Tanium Data Extraction Guide (for SIM Template)

Tanium collects comprehensive endpoint data through its distributed sensors.
The following sources provide the relevant information for this export:

• Computer Information Sensor – Provides device names and endpoint identifiers.

• Installed Applications Sensor – Returns software names, versions, and publishers.

• Tanium Asset or Tanium Discover Modules – (Optional) Provide enriched software inventory and vendor data.

These can be accessed via the Tanium Console (Ask Question feature), Tanium Connect exports, or the Tanium API.

Prerequisites

For Console (UI) Method

• Access to the Tanium Console with permissions to use the Ask Question feature.

• Ensure all endpoints have completed recent sensor scans.

• Optional: Access to Tanium Connect for scheduled exports.

For API or Tanium Connect Method

• Access to the Tanium API or Tanium Connect module.

• API credentials with at least read-only access to sensors:

  • Computer Name

  • Installed Applications

  • Installed Application Versions

  • Installed Application Publisher

• A working environment with PowerShell, curl, or Postman to interact with the API.

• Permission to export or save responses in CSV format.

Recommended Query or Method

Two standard approaches are supported for Tanium-based software inventory exports.

Option 1: Tanium Console (Ask Question Method)

This method is recommended for most users and produces fast, accurate results directly from the Tanium Console.

Step 1: Ask a Question

1. Log into the Tanium Console.

2. In the Questions tab, click Ask a Question.

3. Enter the following question syntax:

   Get Computer Name and Installed Applications and Installed Application Version and Installed Application Publisher from all machines


4. Click Ask Question.

5. Wait for responses to complete (ensure 100% response rate for best accuracy).

Step 2: Export Results

1. Click Export Results in the top-right corner of the question response window.

2. Choose CSV format.

3. Save the file as Tanium_SIM_Export.csv.

4. Confirm the exported columns match the following:

   Field	Description
   Device Name	The hostname of the endpoint
   Software Name	Installed software name
   Software Version	Version number
   Software Publisher	Vendor or publisher name

Option 2: Tanium API or Tanium Connect (Advanced / Automated)

For automated or large-scale environments, use the Tanium Connect module or Tanium API to programmatically extract data.

Step 1: Create an Export Connection in Tanium Connect

1. Go to Tanium Console → Connect → Sources.

2. Click Add Source and choose Saved Question.

3. In the question field, enter:

    

   Get Computer Name and Installed Applications and Installed Application Version and Installed Application Publisher from all machines


4. Under Format, select CSV.

5. Set the output destination (e.g., local path, SFTP, or email).

6. Save and run the connection.

7. The generated file will be named similarly to Tanium_SIM_Export.csv.

Step 2: API Method (Optional Scripted Extraction)

Below is an example PowerShell script using Tanium’s REST API to execute the same question and export the results.

# Tanium SIM Template Export Script
# Requires API credentials with permissions to ask questions

$TaniumUrl = "https://your-tanium-server"
$Username = "api_user"
$Password = "api_password"

# Authenticate to Tanium API
$AuthBody = @{ username = $Username; password = $Password } | ConvertTo-Json
$AuthResponse = Invoke-RestMethod -Uri "$TaniumUrl/api/v2/session/login" -Method POST -Body $AuthBody -ContentType "application/json"
$Token = $AuthResponse.data.session

# Build question text
$QuestionText = "Get Computer Name and Installed Applications and Installed Application Version and Installed Application Publisher from all machines"

# Ask question
$Body = @{ text = $QuestionText } | ConvertTo-Json
$Response = Invoke-RestMethod -Uri "$TaniumUrl/api/v2/questions" -Method POST -Headers @{ "session" = $Token } -Body $Body -ContentType "application/json"
$QuestionId = $Response.data.id

# Wait and retrieve results
Start-Sleep -Seconds 15
$Results = Invoke-RestMethod -Uri "$TaniumUrl/api/v2/questions/$QuestionId/results" -Headers @{ "session" = $Token }

# Process and export results
$ExportData = @()
foreach ($Row in $Results.data.result_sets.rows) {
    $ExportData += [PSCustomObject]@{
        "Device Name"        = $Row[0].text
        "Software Name"      = $Row[1].text
        "Software Version"   = $Row[2].text
        "Software Publisher" = $Row[3].text
    }
}

$ExportPath = "C:\Exports\Tanium_SIM_Export.csv"
$ExportData | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8

Write-Host "Export complete: $ExportPath"

This script connects to Tanium’s REST API, runs the same “Ask Question” query, and exports all software inventory data in the correct SIM Template format.

Exporting to CSV

• For Console Method:
  Export results directly from the Ask Question interface via Export → CSV.

• For API/Connect Method:
  The output file is automatically generated and can be renamed to Tanium_SIM_Export.csv.

Ensure the CSV includes the following headers:

Preparing for SIM Import

1. Open the Licenseware SIM Template.

2. Paste or import the CSV data.

Ensure there are no extra columns or blank rows before saving.

👉 Learn more here

Troubleshooting

Example Output

Device Name,Software Name,Software Version,Software Publisher
PC-001,Google Chrome,129.0.6668.90,Google LLC
PC-002,Microsoft Teams,1.7.00.12345,Microsoft Corporation
LAPTOP-003,Slack,4.39.95,Slack Technologies
SRV-01,Adobe Acrobat DC,24.002.20933,Adobe Inc.