints and frequent sensor evaluation. This is only applicable with the Tanium Server data source. For more information, see Tanium Console User Guide: Max Sensor Age Stability Level: 3 - Stable |
columns -
[String!]
|
The set of sensor columns to query. If you do not specify any columns, the response contains all sensor columns. Stability Level: 3 - Stable |
filter -
SensorValueFilter
|
Returns only the sensor values matching the filter. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"params": [EndpointSensorRefParam],
"maxAge": 123,
"columns": ["xyz789"],
"filter": SensorValueFilter
}
EndpointSensorRefParam
EndpointSentinel
Description
The Microsoft Sentinel details of an endpoint.
Fields
| Field Name | Description |
|---|---|
sccmClient -
EndpointSentinelSCCMClient!
|
The Microsoft System Center Configuration Manager (SCCM) client details of an endpoint. Use of this field requires the Core Content - SCCM solution. Stability Level: 3 - Stable |
windowsDefender -
EndpointSentinelWindowsDefender!
|
The Microsoft Windows Defender details of an endpoint. Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{
"sccmClient": EndpointSentinelSCCMClient,
"windowsDefender": EndpointSentinelWindowsDefender
}
EndpointSentinelSCCMClient
Description
The Microsoft SCCM client details of an endpoint.
Fields
| Field Name | Description |
|---|---|
health -
String
|
The overall health status of the SCCM client. Examples: Healthy, Needs Attention Sensor: SCCM Client Health, Column: Health Status Use of this field requires the Core Content - SCCM solution. Stability Level: 3 - Stable |
reason -
String
|
The details of an SCCM client health value. Example: SCCM Not Running Sensor: SCCM Client Health, Column: Reason Use of this field requires the Core Content - SCCM solution. Stability Level: 3 - Stable |
Example
{
"health": "xyz789",
"reason": "abc123"
}
EndpointSentinelWindowsDefender
Description
The Microsoft Windows Defender details of an endpoint.
Fields
| Field Name | Description |
|---|---|
installed -
String
|
Indicates that Windows Defender is installed. Examples: True, False Sensor: Microsoft Defender Installed Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
clientVersion -
String
|
The installed version of Windows Defender. Examples: 1.225.2203.0, N/A on Linux Sensor: Microsoft Defender AntiMalware Details, Column: Engine Version Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
healthy -
String
|
The overall health status of Windows Defender. Examples: True, False, Microsoft Defender not installed Sensor: Microsoft Defender Health Details, Column: Healthy Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
processEnabled -
String
|
The current state of the Windows Defender process. Examples: , True, False, Unknown Sensor: Microsoft Defender AntiMalware Details, Column: Service Enabled Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
processStartType -
String
|
The startup type of the Windows Defender process. Examples: , Normal, Passive Mode Sensor: Microsoft Defender AntiMalware Details, Column: Service State Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
antivirusEnabled -
String
|
The current state of the Windows Defender antivirus service. Examples: True, False, Unknown, N/A on Linux Sensor: Microsoft Defender AntiVirus Details, Column: Service Enabled Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
antiSpywareEnabled -
String
|
The current state of the Windows Defender antispyware service. Examples: True, False, Unknown, N/A on Linux Sensor: Microsoft Defender AntiSpyware Details, Column: Service Enabled Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
quickScanAge -
String
|
The number of days since the last quick scan. Returns Examples: -1, 0, 2, N/A on Linux Sensor: Microsoft Defender QuickScan Details, Column: Age Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
antivirusSignatureUpdateAge -
String
|
The number of days since the last antivirus signatures update. Returns Examples: -1, 0, 2 Sensor: Microsoft Defender AntiVirus Details, Column: Signature Days Age Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{
"installed": "xyz789",
"clientVersion": "abc123",
"healthy": "abc123",
"processEnabled": "abc123",
"processStartType": "xyz789",
"antivirusEnabled": "xyz789",
"antiSpywareEnabled": "xyz789",
"quickScanAge": "abc123",
"antivirusSignatureUpdateAge": "abc123"
}
EndpointService
Description
The details of a service on an endpoint.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The internal name of the service. Sensor: Service Details, Column: Service Name Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
displayName -
String!
|
The display name of the service. Sensor: Service Details, Column: Service Display Name Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
status -
EndpointServiceStatus
|
The current status of the service. Sensor: Service Details, Column: Service Status Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
startupMode -
EndpointServiceStartupMode
|
The startup mode of the service. Sensor: Service Details, Column: Service Startup Mode Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{
"name": "xyz789",
"displayName": "abc123",
"status": "CONTINUE_PENDING",
"startupMode": "MANUAL"
}
EndpointServiceStartupMode
Description
The set of service startup modes.
Values
| Enum Value | Description |
|---|---|
|
|
The service is started by the service control manager when a process calls the Stability Level: 3 - Stable |
|
|
The service is started automatically by the service control manager during system startup. Stability Level: 3 - Stable |
|
|
The service can no longer be started. Stability Level: 3 - Stable |
|
|
The service is a device driver started by the operating system loader. Stability Level: 3 - Stable |
|
|
The service is a device driver started by the operating system initialization process. Stability Level: 3 - Stable |
|
|
The service is started manually or when required by another service. Stability Level: 3 - Stable |
Example
"MANUAL"
EndpointServiceStatus
Description
The status of a service on an endpoint.
Values
| Enum Value | Description |
|---|---|
|
|
The service has been paused and is about to continue. Stability Level: 3 - Stable |
|
|
The service is paused. Stability Level: 3 - Stable |
|
|
The service is in the process of pausing. Stability Level: 3 - Stable |
|
|
The service is running. Stability Level: 3 - Stable |
|
|
The service is in the process of starting. Stability Level: 3 - Stable |
|
|
The service is not running. Stability Level: 3 - Stable |
|
|
The service is in the process of stopping. Stability Level: 3 - Stable |
Example
"CONTINUE_PENDING"
EndpointSource
Description
The data source from which to retrieve endpoints. The default source is the Tanium Data Service in the standard Tanium endpoint namespace.
You can only specify one data source.
Fields
| Input Field | Description |
|---|---|
tds -
EndpointSourceTDS
|
The Tanium Data Service data source. Stability Level: 3 - Stable |
ts -
EndpointSourceTS
|
The Tanium Server data source. Stability Level: 3 - Stable |
Example
{
"tds": EndpointSourceTDS,
"ts": EndpointSourceTS
}
EndpointSourceTDS
Description
Specifies the use of the Tanium Data Service as the source of endpoints.
Fields
| Input Field | Description |
|---|---|
allNamespaces -
Boolean!
|
If Stability Level: 3 - Stable |
namespaces -
[String!]
|
Returns endpoints within the given namespaces. If Stability Level: 3 - Stable |
excludeErrors -
Boolean!
|
Excludes all endpoints that contain common error values in any requested sensor data. Stability Level: 3 - Stable |
excludeNoResults -
Boolean!
|
Excludes all endpoints that contain Stability Level: 3 - Stable |
Example
{
"allNamespaces": false,
"namespaces": ["xyz789"],
"excludeErrors": true,
"excludeNoResults": false
}
EndpointSourceTS
Description
Specifies the use of a Tanium Server question as the source of endpoints. This waits for question results until any of the success criteria are met or the maximum wait time for a single request has elapsed. The success criteria are not guaranteed to be met. Users might check the collectionInfo field to observe the completeness of the results and might use the refresh argument to try to retrieve more results.
Fields
| Input Field | Description |
|---|---|
expectedCount -
Int
|
The number of endpoints for which to wait. Stability Level: 3 - Stable |
stableWaitTime -
Int
|
The number of seconds to wait for the Tanium Server to not receive new endpoint results. Stability Level: 3 - Stable |
maxWaitTime -
Int!
|
The total number of seconds to wait before returning a response with the available results, regardless of whether the results satisfy any success criteria. This cannot exceed 30 seconds. Stability Level: 3 - Stable |
minPercentage -
Float
|
The minimum fraction of expected endpoints that must have evaluated the question in order for the results to be considered successful. This must be a number between Stability Level: 3 - Stable |
maxAge -
Int
|
This value overrides the sensor default maximum age setting. Setting this value lower than the sensor default maximum age setting increases resource usage on endpoints. Setting this value to very small periods of time might cause excessive resource usage on endpoints and frequent sensor evaluation. This is only applicable with the Tanium Server data source. For more information, see Tanium Console User Guide: Max Sensor Age Stability Level: 3 - Stable |
excludeErrors -
Boolean!
|
Excludes all endpoints that contain common error values in any requested sensor data. Stability Level: 3 - Stable |
excludeNoResults -
Boolean!
|
Excludes all endpoints that contain Stability Level: 3 - Stable |
Example
{
"expectedCount": 987,
"stableWaitTime": 987,
"maxWaitTime": 123,
"minPercentage": 123.45,
"maxAge": 987,
"excludeErrors": true,
"excludeNoResults": true
}
EndpointTargeting
Description
The evaluation used to target endpoints for Tanium interaction.
Example
{"id": "4", "isRoot": false}
EndpointUser
Description
The details of an endpoint user.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The Active Directory name of the endpoint user. Sensor: AD Query - Primary User Details, Column: Name Use of this field requires the Core AD Query Content solution. Stability Level: 3 - Stable |
email -
String!
|
The Active Directory email of the endpoint user. Sensor: AD Query - Primary User Details, Column: Email Use of this field requires the Core AD Query Content solution. Stability Level: 3 - Stable |
phoneNumber -
String!
|
The Active Directory phone number of the endpoint user. Sensor: AD Query - Primary User Details, Column: Phone Number Use of this field requires the Core AD Query Content solution. Stability Level: 3 - Stable |
department -
String!
|
The Active Directory department of the endpoint user. Sensor: AD Query - Primary User Details, Column: Department Use of this field requires the Core AD Query Content solution. Stability Level: 3 - Stable |
city -
String!
|
The Active Directory city of the endpoint user. Sensor: AD Query - Primary User Details, Column: City Use of this field requires the Core AD Query Content solution. Stability Level: 3 - Stable |
country -
String!
|
The Active Directory country of the endpoint user. Sensor: AD Query - Primary User Details, Column: Country Use of this field requires the Core AD Query Content solution. Stability Level: 3 - Stable |
Example
{
"name": "xyz789",
"email": "abc123",
"phoneNumber": "abc123",
"department": "xyz789",
"city": "abc123",
"country": "abc123"
}
EndpointWindowsOS
Description
The Windows operating system details of an endpoint.
Fields
| Field Name | Description |
|---|---|
type -
String!
|
The type of Windows operating system. Examples: Windows Server, Windows Workstation Sensor: Windows OS Type Stability Level: 3 - Stable |
majorVersion -
String!
|
The major version of the Windows operating system. Example: 6.1 Sensor: Windows OS Major Version Stability Level: 3 - Stable |
releaseId -
String!
|
The release ID of the Windows operating system. Example: 1607 Sensor: Windows OS Release ID Stability Level: 3 - Stable |
Example
{
"type": "abc123",
"majorVersion": "abc123",
"releaseId": "xyz789"
}
FieldFilter
Description
Describes a filter for field values. Records with field values matching the filter are included in the query results. Field filters may be single or compound, and have different argument requirements. Any filter that is not valid causes the query to return an error.
Fields
| Input Field | Description |
|---|---|
path -
String
|
The dot notation path to the field to filter, such as "cpu.manufacturer", where the field on which the filter argument is declared is the root of the path. If the path does not resolve to a field, the query returns an error. This is required for single field filters, and not allowed for compound field filters. Stability Level: 3 - Stable |
op -
FieldFilterOp!
|
The operator by which to compare the specified value to the field value. Note that not all operators are valid for all fields or data sources. If the operator is not valid, the query returns an error. This is required for single field filters, and ignored for compound field filters. Stability Level: 3 - Stable |
negated -
Boolean!
|
Indicates that the filter is negated. Records with field values matching the filter are excluded from the query results. Stability Level: 3 - Stable |
value -
String
|
The constant value to compare with the field value, expressed as a string. If this value cannot be interpreted as a valid value for the field type, the query returns an error. This is required for single field filters, and not allowed for compound field filters. Stability Level: 3 - Stable |
filters -
[FieldFilter!]
|
Describes the set of filters which comprise this compound filter. This is required for compound field filters, and not allowed for single field filters. Stability Level: 3 - Stable |
any -
Boolean!
|
Indicates that if any of the filters comprising this compound filter passes, the compound filter passes. This defaults to This is allowed for compound field filters and ignored for single field filters. Stability Level: 3 - Stable |
restrictOwner -
Boolean!
|
Indicates that the filters should apply to owner records participating in the query, in addition to returned field values. This can be used to exclude records that do not match the filter, or would return an undefined value such as This is ignored for filters at the root level of a query. Stability Level: 3 - Stable |
Example
{
"path": "abc123",
"op": "EQ",
"negated": false,
"value": "xyz789",
"filters": [FieldFilter],
"any": true,
"restrictOwner": true
}
FieldFilterOp
Description
The set of operations permitted on FieldFilter instances.
Values
| Enum Value | Description |
|---|---|
|
|
The equality operator. The field value and specified values must be equal. Stability Level: 3 - Stable |
|
|
The less than operator. The field value must be less than the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
LTE is the less than or equals operator, the field value must be less than or equal to the given value. This is only valid for comparable types. Stability Level: 3 - Stable |
|
|
The greater than operator. The field value must be greater than the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
The greater than or equals operator. The field value must be greater than or equal to the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
The string contains operator. The field value must contain the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string starts with operator. The field value must start with the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string ends with operator. The field value must end with the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string matches operator. The field value must fully match the specified value, which is interpreted as a regular expression in Perl syntax. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The updated after operator. The field value must have been updated after the given date and time. This is only valid for fields from certain data sources. Stability Level: 3 - Stable |
|
|
The read after operator. The field value must have been read after the given date and time. This is only valid for fields from certain data sources. Stability Level: 3 - Stable |
Example
"EQ"
FilterField
Description
The list of endpoint fields on which the assets query can be filtered.
Values
| Enum Value | Description |
|---|---|
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
Example
"INVALID"
FilterMatch
Description
The set of compound operators available on assets query filters.
Values
| Enum Value | Description |
|---|---|
|
|
All sub filters must match. Stability Level: 3 - Stable |
|
|
Any sub filter can match. Stability Level: 3 - Stable |
|
|
The sub filter must not match. Stability Level: 3 - Stable |
Example
"ALL"
FilterOps
Description
The set of operations allowed by the assets query filters.
Values
| Enum Value | Description |
|---|---|
|
|
The equality operator. The field value and specified values must be equal. Stability Level: 3 - Stable |
|
|
The less than operator. The field value must be less than the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
The less than or equals operator. The field value must be less than or equal to the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
The greater than operator. The field value must be greater than the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
The greater than or equals operator. The field value must be greater than or equal to the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
The string contains operator. The field value must contain the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string starts with operator. The field value must start with the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string ends with operator. The field value must end with the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string matches operator. The field value must fully match the specified value, which is interpreted as a regular expression in Perl syntax. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The updated since operator. The field value must have been updated since the specified date and time. This is not valid for live queries. Stability Level: 3 - Stable |
|
|
The last seen operator. The field value must have been read since the specified date and time. This is not valid for live queries. Stability Level: 3 - Stable |
Example
"EQ"
FilterSpec
Description
A filter for the assets query.
Fields
| Input Field | Description |
|---|---|
op -
FilterOps
|
The operator by which to compare the field and the value. Stability Level: 3 - Stable |
field -
FilterField
|
The field on which to filter. Stability Level: 3 - Stable |
value -
String
|
The value by which to filter. Stability Level: 3 - Stable |
match -
FilterMatch
|
The operator by which to combine the sub filters. Stability Level: 3 - Stable |
subs -
[FilterSpec]
|
The list of sub filters. Stability Level: 3 - Stable |
Example
{
"op": "EQ",
"field": "INVALID",
"value": "abc123",
"match": "ALL",
"subs": [FilterSpec]
}
Float
Description
The Float scalar type represents signed double-precision fractional values as specified by
IEEE 754.
Example
123.45
ID
Description
The ID scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "4") or integer (such as 4) input value will be accepted as an ID.
Example
4
IDReference
IDRevisionRefInput
Description
A reference to an entity with an identifier and optional revision number.
Example
{"id": "4", "revision": 123}
IdRef
Description
A reference to an entity with a unique identifier.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique identifier of the referent. Stability Level: 3 - Stable |
Example
{"id": 4}
IdRefInput
Description
A reference to an entity with an identifier.
Fields
| Input Field | Description |
|---|---|
id -
ID!
|
The unique identifier of the referent. Stability Level: 3 - Stable |
Example
{"id": 4}
Int
Description
The Int scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1.
Example
123
KillProcessInput
Description
A request to terminate a process running on an endpoint.
Fields
| Input Field | Description |
|---|---|
connectionID -
ID
|
The ID of the Direct Connect connection to the endpoint on which the process is running. You must specify either this value or Stability Level: 3 - Stable |
endpoint -
OpenDirectConnectionInput
|
The endpoint on which the process is running. You must specify either this value or Stability Level: 3 - Stable |
pid -
Int!
|
The ID of the process to terminate. Stability Level: 3 - Stable |
name -
String!
|
The name of the process to terminate. Stability Level: 3 - Stable |
signal -
Signal!
|
The signal to use when terminating the process. Stability Level: 3 - Stable |
Example
{
"connectionID": "4",
"endpoint": OpenDirectConnectionInput,
"pid": 987,
"name": "xyz789",
"signal": "SIGINT"
}
KillProcessPayload
Description
A response to a request to terminate a process.
Fields
| Field Name | Description |
|---|---|
result -
Boolean!
|
Indicates that the process is terminated. Stability Level: 3 - Stable |
Example
{"result": true}
Map
Description
A map of JSON data.
Example
Map
Memory
Description
The memory details of an endpoint.
Fields
| Field Name | Description |
|---|---|
total -
String!
|
The total physical memory installed in the endpoint. Example: 8000 MB Sensor: Total Memory Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
ram -
String!
|
The total amount of installed memory in the endpoint. Example: 2048 MB Sensor: RAM Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{
"total": "abc123",
"ram": "xyz789"
}
Metadata
Description
Arbitrary data that can be recorded on many Tanium Server entities.
Example
{
"adminFlag": false,
"name": "xyz789",
"value": "xyz789"
}
MonotonicDuration
Description
A time duration which measures from an arbitrary point in time and always moves forward. It does not account for calendar or clock time conventions such as time zones, Daylight Savings Time, leap seconds, etc. The total time duration is calculated by adding together the seconds and nanoseconds values.
Example
{"nanoseconds": 987, "seconds": 987}
MonotonicDurationInput
Description
Input for a time duration which measures from an arbitrary point in time and always moves forward. It does not account for calendar or clock time conventions such as time zones, Daylight Savings Time, leap seconds, etc. The total time duration is calculated by adding together the seconds and nanoseconds values.
Example
{"nanoseconds": 987, "seconds": 123}
NamedOnlyRefInput
Description
A reference to an entity with a name.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The assigned name of the referent. Stability Level: 3 - Stable |
Example
{"name": "xyz789"}
NamedRef
NamedRefInput
Description
A reference to a named entity. Only one identifier field may have a value in a valid reference.
Define one, and only one, of either name or id. If you define name and id, only the id is used to identify the entity, and the name is ignored.
Example
{"id": 4, "name": "abc123"}
NetworkAdapter
Description
The network adapter details of an endpoint.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the network adapter. Example: Intel(R) Centrino(R) Ultimate-N 6300 AGN Sensor: Network Adapter Details, Column: Adapter Name Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
manufacturer -
String!
|
The manufacturer of the network adapter. Example: Intel Corporation Sensor: Network Adapter Details, Column: Manufacturer Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
type -
String!
|
The type of the network adapter. Example: Ethernet 802.3 Sensor: Network Adapter Details, Column: Adapter Type Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
macAddress -
String!
|
The MAC address of the network adapter. Example: 00:24:D7:21:9C:70 Sensor: Network Adapter Details, Column: MAC Address Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
speed -
String!
|
The speed of the network adapter. Example: 65 Mbps Sensor: Network Adapter Details, Column: Speed Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
connectionId -
String!
|
The connection ID of the network adapter. Example: Wi-Fi Sensor: Network Adapter Details, Column: Network Connection ID Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{
"name": "xyz789",
"manufacturer": "xyz789",
"type": "xyz789",
"macAddress": "abc123",
"speed": "abc123",
"connectionId": "abc123"
}
Networking
Description
The networking details of an endpoint.
Fields
| Field Name | Description |
|---|---|
dnsServers -
[String]!
|
The IP addresses of any configured DNS servers for active network adapters. Examples: 192.168.1.1, 8.8.8.8 Sensor: DNS Server Stability Level: 3 - Stable |
adapters -
[NetworkAdapter]!
|
The network adapter details of the endpoint. Stability Level: 3 - Stable |
wirelessAdapters -
[WirelessAdapter]!
|
The wireless network adapter details of the endpoint. Stability Level: 3 - Stable |
Example
{
"dnsServers": ["abc123"],
"adapters": [NetworkAdapter],
"wirelessAdapters": [WirelessAdapter]
}
NumericIntervalOption
Fields
| Field Name | Description |
|---|---|
name -
String!
|
Stability Level: 3 - Stable |
value -
String!
|
Stability Level: 3 - Stable |
model -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
parameterType -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"value": "abc123",
"model": ParameterDefinitionType,
"parameterType": ParameterDefinitionType
}
OpenDirectConnectionInput
Description
A request to open a Direct Connect connection to an endpoint.
Fields
| Input Field | Description |
|---|---|
endpointID -
ID
|
The ID of the endpoint. Stability Level: 3 - Stable |
Example
{"endpointID": "4"}
OpenDirectConnectionPayload
Description
A response to a request to open a Direct Connect connection to an endpoint.
Fields
| Field Name | Description |
|---|---|
connectionID -
ID!
|
A connection ID, used for Direct Connect requests. Stability Level: 3 - Stable |
Example
{"connectionID": "4"}
Package
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique ID of the object. This field is read-only. Stability Level: 3 - Stable |
name -
String!
|
The unique name of this package. Stability Level: 3 - Stable |
displayName -
String!
|
The name of the package that displays in the user interface. Stability Level: 3 - Stable |
command -
String!
|
The command to run. Stability Level: 3 - Stable |
commandTimeout -
Int!
|
The limit on how long the command can run before it terminates. Stability Level: 3 - Stable |
expireSeconds -
Int!
|
The default expiration for any action issued with this package. This value should be greater than commandTimeout. The console interprets the difference between the expireSeconds value and commandTimeout value as "download timeout." Stability Level: 3 - Stable |
contentSet -
IDReference
|
The content set to which this package belongs. Stability Level: 3 - Stable |
processGroupFlag -
Boolean!
|
Indicates that Tanium 7.2+ clients run the package command in a process group, and terminate any remaining descendant processes when the package command completes. Default server value is This should always be Stability Level: 3 - Stable |
skipLockFlag -
Boolean!
|
Indicates that clients can run the package command, even when the client has action locks set. This should almost always be Stability Level: 3 - Stable |
metadata -
[Metadata!]!
|
A set of generic name-value pairs that describe this package. Stability Level: 3 - Stable |
sourceHash -
String!
|
This applies only to derived packages. For source package: the hash representation of current state of the source package, and it can change when certain properties of this package are modified. For non-source package: the hash is copied from the source package at creation time and will not change. Stability Level: 3 - Stable |
sourceHashChangedFlag -
Boolean!
|
Indicates that the derived package is out of sync with the source package. Stability Level: 3 - Stable |
sourceID -
Int!
|
The ID of a source package. Specify this when creating an action with a parameterized package. Stability Level: 3 - Stable |
sourceName -
String!
|
The name of a source package. This field is used by the import and export routes when IDs change. Stability Level: 3 - Stable |
parameters -
[PackageParameter!]!
|
A list of parameters to be used for the package. If you define parameters, you must also specify SourceID. Stability Level: 3 - Stable |
parameterDefinition -
ParameterDefinitions
|
JSON metadata about what data should be sent with parameters, used by the console when deploying packages. Stability Level: 3 - Stable |
rawParameterDefinition -
String
|
The raw parameter definition string, This field is defined only when parsing the parameterDefinition string to the expected JSON format fails. Stability Level: 3 - Stable |
verifyExpireSeconds -
Int!
|
The maximum number of seconds for a package verification query before timeout. Stability Level: 3 - Stable |
Example
{
"id": "4",
"name": "abc123",
"displayName": "xyz789",
"command": "xyz789",
"commandTimeout": 123,
"expireSeconds": 123,
"contentSet": IDReference,
"processGroupFlag": false,
"skipLockFlag": true,
"metadata": [Metadata],
"sourceHash": "xyz789",
"sourceHashChangedFlag": true,
"sourceID": 123,
"sourceName": "xyz789",
"parameters": [PackageParameter],
"parameterDefinition": ParameterDefinitions,
"rawParameterDefinition": "xyz789",
"verifyExpireSeconds": 987
}
PackagePagination
Fields
| Field Name | Description |
|---|---|
items -
[Package]!
|
Stability Level: 3 - Stable |
pageInfo -
PaginationInfoWithID!
|
Stability Level: 3 - Stable |
Example
{
"items": [Package],
"pageInfo": PaginationInfoWithID
}
PackageParam
PackageParamInput
Description
A sensor-sourced input parameter for a package.
Example
{
"name": "xyz789",
"value": "abc123"
}
PackageParameter
PackageRef
Description
A package used in an action.
Fields
| Field Name | Description |
|---|---|
id -
ID
|
The ID of the package. Stability Level: 3 - Stable |
name -
String
|
The name of the package. Stability Level: 3 - Stable |
params -
[String!]
|
The list of package parameter input values. These correspond to the positional package parameter variables ( Stability Level: 3 - Stable |
sensorSourcedParams -
[PackageParam!]
|
The map of sensor-sourced package parameters. These parameters correspond to the Stability Level: 3 - Stable |
Example
{
"id": "4",
"name": "abc123",
"params": ["abc123"],
"sensorSourcedParams": [PackageParam]
}
PackageRefInput
Description
Identifies and parameterizes a package for use in an action.
Define one, and only one, of either name or id. If you define name and id, only the id is used to identify the package, and the name is ignored.
Fields
| Input Field | Description |
|---|---|
id -
ID
|
The ID of the package. Stability Level: 3 - Stable |
name -
String
|
The name of the package. Stability Level: 3 - Stable |
params -
[String!]
|
The list of package parameter input values. These correspond to the positional package parameter variables ( Stability Level: 3 - Stable |
sensorSourcedParams -
[PackageParamInput!]
|
The map of sensor-sourced package parameters. These parameters correspond to the Stability Level: 3 - Stable |
Example
{
"id": "4",
"name": "xyz789",
"params": ["xyz789"],
"sensorSourcedParams": [PackageParamInput]
}
PackageSpec
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique identifier of the package spec. Stability Level: 3 - Stable |
name -
String!
|
The unique name of the package spec. Stability Level: 3 - Stable |
lastUpdatedBy -
String!
|
The name of the user that last modified this entity. Stability Level: 3 - Stable |
contentSetName -
String!
|
The name of the content set assigned to the package. The content set controls access to the package.
Stability Level: 2 - Legacy Use |
contentSet -
TaniumPlatformContentSet
|
The content set assigned to the package. The content set controls access to the package. Stability Level: 1.2 - Experimental (Release Candidate) |
command -
String!
|
The command that this package runs on endpoints. Stability Level: 3 - Stable |
commandTimeoutSeconds -
Int!
|
The limit in seconds on how long the command can run before it terminates. Stability Level: 3 - Stable |
expireSeconds -
Int!
|
The default expiration in seconds for any action issued with this package. Stability Level: 3 - Stable |
params -
[PackageSpecParam!]
|
The list of package parameters. These correspond to the positional package parameter variables ( Stability Level: 3 - Stable |
sensorSourcedParams -
[PackageSpecSensorSourcedParam!]
|
The list of sensor-sourced package parameters. These correspond to the Stability Level: 3 - Stable |
Example
{
"id": 4,
"name": "xyz789",
"lastUpdatedBy": "xyz789",
"contentSetName": "abc123",
"contentSet": TaniumPlatformContentSet,
"command": "xyz789",
"commandTimeoutSeconds": 123,
"expireSeconds": 987,
"params": [PackageSpecParam],
"sensorSourcedParams": [PackageSpecSensorSourcedParam]
}
PackageSpecConnection
Description
A page of package spec edges.
Fields
| Field Name | Description |
|---|---|
edges -
[PackageSpecEdge!]!
|
The list of package spec edges. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the package spec collection. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of package spec records available. Stability Level: 3 - Stable |
Example
{
"edges": [PackageSpecEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
PackageSpecEdge
Description
A package spec within a page.
Fields
| Field Name | Description |
|---|---|
node -
PackageSpec!
|
The package spec. Stability Level: 3 - Stable |
cursor -
Cursor!
|
The cursor of this edge within the collection. Stability Level: 3 - Stable |
Example
{
"node": PackageSpec,
"cursor": Cursor
}
PackageSpecParam
Description
A positional package parameter for a package spec.
Fields
| Field Name | Description |
|---|---|
key -
String!
|
The string whose occurrences in the package fields are replaced by the parameter. Stability Level: 3 - Stable |
label -
String!
|
The label of the package parameter. Stability Level: 3 - Stable |
defaultValue -
String
|
The default value of the package parameter that is used when no value is provided. Stability Level: 3 - Stable |
Example
{
"key": "xyz789",
"label": "xyz789",
"defaultValue": "abc123"
}
PackageSpecSensorSourcedParam
Description
A sensor-sourced parameter for a package spec.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the parameter, such as Stability Level: 3 - Stable |
Example
{"name": "xyz789"}
PageInfo
Description
Information about a connection page.
Fields
| Field Name | Description |
|---|---|
hasNextPage -
Boolean!
|
Indicates that there are records after the last record on this page. Stability Level: 3 - Stable |
hasPreviousPage -
Boolean!
|
Indicates that there are records before the first record on this page. Stability Level: 3 - Stable |
startCursor -
Cursor
|
The cursor of the first record on this page. Stability Level: 3 - Stable |
endCursor -
Cursor
|
The cursor of the last record on this page. Stability Level: 3 - Stable |
Example
{
"hasNextPage": false,
"hasPreviousPage": true,
"startCursor": Cursor,
"endCursor": Cursor
}
PaginationInfoWithID
Description
Information about a paginated collection, including an ID for the collection.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
Pagination ID to use when querying pages. Stability Level: 3 - Stable |
totalPages -
Int!
|
Total number of pages. Stability Level: 3 - Stable |
totalItems -
Int!
|
Total number of items. Stability Level: 3 - Stable |
page -
Int!
|
Current page number. Stability Level: 3 - Stable |
perPage -
Int!
|
Number of items per page. Stability Level: 3 - Stable |
Example
{"id": 4, "totalPages": 987, "totalItems": 987, "page": 123, "perPage": 987}
ParameterDefinition
Fields
| Field Name | Description |
|---|---|
model -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
parameterType -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
key -
String!
|
Stability Level: 3 - Stable |
label -
String!
|
Stability Level: 3 - Stable |
helpString -
String!
|
Stability Level: 3 - Stable |
defaultValue -
String
|
Stability Level: 3 - Stable |
validationExpressions -
[ParameterDefinitionValidationExpression!]
|
Stability Level: 3 - Stable |
promptText -
String
|
Stability Level: 3 - Stable |
heightInLines -
Int
|
Stability Level: 3 - Stable |
maxChars -
Int
|
Stability Level: 3 - Stable |
value -
String
|
Stability Level: 3 - Stable |
values -
[String!]!
|
Stability Level: 3 - Stable |
restrict -
String
|
Stability Level: 3 - Stable |
allowEmptyList -
Boolean
|
Stability Level: 3 - Stable |
minimum -
Int
|
Stability Level: 3 - Stable |
maximum -
Int
|
Stability Level: 3 - Stable |
stepSize -
Int
|
Stability Level: 3 - Stable |
snapInterval -
Int
|
Stability Level: 3 - Stable |
dropdownOptions -
[NumericIntervalOption!]
|
Stability Level: 3 - Stable |
componentType -
Int
|
Stability Level: 3 - Stable |
startDateRestriction -
DefaultRangeEnd
|
Stability Level: 3 - Stable |
endDateRestriction -
DefaultRangeEnd
|
Stability Level: 3 - Stable |
startTimeRestriction -
DefaultRangeEnd
|
Stability Level: 3 - Stable |
endTimeRestriction -
DefaultRangeEnd
|
Stability Level: 3 - Stable |
allowDisableEnd -
Boolean
|
Stability Level: 3 - Stable |
defaultRangeStart -
DefaultRangeEnd
|
Stability Level: 3 - Stable |
defaultRangeEnd -
DefaultRangeEnd
|
Stability Level: 3 - Stable |
separatorText -
String
|
Stability Level: 3 - Stable |
Example
{
"model": ParameterDefinitionType,
"parameterType": ParameterDefinitionType,
"key": "xyz789",
"label": "xyz789",
"helpString": "xyz789",
"defaultValue": "xyz789",
"validationExpressions": [
ParameterDefinitionValidationExpression
],
"promptText": "xyz789",
"heightInLines": 987,
"maxChars": 987,
"value": "xyz789",
"values": ["xyz789"],
"restrict": "xyz789",
"allowEmptyList": true,
"minimum": 987,
"maximum": 987,
"stepSize": 123,
"snapInterval": 123,
"dropdownOptions": [NumericIntervalOption],
"componentType": 987,
"startDateRestriction": DefaultRangeEnd,
"endDateRestriction": DefaultRangeEnd,
"startTimeRestriction": DefaultRangeEnd,
"endTimeRestriction": DefaultRangeEnd,
"allowDisableEnd": false,
"defaultRangeStart": DefaultRangeEnd,
"defaultRangeEnd": DefaultRangeEnd,
"separatorText": "xyz789"
}
ParameterDefinitionType
Example
ParameterDefinitionType
ParameterDefinitionValidationExpression
Fields
| Field Name | Description |
|---|---|
model -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
parameterType -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
expression -
String
|
Stability Level: 3 - Stable |
helpString -
String
|
Stability Level: 3 - Stable |
Example
{
"model": ParameterDefinitionType,
"parameterType": ParameterDefinitionType,
"expression": "xyz789",
"helpString": "abc123"
}
ParameterDefinitions
Fields
| Field Name | Description |
|---|---|
parameterType -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
model -
ParameterDefinitionType!
|
Stability Level: 3 - Stable |
parameters -
[ParameterDefinition!]!
|
Stability Level: 3 - Stable |
Example
{
"parameterType": ParameterDefinitionType,
"model": ParameterDefinitionType,
"parameters": [ParameterDefinition]
}
PatchClientNotification
Description
An end user notification displayed to Windows and macOS endpoint users before a restart or deployment.
Fields
| Field Name | Description |
|---|---|
notificationPeriodDuration -
MonotonicDuration!
|
The maximum period of time after a notification is displayed before the end user is forced to start the deployment or restart the endpoint. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
countdownToDeadline -
MonotonicDuration!
|
A countdown displayed to the end user before the end user is forced to start the deployment or restart the endpoint. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
postponeOptions -
PatchPostponeOptions
|
The postponement time periods for users to delay a deployment or endpoint restart. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
title -
String!
|
The notification title. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
body -
String!
|
The notification body. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
translations -
[PatchClientNotificationTranslation!]
|
Translations for the notification. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
includeFrame -
Boolean!
|
Whether the notification window has a frame. End users can move or minimize the notification window using the frame functionality. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"notificationPeriodDuration": MonotonicDuration,
"countdownToDeadline": MonotonicDuration,
"postponeOptions": PatchPostponeOptions,
"title": "xyz789",
"body": "xyz789",
"translations": [PatchClientNotificationTranslation],
"includeFrame": true
}
PatchClientNotificationInput
Description
An end user notification displayed to Windows and macOS endpoint users before a restart or deployment.
Fields
| Input Field | Description |
|---|---|
notificationPeriodDuration -
MonotonicDurationInput!
|
The maximum period of time after a notification is displayed before the end user is forced to start the deployment or restart the endpoint. Stability Level: 1.0 - Experimental (Early Development) |
countdownToDeadline -
MonotonicDurationInput!
|
A countdown displayed to the end user before the end user is forced to start the deployment or restart the endpoint. Stability Level: 1.0 - Experimental (Early Development) |
postponeOptions -
PatchPostponeOptionsInput
|
The postponement time periods for users to delay a deployment or endpoint restart. Stability Level: 1.0 - Experimental (Early Development) |
title -
String!
|
The notification title. Stability Level: 1.0 - Experimental (Early Development) |
body -
String!
|
The notification body. Stability Level: 1.0 - Experimental (Early Development) |
translations -
[PatchClientNotificationTranslationInput!]
|
Translations for the notification. Stability Level: 1.0 - Experimental (Early Development) |
includeFrame -
Boolean!
|
Whether the notification window has a frame. End users can move or minimize the notification window using the frame functionality. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"notificationPeriodDuration": MonotonicDurationInput,
"countdownToDeadline": MonotonicDurationInput,
"postponeOptions": PatchPostponeOptionsInput,
"title": "abc123",
"body": "abc123",
"translations": [
PatchClientNotificationTranslationInput
],
"includeFrame": true
}
PatchClientNotificationTranslation
Description
Translation of a client notification.
Fields
| Field Name | Description |
|---|---|
languageCode -
String!
|
An ISO 639-1 two-letter language code for the translation. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
title -
String!
|
The notification title. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
body -
String!
|
The notification body. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"languageCode": "xyz789",
"title": "abc123",
"body": "abc123"
}
PatchClientNotificationTranslationInput
Description
Translation of a client notification.
Fields
| Input Field | Description |
|---|---|
languageCode -
String!
|
An ISO 639-1 two-letter language code for the translation. Stability Level: 1.0 - Experimental (Early Development) |
title -
String!
|
The notification title. Stability Level: 1.0 - Experimental (Early Development) |
body -
String!
|
The notification body. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"languageCode": "xyz789",
"title": "xyz789",
"body": "xyz789"
}
PatchContentDeploymentType
Description
Content deployment type.
Values
| Enum Value | Description |
|---|---|
|
|
Install manually selected patches or patch lists. Stability Level: 1.0 - Experimental (Early Development) |
|
|
Install all updates. Stability Level: 1.0 - Experimental (Early Development) |
|
|
Install all security updates. Stability Level: 1.0 - Experimental (Early Development) |
Example
"MANUAL_SELECTION"
PatchCreateDeploymentInput
Description
A request to create a Patch deployment.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The deployment name. Stability Level: 1.0 - Experimental (Early Development) |
type -
PatchDeploymentType!
|
The deployment type. This must be Stability Level: 1.0 - Experimental (Early Development) |
platform -
PatchEndpointPlatform!
|
The deployment platform. Stability Level: 1.0 - Experimental (Early Development) |
contentSet -
IdRefInput!
|
The content set to which the deployment belongs. Stability Level: 1.0 - Experimental (Early Development) |
description -
String
|
The deployment description. Stability Level: 1.0 - Experimental (Early Development) |
contentDeploymentType -
PatchContentDeploymentType!
|
The content deployment type. This must be Stability Level: 1.0 - Experimental (Early Development) |
patchLists -
[PatchListRefInput!]
|
Patch lists to include in the deployment. Define at least one of Define exactly one of Stability Level: 1.0 - Experimental (Early Development) |
patches -
[IdRefInput!]
|
Individual patches to include in the deployment. Define at least one of Define exactly one of Stability Level: 1.0 - Experimental (Early Development) |
targets -
PatchTargetsInput!
|
Deployment targeting configuration. Stability Level: 1.0 - Experimental (Early Development) |
schedule -
PatchScheduleInput
|
Deployment scheduling configuration. Required for macOS and Linux deployments. If this is Stability Level: 1.0 - Experimental (Early Development) |
downloadImmediately -
Boolean!
|
Whether the patch content should be downloaded before the installation time. Stability Level: 1.0 - Experimental (Early Development) |
overrideBlocklists -
Boolean!
|
Whether to install all specified patches regardless of block lists. Stability Level: 1.0 - Experimental (Early Development) |
restart -
Boolean!
|
Whether to restart the endpoint after deployment is complete. Stability Level: 1.0 - Experimental (Early Development) |
notifications -
PatchNotificationsInput
|
Deployment notifications for Windows and macOS. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"name": "abc123",
"type": "INSTALL",
"platform": "WINDOWS",
"contentSet": IdRefInput,
"description": "xyz789",
"contentDeploymentType": "MANUAL_SELECTION",
"patchLists": [PatchListRefInput],
"patches": [IdRefInput],
"targets": PatchTargetsInput,
"schedule": PatchScheduleInput,
"downloadImmediately": false,
"overrideBlocklists": false,
"restart": false,
"notifications": PatchNotificationsInput
}
PatchCreateDeploymentPayload
Description
A response to a request to create a deployment.
Fields
| Field Name | Description |
|---|---|
deployment -
PatchDeployment
|
The created deployment. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"deployment": PatchDeployment,
"error": SystemError
}
PatchDefinition
Description
A Tanium patch definition.
Fields
| Field Name | Description |
|---|---|
id -
String!
|
The unique patch definition ID. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
title -
String!
|
The patch definition title. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
cveIds -
[String!]!
|
The CVE IDs associated with the patch. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
platform -
PatchEndpointPlatform!
|
The operating system on which the patch is supported. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
severity -
String!
|
The severity of the patch. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
createdDate -
Date!
|
The patch definition creation date. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
releaseDate -
Date
|
The patch release date. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
isSuperseded -
Boolean!
|
Whether the patch is superseded by another patch. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
sizeInBytes -
Int!
|
The size of the patch in bytes. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"id": "xyz789",
"title": "abc123",
"cveIds": ["abc123"],
"platform": "WINDOWS",
"severity": "xyz789",
"createdDate": "2007-12-03",
"releaseDate": "2007-12-03",
"isSuperseded": false,
"sizeInBytes": 123
}
PatchDefinitionConnection
Description
A page of patch definitions.
Fields
| Field Name | Description |
|---|---|
edges -
[PatchDefinitionEdge!]!
|
The list of patch definition edges. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
pageInfo -
PageInfo!
|
Information about the patch definition collection. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
totalRecords -
Int!
|
The total number of patch definition records available. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"edges": [PatchDefinitionEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
PatchDefinitionEdge
Description
A patch definition within a page.
Fields
| Field Name | Description |
|---|---|
node -
PatchDefinition!
|
The patch definition. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"node": PatchDefinition,
"cursor": Cursor
}
PatchDefinitionFieldFilter
Description
Describes a filter for patch definitions. Patch definitions with field values matching the filter are included in the query results.
Fields
| Input Field | Description |
|---|---|
cveIds -
[String!]
|
The CVE IDs associated with a patch definition. You can specify only one CVE ID per filter. Example: CVE-2014-123456 Stability Level: 1.0 - Experimental (Early Development) |
Example
{"cveIds": ["xyz789"]}
PatchDefinitionFieldSort
Description
Sorting criteria for patch definitions. The list is sorted by the specified field, in the specified order.
Fields
| Input Field | Description |
|---|---|
field -
PatchDefinitionSortField!
|
The field to sort by. Stability Level: 1.0 - Experimental (Early Development) |
order -
SortOrder!
|
The order in which to sort the field values. Stability Level: 1.0 - Experimental (Early Development) |
Example
{"field": "title", "order": "asc"}
PatchDefinitionSortField
Description
Available patch definition fields to sort by.
Values
| Enum Value | Description |
|---|---|
|
|
The patch definition title. Stability Level: 1.0 - Experimental (Early Development) |
|
|
The patch definition severity. Stability Level: 1.0 - Experimental (Early Development) |
|
|
The patch definition platform. Stability Level: 1.0 - Experimental (Early Development) |
|
|
The patch definition release date. Stability Level: 1.0 - Experimental (Early Development) |
Example
"title"
PatchDeployment
Description
A request to create a Patch deployment.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The deployment ID. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
name -
String!
|
The deployment name. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
type -
PatchDeploymentType!
|
The deployment type. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
platform -
PatchEndpointPlatform!
|
The deployment platform. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
contentSet -
IdRef!
|
The content set to which the deployment belongs. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
description -
String
|
The deployment description. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
contentDeploymentType -
PatchContentDeploymentType!
|
The content deployment type. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
patchLists -
[PatchListRef!]
|
Patch lists to include in the deployment. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
patches -
[IdRef!]
|
Individual patches to include in the deployment. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
targets -
PatchTargets!
|
Deployment targeting configuration. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
schedule -
PatchSchedule
|
Deployment scheduling configuration. If this is Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
downloadImmediately -
Boolean!
|
Whether the patch content should be downloaded before the installation time. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
overrideBlocklists -
Boolean!
|
Whether to install all specified patches regardless of block lists. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
restart -
Boolean!
|
Whether to restart the endpoint after deployment is complete. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
notifications -
PatchNotifications
|
Deployment notifications for Windows and macOS. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
author -
TaniumPlatformUser
|
The Tanium user that created the deployment. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
createdTime -
Time!
|
When the deployment was created. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
updatedTime -
Time!
|
When the deployment was last updated. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
stoppedTime -
Time
|
When the deployment was stopped. If the deployment has not been stopped this is Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
status -
PatchDeploymentStatus!
|
The deployment status. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"id": "4",
"name": "xyz789",
"type": "INSTALL",
"platform": "WINDOWS",
"contentSet": IdRef,
"description": "xyz789",
"contentDeploymentType": "MANUAL_SELECTION",
"patchLists": [PatchListRef],
"patches": [IdRef],
"targets": PatchTargets,
"schedule": PatchSchedule,
"downloadImmediately": true,
"overrideBlocklists": false,
"restart": false,
"notifications": PatchNotifications,
"author": TaniumPlatformUser,
"createdTime": "10:15:30Z",
"updatedTime": "10:15:30Z",
"stoppedTime": "10:15:30Z",
"status": "INACTIVE"
}
PatchDeploymentStatus
Description
Patch deployment status.
Values
| Enum Value | Description |
|---|---|
|
|
The deployment has not started yet. Stability Level: 1.0 - Experimental (Early Development) |
|
|
The deployment is active. Stability Level: 1.0 - Experimental (Early Development) |
|
|
The deployment has ended. Stability Level: 1.0 - Experimental (Early Development) |
|
|
The deployment was stopped. Stability Level: 1.0 - Experimental (Early Development) |
Example
"INACTIVE"
PatchDeploymentType
Description
The operation a Patch deployment performs.
Values
| Enum Value | Description |
|---|---|
|
|
Download and install patches on a set of target computers. Stability Level: 1.0 - Experimental (Early Development) |
|
|
Uninstall Windows patches on a set of target computers. Stability Level: 1.0 - Experimental (Early Development) |
Example
"INSTALL"
PatchEndpointPlatform
Description
Endpoint platforms supported by Patch.
Values
| Enum Value | Description |
|---|---|
|
|
Microsoft Windows operating system. Stability Level: 1.0 - Experimental (Early Development) |
|
|
macOS operating system. Stability Level: 1.0 - Experimental (Early Development) |
|
|
Linux operating system. Stability Level: 1.0 - Experimental (Early Development) |
Example
"WINDOWS"
PatchListRef
Description
A patch list reference.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The patch list identifier. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
version -
Int
|
The patch list version number. If this is Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{"id": 4, "version": 987}
PatchListRefInput
Description
A patch list reference input.
Example
{"id": 4, "version": 123}
PatchNotifications
Description
Patch deployment notifications for Windows and macOS endpoints.
Fields
| Field Name | Description |
|---|---|
postDeployment -
PatchClientNotification
|
Notification shown before restarting the endpoint after the end of the deployment. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{"postDeployment": PatchClientNotification}
PatchNotificationsInput
Description
Patch deployment notifications for Windows and macOS endpoints.
Fields
| Input Field | Description |
|---|---|
postDeployment -
PatchClientNotificationInput
|
Notification shown before restarting the endpoint after the end of the deployment. Only applies if Stability Level: 1.0 - Experimental (Early Development) |
Example
{"postDeployment": PatchClientNotificationInput}
PatchPostponeOptions
Description
Postponement options for Windows and macOS endpoint users to delay a restart or deployment.
Fields
| Field Name | Description |
|---|---|
durationOne -
MonotonicDuration!
|
The first restart postponement duration displayed to an end user. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
durationTwo -
MonotonicDuration!
|
The second restart postponement duration displayed to an end user. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
durationThree -
MonotonicDuration!
|
The third restart postponement duration displayed to an end user. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"durationOne": MonotonicDuration,
"durationTwo": MonotonicDuration,
"durationThree": MonotonicDuration
}
PatchPostponeOptionsInput
Description
Postponement options for Windows and macOS endpoint users to delay a restart or deployment.
Fields
| Input Field | Description |
|---|---|
durationOne -
MonotonicDurationInput!
|
The first restart postponement duration displayed to an end user. This value must be smaller than Stability Level: 1.0 - Experimental (Early Development) |
durationTwo -
MonotonicDurationInput!
|
The second restart postponement duration displayed to an end user. This value must be smaller than Stability Level: 1.0 - Experimental (Early Development) |
durationThree -
MonotonicDurationInput!
|
The third restart postponement duration displayed to an end user. This value must be smaller than Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"durationOne": MonotonicDurationInput,
"durationTwo": MonotonicDurationInput,
"durationThree": MonotonicDurationInput
}
PatchQuestionCriteria
Description
Patch deployment question criteria.
Fields
| Field Name | Description |
|---|---|
limitingGroups -
[IdRef!]
|
The computer groups to which an endpoint must belong to be targeted. If you define multiple computer groups, an endpoint is targeted if it belongs to any of the groups. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{"limitingGroups": [IdRef]}
PatchQuestionCriteriaInput
Description
Patch deployment question criteria.
Fields
| Input Field | Description |
|---|---|
filter -
ComputerGroupFilter
|
The filter used to target endpoints for the deployment. Note that when using a parameterized sensor for filtering, you must define all parameters for that sensor, even if a parameter has a default value. Use of this field requires one of the following Tanium permissions: Stability Level: 1.0 - Experimental (Early Development) |
limitingGroups -
[IdRefInput!]
|
The computer groups to which an endpoint must belong to be targeted. If you define multiple computer groups, an endpoint is targeted if it belongs to any of the groups. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"filter": ComputerGroupFilter,
"limitingGroups": [IdRefInput]
}
PatchSchedule
Description
A Patch deployment schedule.
Fields
| Field Name | Description |
|---|---|
type -
PatchScheduleType!
|
The deployment schedule type. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
timeZone -
String
|
The If this is Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
startTime -
Time!
|
The deployment start time. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
endTime -
Time
|
The deployment end time. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
distributeOver -
MonotonicDuration
|
The duration over which the deployment start time is randomized on each endpoint by an amount of time up to the value configured. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
overrideMaintenanceWindows -
Boolean!
|
Whether to allow the deployment to run outside of configured maintenance windows. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
eussAvailableBeforeStart -
Boolean
|
Whether end users can start a deployment before the scheduled start time and outside of maintenance windows in the Self Service Client application. Only applies to Windows deployments. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
eussHideFromActivity -
Boolean
|
Whether the Activity tab in the Self Service Client application hides upcoming deployment activity from end users. Hidden deployments do not appear in the History tab. Only applies to Windows deployments. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"type": "SINGLE",
"timeZone": "abc123",
"startTime": "10:15:30Z",
"endTime": "10:15:30Z",
"distributeOver": MonotonicDuration,
"overrideMaintenanceWindows": false,
"eussAvailableBeforeStart": false,
"eussHideFromActivity": false
}
PatchScheduleInput
Description
A Patch deployment schedule.
Fields
| Input Field | Description |
|---|---|
type -
PatchScheduleType!
|
The deployment schedule type. Stability Level: 1.0 - Experimental (Early Development) |
timeZone -
String
|
The If this is Stability Level: 1.0 - Experimental (Early Development) |
startTime -
Time!
|
The deployment start time. Stability Level: 1.0 - Experimental (Early Development) |
endTime -
Time
|
The deployment end time. Only applies to single deployments. Stability Level: 1.0 - Experimental (Early Development) |
distributeOver -
MonotonicDurationInput
|
The duration over which the deployment start time is randomized on each endpoint by an amount of time up to the value configured. This value must be less than the deployment duration. For single deployments, the duration is the time between Stability Level: 1.0 - Experimental (Early Development) |
overrideMaintenanceWindows -
Boolean!
|
Whether to allow the deployment to run outside of configured maintenance windows. Stability Level: 1.0 - Experimental (Early Development) |
eussAvailableBeforeStart -
Boolean
|
Whether end users can start a deployment before the scheduled start time and outside of maintenance windows in the Self Service Client application. Only applies to Windows deployments. Stability Level: 1.0 - Experimental (Early Development) |
eussHideFromActivity -
Boolean
|
Whether the Activity tab in the Self Service Client application hides upcoming deployment activity from end users. Hidden deployments do not appear in the History tab. Only applies to Windows deployments. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"type": "SINGLE",
"timeZone": "xyz789",
"startTime": "10:15:30Z",
"endTime": "10:15:30Z",
"distributeOver": MonotonicDurationInput,
"overrideMaintenanceWindows": true,
"eussAvailableBeforeStart": false,
"eussHideFromActivity": true
}
PatchScheduleType
Description
Patch deployment scheduling options.
Values
| Enum Value | Description |
|---|---|
|
|
A single deployment with a specific start and end time. Stability Level: 1.0 - Experimental (Early Development) |
|
|
An ongoing deployment that does not have an end time. Stability Level: 1.0 - Experimental (Early Development) |
Example
"SINGLE"
PatchStopDeploymentPayload
Description
A response to a request to stop a deployment that is in progress or scheduled to start in the future.
Fields
| Field Name | Description |
|---|---|
deployment -
PatchDeployment
|
The updated deployment. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"deployment": PatchDeployment,
"error": SystemError
}
PatchTargets
Description
The endpoints on which a deployment runs.
Fields
| Field Name | Description |
|---|---|
computerGroups -
[IdRef!]
|
The computer groups whose endpoints are targeted by the deployment. An endpoint is targeted if it belongs to any computer group in the list. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
questionCriteria -
PatchQuestionCriteria
|
The question criteria used to target endpoints for the deployment. Use of this field requires the Patch solution. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"computerGroups": [IdRef],
"questionCriteria": PatchQuestionCriteria
}
PatchTargetsInput
Description
The endpoints on which a deployment runs. If both computerGroups and questionCriteria are defined, the deployment targets endpoints that match either the defined computer groups or the defined question criteria.
Fields
| Input Field | Description |
|---|---|
computerGroups -
[IdRefInput!]
|
The computer groups whose endpoints are targeted by the deployment. Stability Level: 1.0 - Experimental (Early Development) |
questionCriteria -
PatchQuestionCriteriaInput
|
The question criteria used to target endpoints for the deployment. Stability Level: 1.0 - Experimental (Early Development) |
Example
{
"computerGroups": [IdRefInput],
"questionCriteria": PatchQuestionCriteriaInput
}
PerfQuery
Description
A request to perform a PromQL query.
Fields
| Input Field | Description |
|---|---|
type -
PerfQueryType!
|
The type of PromQL query to perform. Stability Level: 3 - Stable |
query -
String!
|
The PromQL query to perform. Stability Level: 3 - Stable |
from -
Time
|
The start date and time of the PromQL query. Stability Level: 3 - Stable |
to -
Time
|
The end date and time of the PromQL query. Stability Level: 3 - Stable |
step -
String
|
The step size of the PromQL query. Stability Level: 3 - Stable |
Example
{
"type": "QUERY",
"query": "xyz789",
"from": "10:15:30Z",
"to": "10:15:30Z",
"step": "xyz789"
}
PerfQueryType
Description
The set of performance query types.
Values
| Enum Value | Description |
|---|---|
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
Example
"QUERY"
Persona
Description
A set of roles and computer groups that can be used to enforce a set of restrictions on what a user can and cannot do.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the persona. Stability Level: 3 - Stable |
Example
{"name": "abc123"}
PingDirectConnectionInput
Description
A request to ping an endpoint over a Direct Connect connection (for example, to test connectivity).
Fields
| Input Field | Description |
|---|---|
connectionID -
ID!
|
The ID of the connection to ping. Stability Level: 3 - Stable |
Example
{"connectionID": "4"}
PingDirectConnectionPayload
Description
A response to a request to ping an endpoint over a Direct Connect connection.
Fields
| Field Name | Description |
|---|---|
result -
Boolean!
|
Indicates that the ping is acknowledged. Stability Level: 3 - Stable |
Example
{"result": false}
Playbook
Description
A playbook.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The playbook ID. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
revision -
Int!
|
The playbook revision. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
deleted -
Boolean!
|
Whether this playbook revision has been deleted. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
contentSet -
TaniumPlatformContentSet
|
The content set assigned to the playbook. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
name -
String!
|
The playbook name. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
description -
String
|
The playbook description. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
steps -
[PlaybookStep!]!
|
The steps that this playbook contains. The order of items in the list has no effect. The starting step is notated the by Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
startingStep -
PlaybookStep!
|
The starting step of this playbook. The step order can be traversed by following the Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
notificationSettings -
PlaybookNotificationSettings!
|
The playbook notification settings. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
createdTime -
Time!
|
The date and time at which the playbook was created. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
updatedTime -
Time!
|
The date and time at which this playbook revision was updated. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
schedules -
PlaybookScheduleConnection
|
The associated playbook schedules. This returns playbook schedules associated with the playbook ID, regardless of playbook revision. You can add filters to restrict the returned playbook schedules. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Arguments
|
|
runs -
PlaybookRunConnection
|
The associated playbook runs. This returns playbook runs for all version revisions of this playbook. You can add filters to restrict the returned playbook runs. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Arguments
|
|
canRun -
Boolean
|
Whether the current user can run this playbook. This value is
Use of this field requires the Automate solution.
Stability Level: 2 - Legacy Consider using |
currentUserHasActiveRun -
Boolean!
|
Whether the current user has an active playbook run for this playbook revision. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
activeRunsCount -
Int!
|
The count of active playbook runs associated with this playbook, regardless of playbook revision. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
disabledSchedulesCount -
Int!
|
The count of disabled playbook schedules associated with this playbook, regardless of playbook revision. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
nextSchedule -
PlaybookSchedule
|
The playbook schedule corresponding to the next scheduled run. This value is null if the playbook has no enabled schedules. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
author -
TaniumPlatformUser
|
The original playbook author. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
lastModifiedBy -
TaniumPlatformUser
|
The user that created this playbook revision. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": 4,
"revision": 987,
"deleted": true,
"contentSet": TaniumPlatformContentSet,
"name": "abc123",
"description": "xyz789",
"steps": [PlaybookStep],
"startingStep": PlaybookStep,
"notificationSettings": PlaybookNotificationSettings,
"createdTime": "10:15:30Z",
"updatedTime": "10:15:30Z",
"schedules": PlaybookScheduleConnection,
"runs": PlaybookRunConnection,
"canRun": true,
"currentUserHasActiveRun": true,
"activeRunsCount": 987,
"disabledSchedulesCount": 987,
"nextSchedule": PlaybookSchedule,
"author": TaniumPlatformUser,
"lastModifiedBy": TaniumPlatformUser
}
PlaybookConnection
Description
A page of playbook edges.
Fields
| Field Name | Description |
|---|---|
edges -
[PlaybookEdge!]!
|
The list of playbook edges. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
pageInfo -
PageInfo!
|
Information about the playbook collection. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
totalRecords -
Int!
|
The total number of playbook records available. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"edges": [PlaybookEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
PlaybookEdge
Description
A playbook within a page.
Fields
| Field Name | Description |
|---|---|
node -
Playbook!
|
The playbook. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"node": Playbook, "cursor": Cursor}
PlaybookEmailNotificationSettings
Description
Playbook email notification settings.
Fields
| Field Name | Description |
|---|---|
events -
[PlaybookNotificationEventType!]!
|
The playbook notification event types for which an email notification is sent to the configured recipients, if the playbook notification event type is detected. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
recipients -
[String!]!
|
The list of recipient email addresses that should receive an email notification. These email addresses are listed in the email To field. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"events": ["START"],
"recipients": ["xyz789"]
}
PlaybookEmailNotificationSettingsInput
Description
A request to configure playbook email notification settings.
Fields
| Input Field | Description |
|---|---|
events -
[PlaybookNotificationEventType!]!
|
The playbook notification event types for which an email notification is sent to the configured recipients, if the playbook notification event type is detected. Stability Level: 1.1 - Experimental (Active Development) |
recipients -
[String!]!
|
The list of recipient email addresses that should receive an email notification. These email addresses are listed in the email To field. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"events": ["START"],
"recipients": ["abc123"]
}
PlaybookFieldFilter
Description
Describes a filter for playbooks field values. A playbook must match every included filter condition to satisfy the filter.
Fields
| Input Field | Description |
|---|---|
name -
String
|
Playbook name must match the specified string. The case-insensitive comparison can match either part of the name or the full name. Stability Level: 1.1 - Experimental (Active Development) |
ids -
[ID!]
|
Playbook ID must match any of the specified IDs. Stability Level: 1.1 - Experimental (Active Development) |
isScheduled -
Boolean
|
Whether a playbook is scheduled to run. If this is Stability Level: 1.1 - Experimental (Active Development) |
hasDisabledSchedules -
Boolean
|
Whether a playbook has disabled schedules. If this is Stability Level: 1.1 - Experimental (Active Development) |
contentSets -
[NamedRefInput!]
|
Playbook content set name or ID must match any of the specified NamedRefInputs. Stability Level: 1.1 - Experimental (Active Development) |
authorUserIDs -
[ID!]
|
Playbook author user ID must match any of the specified IDs. Include Stability Level: 1.1 - Experimental (Active Development) |
createdBeforeTime -
Time
|
Playbook creation time must be before the specified time. Stability Level: 1.1 - Experimental (Active Development) |
createdAfterTime -
Time
|
Playbook creation time must be after the specified time. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"name": "abc123",
"ids": ["4"],
"isScheduled": false,
"hasDisabledSchedules": true,
"contentSets": [NamedRefInput],
"authorUserIDs": [4],
"createdBeforeTime": "10:15:30Z",
"createdAfterTime": "10:15:30Z"
}
PlaybookFieldSort
Description
Sorting criteria for playbooks. The list is sorted by the specified field, in the specified order.
Fields
| Input Field | Description |
|---|---|
field -
PlaybookSortField!
|
The field to sort by. Stability Level: 1.1 - Experimental (Active Development) |
order -
SortOrder!
|
The order in which to sort the field values. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"field": "name", "order": "asc"}
PlaybookNotificationEvent
Description
Additional information about a playbook notification.
Fields
| Field Name | Description |
|---|---|
event -
PlaybookNotificationEventType!
|
The type of playbook notification event that triggered this notification. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
method -
PlaybookNotificationMethod!
|
The method used to send this notification. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
stepIndex -
Int
|
The index of the playbook step that is associated with this notification. If this notification is not associated with a playbook step, this is Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"event": "START", "method": "EMAIL", "stepIndex": 987}
PlaybookNotificationEventType
Description
Events that can trigger a playbook notification.
Values
| Enum Value | Description |
|---|---|
|
|
Playbook run started. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run completed. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run stopped prior to completion. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run returned an error. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run waiting for manual user confirmation to proceed. Stability Level: 1.1 - Experimental (Active Development) |
Example
"START"
PlaybookNotificationMethod
Description
Methods for sending playbook notifications.
Values
| Enum Value | Description |
|---|---|
|
|
Email notification method. Stability Level: 1.1 - Experimental (Active Development) |
Example
"EMAIL"
PlaybookNotificationSettings
Description
Playbook notification settings.
Fields
| Field Name | Description |
|---|---|
email -
PlaybookEmailNotificationSettings!
|
The playbook email notification settings. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"email": PlaybookEmailNotificationSettings}
PlaybookNotificationSettingsInput
Description
A request to configure playbook notification settings.
Fields
| Input Field | Description |
|---|---|
email -
PlaybookEmailNotificationSettingsInput!
|
The playbook email notification settings. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"email": PlaybookEmailNotificationSettingsInput}
PlaybookOperation
Description
Operations available to perform on a playbook.
Values
| Enum Value | Description |
|---|---|
|
|
Deletes a playbook. Playbook runs associated with this playbook are not automatically deleted if you delete the playbook. Stability Level: 1.1 - Experimental (Active Development) |
Example
"DELETE"
PlaybookPatchClientNotification
Description
An end user notification displayed to Windows and macOS endpoint users before a restart.
Fields
| Field Name | Description |
|---|---|
notificationPeriodDuration -
MonotonicDuration!
|
The maximum period of time after a notification is displayed before the end user is forced to restart the endpoint. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
countdownToDeadline -
MonotonicDuration!
|
A countdown displayed to the end user before the end user is forced to restart the endpoint. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
postponeOptions -
PlaybookPatchPostponeOptions
|
The postponement time periods for users to delay an endpoint restart. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
title -
String!
|
The notification title. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
body -
String!
|
The notification body. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
translations -
[PlaybookPatchClientNotificationTranslation!]
|
Translations for the notification. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
includeFrame -
Boolean!
|
Whether the notification window has a frame. End users can move or minimize the notification window using the frame functionality. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"notificationPeriodDuration": MonotonicDuration,
"countdownToDeadline": MonotonicDuration,
"postponeOptions": PlaybookPatchPostponeOptions,
"title": "xyz789",
"body": "xyz789",
"translations": [
PlaybookPatchClientNotificationTranslation
],
"includeFrame": false
}
PlaybookPatchClientNotificationInput
Description
An end user notification displayed to Windows and macOS endpoint users after a deployment and before a restart.
Fields
| Input Field | Description |
|---|---|
notificationPeriodDuration -
MonotonicDurationInput!
|
The maximum period of time after a notification is displayed before the end user is forced to restart the endpoint. Stability Level: 1.1 - Experimental (Active Development) |
countdownToDeadline -
MonotonicDurationInput!
|
A countdown displayed to the end user before the end user is forced to restart the endpoint. Stability Level: 1.1 - Experimental (Active Development) |
postponeOptions -
PlaybookPatchPostponeOptionsInput
|
The postponement time periods for users to delay an endpoint restart. Stability Level: 1.1 - Experimental (Active Development) |
title -
String!
|
The notification title. Stability Level: 1.1 - Experimental (Active Development) |
body -
String!
|
The notification body. Stability Level: 1.1 - Experimental (Active Development) |
translations -
[PlaybookPatchClientNotificationTranslationInput!]
|
Translations for the notification. Stability Level: 1.1 - Experimental (Active Development) |
includeFrame -
Boolean!
|
Whether the notification window has a frame. End users can move or minimize the notification window using the frame functionality. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"notificationPeriodDuration": MonotonicDurationInput,
"countdownToDeadline": MonotonicDurationInput,
"postponeOptions": PlaybookPatchPostponeOptionsInput,
"title": "abc123",
"body": "xyz789",
"translations": [
PlaybookPatchClientNotificationTranslationInput
],
"includeFrame": false
}
PlaybookPatchClientNotificationTranslation
Description
Translation of a client notification.
Fields
| Field Name | Description |
|---|---|
languageCode -
String!
|
An ISO 639-1 two-letter language code for the translation. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
title -
String!
|
The notification title. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
body -
String!
|
The notification body. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"languageCode": "abc123",
"title": "abc123",
"body": "xyz789"
}
PlaybookPatchClientNotificationTranslationInput
Description
Translation of a client notification.
Fields
| Input Field | Description |
|---|---|
languageCode -
String!
|
An ISO 639-1 two-letter language code for the translation. Stability Level: 1.1 - Experimental (Active Development) |
title -
String!
|
The notification title. Stability Level: 1.1 - Experimental (Active Development) |
body -
String!
|
The notification body. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"languageCode": "abc123",
"title": "abc123",
"body": "xyz789"
}
PlaybookPatchContentDeploymentType
Description
Content deployment type.
Values
| Enum Value | Description |
|---|---|
|
|
Install manually selected patches or patch lists. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Install all updates. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Install all security updates. Stability Level: 1.1 - Experimental (Active Development) |
Example
"MANUAL_SELECTION"
PlaybookPatchEndpointPlatform
Description
Endpoint platforms supported by Patch.
Values
| Enum Value | Description |
|---|---|
|
|
Microsoft Windows operating system. Stability Level: 1.1 - Experimental (Active Development) |
|
|
macOS operating system. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Linux operating system. Stability Level: 1.1 - Experimental (Active Development) |
Example
"WINDOWS"
PlaybookPatchListRef
Description
A patch list reference.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The patch list identifier. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
version -
Int
|
The patch list version number. If this is Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"id": "4", "version": 987}
PlaybookPatchListRefInput
Description
A patch list reference input.
Example
{"id": "4", "version": 123}
PlaybookPatchPostponeOptions
Description
Postponement options for Windows and macOS endpoint users to delay a restart.
Fields
| Field Name | Description |
|---|---|
durationOne -
MonotonicDuration!
|
The first restart postponement duration displayed to an end user. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
durationTwo -
MonotonicDuration!
|
The second restart postponement duration displayed to an end user. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
durationThree -
MonotonicDuration!
|
The third restart postponement duration displayed to an end user. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"durationOne": MonotonicDuration,
"durationTwo": MonotonicDuration,
"durationThree": MonotonicDuration
}
PlaybookPatchPostponeOptionsInput
Description
Postponement options for Windows and macOS endpoint users to delay a restart.
Fields
| Input Field | Description |
|---|---|
durationOne -
MonotonicDurationInput!
|
The first restart postponement duration displayed to an end user. This value must be smaller than Stability Level: 1.1 - Experimental (Active Development) |
durationTwo -
MonotonicDurationInput!
|
The second restart postponement duration displayed to an end user. This value must be smaller than Stability Level: 1.1 - Experimental (Active Development) |
durationThree -
MonotonicDurationInput!
|
The third restart postponement duration displayed to an end user. This value must be smaller than Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"durationOne": MonotonicDurationInput,
"durationTwo": MonotonicDurationInput,
"durationThree": MonotonicDurationInput
}
PlaybookPerformOperationInput
Description
A request to perform an operation enumerated in PlaybookOperation on a playbook.
Fields
| Input Field | Description |
|---|---|
id -
ID!
|
The playbook ID. Stability Level: 1.1 - Experimental (Active Development) |
operation -
PlaybookOperation!
|
The operation to perform. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"id": "4", "operation": "DELETE"}
PlaybookPerformOperationPayload
Description
The result of performing an operation on a playbook.
Fields
| Field Name | Description |
|---|---|
playbook -
Playbook
|
The playbook that the operation was performed on. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbook": Playbook,
"error": SystemError
}
PlaybookRun
Description
A running playbook.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The playbook run unique ID. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
playbook -
Playbook!
|
The associated playbook. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
schedule -
PlaybookSchedule
|
The associated playbook schedule. This is Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
scheduleStartTime -
Time
|
The start time calculated by the schedule. This is Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
startTime -
Time
|
The playbook run start time. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
endTime -
Time
|
The playbook run end time. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
createdTime -
Time!
|
The date and time at which the playbook run was created. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
runAs -
TaniumPlatformUserContext!
|
The user and persona whose permission set this playbook run uses to access content. If the user does not have an active persona selected, the Default Persona is used. If the user schedules a playbook run, that user permission set is assigned to the scheduled playbook run. If the user initiates an ad-hoc playbook run, that user permission set is assigned to the ad-hoc playbook run. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
status -
PlaybookRunStatus!
|
The playbook run status. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
events -
[PlaybookRunEvent!]!
|
The playbook run events. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
steps -
[PlaybookRunStep!]!
|
The playbook run steps, in step evaluation order. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": 4,
"playbook": Playbook,
"schedule": PlaybookSchedule,
"scheduleStartTime": "10:15:30Z",
"startTime": "10:15:30Z",
"endTime": "10:15:30Z",
"createdTime": "10:15:30Z",
"runAs": TaniumPlatformUserContext,
"status": "NOT_STARTED",
"events": [PlaybookRunEvent],
"steps": [PlaybookRunStep]
}
PlaybookRunConnection
Description
A page of playbook run edges.
Fields
| Field Name | Description |
|---|---|
edges -
[PlaybookRunEdge!]!
|
The list of playbook run edges. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
pageInfo -
PageInfo!
|
Information about the playbook run collection. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
totalRecords -
Int!
|
The total number of playbook run records available. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"edges": [PlaybookRunEdge],
"pageInfo": PageInfo,
"totalRecords": 123
}
PlaybookRunEdge
Description
A playbook run within a page.
Fields
| Field Name | Description |
|---|---|
node -
PlaybookRun!
|
The playbook run. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"node": PlaybookRun,
"cursor": Cursor
}
PlaybookRunEvent
Description
A playbook run event.
Fields
| Field Name | Description |
|---|---|
name -
PlaybookRunEventType!
|
The playbook run event name. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
createdTime -
Time!
|
The time at which the event was created. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
initiator -
TaniumPlatformUserContext
|
An optional user that initiated the event. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
notification -
PlaybookNotificationEvent
|
Additional information about a playbook notification. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"name": "CREATE",
"createdTime": "10:15:30Z",
"initiator": TaniumPlatformUserContext,
"notification": PlaybookNotificationEvent
}
PlaybookRunEventType
Description
An enumeration of playbook run event types.
Values
| Enum Value | Description |
|---|---|
|
|
Playbook run created. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run started. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run is now waiting. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run pause requested. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run paused. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run resume requested. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run resumed. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run confirmed. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run end requested. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run ended. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run completed. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run returned an error. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Playbook run timed out. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Notification successfully sent. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Notification failed to send. Stability Level: 1.1 - Experimental (Active Development) |
Example
"CREATE"
PlaybookRunFieldFilter
Description
Describes a filter for playbook runs field values. A playbook run must match every included filter condition to satisfy the filter.
Fields
| Input Field | Description |
|---|---|
playbookIDs -
[ID!]
|
The ID of the playbook associated with this playbook run must match any of the specified IDs. Stability Level: 1.1 - Experimental (Active Development) |
playbookName -
String
|
The name of the playbook associated with this playbook run must match the specified string. The case-insensitive comparison can match either part of the name or the full name. Stability Level: 1.1 - Experimental (Active Development) |
runAsUserIDs -
[ID!]
|
The playbook run Stability Level: 1.1 - Experimental (Active Development) |
statuses -
[PlaybookRunStatus!]
|
The playbook run status must match any of the specified statuses. Stability Level: 1.1 - Experimental (Active Development) |
isScheduled -
Boolean
|
Whether a playbook run is a scheduled run. Stability Level: 1.1 - Experimental (Active Development) |
hasErrors -
Boolean
|
Whether a playbook run generated any errors. Stability Level: 1.1 - Experimental (Active Development) |
createdBeforeTime -
Time
|
Playbook run creation time must be before the specified time. Stability Level: 1.1 - Experimental (Active Development) |
createdAfterTime -
Time
|
Playbook run creation time must be after the specified time. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbookIDs": ["4"],
"playbookName": "abc123",
"runAsUserIDs": ["4"],
"statuses": ["NOT_STARTED"],
"isScheduled": true,
"hasErrors": true,
"createdBeforeTime": "10:15:30Z",
"createdAfterTime": "10:15:30Z"
}
PlaybookRunFieldSort
Description
Sorting criteria for playbook runs. The list is sorted by the specified field, in the specified order.
Fields
| Input Field | Description |
|---|---|
field -
PlaybookRunSortField!
|
The field to sort by. Stability Level: 1.1 - Experimental (Active Development) |
order -
SortOrder!
|
The order in which to sort the field values. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"field": "name", "order": "asc"}
PlaybookRunOperation
Description
Operations available to perform on a playbook run.
Values
| Enum Value | Description |
|---|---|
|
|
Pauses a running playbook run. This has no effect on paused playbook runs. This sets the playbook run status to Stability Level: 1.1 - Experimental (Active Development) |
|
|
Resumes a paused playbook run. This has no effect on running playbook runs. This sets the playbook run status to Stability Level: 1.1 - Experimental (Active Development) |
|
|
Ends a playbook run. This sets the playbook run status to Stability Level: 1.1 - Experimental (Active Development) |
|
|
Confirms a running playbook's manual instruction or user confirmation step. A running playbook halts step evaluation at the instruction step until this operation is invoked. Stability Level: 1.1 - Experimental (Active Development) |
Example
"PAUSE"
PlaybookRunOperationConfirmStepParams
Description
Input parameters for the CONFIRM_STEP playbook run operation.
Example
{"stepIndex": 123, "comment": "xyz789"}
PlaybookRunOperationParameters
Description
Playbook run operation parameters. Only one of the fields should be defined.
Fields
| Input Field | Description |
|---|---|
confirmStep -
PlaybookRunOperationConfirmStepParams
|
Parameters required for the Stability Level: 1.1 - Experimental (Active Development) |
Example
{"confirmStep": PlaybookRunOperationConfirmStepParams}
PlaybookRunPerformOperationInput
Description
A request to perform an operation enumerated in PlaybookRunOperation on a playbook run.
Fields
| Input Field | Description |
|---|---|
id -
ID!
|
The playbook run ID. Stability Level: 1.1 - Experimental (Active Development) |
operation -
PlaybookRunOperation!
|
The operation to perform. Stability Level: 1.1 - Experimental (Active Development) |
parameters -
PlaybookRunOperationParameters
|
The playbook run operation parameters. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": 4,
"operation": "PAUSE",
"parameters": PlaybookRunOperationParameters
}
PlaybookRunPerformOperationPayload
Description
The result of performing an operation on a playbook run.
Fields
| Field Name | Description |
|---|---|
playbookRun -
PlaybookRun!
|
The playbook run on which the operation was performed. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbookRun": PlaybookRun,
"error": SystemError
}
PlaybookRunSortField
Description
Available playbook run fields to sort by.
Values
| Enum Value | Description |
|---|---|
|
|
The playbook run name. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run status, sorted in lifecycle order from playbook run creation to completion. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run schedule start time. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run start time. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run end time. Stability Level: 1.1 - Experimental (Active Development) |
Example
"name"
PlaybookRunStatus
Description
All playbook run states, used for both playbook run and playbook run steps.
Values
| Enum Value | Description |
|---|---|
|
|
The playbook run or step has not started yet. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run or step is in progress. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run or step is paused. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The in-progress playbook run or step started to pause, but is not completely paused. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run or step was paused, then started processing again, but has not completely resumed processing. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The in-progress playbook run or step started ending, but is not completely finished. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run or step is waiting for a user to take an action. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run or step is complete. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run or step ended with an error. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook run stopped prior to completion, but not due to an error. Stability Level: 1.1 - Experimental (Active Development) |
Example
"NOT_STARTED"
PlaybookRunStep
Description
A playbook run step.
Fields
| Field Name | Description |
|---|---|
playbookStep -
PlaybookStep!
|
The associated playbook step. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
status -
PlaybookRunStatus!
|
The playbook run step status. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
error -
String
|
The step error message, if any. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
progress -
[AutomateTaskProgress!]
|
The playbook run step progress. Not all steps return a progress. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
confirmationResult -
PlaybookRunStepConfirmationResult
|
The playbook run step confirmation result. Not all steps have a confirmation. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
taskArgumentOverride -
AutomateTaskArgument
|
The task argument override for this step. The playbook run uses the task argument override values for this step instead of the associated task values defined in the playbook. If this is Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
startTime -
Time
|
The playbook run step start time. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
endTime -
Time
|
The playbook run step end time. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbookStep": PlaybookStep,
"status": "NOT_STARTED",
"error": "abc123",
"progress": [AutomateTaskProgress],
"confirmationResult": PlaybookRunStepConfirmationResult,
"taskArgumentOverride": AutomateTaskArgumentDeployAction,
"startTime": "10:15:30Z",
"endTime": "10:15:30Z"
}
PlaybookRunStepConfirmationResult
Description
The confirmation result for a playbook run. This is provided when the playbook step type is PlaybookStepInstruction or PlaybookStepConfirmation.
Fields
| Field Name | Description |
|---|---|
completedUser -
TaniumPlatformUser!
|
The user who confirmed the step. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
completionTime -
Time!
|
The confirmation time of the step. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
comment -
String!
|
The comment added by the user. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"completedUser": TaniumPlatformUser,
"completionTime": "10:15:30Z",
"comment": "xyz789"
}
PlaybookSchedule
Description
A schedule for running a playbook on a recurring interval.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The playbook schedule ID. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
revision -
Int!
|
The playbook schedule revision. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
playbook -
Playbook!
|
The associated playbook. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
taskArgumentOverrides -
[PlaybookStepTaskArgumentOverride!]!
|
The step task argument overrides to be used for the playbook run created by this playbook schedule. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
cron -
CronExpression!
|
The schedule on which to run the associated playbook, expressed as a cron expression string. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
enabled -
Boolean!
|
Whether the playbook schedule is enabled, allowing the playbook to initiate playbook runs on this schedule. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
scheduledBy -
TaniumPlatformUserContext!
|
The user and persona whose permission set are used to access content for playbook runs created using the schedule. If the user does not have an active persona selected, the Default Persona is used. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
nextRunTime -
Time!
|
The date and time of the next run initiated by this schedule. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
createdTime -
Time!
|
The date and time at which the playbook schedule was created. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
updatedTime -
Time!
|
The date and time at which the playbook schedule was last updated. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": "4",
"revision": 987,
"playbook": Playbook,
"taskArgumentOverrides": [
PlaybookStepTaskArgumentOverride
],
"cron": CronExpression,
"enabled": true,
"scheduledBy": TaniumPlatformUserContext,
"nextRunTime": "10:15:30Z",
"createdTime": "10:15:30Z",
"updatedTime": "10:15:30Z"
}
PlaybookScheduleConnection
Description
A page of playbook schedule edges.
Fields
| Field Name | Description |
|---|---|
edges -
[PlaybookScheduleEdge!]!
|
The list of playbook schedule edges. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
pageInfo -
PageInfo!
|
Information about the playbook schedule collection. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
totalRecords -
Int!
|
The total number of playbook schedule records available. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"edges": [PlaybookScheduleEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
PlaybookScheduleEdge
Description
A playbook schedule within a page.
Fields
| Field Name | Description |
|---|---|
node -
PlaybookSchedule!
|
The playbook schedule. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"node": PlaybookSchedule,
"cursor": Cursor
}
PlaybookScheduleFieldFilter
Description
Describes a filter for playbook schedules field values. A playbook schedule must match every included filter to satisfy the filter.
Fields
| Input Field | Description |
|---|---|
playbookIDs -
[ID!]
|
The ID of the playbook associated with this playbook schedule must match any of the specified IDs. Stability Level: 1.1 - Experimental (Active Development) |
scheduledByIDs -
[ID!]
|
The playbook scheduling user ID must match any of the specified IDs. Stability Level: 1.1 - Experimental (Active Development) |
isEnabled -
Boolean
|
Whether a playbook schedule is enabled. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbookIDs": ["4"],
"scheduledByIDs": [4],
"isEnabled": true
}
PlaybookScheduleOperation
Description
Operations available to perform on a playbook schedule.
Values
| Enum Value | Description |
|---|---|
|
|
Enables a playbook schedule, allowing the playbook to initiate playbook runs on this schedule. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Disables a playbook schedule, preventing the playbook from initiating playbook runs on this schedule. Stability Level: 1.1 - Experimental (Active Development) |
|
|
Deletes a playbook schedule. Stability Level: 1.1 - Experimental (Active Development) |
Example
"ENABLE"
PlaybookSchedulePerformOperationInput
Description
A request to perform an operation enumerated in PlaybookScheduleOperation on a playbook schedule.
Fields
| Input Field | Description |
|---|---|
id -
ID!
|
The playbook schedule ID. Stability Level: 1.1 - Experimental (Active Development) |
operation -
PlaybookScheduleOperation!
|
The operation to perform. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"id": 4, "operation": "ENABLE"}
PlaybookSchedulePerformOperationPayload
Description
The result of performing an operation on a playbook schedule.
Fields
| Field Name | Description |
|---|---|
playbookSchedule -
PlaybookSchedule
|
The playbook schedule on which the operation was performed. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbookSchedule": PlaybookSchedule,
"error": SystemError
}
PlaybookScheduleUpsertInput
Description
A request to upsert a playbook schedule.
Fields
| Input Field | Description |
|---|---|
id -
ID
|
The playbook schedule ID. Stability Level: 1.1 - Experimental (Active Development) |
playbookID -
ID!
|
The associated playbook ID. Stability Level: 1.1 - Experimental (Active Development) |
taskArgumentOverrides -
[PlaybookStepTaskArgumentOverrideInput!]!
|
The step task argument overrides to be used for the playbook run created by this playbook schedule. Each task argument override must match the task type used in the referenced playbook step. If the defined task argument does not match the task type, the response returns an error. Stability Level: 1.1 - Experimental (Active Development) |
cron -
CronExpression!
|
The schedule on which to run the associated playbook, expressed as a cron expression string. Stability Level: 1.1 - Experimental (Active Development) |
enabled -
Boolean!
|
Whether the playbook schedule is enabled, allowing the playbook to initiate playbook runs on this schedule. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": "4",
"playbookID": 4,
"taskArgumentOverrides": [
PlaybookStepTaskArgumentOverrideInput
],
"cron": CronExpression,
"enabled": false
}
PlaybookScheduleUpsertPayload
Description
The result of upserting a playbook schedule.
Fields
| Field Name | Description |
|---|---|
playbookSchedule -
PlaybookSchedule
|
The upserted playbook schedule. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
isNewRecord -
Boolean
|
Whether the request created a new playbook schedule. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbookSchedule": PlaybookSchedule,
"isNewRecord": true,
"error": SystemError
}
PlaybookSortField
Description
Available playbook fields to sort by.
Values
| Enum Value | Description |
|---|---|
|
|
The playbook name. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The count of associated playbook schedules. Stability Level: 1.1 - Experimental (Active Development) |
|
|
The playbook's active runs count. Stability Level: 1.1 - Experimental (Active Development) |
Example
"name"
PlaybookStartInput
Description
A request to start a playbook.
Fields
| Input Field | Description |
|---|---|
id -
ID!
|
The ID of the playbook to start. Stability Level: 1.1 - Experimental (Active Development) |
taskArgumentOverrides -
[PlaybookStepTaskArgumentOverrideInput!]!
|
The step task argument overrides used for this playbook run. Each task argument override must match the task type used in the referenced playbook step. If the defined task argument does not match the task type, the response returns an error. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": "4",
"taskArgumentOverrides": [
PlaybookStepTaskArgumentOverrideInput
]
}
PlaybookStartPayload
Description
A response to a request to start a playbook.
Fields
| Field Name | Description |
|---|---|
playbookRun -
PlaybookRun
|
The created playbook run. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbookRun": PlaybookRun,
"error": SystemError
}
PlaybookStep
Description
A step in a playbook.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The step identifier, which is unique across all steps in the playbook. If this step is the first playbook step, the playbook Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
name -
String!
|
The step name. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
description -
String!
|
A step description. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
currentUserMissingPermissions -
[PlaybookStepMissingPermission!]
|
Additional permissions that the current user requires to run this step. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
endpointTargeting -
PlaybookStepTargeting
|
The criteria used by this step to target endpoints. If the task associated with this step implements Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
taskArgument -
AutomateTaskArgument!
|
The argument for the task to be performed in this step. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
nextStep -
PlaybookStep
|
The step that runs after this step completes. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
previousStep -
PlaybookStep
|
The step that runs before this step. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
metadata -
Map!
|
The playbook step metadata. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": 4,
"name": "xyz789",
"description": "xyz789",
"currentUserMissingPermissions": [
PlaybookStepMissingPermission
],
"endpointTargeting": PlaybookStepTargetingPreviousStep,
"taskArgument": AutomateTaskArgumentDeployAction,
"nextStep": PlaybookStep,
"previousStep": PlaybookStep,
"metadata": Map
}
PlaybookStepInput
Description
Input for a playbook step.
Fields
| Input Field | Description |
|---|---|
id -
ID!
|
The unique step identifier. If the step identifier is not unique across all steps in the playbook, the response returns an error. Reference this step ID as the playbook Stability Level: 1.1 - Experimental (Active Development) |
name -
String!
|
The step name. Stability Level: 1.1 - Experimental (Active Development) |
description -
String
|
The step description. Stability Level: 1.1 - Experimental (Active Development) |
endpointTargeting -
PlaybookStepTargetingInput
|
The criteria used by this step to target endpoints. If the task associated with this step implements Stability Level: 1.1 - Experimental (Active Development) |
taskArgument -
AutomateTaskArgumentInput!
|
The argument for the task to be performed in this step. Stability Level: 1.1 - Experimental (Active Development) |
nextStepID -
ID
|
The ID of the step that runs after this step completes. Stability Level: 1.1 - Experimental (Active Development) |
metadata -
Map
|
The playbook step metadata. For example, this might include additional data used for UI presentation. This is an untyped key/value map. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": 4,
"name": "abc123",
"description": "abc123",
"endpointTargeting": PlaybookStepTargetingInput,
"taskArgument": AutomateTaskArgumentInput,
"nextStepID": 4,
"metadata": Map
}
PlaybookStepMissingPermission
Description
Permissions required by the user submitting the request to access all step content.
Fields
| Field Name | Description |
|---|---|
permissionName -
String!
|
A named permission that the user submitting the request requires to access step content. If Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
contentSetID -
ID
|
The ID of a content set containing step content. If this field contains an ID, the user submitting the request requires the named permission to access this content set. If this is Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"permissionName": "abc123",
"contentSetID": "4"
}
PlaybookStepPatchInstallDeploymentConfig
Description
A Patch install deployment configuration. The patch deployment is created when this step is triggered in Automate. So the scheduling configuration is omitted from this configuration.
This is similar to PatchDeployment with the following fields removed: type, id, targets, schedule, author, createdTime, updatedTime, stoppedTime, status, downloadImmediately.
The following fields have been added from PatchSchedule: distributeOver, overrideMaintenanceWindows, eussHideFromActivity.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The deployment name. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
platform -
PlaybookPatchEndpointPlatform!
|
The deployment platform. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
contentSet -
IdRef!
|
The content set to which the deployment belongs. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
description -
String
|
The deployment description. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
contentDeploymentType -
PlaybookPatchContentDeploymentType!
|
The content deployment type. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
patchLists -
[PlaybookPatchListRef!]
|
Patch lists to include in the deployment. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
patches -
[IdRef!]
|
Individual patches to include in the deployment. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
overrideBlocklists -
Boolean!
|
Whether to install all specified patches regardless of block lists. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
restart -
Boolean!
|
Whether to restart the endpoint after deployment is complete. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
postDeploymentNotification -
PlaybookPatchClientNotification
|
Notification shown before restarting the endpoint after the end of the deployment. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
distributeOver -
MonotonicDuration
|
The duration over which the deployment start time is randomized on each endpoint by an amount of time up to the value configured. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
overrideMaintenanceWindows -
Boolean!
|
Whether to allow the deployment to run outside of configured maintenance windows. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
eussHideFromActivity -
Boolean
|
Whether the Activity tab in the Self Service Client application hides upcoming deployment activity from end users. Hidden deployments do not appear in the History tab. Only applies to Windows deployments. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"name": "xyz789",
"platform": "WINDOWS",
"contentSet": IdRef,
"description": "xyz789",
"contentDeploymentType": "MANUAL_SELECTION",
"patchLists": [PlaybookPatchListRef],
"patches": [IdRef],
"overrideBlocklists": true,
"restart": true,
"postDeploymentNotification": PlaybookPatchClientNotification,
"distributeOver": MonotonicDuration,
"overrideMaintenanceWindows": true,
"eussHideFromActivity": false
}
PlaybookStepPatchInstallDeploymentConfigInput
Description
Input for the Patch Install Deployment configuration. This is similar to PatchCreateDeploymentInput but the following fields are omitted: type, schedule, and targeting.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The deployment name. Stability Level: 1.1 - Experimental (Active Development) |
platform -
PlaybookPatchEndpointPlatform!
|
The deployment platform. Stability Level: 1.1 - Experimental (Active Development) |
contentSet -
IdRefInput!
|
The content set to which the deployment belongs. Stability Level: 1.1 - Experimental (Active Development) |
description -
String
|
The deployment description. Stability Level: 1.1 - Experimental (Active Development) |
contentDeploymentType -
PlaybookPatchContentDeploymentType!
|
The content deployment type. This must be Stability Level: 1.1 - Experimental (Active Development) |
patchLists -
[PlaybookPatchListRefInput!]
|
Patch lists to include in the deployment. Define at least one of Define exactly one of Stability Level: 1.1 - Experimental (Active Development) |
patches -
[IdRefInput!]
|
Individual patches to include in the deployment. Define at least one of Define exactly one of Stability Level: 1.1 - Experimental (Active Development) |
overrideBlocklists -
Boolean!
|
Whether to install all specified patches regardless of block lists. Stability Level: 1.1 - Experimental (Active Development) |
restart -
Boolean!
|
Whether to restart the endpoint after deployment is complete. Stability Level: 1.1 - Experimental (Active Development) |
postDeploymentNotification -
PlaybookPatchClientNotificationInput
|
Post-deployment notifications for Windows and macOS. Stability Level: 1.1 - Experimental (Active Development) |
distributeOver -
MonotonicDurationInput
|
The duration over which the deployment start time is randomized on each endpoint by an amount of time up to the value configured. Stability Level: 1.1 - Experimental (Active Development) |
overrideMaintenanceWindows -
Boolean!
|
Whether to allow the deployment to run outside of configured maintenance windows. Stability Level: 1.1 - Experimental (Active Development) |
eussHideFromActivity -
Boolean
|
Whether the Activity tab in the Self Service Client application hides upcoming deployment activity from end users. Hidden deployments do not appear in the History tab. Only applies to Windows deployments. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"name": "xyz789",
"platform": "WINDOWS",
"contentSet": IdRefInput,
"description": "abc123",
"contentDeploymentType": "MANUAL_SELECTION",
"patchLists": [PlaybookPatchListRefInput],
"patches": [IdRefInput],
"overrideBlocklists": false,
"restart": false,
"postDeploymentNotification": PlaybookPatchClientNotificationInput,
"distributeOver": MonotonicDurationInput,
"overrideMaintenanceWindows": true,
"eussHideFromActivity": true
}
PlaybookStepTargeting
Description
The endpoint targeting criteria that the step uses for evaluation.
Example
PlaybookStepTargetingPreviousStep
PlaybookStepTargetingCompletedPreviousStep
Description
The endpoint targeting criteria for endpoints that completed a previous step.
Fields
| Field Name | Description |
|---|---|
stepID -
ID!
|
A previous playbook run step ID, from which this step inherits endpoint targeting criteria for endpoints that successfully completed the previous step. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"stepID": "4"}
PlaybookStepTargetingCustom
Description
A custom set of endpoint targeting criteria.
Fields
| Field Name | Description |
|---|---|
targeting -
[EndpointTargeting!]!
|
The set of computer groups and sensors that target endpoints. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"targeting": [EndpointTargeting]}
PlaybookStepTargetingInput
Description
Input for the playbook step targeting. Define only one of previousStepTargeting, previousStepCompletedTargeting, or customTargeting.
Fields
| Input Field | Description |
|---|---|
previousStepTargetingID -
ID
|
A previous playbook run step ID from which to inherit endpoint targeting criteria. The referenced step must precede the current step, and must have endpoint targeting criteria (such as the Deploy Action step or Install Patch step). However, you cannot inherit endpoint targeting criteria from a Verify Condition step. The referenced step does not need to immediately precede this step, but it must be the first eligible step with endpoint targeting criteria when traversing backwards through the list of steps. You cannot skip a step with endpoint targeting criteria to reference one that comes earlier in the list. If the referenced step does not target endpoints (such as a Wait step), comes after the current step, or is a Verify Condition step, the response returns an error. Stability Level: 1.1 - Experimental (Active Development) |
previousStepCompletedTargetingID -
ID
|
A previous playbook run step ID, from which this step inherits endpoint targeting criteria for endpoints that successfully completed the previous step. The referenced step must precede the current step, and must have endpoint targeting criteria (such as the Deploy Action step or Install Patch step). However, you cannot inherit endpoint targeting criteria from a Verify Condition step. The referenced step does not need to immediately precede this step, but it must be the first eligible step with endpoint targeting criteria when traversing backwards through the list of steps. You cannot skip a step with endpoint targeting criteria to reference one that comes earlier in the list. If the referenced step does not target endpoints (such as a Wait step), comes after the current step, or is a Verify Condition step, the response returns an error. Stability Level: 1.1 - Experimental (Active Development) |
customTargeting -
ComputerGroupFilter
|
The custom endpoint targeting criteria, including computer group membership and sensor evaluation. A Tanium question returns endpoint results based on this targeting criteria. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"previousStepTargetingID": "4",
"previousStepCompletedTargetingID": 4,
"customTargeting": ComputerGroupFilter
}
PlaybookStepTargetingPreviousStep
Description
The endpoint targeting criteria used by a previous playbook run step.
Fields
| Field Name | Description |
|---|---|
stepID -
ID!
|
A previous playbook run step ID, from which this step inherits endpoint targeting criteria. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"stepID": 4}
PlaybookStepTaskArgumentOverride
Description
A task argument override for a playbook step.
Fields
| Field Name | Description |
|---|---|
stepId -
String!
|
The step ID associated with a task that this task argument overrides. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
taskArgument -
AutomateTaskArgument!
|
The task argument that overrides the task referenced in the associated step. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"stepId": "xyz789",
"taskArgument": AutomateTaskArgumentDeployAction
}
PlaybookStepTaskArgumentOverrideInput
Description
A request to define a task argument override. The playbook run uses the task argument override values for the associated step instead of the step task values defined in the playbook. The defined task argument must match the task type used in the referenced playbook step. If the defined task argument does not match the task type, the response returns an error.
Fields
| Input Field | Description |
|---|---|
stepId -
String!
|
The step ID associated with a task that this task argument overrides. Stability Level: 1.1 - Experimental (Active Development) |
taskArgument -
AutomateTaskArgumentInput!
|
The task argument that overrides the task referenced in the associated step. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"stepId": "abc123",
"taskArgument": AutomateTaskArgumentInput
}
PlaybookUpsertInput
Description
A request to upsert a playbook.
Fields
| Input Field | Description |
|---|---|
id -
ID
|
The playbook ID. Stability Level: 1.1 - Experimental (Active Development) |
contentSet -
NamedRefInput
|
The name of the content set to which this playbook belongs. Stability Level: 1.1 - Experimental (Active Development) |
name -
String!
|
The playbook name. Stability Level: 1.1 - Experimental (Active Development) |
description -
String
|
The playbook description. Stability Level: 1.1 - Experimental (Active Development) |
steps -
[PlaybookStepInput!]!
|
The steps that this playbook contains. The order of items in the list has no effect. The starting step is notated by the Upsert returns an error when:
Stability Level: 1.1 - Experimental (Active Development) |
startingStepID -
ID!
|
The ID of the first step to run when the playbook starts. Stability Level: 1.1 - Experimental (Active Development) |
notificationSettings -
PlaybookNotificationSettingsInput
|
The playbook notification settings. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": 4,
"contentSet": NamedRefInput,
"name": "abc123",
"description": "xyz789",
"steps": [PlaybookStepInput],
"startingStepID": "4",
"notificationSettings": PlaybookNotificationSettingsInput
}
PlaybookUpsertPayload
Description
The result of upserting a playbook.
Fields
| Field Name | Description |
|---|---|
playbook -
Playbook
|
The upserted playbook. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
isNewRecord -
Boolean
|
Whether the request created a new playbook. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"playbook": Playbook,
"isNewRecord": false,
"error": SystemError
}
Principal
Process
Description
A process running on an endpoint.
Fields
| Field Name | Description |
|---|---|
pid -
Int!
|
The ID of the process. Stability Level: 3 - Stable |
ppid -
Int!
|
The ID of the parent of this process. Stability Level: 3 - Stable |
name -
String!
|
The name of the process. Stability Level: 3 - Stable |
commandLine -
String!
|
The command line of the process. Stability Level: 3 - Stable |
userName -
String!
|
The name of the user that started the process. Stability Level: 3 - Stable |
groupName -
String!
|
The group name of the process. Stability Level: 3 - Stable |
cpuUserTimeSeconds -
Float!
|
The seconds of CPU user time used by the process. Stability Level: 3 - Stable |
cpuKernelTimeSeconds -
Float!
|
The seconds of CPU kernel time used by the process. Stability Level: 3 - Stable |
cpuUsagePercent -
Float!
|
The current CPU usage as a percent from 0 to 100. Stability Level: 3 - Stable |
memoryResidentBytes -
Int!
|
The number of memory resident bytes used by the process. Stability Level: 3 - Stable |
Example
{
"pid": 123,
"ppid": 987,
"name": "xyz789",
"commandLine": "abc123",
"userName": "abc123",
"groupName": "abc123",
"cpuUserTimeSeconds": 123.45,
"cpuKernelTimeSeconds": 123.45,
"cpuUsagePercent": 123.45,
"memoryResidentBytes": 123
}
Processor
Description
The processor details of an endpoint.
Fields
| Field Name | Description |
|---|---|
cpu -
String!
|
The description of the CPU. Example: Intel(R) Core(TM) i5-2500 CPU @ 3.30GHz Sensor: CPU Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
architecture -
String!
|
The architecture of the CPU. Example: i386, X86-based PC Sensor: CPU Architecture Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
cacheSize -
String!
|
The cache size of the CPU in KB. Example: 1024 KB Sensor: CPU Cache Size Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
consumption -
String!
|
The current total CPU consumption as a percentage ( Example: 50% Sensor: CPU Consumption Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
highConsumption -
String!
|
Indicates whether the client machine is currently experiencing high utilization of its CPU. Example: Under threshold Sensor: High CPU Consumption Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
family -
String!
|
The CPU family. Example: Xeon, Family 198 Sensor: CPU Family Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
manufacturer -
String!
|
The CPU manufacturer. Example: GenuineIntel Sensor: CPU Manufacturer Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
speed -
String!
|
The speed of the CPU in megahertz. Example: 3200 Mhz Sensor: CPU Speed Mhz Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
revision -
String!
|
The revision number of the CPU. Example: 5898 Sensor: Revision of CPU Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
logicalProcessors -
Int!
|
The number of logical processors. Example: 8 Sensor: CPU Details, Column: Total Logical Processors Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{
"cpu": "abc123",
"architecture": "xyz789",
"cacheSize": "xyz789",
"consumption": "xyz789",
"highConsumption": "xyz789",
"family": "xyz789",
"manufacturer": "abc123",
"speed": "xyz789",
"revision": "xyz789",
"logicalProcessors": 123
}
Report
Description
A report.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The ID of the report. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
name -
String!
|
The report name. Note that reports are not required to have unique names. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
description -
String!
|
The description of the report. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
contentSet -
NamedRef!
|
The content set associated with the report. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
labels -
[String!]
|
The labels associated with the report. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
createdTime -
Time!
|
The time at which the report was created. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
author -
Principal!
|
The report's creator. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
modifiedTime -
Time!
|
The time at which the report was most recently modified. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
lastModifiedBy -
Principal!
|
The user who most recently modified the report. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
moduleName -
String
|
The name of the Tanium module the report is associated with. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
favorite -
Boolean!
|
Indicates this report is marked as a favorite by the current user. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
viewDetails -
ReportView!
|
The report view details. These details are read-only through this query. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"id": "4",
"name": "xyz789",
"description": "abc123",
"contentSet": NamedRef,
"labels": ["xyz789"],
"createdTime": "10:15:30Z",
"author": Principal,
"modifiedTime": "10:15:30Z",
"lastModifiedBy": Principal,
"moduleName": "xyz789",
"favorite": false,
"viewDetails": ReportView
}
ReportConnection
Description
A page of report edges.
Fields
| Field Name | Description |
|---|---|
edges -
[ReportEdge!]!
|
The list of report edges. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the report collection. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of report records available. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"edges": [ReportEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
ReportDeletePayload
Description
The result of deleting a report.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The ID of the report. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"id": "4",
"error": SystemError
}
ReportEdge
Description
A report within a page.
Example
{"node": Report, "cursor": Cursor}
ReportExportPayload
Description
A response to a request to export a report definition.
Fields
| Field Name | Description |
|---|---|
reportDefinition -
String!
|
The exported report definition data. You can import this report definition using the Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{"reportDefinition": "xyz789"}
ReportFieldFilter
Description
Describes a filter for report field values. A report must match every included filter condition to satisfy the filter.
Fields
| Input Field | Description |
|---|---|
moduleNames -
[String!]
|
Report module name must match one of the specified values. Stability Level: 3 - Stable |
authorNames -
[String!]
|
Report author must match one of the specified values. Stability Level: 3 - Stable |
createdBefore -
Time
|
Report creation time must be before the specified time. Stability Level: 3 - Stable |
createdAfter -
Time
|
Report creation time must be after the specified time. Stability Level: 3 - Stable |
text -
String
|
Report name or description must contain the specified text value. Stability Level: 3 - Stable |
contentSetNames -
[String!]
|
Report content set name must match one of the specified values. Stability Level: 3 - Stable |
labels -
[String!]
|
A report label must match one of the specified values. Stability Level: 3 - Stable |
Example
{
"moduleNames": ["abc123"],
"authorNames": ["abc123"],
"createdBefore": "10:15:30Z",
"createdAfter": "10:15:30Z",
"text": "abc123",
"contentSetNames": ["xyz789"],
"labels": ["xyz789"]
}
ReportImportInput
Description
A request to import a report definition.
Fields
| Input Field | Description |
|---|---|
allowDuplicate -
Boolean!
|
Specifies whether the operation should allow the import of a report definition with the same name as an existing report. If you import a report definition with the same name as an existing report, this import does not overwrite the existing report. Stability Level: 3 - Stable |
reportDefinition -
String!
|
The report definition data to construct the report from. Must originate from running the Stability Level: 3 - Stable |
Example
{
"allowDuplicate": false,
"reportDefinition": "xyz789"
}
ReportImportPayload
Description
A response to a request to import a report definition.
Fields
| Field Name | Description |
|---|---|
report -
Report
|
The report created by the request. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"report": Report,
"error": SystemError
}
ReportResultDataCollectionInfo
Description
Information about the report data results that populate a ReportResultDataConnection.
Fields
| Field Name | Description |
|---|---|
active -
Boolean!
|
Indicates results may still continue to accumulate in the underlying collection, and you may refresh the cursor to get complete results. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
startCursor -
Cursor
|
The cursor for the beginning of the collection. This will be populated if the collection is empty, as long as the collection has the possibility of being refreshed with new results. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{"active": false, "startCursor": Cursor}
ReportResultDataColumn
Description
A report result data column.
Fields
| Field Name | Description |
|---|---|
values -
[String!]
|
The list of values for the column. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{"values": ["abc123"]}
ReportResultDataConnection
Description
A page of report result data.
Fields
| Field Name | Description |
|---|---|
viewDetails -
ReportView!
|
The report view details. These details are read-only through this query. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
edges -
[ReportResultDataEdge!]!
|
The list of report result data edges. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the report result data collection. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of report result data entries available. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
collectionInfo -
ReportResultDataCollectionInfo!
|
Information about the report data results that contribute to the collection. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"viewDetails": ReportView,
"edges": [ReportResultDataEdge],
"pageInfo": PageInfo,
"totalRecords": 123,
"collectionInfo": ReportResultDataCollectionInfo
}
ReportResultDataEdge
Description
A report result data row within a page.
Fields
| Field Name | Description |
|---|---|
node -
ReportResultDataRow!
|
The report result data row. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
cursor -
Cursor!
|
The cursor of this edge within the collection. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"node": ReportResultDataRow,
"cursor": Cursor
}
ReportResultDataRow
Description
A report result data row.
Fields
| Field Name | Description |
|---|---|
columns -
[ReportResultDataColumn!]!
|
The data columns in a report result data row. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
count -
Int!
|
The total count of entities grouped into a result data row. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{"columns": [ReportResultDataColumn], "count": 987}
ReportView
Description
The view details of a report. This determines what data the report returns and how the data is sorted through the reportResultData query.
Fields
| Field Name | Description |
|---|---|
sources -
[ReportViewSource!]!
|
The data sources queried by the view. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
columns -
[ReportViewColumn!]!
|
The columns queried by the view. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
sort -
[ReportViewColumnSort!]!
|
The sort order of columns within the view. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"sources": [ReportViewSource],
"columns": [ReportViewColumn],
"sort": [ReportViewColumnSort]
}
ReportViewColumn
Description
A column used in a report view.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the report column. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
sourceName -
String!
|
The name of the report source this column is derived from. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
sourceColumnName -
String!
|
The name of the report source column that this column is derived from. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"sourceName": "xyz789",
"sourceColumnName": "xyz789"
}
ReportViewColumnSort
Description
Defines the sort order of a column within a report view.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the report column being sorted. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
index -
Int!
|
The index of the column being sorted. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
descending -
Boolean!
|
Whether the column is sorted in descending order (high to low). Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"index": 987,
"descending": true
}
ReportViewSource
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The name of the report source. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
flatten -
Boolean!
|
Whether result data from this report is flattened. For more information, see Tanium Reporting User Guide: Flattened data Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{"name": "xyz789", "flatten": true}
ReportingDashboardDeletePayload
Description
The result of deleting a Reporting dashboard.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The dashboard ID. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Use of this field requires the Reporting solution. Stability Level: 3 - Stable |
Example
{"id": 4, "error": SystemError}
ScheduledAction
Description
A scheduled action.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The ID of the scheduled action. Stability Level: 3 - Stable |
targets -
ActionTargets!
|
The endpoints on which the scheduled action runs. Stability Level: 3 - Stable |
package -
PackageRef!
|
The package containing the action script and any other files. Stability Level: 3 - Stable |
distributeSeconds -
Int
|
The time over which to distribute actions to endpoints in batches, to prevent spikes in network traffic or other resource consumption. Stability Level: 3 - Stable |
expireSeconds -
Int
|
The time for which any given action is active. Stability Level: 3 - Stable |
endTime -
Time
|
The end time of a scheduled action. If this is Stability Level: 3 - Stable |
issueSeconds -
Int
|
The time between action runs. Stability Level: 3 - Stable |
startTime -
Time
|
The start time of the scheduled action. Stability Level: 3 - Stable |
name -
String!
|
The name of the scheduled action. Stability Level: 3 - Stable |
comment -
String!
|
A short description of the scheduled action. Stability Level: 3 - Stable |
approved -
Boolean!
|
Indicates the scheduled action is allowed to create actions. Stability Level: 3 - Stable |
issueCount -
Int!
|
The number of actions created by the scheduled action. Stability Level: 3 - Stable |
lastStartTime -
Time
|
The most recent time at which an action was created by the scheduled action. Stability Level: 3 - Stable |
nextStartTime -
Time
|
The next time at which an action will be created by the scheduled action. Stability Level: 3 - Stable |
status -
ScheduledActionStatus
|
The status of the scheduled action. Stability Level: 3 - Stable |
creator -
Principal!
|
The scheduled action's creator. Stability Level: 3 - Stable |
approver -
Principal
|
The scheduled action's approver, if any. Stability Level: 3 - Stable |
metadata -
[Metadata!]!
|
The Tanium server metadata about the scheduled action. Stability Level: 3 - Stable |
lastAction -
Action
|
The action most recently created by the scheduled action. Stability Level: 3 - Stable |
Example
{
"id": "4",
"targets": ActionTargets,
"package": PackageRef,
"distributeSeconds": 123,
"expireSeconds": 987,
"endTime": "10:15:30Z",
"issueSeconds": 123,
"startTime": "10:15:30Z",
"name": "abc123",
"comment": "xyz789",
"approved": false,
"issueCount": 123,
"lastStartTime": "10:15:30Z",
"nextStartTime": "10:15:30Z",
"status": "ENABLED",
"creator": Principal,
"approver": Principal,
"metadata": [Metadata],
"lastAction": Action
}
ScheduledActionApprovePayload
Description
The result of approving a scheduled action.
Fields
| Field Name | Description |
|---|---|
id -
ID
|
The ID of the scheduled action. Stability Level: 3 - Stable |
approved -
Boolean
|
Indicates that the scheduled action was approved, or not, if known. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 3 - Stable |
Example
{"id": 4, "approved": false, "error": SystemError}
ScheduledActionConnection
Description
A page of scheduled action edges.
Fields
| Field Name | Description |
|---|---|
edges -
[ScheduledActionEdge!]!
|
The list of scheduled action edges. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the scheduled action collection. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of scheduled action records available. Stability Level: 3 - Stable |
Example
{
"edges": [ScheduledActionEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
ScheduledActionCreateInput
Description
A request to create a scheduled action.
Fields
| Input Field | Description |
|---|---|
targets -
ActionTargetsInput!
|
The endpoints on which the actions run. Stability Level: 3 - Stable |
package -
PackageRefInput!
|
The package containing the action script and any other files. Stability Level: 3 - Stable |
schedule -
ScheduledActionScheduleInput!
|
The schedule on which the actions run. Stability Level: 3 - Stable |
name -
String
|
The scheduled action name. Note that scheduled actions are not required to have unique names. Stability Level: 3 - Stable |
comment -
String
|
A short description. Stability Level: 3 - Stable |
Example
{
"targets": ActionTargetsInput,
"package": PackageRefInput,
"schedule": ScheduledActionScheduleInput,
"name": "xyz789",
"comment": "xyz789"
}
ScheduledActionCreatePayload
Description
The result of creating a scheduled action.
Fields
| Field Name | Description |
|---|---|
scheduledAction -
ScheduledAction
|
The newly created scheduled action. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"scheduledAction": ScheduledAction,
"error": SystemError
}
ScheduledActionDeletePayload
Description
The result of deleting a scheduled action.
Fields
| Field Name | Description |
|---|---|
id -
ID
|
The ID of the scheduled action. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 3 - Stable |
Example
{"id": 4, "error": SystemError}
ScheduledActionEdge
Description
A scheduled action within a page.
Fields
| Field Name | Description |
|---|---|
node -
ScheduledAction!
|
The scheduled action. Stability Level: 3 - Stable |
cursor -
Cursor!
|
The cursor of this edge within the collection. Stability Level: 3 - Stable |
Example
{
"node": ScheduledAction,
"cursor": Cursor
}
ScheduledActionScheduleInput
Description
The schedule on which the action should run.
Fields
| Input Field | Description |
|---|---|
distributeSeconds -
Int
|
The time over which to distribute actions to endpoints in batches, to prevent spikes in network traffic or other resource consumption. A value of Stability Level: 3 - Stable |
expireSeconds -
Int
|
The time for which any given action is active. This both defaults to and must be greater than or equal to either the package's expiration time or the sum of the package's command timeout and the Stability Level: 3 - Stable |
reissueSeconds -
Int!
|
The time between recurring action runs. This must be greater than the Stability Level: 3 - Stable |
startTime -
Time
|
The start time of the action. This defaults to the current time. Stability Level: 3 - Stable |
endTime -
Time
|
The end time of a scheduled action. The default value is Stability Level: 3 - Stable |
Example
{
"distributeSeconds": 123,
"expireSeconds": 987,
"reissueSeconds": 987,
"startTime": "10:15:30Z",
"endTime": "10:15:30Z"
}
ScheduledActionStatus
Description
The status of a scheduled action.
Values
| Enum Value | Description |
|---|---|
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
Example
"ENABLED"
Sensor
Description
A sensor is a named source of endpoint data. Normal sensors are managed by the Tanium Server and executed as scripts on endpoints. Virtual sensors are managed by TDS and typically store data computed and asserted by various systems.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The sensor name. Stability Level: 3 - Stable |
lastUpdatedBy -
String!
|
The name of the user that last modified this entity. Stability Level: 3 - Stable |
description -
String!
|
The sensor description. Stability Level: 3 - Stable |
contentSetName -
String!
|
The name of the content set assigned to the package. The content set controls access to the package.
Stability Level: 2 - Legacy Use |
contentSet -
TaniumPlatformContentSet
|
The content set assigned to the sensor. The content set controls access to the sensor. Stability Level: 1.2 - Experimental (Release Candidate) |
virtual -
Boolean!
|
Indicates that the sensor is virtual, managed by TDS, and not available to TS queries. Stability Level: 3 - Stable |
parameters -
[SensorParameter!]
|
The list of parameters accepted when reading the sensor. This is Stability Level: 3 - Stable |
columns -
[SensorColumn!]
|
The list of columns provided by the sensor. This is Stability Level: 3 - Stable |
harvested -
Boolean!
|
Indicates that the sensor is harvested in TDS. Parameterized sensors are never harvested directly; these sensors are harvested with specific sets of parameter values. See the Stability Level: 3 - Stable |
endpointQueryPaths -
[String!]!
|
The list of paths in the endpoints query in which this sensor is read. For example, Stability Level: 3 - Stable |
parameterizations -
[SensorParameterization!]
|
The sets of parameter values for this parameterized sensor that are important, by virtue of being harvested, registered in the endpoints query schema, or similar. This is Stability Level: 3 - Stable |
category -
String!
|
The sensor category. The value Stability Level: 3 - Stable |
maxAgeSeconds -
Int
|
The maximum age of sensor readings in seconds. This is absent for virtual sensors. Stability Level: 3 - Stable |
ignoreCase -
Boolean!
|
Indicates the system should ignore case when comparing sensor readings. Stability Level: 3 - Stable |
keepDuplicatesFlag -
Boolean
|
Indicates that sensors should report all values if a reading obtains duplicates. This is absent for virtual sensors. Stability Level: 3 - Stable |
valueType -
String!
|
The type of value returned by the sensor, used to compare and sort values. The system does not validate or enforce these types. Stability Level: 3 - Stable |
scripts -
[SensorScript!]
|
The scripts which implement the sensor on the various platforms. This is absent for virtual sensors. Stability Level: 3 - Stable |
created -
Time
|
When the sensor was created, if known. Stability Level: 3 - Stable |
updated -
Time
|
When the sensor was last updated, if known. Stability Level: 3 - Stable |
hidden -
Boolean!
|
Indicates the sensor is hidden by default. Note that the Tanium Core Platform, Tanium solutions, or Tanium shared services might use a given hidden sensor. Using or editing a hidden sensor might negatively impact Tanium functionality that relies upon the sensor. Hidden sensors are subject to change without notice. Stability Level: 3 - Stable |
Example
{
"name": "xyz789",
"lastUpdatedBy": "xyz789",
"description": "abc123",
"contentSetName": "xyz789",
"contentSet": TaniumPlatformContentSet,
"virtual": true,
"parameters": [SensorParameter],
"columns": [SensorColumn],
"harvested": true,
"endpointQueryPaths": ["abc123"],
"parameterizations": [SensorParameterization],
"category": "xyz789",
"maxAgeSeconds": 987,
"ignoreCase": true,
"keepDuplicatesFlag": false,
"valueType": "xyz789",
"scripts": [SensorScript],
"created": "10:15:30Z",
"updated": "10:15:30Z",
"hidden": true
}
SensorColumn
Description
A sensor column describes a named portion of a sensor reading.
Fields
| Field Name | Description |
|---|---|
name -
String!
|
The column name. Stability Level: 3 - Stable |
ignoreCase -
Boolean!
|
Indicates the system should ignore case when comparing column values. Stability Level: 3 - Stable |
valueType -
String!
|
The type of value in the column, used to compare and sort values. The system does not validate or enforce these types. Stability Level: 3 - Stable |
hidden -
Boolean!
|
Indicates the column is hidden by default. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"ignoreCase": true,
"valueType": "xyz789",
"hidden": false
}
SensorConnection
Description
A page of sensor edges.
Fields
| Field Name | Description |
|---|---|
edges -
[SensorEdge!]!
|
The list of sensor edges. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the sensor collection. Stability Level: 3 - Stable |
totalRecords -
Int!
|
The total number of sensor records available. Stability Level: 3 - Stable |
Example
{
"edges": [SensorEdge],
"pageInfo": PageInfo,
"totalRecords": 987
}
SensorEdge
SensorHarvestInput
Description
A request to manage the harvest registration of a sensor in TDS.
Fields
| Input Field | Description |
|---|---|
name -
String!
|
The name of the sensor to harvest. Stability Level: 3 - Stable |
parameters -
[EndpointSensorRefParam!]
|
The values of the parameterizable sensor to harvest. Stability Level: 3 - Stable |
integrationName -
String!
|
The name of the integration for which the sensor is being harvested. This should be a lowercase compound string joined by hyphens, where the first part indicates the name of the company responsible for the integration and the second part indicates the name or purpose of the integration. The prefix Stability Level: 3 - Stable |
harvest -
Boolean!
|
Indicates the sensor is being registered or deregistered for harvest. Stability Level: 3 - Stable |
cursor -
Cursor
|
The cursor value from a previous sensor harvest request. Stability Level: 3 - Stable |
Example
{
"name": "abc123",
"parameters": [EndpointSensorRefParam],
"integrationName": "abc123",
"harvest": false,
"cursor": Cursor
}
SensorHarvestPayload
Description
A response to a harvest registration request.
Fields
| Field Name | Description |
|---|---|
cursor -
Cursor
|
Indicates the request is not complete and provides an identifier for subsequent calls to determine the request's terminal state. Stability Level: 3 - Stable |
success -
Boolean
|
Indicates the request completed successfully or failed. Stability Level: 3 - Stable |
error -
SystemError
|
Specifies that the request terminated in an error. Stability Level: 3 - Stable |
Example
{
"cursor": Cursor,
"success": false,
"error": SystemError
}
SensorParameter
Description
A sensor parameter describes an argument to a sensor.
Example
{
"name": "xyz789",
"defaultValue": "xyz789"
}
SensorParameterValue
SensorParameterization
Description
A sensor parameterization is a specific set of sensor parameter values.
Fields
| Field Name | Description |
|---|---|
values -
[SensorParameterValue!]!
|
The values of this parameterization. The values are returned in the order parameters are defined in the sensor definition. Stability Level: 3 - Stable |
harvested -
Boolean!
|
Indicates the parameterized sensor is registered for harvest in TDS with these values. Stability Level: 3 - Stable |
endpointQueryPaths -
[String!]!
|
The list of paths in the endpoints query in which this sensor is read with these parameters. Stability Level: 3 - Stable |
Example
{
"values": [SensorParameterValue],
"harvested": false,
"endpointQueryPaths": ["xyz789"]
}
SensorScript
Description
The script implementing a sensor for a given platform.
Fields
| Field Name | Description |
|---|---|
platform -
EndpointPlatform!
|
The platform on which the sensor script runs. Stability Level: 3 - Stable |
source -
String!
|
The source code. Stability Level: 3 - Stable |
type -
SensorScriptType!
|
The type. Stability Level: 3 - Stable |
Example
{
"platform": "Unknown",
"source": "abc123",
"type": "Unknown"
}
SensorScriptType
Description
The types of sensor scripts allowed by the platform.
Values
| Enum Value | Description |
|---|---|
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
Example
"Unknown"
SensorValueFilter
Description
Describes a filter for endpoint sensor values. Sensor values matching the filter are included in the query results. Sensor value filters may be single or compound (nested one level deep).
Any filter that is not valid causes the query to return an error.
Fields
| Input Field | Description |
|---|---|
column -
String
|
The name of the sensor column to apply the filter to. If this does not resolve to an existing column name on the associated sensor, the query returns an error. This is required for single sensor value filters, and ignored for compound sensor value filters. Stability Level: 3 - Stable |
op -
SensorValueFilterOp!
|
The operator by which to compare the specified value to the sensor value. This is required for single sensor value filters, and ignored for compound sensor value filters. Stability Level: 3 - Stable |
value -
String
|
The constant value to compare with the sensor value, expressed as a string. This is required for single sensor value filters, and not allowed for compound sensor value filters. Stability Level: 3 - Stable |
filters -
[SensorValueFilter!]
|
Describes the set of filters which comprise this compound filter. All of the filters comprising this compound filter must pass for the compound filter to pass. This is required for compound sensor value filters, and not allowed for single sensor value filters. Stability Level: 3 - Stable |
any -
Boolean!
|
Indicates that if any of the filters comprising this compound filter passes, the compound filter passes. This defaults to This is allowed for compound field filters and ignored for single field filters. Stability Level: 3 - Stable |
restrictOwner -
Boolean!
|
Indicates that the filters should apply to owner records participating in the query, in addition to returned field values. This can be used to exclude records that do not match the filter, or would return an undefined value such as This is ignored for filters at the root level of a query. Stability Level: 3 - Stable |
negated -
Boolean!
|
Indicates that the filter is negated. Records with field values matching the filter are excluded from the query results. Negating the For more information, see Tanium Console User Guide: Processing limits for regular expressions Stability Level: 1.2 - Experimental (Release Candidate) |
Example
{
"column": "abc123",
"op": "EQ",
"value": "abc123",
"filters": [SensorValueFilter],
"any": false,
"restrictOwner": false,
"negated": true
}
SensorValueFilterOp
Description
The set of operations permitted on SensorValueFilter instances.
Values
| Enum Value | Description |
|---|---|
|
|
The equality operator. The sensor value and specified values must be equal. Stability Level: 3 - Stable |
|
|
The less than operator. The sensor value must be less than the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
LTE is the less than or equals operator, the sensor value must be less than or equal to the given value. This is only valid for comparable types. Stability Level: 3 - Stable |
|
|
The greater than operator. The sensor value must be greater than the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
The greater than or equals operator. The sensor value must be greater than or equal to the specified value. This is valid only for comparable types. Stability Level: 3 - Stable |
|
|
The string contains operator. The sensor value must contain the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string starts with operator. The sensor value must start with the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string ends with operator. The sensor value must end with the specified value. This is valid only for string types. Stability Level: 3 - Stable |
|
|
The string matches operator. The sensor value must fully match the specified value, which is interpreted as a regular expression in Perl syntax. This is valid only for string types. Stability Level: 3 - Stable |
Example
"EQ"
Signal
Description
The set of signals that can be sent to processes.
Values
| Enum Value | Description |
|---|---|
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
Example
"SIGINT"
SoftwareApplicabilityCounts
Description
The number of endpoints in each applicability status.
Fields
| Field Name | Description |
|---|---|
installEligibleCount -
Int!
|
The number of endpoints where the software is not installed and system requirements are met. Stability Level: 3 - Stable |
installedCount -
Int!
|
The number of systems where the software package is already installed. Stability Level: 3 - Stable |
notApplicableCount -
Int!
|
The number of endpoints where the system requirements or prerequisites are not met. Stability Level: 3 - Stable |
updateEligibleCount -
Int!
|
The number of endpoints where one or more of the previous versions of the application are detected, and the software package can update those systems. Stability Level: 3 - Stable |
updateIneligibleCount -
Int!
|
The number of endpoints where one or more of the previous versions of the application are detected, but the system requirements are not met. Stability Level: 3 - Stable |
Example
{
"installEligibleCount": 123,
"installedCount": 987,
"notApplicableCount": 123,
"updateEligibleCount": 987,
"updateIneligibleCount": 123
}
SoftwareDeploymentDetails
Description
The details of a software deployment.
Fields
| Field Name | Description |
|---|---|
ID -
ID!
|
The ID of the software deployment. Stability Level: 3 - Stable |
name -
String!
|
The name of the software deployment. Stability Level: 3 - Stable |
errors -
[SoftwareDeploymentErrorCount!]
|
Any error messages logged during software deployment. Stability Level: 3 - Stable |
status -
SoftwareDeploymentStatus
|
The status of the software deployment. Stability Level: 3 - Stable |
Example
{
"ID": "4",
"name": "abc123",
"errors": [SoftwareDeploymentErrorCount],
"status": SoftwareDeploymentStatus
}
SoftwareDeploymentErrorCount
SoftwareDeploymentStatus
Description
The status and related details of a software deployment.
Fields
| Field Name | Description |
|---|---|
label -
SoftwareDeploymentStatusLabel!
|
The status label for the software deployment. Stability Level: 3 - Stable |
completeCount -
Int!
|
The number of endpoints where the deployment completed. Stability Level: 3 - Stable |
downloadCompleteWaitingCount -
Int!
|
The number of endpoints that finished downloading files and are waiting to run the deployment. Stability Level: 3 - Stable |
downloadingCount -
Int!
|
The number of endpoints that are downloading required files. Stability Level: 3 - Stable |
failedCount -
Int!
|
The number of endpoints where the deployment failed. Stability Level: 3 - Stable |
notApplicableCount -
Int!
|
The number of endpoints where the system requirements or prerequisites are not met. Stability Level: 3 - Stable |
runningCount -
Int!
|
The number of endpoints that finished downloading files and are running the deployment. Stability Level: 3 - Stable |
waitingCount -
Int!
|
The number of endpoints waiting to run the deployment. Stability Level: 3 - Stable |
Example
{
"label": "ACTIVE",
"completeCount": 123,
"downloadCompleteWaitingCount": 987,
"downloadingCount": 123,
"failedCount": 123,
"notApplicableCount": 987,
"runningCount": 987,
"waitingCount": 123
}
SoftwareDeploymentStatusLabel
Description
The set of status labels for a software deployment.
Values
| Enum Value | Description |
|---|---|
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
Example
"ACTIVE"
SoftwareOperation
Description
The set of operations permitted for software package deployments.
Values
| Enum Value | Description |
|---|---|
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
|
|
Stability Level: 3 - Stable |
Example
"INSTALL"
SoftwarePackage
Description
The details of a software package.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The ID of the software package. Stability Level: 3 - Stable |
platform -
EndpointPlatform!
|
The operating system platform on which the software package runs. Stability Level: 3 - Stable |
productName -
String!
|
The name of the software package. Stability Level: 3 - Stable |
productVendor -
String!
|
The vendor of the software package. Stability Level: 3 - Stable |
productVersion -
String!
|
The version of the software package. Stability Level: 3 - Stable |
applicabilityCounts -
SoftwareApplicabilityCounts
|
The number of endpoints in each applicability status. Stability Level: 3 - Stable |
Example
{
"id": 4,
"platform": "Unknown",
"productName": "abc123",
"productVendor": "xyz789",
"productVersion": "xyz789",
"applicabilityCounts": SoftwareApplicabilityCounts
}
SoftwarePackageConnection
Description
A page of software packages.
Fields
| Field Name | Description |
|---|---|
edges -
[SoftwarePackageEdge]!
|
The list of software package edges. Stability Level: 3 - Stable |
pageInfo -
PageInfo!
|
Information about the software package collection. Stability Level: 3 - Stable |
totalCount -
Int!
|
The total number of records in the software package collection. Stability Level: 3 - Stable |
Example
{
"edges": [SoftwarePackageEdge],
"pageInfo": PageInfo,
"totalCount": 123
}
SoftwarePackageEdge
Description
A software package within a page.
Fields
| Field Name | Description |
|---|---|
cursor -
Cursor!
|
The cursor of this edge within the collection. Stability Level: 3 - Stable |
node -
SoftwarePackage!
|
The software package. Stability Level: 3 - Stable |
Example
{
"cursor": Cursor,
"node": SoftwarePackage
}
SoftwareTarget
Description
The endpoints on which to perform a software management operation.
Fields
| Input Field | Description |
|---|---|
targetGroup -
String
|
The name of the group of endpoints on which to perform the operation. This is a subset of the action group. This defaults to the Stability Level: 3 - Stable |
endpoints -
[ID]
|
The list of endpoint IDs on which to perform the operation. You can add up to 25 endpoints. Stability Level: 3 - Stable |
Example
{
"targetGroup": "abc123",
"endpoints": ["4"]
}
SortOrder
Description
The directions in which entities can be sorted.
Values
| Enum Value | Description |
|---|---|
|
|
Ascending order. Stability Level: 3 - Stable |
|
|
Descending order. Stability Level: 3 - Stable |
Example
"asc"
String
Description
The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.
Example
"abc123"
SystemError
Description
A system error represents a problem that occurred while trying to process a command.
Fields
| Field Name | Description |
|---|---|
message -
String
|
Briefly describes the problem and any possible solutions. Stability Level: 3 - Stable |
retryable -
Boolean
|
Indicates that the system might succeed on a subsequent try of the same request. Stability Level: 3 - Stable |
timedOut -
Boolean
|
Indicates that the system timed out while trying to process the command, and it is not known if it succeeded or not. Stability Level: 3 - Stable |
Example
{
"message": "abc123",
"retryable": true,
"timedOut": true
}
TaniumPlatformContentSet
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique content set ID. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
name -
String!
|
The unique content set name. Stability Level: 1.1 - Experimental (Active Development) |
description -
String
|
The content set description. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": "4",
"name": "abc123",
"description": "xyz789"
}
TaniumPlatformUser
Description
A user who can access the Tanium platform.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique user ID. Use of this field requires the Automate solution. Stability Level: 1.1 - Experimental (Active Development) |
username -
String
|
The unique user name, used for authentication to the Tanium platform. Stability Level: 1.1 - Experimental (Active Development) |
displayName -
String
|
The user display name. Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"id": 4,
"username": "xyz789",
"displayName": "abc123"
}
TaniumPlatformUserContext
Description
A Tanium platform user context, containing the Tanium platform user and selected persona.
Fields
| Field Name | Description |
|---|---|
user -
TaniumPlatformUser!
|
The Tanium platform user. Stability Level: 1.1 - Experimental (Active Development) |
persona -
TaniumPlatformUserPersona
|
The Tanium platform user persona. A Stability Level: 1.1 - Experimental (Active Development) |
Example
{
"user": TaniumPlatformUser,
"persona": TaniumPlatformUserPersona
}
TaniumPlatformUserPersona
Description
A user persona in the Tanium platform. Note that the default persona is represented as a null reference to this type.
Fields
| Field Name | Description |
|---|---|
id -
ID!
|
The unique user persona ID. Stability Level: 1.1 - Experimental (Active Development) |
Example
{"id": 4}
ThreatResponseAlertRef
Description
Identifies a Threat Response alert. The guid must be specified.
Fields
| Input Field | Description |
|---|---|
guid -
ID
|
The alert's guid. Stability Level: 3 - Stable |
Example
{"guid": 4}
ThreatResponseAlertResolvePayload
Description
The result of resolving a Threat Response alert.
Fields
| Field Name | Description |
|---|---|
resolved -
Boolean
|
Indicates that the alert was resolved. Stability Level: 3 - Stable |
guid -
ID
|
The alert's guid. Stability Level: 3 - Stable |
error -
SystemError
|
Indicates that the request terminated in an error. Stability Level: 3 - Stable |
Example
{"resolved": false, "guid": 4, "error": SystemError}
Time
Description
An instant in time in RFC 3339 format.
Example
"10:15:30Z"
WirelessAdapter
Description
The wireless adapter details of an endpoint.
Fields
| Field Name | Description |
|---|---|
ssid -
String!
|
The SSID (name) of the wireless network to which this wireless adapter connects. Example: linksys Sensor: Wireless Network Connected SSID, Column: Wireless Network Connected SSID Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
state -
ConnectedState!
|
The state of the adapter connection to its network. Example: CONNECTED Sensor: Wireless Network Connected SSID, Column: Wireless Network Connected SSID Use of this field requires the Core Content solution. Stability Level: 3 - Stable |
Example
{"ssid": "abc123", "state": "CONNECTED"}