Real-World Scenarios
Putting It All Together
In lessons 1 through 7, you learned the foundations of Tanium Investigate: Single Endpoint View, data collection, the investigation workspace, Direct Connect, remote remediation, and ServiceNow integration. This capstone lesson presents four scenarios that require you to apply multiple skills together, just as you would in a real production environment at Mercury Insurance.
For each scenario, read the situation carefully, think about what tools and techniques you would use, and then select the best course of action. After checking your answer, read the full walkthrough to understand the complete approach.
Module 2 Skills Integration
Four Scenarios at a Glance
Key Principles for Real-World Investigations
Assess First
Always check the SEV and endpoint data before taking action. Understand the scope and severity.
Contain if Needed
For security incidents, quarantine first to stop damage while preserving evidence for analysis.
Use the Right Tool
Performance for fleet-level trends, Investigate for endpoint deep dives. They complement each other.
Document Everything
Annotations, work notes, ticket updates. Build the record as you go, not from memory after.
Prevent Recurrence
Fixing the symptom is not enough. Address the root cause and deploy preventive measures fleet-wide.
Scenario 1: "My Computer is Frozen"
A Personal Lines underwriter calls the help desk: "My computer is completely frozen. I can't click anything, the mouse moves but nothing responds. I have a policy review due in 20 minutes and I can't access any of my files." The user is in the Rancho Cucamonga office.
Your Investigation Data
| Process | CPU | Memory | Status |
|---|---|---|---|
| WINWORD.EXE | 78% | 4.2 GB | Runaway |
| OneDrive.exe | 12% | 1.8 GB | Elevated |
| explorer.exe | 3% | 280 MB | Normal |
| TaniumClient.exe | 1% | 85 MB | Responsive |
Full Walkthrough
Open Direct Connect
From the SEV, initiate a Direct Connect session. Establishes within seconds since the Tanium client is responsive.
Confirm the Process
In the Processes tab, verify WINWORD.EXE is at 78% CPU and 4.2 GB RAM. Note the PID for the audit trail.
Notify the User
"I can see the issue remotely. Microsoft Word has frozen and is consuming all your CPU. I'm going to close the stuck Word process — you may lose any unsaved changes. Is that okay?"
Kill the Process
Terminate WINWORD.EXE via Direct Connect. Within 5-10 seconds, CPU drops to 22% and the machine becomes responsive.
Verify and Document
Watch performance graphs stabilize. Ask user to confirm. Investigate root cause (large file? COM add-in? OneDrive conflict?). Update ticket. Total time: under 5 minutes.
Scenario 2: Suspicious Process Detected
The security team sends an urgent message: "We have detected an unusual process, svchost-update.exe, running on 3 endpoints in Claims. The process name is designed to look like a legitimate Windows service but it is not a known Microsoft binary. It was first seen 2 hours ago and appears to be making outbound HTTPS connections to an external IP."
| Endpoint | User | Process Path | Hash (SHA-256) | External IP |
|---|---|---|---|---|
| CAEI781901 | jsmith | C:\Users\jsmith\AppData\Local\Temp\svchost-update.exe | a3f8e2...7d91 | 185.234.xx.xx:443 |
| CAEI782340 | alee | C:\Users\alee\AppData\Local\Temp\svchost-update.exe | a3f8e2...7d91 | 185.234.xx.xx:443 |
| CAEI782901 | mwong | C:\Users\mwong\AppData\Local\Temp\svchost-update.exe | a3f8e2...7d91 | 185.234.xx.xx:443 |
Full Walkthrough
Create Workspace
Open investigation, link to security incident number, add all 3 endpoints.
Quarantine Immediately
Isolate all 3 endpoints from the network. Tanium client maintains its connection for continued investigation. Stop potential data exfiltration.
Gather Evidence
Direct Connect to each endpoint: record PID, parent process, file path, creation timestamp. Download the executable. Record SHA-256 hash for threat intel lookup.
Check Network IOCs
Identify the external IP, port, connection duration. Provide to security team for firewall blocking.
Check Persistence
Search registry auto-run entries. Check Task Scheduler. Found: scheduled task "WindowsUpdateCheck" — this is how it survives reboots.
Document and Hand Off
All findings in investigation workspace with annotations. Push to ServiceNow security incident. Security team has hashes, IOCs, timeline, and full evidence chain.
Scenario 3: Post-Patch Troubleshooting
Tanium Performance alerts fire at 8:15 AM Wednesday: 50 endpoints across Underwriting have degraded health scores. Average health dropped from 76 to 41 overnight. A cumulative Windows update was deployed Tuesday night. The Underwriting manager calls: "Half my team can't work — their laptops are crawling. What did you do to our machines?"
| Group | Count | Patched | Avg Health | Avg CPU |
|---|---|---|---|---|
| Affected Endpoints | 50 | Tue night | 41 | 82% |
| Unaffected Endpoints | 70 | Not yet | 78 | 25% |
| Early-patched (1 AM) | 5 | Tue 1 AM | 72 | 30% |
Full Walkthrough
Confirm with Performance
Filter to Underwriting group. Verify all 50 affected endpoints were patched between 1-3 AM Tuesday. The 70 unaffected were scheduled for Wednesday night.
Pivot to Investigate
Create investigation workspace. Select 3 representative affected endpoints (different hardware, different sub-teams).
Direct Connect Deep Dive
All 3 show TiWorker.exe at 40-55% CPU and SearchIndexer.exe at 15-25%. These are standard post-patch optimization processes.
Check Early-Patched Machines
The 5 endpoints patched at 1 AM have already recovered to health 70+. Post-patch processes completed after ~6 hours.
Communicate
Inform the manager: "Standard Windows post-patch optimization. Based on early-patched machines, expect recovery by noon."
Monitor Stragglers
At noon, 45 of 50 recovered. For the remaining 5, Direct Connect reveals stuck TiWorker. Deploy targeted service restart.
Scenario 4: ServiceNow-Driven Investigation
A ServiceNow ticket from a Claims adjuster: "My laptop is very slow and I can't open any applications. Outlook takes 5 minutes to load, Excel won't open at all, and I get 'low disk space' warnings every few minutes. This has been getting worse for the past week."
| Directory | Size | Files | Status |
|---|---|---|---|
| C:\ProgramData\AppLogs\ClaimsSystem\ | 85 GB | 12,847 | Unmanaged logs |
| C:\Users\mgarcia\ | 42 GB | -- | Normal |
| C:\Windows\ | 38 GB | -- | Normal |
| C:\Program Files\ | 28 GB | -- | Normal |
Full Walkthrough
Check Tanium Data in SN
Open ticket, view embedded Tanium data. Health: 18, Disk: 99.2%. Immediately see disk is the primary issue.
Identify the Consumer
Launch Investigate from SN. Direct Connect file system browser reveals 85 GB of ClaimsSystem log files dating back 18 months.
Verify Safety
Most recent 30 days = 4 GB. Remaining 81 GB are historical logs older than 30 days. Compliance requires only 90-day retention.
Deploy Cleanup from SN
Trigger Tanium disk cleanup targeting files > 90 days old. Frees 78 GB. Disk drops from 99.2% to 66%.
Verify and Prevent
Health score recovers to 62. Apps launch normally. Create follow-up: configure log rotation fleet-wide for all ClaimsSystem endpoints.
Cleaning up the logs fixes this one machine. Configuring log rotation fleet-wide prevents this from happening on every endpoint running the Claims application. That is the difference between reactive support (fixing the symptom) and proactive engineering (fixing the root cause).
Scenario 1: "My Computer is Frozen"
Underwriter's UI is frozen. 20-minute deadline. Health score 12, CPU 100% for 47 minutes. WINWORD.EXE at 78% CPU, 4.2 GB RAM. Tanium client is responsive.
What is the best immediate action?
Scenario 2: Suspicious Process Detected
Security alert: svchost-update.exe on 3 Claims endpoints. Not a known Microsoft binary. Making outbound HTTPS connections to external IP. First seen 2 hours ago. Potential data exfiltration.
What is the best approach?
Scenario 3: Post-Patch Troubleshooting
50 of 120 Underwriting endpoints degraded after Tuesday night's Windows update. Health dropped from 76 to 41. CPU averaging 82%. 70 unpatched endpoints are fine. Early-patched machines have already recovered.
What is the best approach?
Scenario 4: ServiceNow-Driven Investigation
Claims adjuster ticket: laptop very slow, can't open apps, "low disk space" warnings. Getting worse for a week. You are in ServiceNow with Tanium integration. Health score 18, disk 99.2%.
What is the best approach?
✍ Module 2 Review: Lessons 5-8
1. What is the key requirement for establishing a Direct Connect session to an endpoint?
2. Why should you quarantine an endpoint rather than simply deleting a suspicious file during a security investigation?
3. In the post-patch troubleshooting scenario, how do Tanium Performance and Tanium Investigate work together?
4. What is the biggest advantage of the Tanium-ServiceNow integration for help desk agents?
5. In the "slow laptop with full disk" scenario, what was the critical step that prevented the problem from recurring?
🏆 Module 2 Progress Checkpoint
You have completed all 8 lessons in Module 2: Tanium Investigate. You now know how to use Single Endpoint View, Direct Connect, the investigation workspace, remote remediation, and ServiceNow integration to investigate and resolve endpoint issues efficiently.
Module 2 Complete!
Congratulations — you have completed all 8 lessons in Module 2: Tanium Investigate.
You have completed both modules of the Tanium Specialization training. Head to the Certification Exam to demonstrate your knowledge and earn your certification.
DEX Specialization Training © 2026