Tanium Threat Response

Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version below 3.0.159. In order to use Tanium Threat Response version 3.0.159 and above, use Tanium Threat Response V2 Integration.

Endpoint · Tanium Threat Response

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • url — Hostname, IP address, or server URL (required)
  • credentials — Username (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • filter_alerts_by_state — A comma-separated list of alert states to filter by in fetch incidents command. Possible options are: unresolved, in progress, resolved or suppressed. Empty list won't filter the incidents by state.

Commands (39)

  • tanium-tr-alert-update-state

    Updates the state of a single alert.

  • tanium-tr-create-connection

    Creates a local or remote connection.

  • tanium-tr-create-evidence

    Creates an evidence.

  • tanium-tr-create-snapshot

    Captures a new snapshot by connection name.

  • tanium-tr-delete-connection

    Deletes a connection by connection name.

  • tanium-tr-delete-evidence

    Deletes an evidence.

  • tanium-tr-delete-file-download

    Deletes a file download.

  • tanium-tr-delete-file-from-endpoint

    Deletes a file from the given endpoint.

  • tanium-tr-delete-local-snapshot

    Deletes a local snapshot by connection name and file name.

  • tanium-tr-delete-snapshot

    Deletes a snapshot by connection name and snapshot ID.

  • tanium-tr-get-alert-by-id

    Returns an alert object based on alert ID.

  • tanium-tr-get-connection-by-name

    Returns a connection object based on connection name.

  • tanium-tr-get-download-file-request-status

    Gets the status of the download file request.

  • tanium-tr-get-downloaded-file

    Gets the actual content of a downloaded file by file ID.

  • tanium-tr-get-events-by-process

    Gets the events for a process.

  • tanium-tr-get-evidence-by-id

    Gets evidence by evidence ID.

  • tanium-tr-get-file-download-info

    Gets the metadata of a file download. You must supply either the `path` or `id` argument for the command to run successfully.

  • tanium-tr-get-file-info

    Gets information about a file from a remote connection.

  • tanium-tr-get-intel-doc-by-id

    Returns an intel document object based on ID.

  • tanium-tr-get-label-by-id

    Returns a label object based on label ID.

  • tanium-tr-get-parent-process

    Gets information for the parent process.

  • tanium-tr-get-parent-process-tree

    Gets the parent process tree for the process instance.

  • tanium-tr-get-process-children

    Gets the children of this process instance.

  • tanium-tr-get-process-info

    Get information for a process.

  • tanium-tr-get-process-timeline

    Gets the process timeline.

  • tanium-tr-get-process-tree

    Gets the process tree for the process instance.

  • tanium-tr-intel-doc-create

    Add a new intel document to the system by providing its document contents.

  • tanium-tr-list-alerts

    Returns a list of all alerts.

  • tanium-tr-list-connections

    Returns all connections.

  • tanium-tr-list-events-by-connection

    Queries events for a connection.

  • tanium-tr-list-evidence

    Returns a list of all available evidence in the system.

  • tanium-tr-list-file-downloads

    Returns all downloaded files in the system.

  • tanium-tr-list-files-in-directory

    Gets a list of files in the given directory.

  • tanium-tr-list-intel-docs

    Returns a list of all intel documents.

  • tanium-tr-list-labels

    Returns all available labels in the system.

  • tanium-tr-list-local-snapshots-by-connection

    Returns all local snapshots of a single connection.

  • tanium-tr-list-snapshots-by-connection

    Returns all snapshots of a single connection.

  • tanium-tr-request-file-download

    Requests a new file download.

  • tanium-tr-start-quick-scan

    Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.