Managing connections

You can view status, edit, import, and export connections.

View connection status

To view the status of your connections, choose one of the following options:

• Go to the Connect Overview page, and scroll to the Connections section.
• From the Connect menu, click Connections.

A list of your connections displays with status information.

If a Last Run Status value displays Critical , the most recent connection run failed. Review the connection log information for previous runs to troubleshoot. If a Tanium solution or source displays Critical , the installed solution does not meet the minimum required version for proper compatibility and functionality. Upgrade the solution to the minimum required version or later.

If a Last Run Status value displays Critical , the most recent connection run failed. Review the connection log information for previous runs to troubleshoot.

• Click to expand any row to show additional details for the connection, include owner, source, and schedule.
• Click any connection to view details for the connection, including associated persona, statistics about the amount of data, connection runs, schedule, and logs for previous runs.

The Connections section also has a dedicated page. To access, click Connections from the Connect menu.

Filter connections list

If you have many connections, you can filter or order the list.

• To filter on a specific connection, enter the connection name in the Filter by text field. The list updates with any connection names that contain the value you entered. To clear the filter, click X in the Filter by text field.
• Click a column header to sort the connections by the data in the column in descending order. Click the column header again to sort the list in ascending order. To clear the sort, click the column header a third time.

View schedule for all connections

To view the schedule for each connection in relation to all of the other connections, choose one of the following options:

• From the Connect menu, click Schedule.

• From the Connect Overview page, scroll to the Connections section and click Schedule.

The default view shows the connection runs for the current day, in the time zone of your browser.

• To view details about a connection, click the connection name or click a run icon for the connection. If the run icon is for a failed run, click the run icon to open the specific run log.
• To view all of the connections that happened on a specific date, select the date in the calendar field above the schedule.
• To filter the connections that display in the schedule, type a name into the Filter by name field. The list of connections automatically updates. To clear the filter, click X in the Filter by name field.
• To view the run log for a specific connection run, click the run icon in the schedule.

View connection metrics

Use the charts in the Summary section to view overall connection metrics.

• To track how many connections have run for each hour over the past seven days, use the Connection Runs Per Hour and Scheduled Connections Per Hour charts.
• To track how much data is sent by all connections over the past seven days, use the Rows Sent Per Day and Bytes Sent Per Day charts.

Edit connections

To edit a connection, go to Modules > Connect, scroll to the Connections section, click the connection, and click Edit. You can change the connection source configuration, destination configuration, filters, formats, and schedule in the configuration screen.

After you create a connection, you cannot update the connection source type or destination type, only the source configuration or destination configuration. If you want to change the source type or destination type, create a new connection.

Users that are members of predefined roles can only edit owned connections. For more information on connection ownership, see Update connection owner and persona.

You can reference the documentation for the particular destination type for more information.

• Some destinations use specific destination names. When you edit a named destination, the changes affect all connections where that specific Destination Name is used.
• Some connections use passwords for the destination. If you change settings for a destination, you must re-enter the password.

Schedule connections

Schedule connections to run at specific time intervals. Then, you can view the schedule status of all of your connections in the schedule view.

Update a connection schedule

1. Edit the connection.
   From the Connect Overview page, scroll to the Connections section, and click the connection.

2. Use the Schedule section to update the schedule:

   • Select Enable schedule.
   • In the Schedule Type, select Basic to build a schedule with the provided controls.
     
   • To view or edit the cron expression directly, select Advanced - Define as a Cron Expression, and use the Advanced field to edit the cron expression.
     
     
     
     
     
   If a user that owns a scheduled connection is deleted, future scheduled instances of that connection do not run. For more information, see Issue: Scheduled connection owned by a deleted user no longer runs.
3. Scroll to the bottom of the page and click Save.

Run connections

In addition to scheduling a connection, you can manually run a connection. There are multiple options throughout Connect to manually run a connection:

• From the Connect Overview page, scroll to the Connections section, select the checkbox next to the connection, and click Run Now.
  
• From the Connect menu, click Connections to open the Connections page. Select the checkbox next to the connection, and click Run Now.
• From either the Connect Overview page or the Connections page, click the connection to view details for the connection. From this page, click Run.
• When you edit a connection, click Run at the top of the page to run the connection. Note that if you click Run, any changes you made are not saved. If you make changes to the connection and want to run the connection with the updated settings, scroll to the bottom of the page and click Save and Run.

If a connection is already running, the option to run the connection is replaced with a Stop button.

Update connection owner and persona

Each connection is associated with a user account that owns the connection, and an optional persona for that user account. Only data that the owner user and associated persona can access is sent from a source to a connection destination.

Connections display one of the following Owner values:

• A user name if a user owns the connection

• Unassigned if no user owns the connection

Connections display one of several Run as Persona values:

• a persona name if a persona is associated with the connection and the active session user either has the persona or otherwise has rights to view the persona

• a persona ID if a persona is associated with the connection, but the active session user does not have the persona nor rights to view the persona

• Default Persona if no persona is associated with the connection

• Unknown while an existing connection is migrated to an updated Connect version, or in other rare cases. For more information, see

  Troubleshooting.

The user that creates a connection is the initial owner, and that user's active persona at creation time is the initial persona associated with the connection. If the user selects the default persona during connection creation, no persona is associated with the connection.

You can update a connection owner or associated persona. For example, if a connection owner leaves a department or otherwise changes responsibilities, you can update the connection owner to another user to maintain the connections and data output. Alternatively, if you add a new computer group and new persona, you can update the persona associated with the connection to the new persona, and include data from the new endpoints in a connection run.

Verify that a new owner user or persona can access intended content before you update connection ownership or associated persona, to ensure that a connection runs as expected. For example, if the updated permission set does not have the right to access a computer group, endpoint members of that computer group might not be included in the data. Alternatively, if the updated permission set does not have the right to access a saved question, a connection that uses that saved question as a source might fail.

You can only update the persona associated with a connection if your user is the owner. The personas available to a connection are limited to the personas assigned to your user account. You can update connection ownership or associated persona for one or more connections at a time.

Update owner or persona for one or more connections

1. Change your active persona to a persona you want to associate with a connection. If you use the default persona, no persona is associated with a connection. For more information on selecting a persona, see Tanium Console User Guide: Select a persona for your Console session.

2. Choose one of the following options:

   • From the Connect Overview page, scroll to the Connections section.
   • From the Connect menu, click Connections.
3.  Choose one of the following options:
   • To update the owner and persona to your active user and persona, select the checkbox next to one or more connections, then click Actions > Edit Ownership. Click Save.

     The connection ownership updates to the active session user and persona.

   • To update the persona on connections that your user owns, select the checkbox next to one or more connections, then click Actions > Change persona. Click Change Persona.

     The connection persona updates to the active session user persona.

   If you select multiple connections to update ownership, and your user account is already the owner of some connections, your user remains the owner of those connections. Similarly, if the active persona is already associated with some of the selected connections, the persona remains associated with those connections.

Manage connection limits

When scheduling connections, you should stagger connection start times to reduce the number of connections that run simultaneously. For information on how to see the schedule for all connections, see View schedule for all connections.

Export connections

If you want to back up or move connections between environments, you can export a connection.

1. From the Connect Overview page, scroll to the Connections section.
2. Select the connections that you want to export, click Actions > Export, and confirm the export. The connections are saved to your download folder as a JSON file.

Import connections

You can import connections from JSON files that have been exported from the Connect 4 Workbench. You cannot import connections from Connect 3 or earlier.

1. From the Connect Overview page, scroll to the Connections section.
2. Click Import and then click Import File. Select the JSON file from which you want to import connections.
3. Expand each row to review the messages for each connection that you are importing.
   
   
   
   
   

   You can filter the list of connections by the connection status, source, or destination.

4. When you are ready to import one or more connections, select the connections and click Save.
5. If any of the connections have errors or warnings, resolve the issues before you import the connection.
   1. Click the name of the connection that you want to import that has import errors.
   2. Edit the settings in the connection to resolve the issues.
   3. Click Import Connection.
6. (Optional) If a connection is on the list that you do not want to import or review, select the connection and click Remove.

Use the same source for multiple destinations

For Event, Saved Question, and Tanium Data Service sources, you can send data from one source to multiple destinations by creating multiple connections that run at the same time, or within the question expiration period.

For example, you might want the output of a single saved question to send data to Splunk and also send an email. You can create two connections that both use the same source, but are each configured to use different destinations. If you configure both connections to run at the same time, or within the question expiration period, the environment is queried only once and the data is sent to both destinations.

For more information about the question expiration period, see Tanium Console User Guide: Question expiration.

Use the same destination in multiple connections

You can reuse a destination in multiple connections. An existing destination is a specific instance of a destination that has specific details of the data target specified. These details vary for each destination type, but might include information such as the target IP address and port number, user name and password information, and destination paths.

After you create a destination, you can use the destination again in another connection.
To reuse a destination, choose an existing destination for the Destination Name.

For example, you might create a Splunk connection by setting the host name and port of the Splunk indexer and the format of the data to send. You can use this configured Splunk destination with multiple connections to send multiple data sources to your single Splunk configuration.

Configure a unique destination per connection. If you edit the settings for a shared destination for one connection, any other connections that use the shared destination are affected, and connection runs might fail. Alternatively, you can copy the settings of an existing destination, then update the Destination Name to create a unique destination.

Clear New Items cache

If you are using the New Items filter, you can clear the new items cache in an existing connection.

1. From the Connect Overview page, scroll to the Connections section, and click the connection.
2. Click Edit.
3. Expand the Configure Output > Filters > Learning Settings section.
4. Click Clear Learned Items Cache and then click Confirm to remove all of the items in the baseline data. To remove all items in the baseline data and restart the learning period, click Restart learning.

Configure notifications for failed connection runs

If you use the Connect > Failed Connection Run event group, you can choose to send a notification for a failed connection run.
This type of connection runs only once. If this connection fails, it does not reattempt the notification, so it prevents the connection from repeatedly running in the event that something in the connection is failing.