Tanium Agent FAQs – Tanium Tech Talks #88 – 90

A common question we hear is, “How does the Tanium agent affect the endpoint performance?” In this Tanium Tech Talk series, host Ashley McGlone interviews Jeff Stokes, a Principal Escalation Engineer at Tanium, who addresses this question and shows you how to optimize the Tanium agent for your environment. This series covers expectations for endpoint agent load, agent tuning, proper anti-virus exclusions, virtual infrastructure, and more.

Agent Impact on Endpoints – Tanium Agent FAQs – Tanium Tech Talks #88

In this video, Jeff and Ashley discuss the memory, CPU, disk, and network impact of the Tanium Agent on Windows, Mac, and Linux endpoints, and how it can be tuned to optimize performance.

Jeff explains how the Windows memory manager handles the Tanium Agent’s memory consumption, how the Tanium Agent throttles its CPU usage, how the Tanium Agent reduces its disk I/O with the 7.6 platform update, and how the Tanium Agent can be configured to use network neighborhood or direct connections to the zone server. Jeff also advises customers to review their endpoint hardware and resource allocation and to use the performance module and ETL traces to monitor and troubleshoot performance issues.

Key takeaways:

• Understand memory, CPU, disk, and network performance of the agent
• Consolidate agents with Tanium to free up end-user resources
• Tanium Client 7.6 improves performance
• Use Performance and Tanium Client Management to see agent health
• Use the core content to collect ETL files for support

Third-Party Exclusions – Tanium Agent FAQs – Tanium Tech Talks #89

The second installment of this Agent FAQ series explores the common types and causes of agent conflicts, and how to prevent them by setting proper exclusions for the Tanium Agent. Jeff lists some of the typical agents that he sees in customer environments, such as antivirus, DLP, privilege management, and user profile management. He also demonstrates how to use tools like Process Monitor and ETL traces to identify and resolve agent issues. Jeff stresses the importance of following the Tanium documentation and articles on the Tanium Resource Center to guide you when setting exclusions for different antivirus products and using the Enforce module to automate exclusions for Microsoft Defender for Endpoint.

Key takeaways

• Balance endpoint performance and security with proper exclusions
• See documentation for processes and paths to exclude
• Recognize and investigate agent conflicts
• Tanium package included for capturing ETL traces
• Use Enforce to populate MDE exclusions automatically

Virtual Endpoints (VDI & VMs) – Tanium Agent FAQs – Tanium Tech Talks #90

The third and final installment in this Agent FAQ series addresses the challenges and best practices of deploying and configuring the Tanium Agent in virtual environments, such as VMs and VDI. Jeff explains how the Tanium Agent can be adjusted to avoid resource storms and contention in shared infrastructure, by using settings like distribute over time, VDI settings, low resource mode, and pre-indexing. Jeff also discusses how to handle ephemeral VMs and non-persistent VDI, and how to optimize the index and comply modules for virtual environments.

Key takeaways

• Reduce agent impact without reducing data
• Use virtual sensors and computer groups to target optimized settings
• Out-of-the-box settings to reduce the load of sensors and packages
• Module-specific settings for Reveal, Comply, Threat Response