Module 1 — Lesson 2 of 8

Installation & Configuration

How Tanium Performance is deployed, the Performance CX, system requirements, and initial configuration best practices.

📚 Overview

🔧 Deep Dive

🛠 Hands-On

✅ Check

📦

Manual Installs Needed

⏱

15–30m

Time to First Data

💾

<1%

CX CPU Overhead

📌

5 min

Default Collection Interval

Deployment Workflow: 5 Steps to Performance Data

Tanium Performance is a solution module installed on your existing Tanium Server. If your organization already runs Tanium (Mercury Insurance does), adding Performance is primarily a server-side operation -- no new agent rollout.

The Tanium Server automatically pushes the Performance Client Extension (CX) to targeted endpoints. Within 15-30 minutes, telemetry begins flowing into dashboards.

Key Concept

Deploying a new module like Performance does not require a new agent installation. The existing Tanium Client downloads the CX component automatically. This is a major advantage of a platform-based approach.

CX Resource Footprint

CPU Usage

<1%

Memory (RAM)

20-40 MB

Disk Impact

Minimal

Network

Few KB/interval

What the Performance CX Collects

Performance CX -- Telemetry Collection

Telemetry Type	What's Collected	Sample Rate
CPU Utilization	Average and peak usage over time	Every 5 min
Memory (RAM)	Total, available, committed, page file	Every 5 min
Disk I/O	IOPS, throughput, queue length, free space	Every 5 min
Boot/Login Time	BIOS, OS load, desktop ready, login duration	On each boot
App Stability	Crash events, hang events from Event Log	Continuous
Network Latency	RTT to DCs, file servers, cloud gateways	Every 5 min

System Requirements

Server Side

Tanium Server 7.4+ (Mercury runs a current version)
Module Server installed and healthy -- used to process and store telemetry
Storage: ~1-2 GB per 1,000 endpoints per month of retained data

Endpoint Side

OS	Minimum Version	Support Level
Windows	Windows 10 (1809+) / Windows 11	Full ✓
macOS	macOS 11 (Big Sur)+	Partial (some metric limits)
Linux	RHEL 8+ / Ubuntu 20.04+	Limited (server monitoring)

Legacy OS Not Supported

Windows 7 and Windows 8.1 endpoints are not supported. They will not receive the CX and will not appear in Performance dashboards. This is an additional data point for hardware refresh planning.

Initial Configuration Decisions

Data Collection Intervals ▼

Default: every 5 minutes. Shorter intervals (1 min) provide more granular data but increase resource usage. Longer intervals (15 min) reduce overhead but may miss short-lived spikes. The default is ideal for most deployments.

Computer Groups and Targeting ▼

Tanium organizes endpoints into computer groups based on OS, department, location, device type, or custom criteria. You choose which groups receive the CX, enabling phased rollout.

Data Retention Settings ▼

Data Type	Typical Retention	Use Case
High-resolution (per-interval)	7-14 days	Real-time troubleshooting
Aggregated (hourly/daily)	30-90 days	Trend analysis
Historical (weekly/monthly)	Up to 12 months	Long-term reporting

CX Lifecycle: Under the Hood

The Tanium Client is intentionally minimal -- an "operating system" for modules. Each CX is an "application" running within it.

Package Created

The Tanium Server creates a package containing CX binaries and config files.

Distribution

Package distributed to targeted endpoints via Tanium's content distribution mechanism.

Download & Verify

Tanium Client downloads the package, verifies integrity (hash check), and installs the CX.

CX Starts

CX runs as a subprocess of the Tanium Client -- not as a separate Windows service.

Data Collection Begins

CX registers with the Performance module server and begins collecting telemetry.

Updates and Removal

CX updates are automatic -- the server pushes new packages and endpoints apply them. To remove Performance from a group, just remove them from the target, and the CX uninstalls cleanly. Multiple CXs (Performance, Patch, Comply) can coexist on one endpoint.

Pro Tip: Start with a Pilot Group

Do not deploy to your entire fleet on day one. Select a pilot group of 200-500 diverse endpoints -- mix of desktops/laptops, different departments, different locations. Monitor for 1-2 weeks to validate data flow, dashboard population, and CX impact. Then expand in phases until you reach full fleet coverage.

🤔 What Would You Do?

You are planning the Performance CX rollout for Mercury Insurance's fleet of approximately 4,000 endpoints. Your manager asks: "Can we just push it to everyone this weekend?"

What is the best approach?

Deploy to all 4,000 endpoints at once for maximum immediate coverage Start with a 200-500 endpoint pilot group, validate for 1-2 weeks, then expand in phases Only deploy to executive machines since they are highest priority Wait for the vendor to send someone to install it

Correct! A phased rollout with a diverse pilot group is best practice. It lets you validate data flow, catch issues early, and tune configuration before impacting 4,000 machines.

Not quite. Best practice is a phased approach: start with 200-500 diverse endpoints as a pilot, validate for 1-2 weeks, then expand in phases until full coverage.

Simulated: CX Deployment Console

Walk through what the deployment experience looks like in the Tanium Console.

Tanium Console -- Performance CX Deployment

Overview

Deployment

Settings

CX Deployment Status

312

CX Installed

Pending Install

Failed

350

Targeted Total

Target Computer Groups

Computer Group	Endpoints	CX Status	Phase
IT Department	85	Complete	Pilot (Week 1)
Claims - LA Office	120	Complete	Pilot (Week 1)
Underwriting - Remote	107	In Progress	Phase 2 (Week 3)
All Remaining	3,688	Scheduled	Phase 3 (Week 5)

Match the Requirement to Its Category

Drag each requirement to Server or Endpoint.

Tanium Server 7.4+

Windows 10 (1809+)

Module Server healthy

100 MB free disk space

Server: Platform version requirement

Server: Data processing component

Endpoint: Minimum OS version

Endpoint: Storage for CX and staging

All matches correct! You understand the server vs. endpoint requirements.

Some matches are incorrect. Review the System Requirements section in the Deep Dive tab.

✍ Knowledge Check

1. What is the recommended approach when first deploying Tanium Performance to a fleet of endpoints?

Deploy to every endpoint simultaneously for maximum coverage Start with a pilot group of 200-500 diverse endpoints, validate for 1-2 weeks, then expand in phases Only deploy to executive machines since they are the highest priority Wait until Tanium recommends a deployment date

Correct! A phased rollout starting with a diverse pilot group lets you validate data flow and tune settings before impacting the full fleet.

Not quite. Best practice is to start with a pilot group of 200-500 diverse endpoints, validate for 1-2 weeks, then expand in phases.

2. How does the Performance CX get installed on endpoints?

IT technicians must manually install it on each machine via a setup wizard Employees download it from a self-service portal The Tanium Server automatically deploys it to targeted endpoints through the existing Tanium Client It is included in the Windows operating system by default

Correct! The Tanium Client already on each endpoint handles the CX deployment automatically -- no manual installation needed.

Not quite. The Performance CX is automatically deployed by the Tanium Server through the existing Tanium Client already installed on endpoints. No manual installation is required.

← Previous: Overview & Purpose Next: Dashboards & Metrics →

DEX Training

Installation & Configuration

Deployment Workflow: 5 Steps to Performance Data

CX Resource Footprint

What the Performance CX Collects

System Requirements

Server Side

Endpoint Side

Initial Configuration Decisions

CX Lifecycle: Under the Hood

Package Created

Distribution

Download & Verify

CX Starts

Data Collection Begins

🤔 What Would You Do?

Simulated: CX Deployment Console

CX Deployment Status

Target Computer Groups

Match the Requirement to Its Category

✍ Knowledge Check