Module 2 — Lesson 2 of 8

Single Endpoint View

The consolidated dashboard for deep-diving into any endpoint — hardware, software, performance, compliance, and more in one place.

📚 Overview

🔧 Deep Dive

🛠 Hands-On

✅ Check

The Single Endpoint View (SEV) is a live, interactive dashboard that consolidates every piece of data Tanium knows about one endpoint. Instead of querying 5 different tools, open the SEV and see it all.

SEV Panel Layout

At-a-Glance Health

Health Score

34%

CPU

68%

Memory

82%

Disk Used

Simulated SEV: Hardware Panel

Tanium Investigate — Single Endpoint View

Hardware

Software

Performance

Actions

Dell Latitude 5540

Model

Intel i7-1365U

CPU

16 GB DDR5

RAM

45 GB Free

Disk (256 GB SSD)

Property	Value
Computer Name	CAEI778766
Serial Number	DL5540-J9K2M1
BIOS Version	1.14.0
Network Adapter	Intel Wi-Fi 6E AX211 (192.168.1.47)
OS	Windows 11 Enterprise 23H2 (Build 22631)
Uptime	12 days 7 hours 22 min
Last Restart	2026-03-04 01:15:33

4 Ways to Launch the SEV

🔍

Type computer name, IP, or username in the global search bar

📈

Interact

Click any endpoint in Tanium question results

📊

Dashboards

Click endpoint name in Performance reports

🔗

Cross-Module

Links from Patch, Deploy, Comply, Threat Response

Live vs. Cached Data

Aspect	Online Endpoint (Live)	Offline Endpoint (Cached)
Source	Real-time query via Tanium Client	TDS historical snapshot
Freshness	Current state (seconds old)	Last known state (hours/days old)
Process List	Live CPU/mem per process	Snapshot only
Hardware Info	Confirmed current	Reliable (rarely changes)
Network Connections	Active connections	Stale / irrelevant
Indicator	Green "Online" badge	Gray "Cached" badge + timestamp

Why Cached Data Matters

User calls at 8 AM: "My laptop won't boot." Machine is offline, but you can still see its last known state from TDS -- recently installed software, pending patches, performance metrics before shutdown -- giving you a head start before the machine is even powered on.

Customization & RBAC

Custom SEV Tabs▼

Admins can create custom tabs tailored to team workflows:

Sensor Panels: "Recent App Crashes," "Pending Restarts," "Top CPU Consumers"
Pre-configured Widgets: Charts, tables auto-populated for any endpoint
Action Panels: One-click buttons for common remediation tasks

Role-Based Access (RBAC)▼

Panel visibility: Help desk sees hardware + performance; security team sees compliance details
Action permissions: L1 = view only; L2 = restart services; L3 = deploy packages
Endpoint scope: Regional teams see their location only; central IT sees everything

The Drill-Down Workflow

Fleet Dashboard

Spot a cluster of low health scores across your environment

Computer Group

Click into "Accounting - LA Office" -- 8 endpoints below score 40

Open SEV

Click one endpoint: CPU at 95%, process consuming 6 GB RAM

Take Action

Kill the process, force pending update, or open Direct Connect

Simulated SEV: Software Panel

Review the software inventory below. Identify which application was recently installed and could be causing issues.

SEV: CAEI778766 — Software Inventory

Application	Version	Publisher	Installed
Microsoft 365 Apps	16.0.17328	Microsoft	2025-11-15
Google Chrome	123.0.6312	Google	2025-12-01
Zoom Workplace	6.4.2	Zoom	2026-02-28
CRM Desktop Agent	4.2.0-beta	Salesforce	2026-03-15
CrowdStrike Falcon	7.10.16303	CrowdStrike	2025-10-20
GlobalProtect VPN	6.2.1	Palo Alto	2025-09-15

Based on the software panel above, which application is the most likely cause of a sudden performance issue?

Microsoft 365 Apps (installed Nov 2025) CRM Desktop Agent 4.2.0-beta (installed yesterday) CrowdStrike Falcon (installed Oct 2025)

Correct! The CRM Desktop Agent is a beta version installed just yesterday -- the most recent change and a prime suspect for new issues.

Not quite. Look for the most recent installation date. A beta-version application installed yesterday is the most likely culprit for a sudden change.

Scenario: Offline Endpoint

Help Desk Ticket #INC0092155

User: Tom Chen, Marketing
Issue: "Laptop won't boot -- stuck on spinning dots after Windows logo."
Status: Endpoint is OFFLINE.

What is your first step in Tanium Investigate?

Wait for the user to bring the machine back online Open the SEV to view TDS cached data -- check last known patches, software, and performance Immediately ship a replacement laptop

Correct! The SEV shows cached TDS data even for offline endpoints. You can check for pending patches, recent software installs, or performance red flags before the machine boots.

Not quite. The SEV works for offline endpoints by displaying cached TDS data -- the last known state of hardware, software, patches, and performance.

✍ Knowledge Check

1. What happens when you open the SEV for an offline endpoint?

The SEV shows an error message and no data The SEV displays cached data from TDS, showing the last known state The SEV automatically initiates a Wake-on-LAN The SEV redirects you to a different module

Correct! The SEV falls back to cached TDS data for offline endpoints, showing the last known state.

Not quite. The SEV displays cached data from TDS when an endpoint is offline, with timestamps indicating when data was collected.

2. Which of the following is a valid way to launch the SEV?

Only through the global search bar Only from Tanium Performance dashboards From search, Interact results, dashboards, and cross-module links Only by entering the endpoint's IP address manually

Correct! The SEV is accessible from multiple entry points: global search, Interact results, dashboards, and cross-module links.

Not quite. The SEV can be launched from multiple locations throughout the Tanium console.

← Previous: Overview & Purpose Next: Data Collection →