Tanium Threat Response

Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version below 3.0.159. In order to use Tanium Threat Response version 3.0.159 and above, use Tanium Threat Response V2 Integration.

Endpoint · Tanium Threat Response

Details

ID	`Tanium Threat Response`
Provider	Tanium
Category	Endpoint
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Tanium Threat Response - This Integration works with Tanium Threat Response version below 3.0.159. In order to use Tanium Threat Response version 3.0.159 and above, use Tanium Threat Response V2 Integration.

Configure Tanium Threat Response in Cortex

Parameter	Description	Required
isFetch	Fetch incidents	False
incidentType	Incident type	False
url	Hostname, IP address, or server URL	True
credentials	Username	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False
fetch_time	First fetch timestamp ({number} {time unit}, e.g., 12 hours, 7 days)	False
filter_alerts_by_state	A comma-separated list of alert states to filter by in fetch incidents command. Possible options are: unresolved, in progress, resolved or suppressed. Empty list won’t filter the incidents by state.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

tanium-tr-get-intel-doc-by-id

Returns an intel document object based on ID.

Base Command

tanium-tr-get-intel-doc-by-id

Input

Argument Name	Description	Required
intel-doc-id	The intel document ID.	Required

Context Output

Path	Type	Description
Tanium.IntelDoc.AlertCount	Number	The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt	Date	The date at which this intel was first added to the system.
Tanium.IntelDoc.Description	String	The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID	Number	The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds	Number	The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name	String	The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount	Number	The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt	Date	The date when this intel was last updated.

Command Example

!tanium-tr-get-intel-doc-by-id intel-doc-id=2

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "CreatedAt": "2019-07-31T18:46:28.814Z",
            "Description": "Detects usage of the NET.EXE utility to enumerate members of the local Administrators or Domain Administrators groups. Often used during post-compromise reconnaissance.",
            "ID": 2,
            "LabelIds": [
                2,
                3,
                9,
                16
            ],
            "Name": "Administrator Account Enumeration",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2020-01-14T21:37:30.934Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID	Name	Description	Type	Alert Count	Unresolved Alert Count	Created At	Updated At	Label Ids
2	Administrator Account Enumeration	Detects usage of the NET.EXE utility to enumerate members of the local Administrators or Domain Administrators groups. Often used during post-compromise reconnaissance.		0	0	2019-07-31T18:46:28.814Z	2020-01-14T21:37:30.934Z	2, 3, 9, 16

tanium-tr-list-intel-docs

Returns a list of all intel documents.

Base Command

tanium-tr-list-intel-docs

Input

Argument Name	Description	Required
limit	The maximum number of intel documents to return.	Optional
offset	The offset number to begin listing intel documents.	Optional

Context Output

Path	Type	Description
Tanium.IntelDoc.AlertCount	Number	The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt	Date	The date at which this intel was first added to the system.
Tanium.IntelDoc.Description	String	The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID	Number	The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds	Number	The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name	String	The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount	Number	The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt	Date	The date when this intel was last updated.

Command Example

!tanium-tr-list-intel-docs limit=2

Context Example

{
    "Tanium": {
        "IntelDoc": [
            {
                "AlertCount": 0,
                "CreatedAt": "2020-01-14T21:37:32.263Z",
                "ID": 99,
                "LabelIds": [
                    2,
                    7,
                    11,
                    16
                ],
                "Name": "Spooler Service Creating or Spawning Executables",
                "UnresolvedAlertCount": 0,
                "UpdatedAt": "2020-01-14T21:37:32.263Z"
            },
            {
                "AlertCount": 0,
                "CreatedAt": "2020-01-14T21:37:32.075Z",
                "ID": 98,
                "LabelIds": [
                    2,
                    8,
                    16
                ],
                "Name": "RunDll Creating MiniDump",
                "UnresolvedAlertCount": 0,
                "UpdatedAt": "2020-01-14T21:37:32.075Z"
            }
        ]
    }
}

Human Readable Output

Intel docs

ID	Name	Alert Count	Unresolved Alert Count	Created At	Updated At	Label Ids
99	Spooler Service Creating or Spawning Executables	0	0	2020-01-14T21:37:32.263Z	2020-01-14T21:37:32.263Z	2, 7, 11, 16
98	RunDll Creating MiniDump	0	0	2020-01-14T21:37:32.075Z	2020-01-14T21:37:32.075Z	2, 8, 16

tanium-tr-list-alerts

Returns a list of all alerts.

Base Command

tanium-tr-list-alerts

Input

Argument Name	Description	Required
limit	The maximum number of alerts to return. The default value is 5.	Optional
offset	The offset number to begin listing alerts.	Optional
computer-ip-address	Filter alerts by the specified computer IP addresses.	Optional
computer-name	Filter alerts by the specified computer name.	Optional
scan-config-id	Filter alerts by the specified scan config ID.	Optional
intel-doc-id	Filter alerts by the specified intel document ID.	Optional
severity	Filter alerts by the specified severity.	Optional
priority	Filter alerts by the specified priority.	Optional
type	Filter alerts by the specified type.	Optional
state	Filter alerts by the specified state. Can be “Unresolved”, “In Progress”, “Ignored”, or “Resolved”.	Optional

Context Output

Path	Type	Description
Tanium.Alert.Priority	String	The priority of the alert.
Tanium.Alert.ComputerName	String	The hostname of the computer that generated the alert.
Tanium.Alert.GUID	String	A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt	Date	The moment that the alert was generated.
Tanium.Alert.UpdatedAt	Date	The last time the alert state was updated.
Tanium.Alert.State	String	The current state of the alert. For example, “unresolved”, “inprogress”, and so on.
Tanium.Alert.ComputerIpAddress	String	The IP address of the computer that generated the alert.
Tanium.Alert.Type	String	The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID	Number	The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt	Date	The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId	Number	The intel document revision, if intelDocId is present.
Tanium.Alert.Severity	String	The severity of the alert.

Command Example

!tanium-tr-list-alerts limit=1

Context Example

{
    "Tanium": {
        "Alert": {
            "AlertedAt": "2019-09-22T14:01:31.000Z",
            "ComputerIpAddress": "172.0.0.0",
            "ComputerName": "HOST_NAME",
            "CreatedAt": "2019-09-22T14:01:59.768Z",
            "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
            "ID": 1,
            "IntelDocId": 64,
            "Priority": "high",
            "Severity": "info",
            "State": "Unresolved",
            "Type": "detect.match",
            "UpdatedAt": "2020-02-05T14:55:41.440Z"
        }
    }
}

Human Readable Output

Alerts

ID	Type	Severity	Priority	Alerted At	Created At	Updated At	Computer Ip Address	Computer Name	GUID	State	Intel Doc Id
1	detect.match	info	high	2019-09-22T14:01:31.000Z	2019-09-22T14:01:59.768Z	2020-02-05T14:55:41.440Z	172.0.0.0	HOST_NAME	a33e3482-556e-4e9d-bbbd-2fdbe330d492	Unresolved	64

tanium-tr-get-alert-by-id

Returns an alert object based on alert ID.

Base Command

tanium-tr-get-alert-by-id

Input

Argument Name	Description	Required
alert-id	The alert ID.	Required

Context Output

Path	Type	Description
Tanium.Alert.Priority	String	The priority of the alert.
Tanium.Alert.ComputerName	String	The hostname of the computer that generated the alert.
Tanium.Alert.GUID	String	A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt	Date	The date when the alert was generated.
Tanium.Alert.UpdatedAt	Date	The date when the alert state was last updated.
Tanium.Alert.State	String	The current state of the alert. For example, “unresolved”, “inprogress”.
Tanium.Alert.ComputerIpAddress	String	The IP address of the computer that generated the alert.
Tanium.Alert.Type	String	The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID	Number	The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt	Date	The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId	Number	The intel document revision, if intelDocId is present.
Tanium.Alert.Severity	String	The severity of the alert.

Command Example

!tanium-tr-get-alert-by-id alert-id=1

Context Example

{
    "Tanium": {
        "Alert": {
            "AlertedAt": "2019-09-22T14:01:31.000Z",
            "ComputerIpAddress": "172.0.0.0",
            "ComputerName": "HOST_NAME",
            "CreatedAt": "2019-09-22T14:01:59.768Z",
            "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
            "ID": 1,
            "IntelDocId": 64,
            "Priority": "high",
            "Severity": "info",
            "State": "Unresolved",
            "Type": "detect.match",
            "UpdatedAt": "2020-02-05T14:55:41.440Z"
        }
    }
}

Human Readable Output

Alert information

ID	Type	Severity	Priority	Alerted At	Created At	Updated At	Computer Ip Address	Computer Name	GUID	State	Intel Doc Id
1	detect.match	info	high	2019-09-22T14:01:31.000Z	2019-09-22T14:01:59.768Z	2020-02-05T14:55:41.440Z	172.0.0.0	HOST_NAME	a33e3482-556e-4e9d-bbbd-2fdbe330d492	Unresolved	64

tanium-tr-alert-update-state

Updates the state of a single alert.

Base Command

tanium-tr-alert-update-state

Input

Argument Name	Description	Required
alert-id	The ID of the alert to update.	Required
state	The new state for the alert. Can be “Unresolved”, “In Progress”, “Ignored”, or “Resolved”.	Required

Context Output

Path	Type	Description
Tanium.Alert.Priority	String	The priority of the alert.
Tanium.Alert.ComputerName	String	The hostname of the computer that generated the alert.
Tanium.Alert.GUID	String	A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt	Date	The date when the alert was generated.
Tanium.Alert.UpdatedAt	Date	The date when the alert state was last updated.
Tanium.Alert.State	String	The current state of the alert. For example, “unresolved”, “inprogress”.
Tanium.Alert.ComputerIpAddress	String	The IP address of the computer that generated the alert.
Tanium.Alert.Type	String	The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID	Number	The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt	Date	The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId	Number	The intel document revision, if intelDocId is present.
Tanium.Alert.Severity	String	The severity of the alert.

Command Example

!tanium-tr-alert-update-state alert-id=1 state=Unresolved

Context Example

{
    "Tanium": {
        "Alert": {
            "AlertedAt": "2019-09-22T14:01:31.000Z",
            "ComputerIpAddress": "172.0.0.0",
            "ComputerName": "HOST_NAME",
            "CreatedAt": "2019-09-22T14:01:59.768Z",
            "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
            "ID": 1,
            "IntelDocId": 64,
            "Priority": "high",
            "Severity": "info",
            "State": "Unresolved",
            "Type": "detect.match",
            "UpdatedAt": "2020-02-05T14:55:41.440Z"
        }
    }
}

Human Readable Output

Alert state updated to Unresolved

ID	Type	Severity	Priority	Alerted At	Created At	Updated At	Computer Ip Address	Computer Name	GUID	State	Intel Doc Id
1	detect.match	info	high	2019-09-22T14:01:31.000Z	2019-09-22T14:01:59.768Z	2020-02-05T14:55:41.440Z	172.0.0.0	HOST_NAME	a33e3482-556e-4e9d-bbbd-2fdbe330d492	Unresolved	64

tanium-tr-list-snapshots-by-connection

Returns all snapshots of a single connection.

Base Command

tanium-tr-list-snapshots-by-connection

Input

Argument Name	Description	Required
limit	The maximum number of snapshots to return.	Optional
offset	The offset number to begin listing snapshots.	Optional
connection-name	The connection name.	Required

Context Output

Path	Type	Description
Tanium.Snapshot.ConnectionName	String	The snapshot connection name.
Tanium.Snapshot.Error	String	The snapshot error message.
Tanium.Snapshot.ID	String	The snapshot id.
Tanium.Snapshot.Started	Date	The date when the snapshot was created.
Tanium.Snapshot.State	String	The current state of the snapshot.

Command Example

!tanium-tr-list-snapshots-by-connection connection-name=HOST_NAME limit=2

Context Example

{
    "Tanium": {
        "Snapshot": [
            {
                "ConnectionName": "HOST_NAME",
                "FileName": "2020_02_06T15.54.43.600Z.db",
                "Started": "2020-02-06T15:54:43.600Z",
                "State": "complete"
            },
            {
                "ConnectionName": "HOST_NAME",
                "Error": "Error checkpointing remote database",
                "FileName": "2020_02_06T15.54.46.795Z.db",
                "Started": "2020-02-06T15:54:46.795Z",
                "State": "error"
            }
        ]
    }
}

Human Readable Output

Snapshots

File Name	Connection Name	State	Started	Error
2020_02_06T15.54.43.600Z.db	HOST_NAME	complete	2020-02-06T15:54:43.600Z
2020_02_06T15.54.46.795Z.db	HOST_NAME	error	2020-02-06T15:54:46.795Z	Error checkpointing remote database

tanium-tr-create-snapshot

Captures a new snapshot by connection name.

Base Command

tanium-tr-create-snapshot

Input

Argument Name	Description	Required
connection-name	The connection name.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-create-snapshot connection-name=HOST_NAME

Human Readable Output

Initiated snapshot creation request for HOST_NAME.

tanium-tr-delete-snapshot

Deletes a snapshot by connection name and snapshot ID.

Base Command

tanium-tr-delete-snapshot

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
snapshot-id	The snapshot ID.	Required

Context Output

Path	Type	Description
Tanium.Snapshot.ID	String	The snapshot ID.
Tanium.Snapshot.ConnectionName	String	The connection name.
Tanium.Snapshot.Deleted	Boolean	Whether the snapshot has been deleted.

Command Example

!tanium-tr-delete-snapshot connection-name=HOST_NAME snapshot-id=2020_02_06T15.54.43.600Z.db

Context Example

{
    "Tanium": {
        "LocalSnapshot": {
            "ConnectionName": "HOST_NAME",
            "Deleted": True,
            "FileName": "2020_02_06T15.54.43.600Z.db"
        }
    }
}

Human Readable Output

Snapshot 2020_02_06T15.54.43.600Z.db deleted successfully.

tanium-tr-list-local-snapshots-by-connection

Returns all local snapshots of a single connection.

Base Command

tanium-tr-list-local-snapshots-by-connection

Input

Argument Name	Description	Required
limit	The maximum number of local snapshots to return. The default value is 50.	Optional
offset	The offset number to begin listing local snapshots.	Optional
connection-name	The connection name.	Required

Context Output

Path	Type	Description
Tanium.LocalSnapshot.ConnectionName	String	The snapshot connection name.
Tanium.LocalSnapshot.FileName	String	The snapshot file name.

Command Example

!tanium-tr-list-local-snapshots-by-connection connection-name=HOST_NAME limit=2

Context Example

{
    "Tanium": {
        "LocalSnapshot": [
            {
                "ConnectionName": "HOST_NAME",
                "Deleted": false,
                "FileName": "2020_02_06T15.54.43.600Z.db"
            },
            {
                "ConnectionName": "HOST_NAME",
                "Deleted": false,
                "FileName": "2020_01_09T15.25.13.535Z.db"
            }
        ]
    }
}

Human Readable Output

Local snapshots

File Name	Connection Name
2020_02_06T15.54.43.600Z.db	HOST_NAME
2020_01_09T15.25.13.535Z.db	HOST_NAME

tanium-tr-delete-local-snapshot

Deletes a local snapshot by directory name and file name.

Base Command

tanium-tr-delete-local-snapshot

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
file-name	The file name.	Required

Context Output

Path	Type	Description
Tanium.LocalSnapshot.FileName	String	The snapshot file name.
Tanium.LocalSnapshot.Deleted	Boolean	Whether the local snapshot has been deleted.

Command Example

!tanium-tr-delete-local-snapshot connection-name=HOST_NAME file-name=2020_02_06T15.54.43.600Z.db

Context Example

{
    "Tanium": {
        "LocalSnapshot": {
            "ConnectionName": "HOST_NAME",
            "Deleted": true,
            "FileName": "2020_02_06T15.54.43.600Z.db"
        }
    }
}

Human Readable Output

Local snapshot from Directory HOST_NAME and File 2020_02_06T15.54.43.600Z.db is deleted successfully.

tanium-tr-list-connections

Returns all connections.

Base Command

tanium-tr-list-connections

Input

Argument Name	Description	Required
limit	The maximum number of connections to return.	Optional
offset	The offset number to begin listing connections.	Optional

Context Output

Path	Type	Description
Tanium.Connection.CreateTime	Date	Time when the connection was first created.
Tanium.Connection.Name	String	The connection name.
Tanium.Connection.Remote	Boolean	Whether it is a remote connection.
Tanium.Connection.State	String	Current connection state. Can be “closed”, “pending”, “active”, “timeout”, or “migrating”.
Tanium.Connection.Deleted	Boolean	Whether the connection has been deleted.
Tanium.Connection.DestionationType	String	The destionation type (computer_name or ip_address).
Tanium.Connection.DST	String	The connection’s DST.
Tanium.Connection.OSName	String	The connection’s operating system.

Command Example

!tanium-tr-list-connections limit=2

Context Example

{
    "Tanium": {
        "Connection": [
            {
                "DST": "HOST_NAME",
                "Name": "HOST_NAME",
                "State": "timeout",
                "Deleted": false,
                "DestionationType": "computer-name",
                "OSName": "Linux"
            },
            {
                "DST": "HOST_NAME-2020_01_09T15.25.13.535Z.db",
                "Name": "HOST_NAME-2020_01_09T15.25.13.535Z.db",
                "State": "timeout",
                "Deleted": false,
                "DestionationType": "computer-name"
                "OSName": "Linux"
            }
        ]
    }
}

Human Readable Output

Connections

Name	State	DST	OS Name
HOST_NAME	timeout	HOST_NAME	Linux
HOST_NAME-2020_01_09T15.25.13.535Z.db	timeout	HOST_NAME-2020_01_09T15.25.13.535Z.db	Linux

tanium-tr-get-connection-by-name

Returns a connection object based on connection name.

Base Command

tanium-tr-get-connection-by-name

Input

Argument Name	Description	Required
connection-name	The connection name.	Required

Context Output

Path	Type	Description
Tanium.Connection.CreateTime	Date	Time when the connection was first created.
Tanium.Connection.Name	String	The connection name.
Tanium.Connection.Remote	Boolean	Whether it is a remote connection.
Tanium.Connection.State	String	Current connection state. Can be “closed”, “pending”, “active”, “timeout”, or “migrating”.
Tanium.Connection.Deleted	Boolean	Whether the connection has been deleted.
Tanium.Connection.DestionationType	String	The destionation type (computer_name or ip_address).
Tanium.Connection.DST	String	The connection’s DST.
Tanium.Connection.OSName	String	The connection’s operating system.

Command Example

!tanium-tr-get-connection-by-name connection-name=HOST_NAME

Context Example

{
    "Tanium": {
        "Connection": {
            "CreateTime": "2020-02-06T15:54:40.830Z",
            "Name": "HOST_NAME",
            "Deleted": false,
            "OSName": "Windows",
            "Remote": true,
            "State": "active"
        }
    }
}

Human Readable Output

Connection information

Name	State	Remote	Create Time	OS Name
HOST_NAME	active	true	2020-02-06T15:54:40.830Z	Windows

tanium-tr-create-connection

Creates a local or remote connection.

Base Command

tanium-tr-create-connection

Input

Argument Name	Description	Required
remote	Whether it is a remote connection. Can be “True” or “False”.	Required
destination-type	Type of destination. Can be “ip_address” or “computer_name”.	Required
destination	Computer name or IP address.	Required
connection-timeout	connection timeout, in milliseconds.	Optional

Context Output

There is no context output for this command.

Command Example

!tanium-tr-create-connection destination=HOST_NAME destination-type=computer_name remote=False

Human Readable Output

Initiated connection request to HOST_NAME.

tanium-tr-delete-connection

Deletes a connection by connection name.

Base Command

tanium-tr-delete-connection

Input

Argument Name	Description	Required
connection-name	The name of the connection.	Required

Context Output

Path	Type	Description
Tanium.Connection.Name	String	The connection name.
Tanium.Connection.Deleted	Boolean	Whether the connection has been deleted.

Command Example

!tanium-tr-delete-connection connection-name=HOST_NAME

Context Example

{
    "Tanium": {
        "Connection": {
            "Name": "HOST_NAME",
            "Deleted": true
        }
    }
}

Human Readable Output

Connection HOST_NAME deleted successfully.

tanium-tr-list-labels

Returns all available labels in the system.

Base Command

tanium-tr-list-labels

Input

Argument Name	Description	Required
limit	The maximum number of labels to return.	Optional
offset	The offset number to begin listing labels.	Optional

Context Output

Path	Type	Description
Tanium.Label.CreatedAt	Date	The date when this label was created.
Tanium.Label.Description	String	An extended description of the label.
Tanium.Label.ID	Number	The unique identifier for this label.
Tanium.Label.IndicatorCount	Number	The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.Name	String	The display name of the label.
Tanium.Label.SignalCount	Number	The number of Tanium Signal documents associated with this label.
Tanium.Label.UpdatedAt	Date	The date when this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-list-labels limit=2

Context Example

{
    "Tanium": {
        "Label": [
            {
                "CreatedAt": "2019-07-31T18:46:28.629Z",
                "Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                "ID": 1,
                "IndicatorCount": 0,
                "Name": "Alpha",
                "SignalCount": 0,
                "UpdatedAt": "2019-07-31T18:46:28.629Z"
            },
            {
                "CreatedAt": "2019-07-31T18:46:28.629Z",
                "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                "ID": 2,
                "IndicatorCount": 0,
                "Name": "Beta",
                "SignalCount": 97,
                "UpdatedAt": "2019-07-31T18:46:28.629Z"
            }
        ]
    }
}

Human Readable Output

Labels

Name	Description	ID	Indicator Count	Signal Count	Created At	Updated At
Alpha	These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.	1	0	0	2019-07-31T18:46:28.629Z	2019-07-31T18:46:28.629Z
Beta	These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.	2	0	97	2019-07-31T18:46:28.629Z	2019-07-31T18:46:28.629Z

tanium-tr-get-label-by-id

Returns a label object based on label ID.

Base Command

tanium-tr-get-label-by-id

Input

Argument Name	Description	Required
label-id	The label ID.	Required

Context Output

Path	Type	Description
Tanium.Label.CreatedAt	Date	The date when this label was created.
Tanium.Label.Description	String	An extended description of the label.
Tanium.Label.ID	Number	The unique identifier for this label.
Tanium.Label.IndicatorCount	Number	The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.Name	String	The display name of the label.
Tanium.Label.SignalCount	Number	The number of Tanium Signal documents associated with this label.
Tanium.Label.UpdatedAt	Date	The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-get-label-by-id label-id=1

Context Example

{
    "Tanium": {
        "Label": {
            "CreatedAt": "2019-07-31T18:46:28.629Z",
            "Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
            "ID": 1,
            "IndicatorCount": 0,
            "Name": "Alpha",
            "SignalCount": 0,
            "UpdatedAt": "2019-07-31T18:46:28.629Z"
        }
    }
}

Human Readable Output

Label information

Name	Description	ID	Indicator Count	Signal Count	Created At	Updated At
Alpha	These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.	1	0	0	2019-07-31T18:46:28.629Z	2019-07-31T18:46:28.629Z

tanium-tr-list-file-downloads

Returns all downloaded files in the system.

Base Command

tanium-tr-list-file-downloads

Input

Argument Name	Description	Required
limit	The maximum number of files to return. The default value is 50.	Optional
offset	Offset to start getting file downloads. The default is 0.	Optional
host	Filter downloaded files by host.	Optional

Context Output

Path	Type	Description
Tanium.FileDownload.Size	Number	The size of the file, in bytes.
Tanium.FileDownload.Path	String	The path of the file.
Tanium.FileDownload.Downloaded	Date	The date when this file was downloaded.
Tanium.FileDownload.Host	String	The hostname of the downloaded file.
Tanium.FileDownload.Created	Date	The date when the file was created.
Tanium.FileDownload.Hash	String	The file hash.
Tanium.FileDownload.SPath	String	The file SPath.
Tanium.FileDownload.ID	Number	The downloaded file ID.
Tanium.FileDownload.LastModified	Date	The date when the file was last modified.
Tanium.FileDownload.CreatedBy	String	The user that created this file.
Tanium.FileDownload.CreatedByProc	String	The process path that created this file.
Tanium.FileDownload.LastModifiedBy	String	The user that last modified this file.
Tanium.FileDownload.LastModifiedByProc	String	The process path that modified this file.
Tanium.FileDownload.Comments	String	Additional comments for the downloaded file.
Tanium.FileDownload.Tags	String	The downloaded file tags.
Tanium.FileDownload.Deleted	Boolean	Whether the file download has been deleted.

Command Example

!tanium-tr-list-file-downloads host=HOST_NAME limit=2 offset=1

Context Example

{
    "Tanium": {
        "FileDownload": [
            {
                "Created": "2020-01-02 15:39:57.289",
                "CreatedBy": "NT AUTHORITY\\LOCAL SERVICE",
                "CreatedByProc": "C:\\Windows\\System32\\svchost.exe",
                "Downloaded": "2020-01-02 15:40:29.003",
                "Hash": "2ae2da9237309b13b9a9d52d1358c826",
                "Host": "HOST_NAME",
                "ID": 4,
                "LastModified": "2020-01-02 15:39:57.289",
                "LastModifiedBy": "NT AUTHORITY\\LOCAL SERVICE",
                "LastModifiedByProc": "C:\\Windows\\System32\\svchost.exe",
                "Path": "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive1.dat",
                "SPath": "6ae86937-611f-45e9-900c-3ba57298f264.zip",
                "Size": 2048,
                "Deleted": false
            },
            {
                "Created": "Tue, 03 Sep 2019 17:51:40 GMT",
                "Downloaded": "2020-01-15 13:04:02.827",
                "Hash": "99297a0e626ca092ff1884ad28f54453",
                "Host": "HOST_NAME",
                "ID": 6,
                "LastModified": "Wed, 15 Jan 2020 08:57:19 GMT",
                "Path": "C:\\Program Files (x86)\\Tanium\\Tanium Client\\Logs\\log1.txt",
                "SPath": "c0531415-87a6-4d28-a226-b485784b1881.zip",
                "Size": 10485904,
                "Deleted": true
            }
        ]
    }
}

Human Readable Output

File downloads

ID	Host	Path	Hash	Downloaded	Size	Created	Created By	Created By Proc	Last Modified	Last Modified By	Last Modified By Proc	S Path
4	HOST_NAME	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat	2ae2da9237309b13b9a9d52d1358c826	2020-01-02 15:40:29.003	2048	2020-01-02 15:39:57.289	NT AUTHORITY\LOCAL SERVICE	C:\Windows\System32\svchost.exe	2020-01-02 15:39:57.289	NT AUTHORITY\LOCAL SERVICE	C:\Windows\System32\svchost.exe	6ae86937-611f-45e9-900c-3ba57298f264.zip
6	HOST_NAME	C:\Program Files (x86)\Tanium\Tanium Client\Logs\log1.txt	99297a0e626ca092ff1884ad28f54453	2020-01-15 13:04:02.827	10485904	Tue, 03 Sep 2019 17:51:40 GMT			Wed, 15 Jan 2020 08:57:19 GMT			c0531415-87a6-4d28-a226-b485784b1881.zip

tanium-tr-get-downloaded-file

Gets the actual content of a downloaded file by file ID.

Base Command

tanium-tr-get-downloaded-file

Input

Argument Name	Description	Required
file-id	The file ID.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-get-downloaded-file file-id=4

Context Example

{
    "File": {
        "EntryID": "8389@b32fdf18-1c65-43af-8918-7f85a1fab951",
        "Extension": "zip",
        "Info": "application/zip",
        "MD5": "216923cc567afe1009e7c90c105450f5",
        "Name": "lastalive1.dat.zip",
        "SHA1": "f7d257dc94ea0b650f62cc87264861b593a341c8",
        "SHA256": "5d0051b4c596e06217bdb3e48196b0515a7983f18a8ea7477bc33c837e0202e5",
        "SHA512": "269669cda90658e1bfea8ff85f27f8f68320ccd3b54c64a00037204fa3b5422634d9107806ddad585fa0d5c7fe7aa7fa240afb4142c6ff02537b039d176bd482",
        "SSDeep": "6:5jPRX/CSkILyratwQte+zetPYwCRXgLrCDh/+loUn:5jtCCPtTzep33vCDJaoUn",
        "Size": 253,
        "Type": "Zip archive data, at least v2.0 to extract"
    }
}

Human Readable Output

tanium-tr-list-events-by-connection

Queries events for a connection.

Base Command

tanium-tr-list-events-by-connection

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
event-type	The type of event. Can be “File”, “Network”, “Registry”, “Process”, “Driver”, “Security”, “Combined”, “DNS”, or “Image”. The default is “Combined”.	Required
limit	The maximum number of events to return. The default value is 50.	Optional
offset	Offset to start getting the result set. The default is 0.	Optional
filter	Advanced search that filters according to event fields. For example: [[‘process_id’, ‘gt’, ‘30’], [‘username’, ‘ne’, ‘administrator’]]. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional operators: eq (equals), ne (does not equal); for integers/date: gt (greater than), gte (greater than or equals), ls (less than), lse (less than or equals); for strings: co (contains), nc (does not contain).	Optional
match	Whether the results should fit all filters or at least one filter.	Optional
sort	A comma-separated list of fields to sort on prefixed by +/- for ascending or descending and ordered by priority left to right. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC).	Optional
fields	A comma-separated list of fields on which to search. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time.	Optional

Context Output

Path	Type	Description
TaniumEvent.Domain	String	The domain of the event.
TaniumEvent.File	String	The path of the file in the event.
TaniumEvent.Operation	String	The event operation.
TaniumEvent.ProcessID	Number	The ID of the process.
TaniumEvent.ProcessName	String	The name of the process.
TaniumEvent.ProcessTableID	Number	The ID of the process table.
TaniumEvent.Timestamp	Date	The date when the event was created.
TaniumEvent.Username	String	The username associated with the event.
TaniumEvent.DestinationAddress	String	The network event destination address.
TaniumEvent.DestinationPort	Number	The network event destination port.
TaniumEvent.SourceAddress	String	The network event source address.
TaniumEvent.SourcePort	Number	The network event source port.
TaniumEvent.KeyPath	String	The registry key path.
TaniumEvent.ValueName	String	The registry value name.
TaniumEvent.ExitCode	Number	The process exit code.
TaniumEvent.ProcessCommandLine	String	The process command line.
TaniumEvent.ProcessHash	String	The hash value of the process.
TaniumEvent.SID	Number	The process SID.
TaniumEvent.Hashes	String	The hashes of the driver.
TaniumEvent.ImageLoaded	String	The image loaded path of the driver.
TaniumEvent.Signature	String	The signature of the driver.
TaniumEvent.Signed	Boolean	Whether the driver is signed.
TaniumEvent.EventID	Number	The ID of the event.
TaniumEvent.EventOpcode	Number	The event opcode.
TaniumEvent.EventRecordID	Number	The ID of the event record.
TaniumEvent.EventTaskID	Number	The ID of the event task.
TaniumEvent.Query	String	The query of the DNS.
TaniumEvent.Response	String	The response of the DNS.
TaniumEvent.ImagePath	String	The image path.
TaniumEvent.CreationTime	Date	The process creation time
TaniumEvent.EndTime	Date	The process end time.
TaniumEvent.EventTaskName	String	The name of the event task.
TaniumEvent.Property.Name	String	The name of the event’s property
TaniumEvent.Property.Value	String	The value of the event’s property

Command Example

!tanium-tr-list-events-by-connection connection-name=HOST_NAME event-type=Process limit=2

Context Example

{
    "Tanium": {
        "Event": [
            {
                "Domain": "root",
                "Type": "Process",
                "CreationTime": "2020-03-02 16:05:37.574",
                "EndTime": "2020-03-03 11:28:28.413",
                "ExitCode": 0,
                "ProcessCommandLine": "sleep 0.1",
                "ProcessID": 13136,
                "ProcessName": "/usr/bin/sleep",
                "ProcessTableID": 17191168,
                "SID": 5,
                "Username": "root"
            },
            {
                "Domain": "root",
                "Type": "Process",
                "CreationTime": "2020-03-02 23:09:33.153",
                "EndTime": "2020-03-03 08:48:05.624",
                "ExitCode": 0,
                "ProcessCommandLine": "sleep 0.1",
                "ProcessHash": "BEA3A5351BBE28622A560FF5F18C805E",
                "ProcessID": 4229,
                "ProcessName": "/usr/bin/sleep",
                "ProcessTableID": 17232881,
                "SID": 5,
                "Username": "root"
            }
        ]
    }
}

Human Readable Output

Events for HOST_NAME

Domain	Type	Process Table ID	Process Command Line	Process ID	Process Name	Exit Code	SID	Username	Creation Time	End Time
root	Process	17191168	sleep 0.1	13136	/usr/bin/sleep	0	5	root	2020-03-02 16:05:37.574	2020-03-03 11:28:28.413
root	Process	17232881	sleep 0.1	4229	/usr/bin/sleep	0	5	root	2020-03-02 23:09:33.153	2020-03-03 08:48:05.624

tanium-tr-get-file-download-info

Gets the metadata of a file download. You must supply either the path or id agument for the command to run successfully.

Base Command

tanium-tr-get-file-download-info

Input

Argument Name	Description	Required
host	The hostname of the downloaded file.	Required
path	The path of the file.	Optional
id	File download ID.	Optional

Context Output

Path	Type	Description
Tanium.FileDownload.Size	Number	The size of the file, in bytes.
Tanium.FileDownload.Path	String	The path of the file.
Tanium.FileDownload.Downloaded	Date	The date when this file was downloaded.
Tanium.FileDownload.Host	String	The hostname of the downloaded file.
Tanium.FileDownload.Created	Date	The date when the file was created.
Tanium.FileDownload.Hash	String	The file hash.
Tanium.FileDownload.SPath	String	The file SPath.
Tanium.FileDownload.ID	Number	The downloaded file ID.
Tanium.FileDownload.LastModified	Date	The date when the file was last modified.
Tanium.FileDownload.CreatedBy	String	The user that created this file.
Tanium.FileDownload.CreatedByProc	String	The process path that created this file.
Tanium.FileDownload.LastModifiedBy	String	The user that last modified this file.
Tanium.FileDownload.LastModifiedByProc	String	The process path that modified this file.
Tanium.FileDownload.Comments	String	The downloaded file comments.
Tanium.FileDownload.Tags	String	The downloaded file tags.
Tanium.FileDownload.Deleted	Boolean	Whether the file download has been deleted.

Command Example

!tanium-tr-get-file-download-info host=HOST_NAME id=4

Context Example

{
    "Tanium": {
        "FileDownload": {
            "Created": "2020-01-02 15:39:57.289",
            "CreatedBy": "NT AUTHORITY\\LOCAL SERVICE",
            "CreatedByProc": "C:\\Windows\\System32\\svchost.exe",
            "Downloaded": "2020-01-02 15:40:29.003",
            "Hash": "2ae2da9237309b13b9a9d52d1358c826",
            "Host": "HOST_NAME",
            "ID": 4,
            "LastModified": "2020-01-02 15:39:57.289",
            "LastModifiedBy": "NT AUTHORITY\\LOCAL SERVICE",
            "LastModifiedByProc": "C:\\Windows\\System32\\svchost.exe",
            "Path": "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive1.dat",
            "SPath": "6ae86937-611f-45e9-900c-3ba57298f264.zip",
            "Size": 2048,
            "Deleted": false
        }
    }
}

Human Readable Output

File download metadata for file `C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat`

ID	Host	Path	Hash	Downloaded	Size	Created	Created By	Created By Proc	Last Modified	Last Modified By	Last Modified By Proc	S Path
4	HOST_NAME	C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat	2ae2da9237309b13b9a9d52d1358c826	2020-01-02 15:40:29.003	2048	2020-01-02 15:39:57.289	NT AUTHORITY\LOCAL SERVICE	C:\Windows\System32\svchost.exe	2020-01-02 15:39:57.289	NT AUTHORITY\LOCAL SERVICE	C:\Windows\System32\svchost.exe	6ae86937-611f-45e9-900c-3ba57298f264.zip

tanium-tr-get-process-info

Get information for a process.

Base Command

tanium-tr-get-process-info

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
ptid	The process instance ID.	Required

Context Output

Path	Type	Description
Tanium.Process.CreateTime	Date	Time when the process was created.
Tanium.Process.Domain	String	The domain of the process.
Tanium.Process.ExitCode	Number	The process exit code.
Tanium.Process.ProcessCommandLine	String	The process command line.
Tanium.Process.ProcessID	Number	The ID of the process.
Tanium.Process.ProcessName	String	File of the process.
Tanium.Process.ProcessTableId	Number	The ID of the process table.
Tanium.Process.SID	String	The security ID of the process.
Tanium.Process.Username	String	The username who created the process.

Command Example

!tanium-tr-get-process-info ptid=667680 connection-name=HOST_NAME limit=5

Context Example

{
    "Tanium": {
        "Process": {
            "CreateTime": "2020-01-22 16:16:07.553",
            "Domain": "NT AUTHORITY",
            "ExitCode": 0,
            "ProcessCommandLine": "System",
            "ProcessID": 4,
            "ProcessName": "System",
            "ProcessTableId": 667680,
            "SID": "S-1-5-18",
            "Username": "SYSTEM"
        }
    }
}

Human Readable Output

Process information for process with PTID 667680

Process ID	Process Name	Process Command Line	Process Table Id	SID	Username	Domain	Exit Code	Create Time
4	System	System	667680	S-1-5-18	SYSTEM	NT AUTHORITY	0	2020-01-22 16:16:07.553

tanium-tr-get-events-by-process

Gets the events for a process.

Base Command

tanium-tr-get-events-by-process

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
ptid	The process instance ID.	Required
limit	The maximum number of events to return.	Optional
offset	The offset number to begin listing events.	Optional

Context Output

Path	Type	Description
Tanium.ProcessEvent.ID	Number	The ID of the event.
Tanium.ProcessEvent.Detail	Unknown	The event details.
Tanium.ProcessEvent.Operation	String	The event operation.
Tanium.ProcessEvent.Timestamp	Date	Time when the event was created.
Tanium.ProcessEvent.Type	String	The event type.

Command Example

!tanium-tr-get-events-by-process ptid=667680 connection-name=HOST_NAME limit=1

Context Example

{
    "Tanium": {
        "ProcessEvent": {
            "Detail": "4: System",
            "ID": 667680,
            "Operation": "CreateProcess",
            "Timestamp": "2020-01-22 16:16:07.553",
            "Type": "Process"
        }
    }
}

Human Readable Output

Events for process 667680

ID	Detail	Type	Timestamp	Operation
667680	4: System	Process	2020-01-22 16:16:07.553	CreateProcess

tanium-tr-get-process-children

Gets the children of this process instance.

Base Command

tanium-tr-get-process-children

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
ptid	The process instance ID.	Required

Context Output

Path	Type	Description
Tanium.ProcessChildren.ID	Number	The ID of the process.
Tanium.ProcessChildren.Name	String	File of the process.
Tanium.ProcessChildren.PID	Number	The PID of the process.
Tanium.ProcessChildren.PTID	Number	The process instance ID.
Tanium.ProcessChildren.Parent	String	The parent process name.

Command Example

!tanium-tr-get-process-children ptid=667680 connection-name=HOST_NAME

Context Example

{
    "Tanium": {
        "ProcessChildren": [
            {
                "ID": 667681,
                "Name": "0: Unknown Process",
                "PID": 0,
                "PTID": 667681,
                "Parent": "4: System"
            },
            {
                "ID": 667682,
                "Name": "1: Pruned Process",
                "PID": 1,
                "PTID": 667682,
                "Parent": "4: System"
            },
            {
                "ID": 667683,
                "Name": "392: smss.exe",
                "PID": 392,
                "PTID": 667683,
                "Parent": "4: System"
            }
        ]
    }
}

Human Readable Output

Children for process with PTID 667680

ID	Name	PID	PTID	Parent
667681	0: Unknown Process	0	667681	4: System
667682	1: Pruned Process	1	667682	4: System
667683	392: smss.exe	392	667683	4: System

tanium-tr-get-parent-process

Gets information for the parent process.

Base Command

tanium-tr-get-parent-process

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
ptid	The process instance ID.	Required

Context Output

Path	Type	Description
Tanium.Process.CreateTime	Date	Time when the process was created.
Tanium.Process.Domain	String	The domain of the process.
Tanium.Process.ExitCode	Number	The process exit code.
Tanium.Process.ProcessCommandLine	String	The process command line.
Tanium.Process.ProcessID	Number	The ID of the process.
Tanium.Process.ProcessName	String	File of the process.
Tanium.Process.ProcessTableId	Number	The ID of the process table.
Tanium.Process.SID	String	The security ID of the process.
Tanium.Process.Username	String	The username who created the process.

Command Example

!tanium-tr-get-parent-process ptid=667681 connection-name=HOST_NAME

Context Example

{
    "Tanium": {
        "ParentProcess": {
            "CreateTime": "2020-01-22 16:16:07.553",
            "Domain": "NT AUTHORITY",
            "ExitCode": 0,
            "ProcessCommandLine": "System",
            "ProcessID": 4,
            "ProcessName": "System",
            "ProcessTableId": 667680,
            "SID": "S-1-5-18",
            "Username": "SYSTEM"
        }
    }
}

Human Readable Output

Process information for process with PTID 667681

Process ID	Process Name	Process Command Line	Process Table Id	SID	Username	Domain	Exit Code	Create Time
4	System	System	667680	S-1-5-18	SYSTEM	NT AUTHORITY	0	2020-01-22 16:16:07.553

tanium-tr-get-parent-process-tree

Gets the parent process tree for the process instance.

Base Command

tanium-tr-get-parent-process-tree

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
ptid	The process instance ID.	Required

Context Output

Path	Type	Description
Tanium.ParentProcessTree.ID	Number	The parent process ID.
Tanium.ParentProcessTree.Name	String	File of the parent process.
Tanium.ParentProcessTree.PID	Number	The parent process PID.
Tanium.ParentProcessTree.PTID	Number	The parent process instance ID.
Tanium.ParentProcessTree.Parent	String	The parent process name.
Tanium.ParentProcessTree.Children	Unknown	The parent process children.

Command Example

!tanium-tr-get-parent-process-tree ptid=667681 connection-name=HOST_NAME

Context Example

{
    "Tanium": {
        "ParentProcessTree": {
            "Children": [
                {
                    "Children": [],
                    "ID": 667681,
                    "Name": "0: Unknown Process",
                    "PID": 0,
                    "PTID": 667681,
                    "Parent": "4: System"
                },
                {
                    "Children": [],
                    "ID": 667682,
                    "Name": "1: Pruned Process",
                    "PID": 1,
                    "PTID": 667682,
                    "Parent": "4: System"
                },
                {
                    "Children": [],
                    "ID": 667683,
                    "Name": "392: smss.exe",
                    "PID": 392,
                    "PTID": 667683,
                    "Parent": "4: System"
                }
            ],
            "ID": 667680,
            "Name": "4: System",
            "PID": 4,
            "PTID": 667680
        }
    }
}

Human Readable Output

Parent process for process with PTID 667681

ID	Name	PID	PTID
667680	4: System	4	667680

Processes with the same parent

ID	Name	PID	PTID	Parent
667681	0: Unknown Process	0	667681	4: System
667682	1: Pruned Process	1	667682	4: System
667683	392: smss.exe	392	667683	4: System

tanium-tr-get-process-tree

Gets the process tree for the process instance.

Base Command

tanium-tr-get-process-tree

Input

Argument Name	Description	Required
connection-name	The connection name.	Required
ptid	The process instance ID.	Required

Context Output

Path	Type	Description
Tanium.ProcessTree.ID	Number	The process ID.
Tanium.ProcessTree.Name	String	File of the process.
Tanium.ProcessTree.PID	Number	The process PID.
Tanium.ProcessTree.PTID	Number	The process instance ID.
Tanium.ProcessTree.Parent	String	The parent process name.
Tanium.ProcessTree.Children	Unknown	The process children.

Command Example

!tanium-tr-get-process-tree ptid=667680 connection-name=HOST_NAME

Context Example

{
    "Tanium": {
        "ProcessTree": {
            "Children": [
                {
                    "Children": [],
                    "ID": 667681,
                    "Name": "0: Unknown Process",
                    "PID": 0,
                    "PTID": 667681,
                    "Parent": "4: System"
                },
                {
                    "Children": [],
                    "ID": 667682,
                    "Name": "1: Pruned Process",
                    "PID": 1,
                    "PTID": 667682,
                    "Parent": "4: System"
                },
                {
                    "Children": [],
                    "ID": 667683,
                    "Name": "392: smss.exe",
                    "PID": 392,
                    "PTID": 667683,
                    "Parent": "4: System"
                }
            ],
            "ID": 667680,
            "Name": "4: System",
            "PID": 4,
            "PTID": 667680
        }
    }
}

Human Readable Output

Process information for process with PTID 667680

ID	Name	PID	PTID
667680	4: System	4	667680

Children for process with PTID 667680

ID	Name	PID	PTID	Parent
667681	0: Unknown Process	0	667681	4: System
667682	1: Pruned Process	1	667682	4: System
667683	392: smss.exe	392	667683	4: System

tanium-tr-list-evidence

Returns a list of all available evidence in the system.

Base Command

tanium-tr-list-evidence

Input

Argument Name	Description	Required
limit	The maximum number of evidences to return. The default value is 50.	Optional
offset	Offset to start getting the events result set. The default is 0.	Optional
sort	A comma-separated list of fields by which to sort, using +/- prefixes for ascending/descending, in order of priority (left to right).	Optional

Context Output

Path	Type	Description
Tanium.Evidence.ID	Number	The evidence ID.
Tanium.Evidence.CreatedAt	Date	Time when the process was created.
Tanium.Evidence.LastModified	Date	The date that the file was last modified.
Tanium.Evidence.User	String	The user of the evidence.
Tanium.Evidence.ConnectionName	String	The evidence connection name.
Tanium.Evidence.Type	Number	The evidence type.
Tanium.Evidence.ProcessTableId	Number	The evidence process table ID.
Tanium.Evidence.Timestamp	Date	The evidence timestamp.
Tanium.Evidence.Summary	String	The evidence summary.
Tanium.Evidence.Comments	String	The evidence comments.
Tanium.Evidence.Tags	String	The evidence tags.
Tanium.Evidence.Deleted	Boolean	Whether the evident has been deleted.

Command Example

!tanium-tr-list-evidence limit=2 offset=1 sort=+id

Context Example

{
    "Tanium": {
        "Evidence": [
            {
                "ConnectionName": "HOST_NAME",
                "CreatedAt": "2020-01-02 15:40:03",
                "ID": 2,
                "ProcessTableId": 45632561,
                "Summary": "CreateProcess: C:\\Windows\\SysWOW64\\cmd.exe",
                "Timestamp": "2020-01-02 15:39:28.809",
                "Type": 2,
                "UpdatedAt": "2020-01-02 15:40:03",
                "User": "actionapprover",
                "Deleted": false
            },
            {
                "ConnectionName": "HOST_NAME",
                "CreatedAt": "2020-01-13 18:02:01",
                "ID": 13,
                "ProcessTableId": 4563722,
                "Summary": "CreateProcess: C:\\Windows\\System32\\wsqmcons.exe",
                "Timestamp": "2020-01-13 18:00:01.010",
                "Type": 2,
                "UpdatedAt": "2020-01-13 18:02:01",
                "User": "HOST_NAME\\administrator",
                "Deleted": false
            }
        ]
    }
}

Human Readable Output

Evidence List

ID	Timestamp	Conntection Name	User	Summary	Type	Created At	Updated At	Process Table Id
2	2020-01-02 15:39:28.809	HOST_NAME	actionapprover	CreateProcess: C:\Windows\SysWOW64\cmd.exe	2	2020-01-02 15:40:03	2020-01-02 15:40:03	45632561
13	2020-01-13 18:00:01.010	HOST_NAME	HOST_NAME\administrator	CreateProcess: C:\Windows\System32\wsqmcons.exe	2	2020-01-13 18:02:01	2020-01-13 18:02:01	4563722

tanium-tr-get-evidence-by-id

Gets evidence by evidence ID.

Base Command

tanium-tr-get-evidence-by-id

Input

Argument Name	Description	Required
evidence-id	The ID of the evidence.	Required

Context Output

Path	Type	Description
Tanium.Evidence.ID	Number	The evidence ID.
Tanium.Evidence.CreatedAt	Date	Time when the process was created.
Tanium.Evidence.LastModified	Date	The date that the file was last modified.
Tanium.Evidence.User	String	The user of the evidence.
Tanium.Evidence.ConnectionName	String	The evidence connection name.
Tanium.Evidence.Type	Number	The evidence type.
Tanium.Evidence.ProcessTableId	Number	The evidence process table ID.
Tanium.Evidence.Timestamp	Date	The evidence timestamp.
Tanium.Evidence.Summary	String	The evidence summary.
Tanium.Evidence.Comments	String	The evidence comments.
Tanium.Evidence.Tags	String	The evidence tags.
Tanium.Evidence.Deleted	Boolean	Whether the evident has been deleted.

Command Example

!tanium-tr-get-evidence-by-id evidence-id=2

Context Example

{
    "Tanium": {
        "Evidence": {
            "CreatedAt": "2020-01-02 15:40:03",
            "ConnectionName": "HOST_NAME",
            "ProcessTableId": 45632561,
            "ID": 2,
            "Summary": "CreateProcess: C:\\Windows\\SysWOW64\\cmd.exe",
            "Timestamp": "2020-01-02 15:39:28.809",
            "Type": 2,
            "UpdatedAt": "2020-01-02 15:40:03",
            "User": "actionapprover",
            "Deleted": false
        }
    }
}

Human Readable Output

Label information

ID	Timestamp	Connection Name	User	Summary	Type	Created At	Updated At	Process Table Id
2	2020-01-02 15:39:28.809	HOST_NAME	actionapprover	CreateProcess: C:\Windows\SysWOW64\cmd.exe	2	2020-01-02 15:40:03	2020-01-02 15:40:03	45632561

tanium-tr-create-evidence

Creates an evidence.

Base Command

tanium-tr-create-evidence

Input

Argument Name	Description	Required
connection-name	The name of the connection.	Required
ptid	The process instance ID.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-create-evidence connection-name=HOST_NAME connection-name=HOST_NAME ptid=13538572

Human Readable Output

Evidence have been created.

tanium-tr-delete-evidence

Deletes an evidence.

Base Command

tanium-tr-delete-evidence

Input

Argument Name	Description	Required
evidence-id	The ID of the evidence.	Required

Context Output

Path	Type	Description
Tanium.Evidence.ID	String	The evidence ID.
Tanium.Evidence.Deleted	Boolean	Whether the evidence has been deleted.

Command Example

!tanium-tr-delete-evidence evidence-id=1

Context Example

{
    "Tanium": {
        "Evidence": {
            "ID": 2,
            "Deleted": true
        }
    }
}

Human Readable Output

Evidence 1 has been deleted successfully.

tanium-tr-request-file-download

Requests a new file download.

Base Command

tanium-tr-request-file-download

Input

Argument Name	Description	Required
path	Path to file.	Required
connection-name	Connection name.	Required

Context Output

Path	Type	Description
Tanium.FileDownload.Path	String	The file download path.
Tanium.FileDownload.ConnectionName	String	The file download connection name.
Tanium.FileDownload.Downloaded	Date	Date of the download request.
Tanium.FileDownload.Status	String	Status of the file download request.
Tanium.FileDownload.ID	Number	ID of the file download.

Command Example

!tanium-tr-request-file-download connection-name=HOST_NAME path=dev/autofs

Context Example

{
    "Tanium": {
        "FileDownload": {
            "Downloaded": "2020-02-06 16:05:40.227674",
            "ConnectionName": "HOST_NAME",
            "Path": "dev/autofs"
        }
    }
}

Human Readable Output

Download request of file autofs has been sent successfully.

tanium-tr-delete-file-download

Deletes a file download.

Base Command

tanium-tr-delete-file-download

Input

Argument Name	Description	Required
file-id	File download ID.	Required

Context Output

Path	Type	Description
Tanium.FileDownload.ID	String	The file download ID.
Tanium.FileDownload.Deleted	Boolean	Whether the file download has been deleted.

Command Example

!tanium-tr-delete-file-download file-id=3

Context Example

{
    "Tanium": {
        "FileDownload": {
            "ID": 3,
            "Deleted": true
        }
    }
}

Human Readable Output

Delete request of file with ID 3 has been sent successfully.

tanium-tr-list-files-in-directory

Gets a list of files in the given directory.

Base Command

tanium-tr-list-files-in-directory

Input

Argument Name	Description	Required
path	Path to the directory.	Required
connection-name	Connection name.	Required
limit	The maximum number of files to return. The default value is 50.	Optional
offset	Offset to start getting files. The default is 0.	Optional

Context Output

Path	Type	Description
Tanium.File.Created	Date	Time the file was created.
Tanium.File.Size	Number	The file size.
Tanium.File.IsDirectory	Boolean	Whether or not the file is a directory.
Tanium.File.LastModified	Date	The date that the file was last modified.
Tanium.File.Path	Boolean	The file path.
Tanium.File.Permissions	Date	The file permissions.
Tanium.File.ConnectionName	String	The host of the file.
Tanium.File.Deleted	Boolean	Whether the file has been deleted.

Command Example

!tanium-tr-list-files-in-directory path=`C:\Program Files (x86)\Tanium\Tanium Client\` connection-name=HOST_NAME limit=2

Context Example

{
    "Tanium": {
        "File": [
            {
                "Created": "1970-01-19 03:25:44",
                "IsDirectory": false,
                "LastModified": "1970-01-19 03:25:44",
                "Path": ".detect-engine.lock",
                "Permissions": "rw-rw-rw-",
                "Size": 0,
                "Deleted": false
            },
            {
                "Created": "1970-01-18 21:02:12",
                "IsDirectory": true,
                "LastModified": "1970-01-19 07:10:05",
                "Path": "Downloads",
                "Permissions": "rw-rw-rw-",
                "Size": 393216,
                "Deleted": false
            }
        ]
    }
}

Human Readable Output

Files in directory `C:\Program Files (x86)\Tanium\Tanium Client\`

Path	Size	Created	Last Modified	Permissions	Is Directory
.detect-engine.lock	0	1970-01-19 03:25:44	1970-01-19 03:25:44	rw-rw-rw-	false
Downloads	393216	1970-01-18 21:02:12	1970-01-19 07:10:05	rw-rw-rw-	true

tanium-tr-get-file-info

Gets information about a file from a remote connection.

Base Command

tanium-tr-get-file-info

Input

Argument Name	Description	Required
connection-name	The name of the connection.	Required
path	The path to the file.	Required

Context Output

Path	Type	Description
Tanium.File.Created	Date	The file creation timestamp.
Tanium.File.Size	Number	The file size.
Tanium.File.IsDirectory	Boolean	Whether or not the file is a directory.
Tanium.File.LastModified	Date	The date that the file was last modified.
Tanium.File.Path	String	The file path.
Tanium.File.ConnectionName	String	The host of the file.
Tanium.File.Deleted	Boolean	Whether the file has been deleted.

Command Example

!tanium-tr-get-file-info connection-name=HOST_NAME path=`C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe`

Context Example

{
    "Tanium": {
        "File": {
            "Created": "1970-01-18 20:01:58",
            "IsDirectory": false,
            "LastModified": "1970-01-18 20:01:58",
            "Size": 4938736
            "Path": "C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe",
            "ConnectionName": "HOST_NAME",
            "Deleted": false
        }
    }
}

Human Readable Output

Information for file `C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe`

Path	Size	Created	Last Modified	Is Directory	Connection Name
C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe	4938736	1970-01-18 20:01:58	1970-01-18 20:01:58	false	HOST_NAME

tanium-tr-delete-file-from-endpoint

Deletes a file from the given endpoint.

Base Command

tanium-tr-delete-file-from-endpoint

Input

Argument Name	Description	Required
connection-name	Connection name.	Required
path	Path to file.	Required

Context Output

Path	Type	Description
Tanium.File.Path	String	The file path.
Tanium.File.ConnectionName	String	The host of the file.
Tanium.File.Deleted	Boolean	Whether the file has been deleted.

Command Example

!tanium-tr-delete-file-from-endpoint path=`C:\Program Files (x86)\Tanium\Tanium Client\Logs\log0.txt` connection-name=HOST_NAME

Context Example

{
    "Tanium": {
        "File": {
            "Path": "C:\Program Files (x86)\Tanium\Tanium Client\Logs\log0.txt",
            "ConnectionName": "HOST_NAME",
            "Deleted": true
        }
    }
}

Human Readable Output

Delete request of file C:\Program Files (x86)\Tanium\Tanium Client\Logs\log0.txt from endpoint HOST_NAME has been sent successfully.

tanium-tr-get-process-timeline

Gets the process timeline.

Base Command

tanium-tr-get-process-timeline

Input

Argument Name	Description	Required
connection-name	Connection name.	Required
ptid	Process table ID.	Required
category	The event categories to retrieve. Can be “File”, “DNS”, “Registry”, “Network”, “Image”, or “Process”.	Required
limit	The maximum number of events to return. The default value is 50.	Optional
offset	Offset to start getting the events. The default is 0.	Optional

Context Output

Path	Type	Description
Tanium.ProcessTimeline.ProcessTableID	Number	The process instance ID.
Tanium.ProcessTimeline.ConnectionName	String	The connection name of the process.
Tanium.ProcessTimeline.Date	Date	Events date of the process.
Tanium.ProcessTimeline.Event	String	Event of the process.
Tanium.ProcessTimeline.Category	String	The event category of the process.

Command Example

!tanium-tr-get-process-timeline ptid=13530396 connection-name=HOST_NAME category=Process limit=2

Context Example

{
    "Tanium": {
        "ProcessTimeline": [
            {
                "Category": "Process",
                "Date": "2020-02-05 10:16:02.319000",
                "Event": [
                    "Process started by root\\root"
                ]
            },
            {
                "Category": "Process",
                "Date": "2020-02-05 10:17:00.000000",
                "Event": [
                    "Process ended"
                ]
            }
        ]
    }
}

Human Readable Output

Timeline data for process with PTID `13530396`

Date	Event	Category
2020-02-05 10:16:02.319000	Process started by root\root	Process
2020-02-05 10:17:00.000000	Process ended	Process

tanium-tr-get-download-file-request-status

Gets the status of the download file request.

Base Command

tanium-tr-get-download-file-request-status

Input

Argument Name	Description	Required
request-date	Date of the download file request, or example: 2019-09-23T12:55:08.622	Required
connection-name	The connection to which the request was made.	Optional
path	The file path.	Optional

Context Output

Path	Type	Description
Tanium.DownloadFile.ID	Number	ID of the file download.
Tanium.DownloadFile.ConnectionName	String	Host of the file.
Tanium.DownloadFile.Path	String	Path of the file.
Tanium.DownloadFile.Status	String	Status of the file download request.
Tanium.DownloadFile.Downloaded	Date	The date of the download request.

Command Example

!tanium-tr-get-download-file-request-status request-date=2019-09-23T12:55:08.622

Context Example

{
    "Tanium": {
        "FileDownload": {
            "Downloaded": "2020-01-02 15:40:18.052",
            "ID": 3,
            "Status": "Completed",
            "Path": "C:\Program Files (x86)\Tanium\Tanium Client\Logs\log1.txt",
            "ConnectionName": "HOST_NAME"
        }
    }
}

Human Readable Output

File download request status

ID	Connection Name	Status	Path	Downloaded
3	HOST_NAME	Completed	C:\Program Files (x86)\Tanium\Tanium Client\Logs\log1.txt	2020-01-02 15:40:18.052

tanium-tr-intel-doc-create

Add a new intel document to the system by providing its document contents.

Base Command

tanium-tr-intel-doc-create

Input

Argument Name	Description	Required
entry-id	The file entry ID.	Required
file_extension	The suffix at the end of a filename. (Available file types - yara, stix, ioc)	Required

Context Output

Path	Type	Description
Tanium.IntelDoc.AlertCount	Number	The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt	Date	The date at which this intel was first added to the system.
Tanium.IntelDoc.Description	String	The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID	Number	The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds	Number	The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name	String	The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.Type	String	The shortened type name of the intel. For example, “openioc”, “stix”, “yara”.
Tanium.IntelDoc.UnresolvedAlertCount	Number	The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt	Date	The date when this intel was last updated.

Command Example

!tanium-tr-intel-doc-create entry-id=7173@e99f97d1-7225-4c75-896c-3c960febbe8c file_extension=ioc

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "CreatedAt": "2019-07-31T18:46:28.814Z",
            "Description": "Detects usage of the NET.EXE utility to enumerate members of the local Administrators or Domain Administrators groups. Often used during post-compromise reconnaissance.",
            "ID": 2,
            "LabelIds": [
                2,
                3,
                9,
                16
            ],
            "Name": "Administrator Account Enumeration",
            "Type": "openioc",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2020-01-14T21:37:30.934Z"
        }
    }
}

Human Readable Output

Intel Doc uploaded

ID	Name	Description	Type	Alert Count	Unresolved Alert Count	Created At	Updated At	Label Ids
2	Administrator Account Enumeration	Detects usage of the NET.EXE utility to enumerate members of the local Administrators or Domain Administrators groups. Often used during post-compromise reconnaissance.	openioc	0	0	2019-07-31T18:46:28.814Z	2020-01-14T21:37:30.934Z	2, 3, 9, 16

tanium-tr-start-quick-scan

Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to Administration -> Computer Groups in the UI. Computer group names and IDs can also be retrieved by using the tn-list-groups command in the Tanium integration.

Base Command

tanium-tr-start-quick-scan

Input

Argument Name	Description	Required
intel-doc-id	The intel document ID.	Required
computer-group-name	The name of a Tanium computer group. See command description for possible ways to retrieve this value.	Required

Context Output

Path	Type	Description
Tanium.QuickScan.AlertCount	Number	The number of alerts returned from the quick scan.
Tanium.QuickScan.ComputerGroupId	Number	The ID of a Tanium computer group.
Tanium.QuickScan.CreatedAt	Date	The date the quick scan was created.
Tanium.QuickScan.ID	Number	The ID of the quick scan.
Tanium.QuickScan.IntelDocId	Number	The unique identifier for this intel in the instance of the system.
Tanium.QuickScan.QuestionID	Number	The ID of the quick scan question.
Tanium.QuickScan.UserID	Number	The user ID which initiated the quick scan.

Command Example

!tanium-tr-start-quick-scan intel-doc-id=2 computer-group-name="All Computers"

Context Example

{
    "Tanium": {
        "QuickScan": {
            "AlertCount": 0,
            "ComputerGroupId": 1
            "CreatedAt": "2019-07-31T18:46:28.814Z",
            "ID": 5,
            "IntelDocId": 2
            "QuestionID": 4,
            "UserID": 3
        }
    }
}

Human Readable Output

Quick Scan started

Alert Count	ComputerGroupId	CreatedAt	ID	IntelDocId	QuestionID	UserID
	0	1	2019-07-31T18:46:28.814Z	5	2	4	3

Configuration parameters

isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
url — Hostname, IP address, or server URL (required)
credentials — Username (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
filter_alerts_by_state — A comma-separated list of alert states to filter by in fetch incidents command. Possible options are: unresolved, in progress, resolved or suppressed. Empty list won't filter the incidents by state.

Commands (39)

tanium-tr-alert-update-state
Updates the state of a single alert.
tanium-tr-create-connection
Creates a local or remote connection.
tanium-tr-create-evidence
Creates an evidence.
tanium-tr-create-snapshot
Captures a new snapshot by connection name.
tanium-tr-delete-connection
Deletes a connection by connection name.
tanium-tr-delete-evidence
Deletes an evidence.
tanium-tr-delete-file-download
Deletes a file download.
tanium-tr-delete-file-from-endpoint
Deletes a file from the given endpoint.
tanium-tr-delete-local-snapshot
Deletes a local snapshot by connection name and file name.
tanium-tr-delete-snapshot
Deletes a snapshot by connection name and snapshot ID.
tanium-tr-get-alert-by-id
Returns an alert object based on alert ID.
tanium-tr-get-connection-by-name
Returns a connection object based on connection name.
tanium-tr-get-download-file-request-status
Gets the status of the download file request.
tanium-tr-get-downloaded-file
Gets the actual content of a downloaded file by file ID.
tanium-tr-get-events-by-process
Gets the events for a process.
tanium-tr-get-evidence-by-id
Gets evidence by evidence ID.
tanium-tr-get-file-download-info
Gets the metadata of a file download. You must supply either the `path` or `id` argument for the command to run successfully.
tanium-tr-get-file-info
Gets information about a file from a remote connection.
tanium-tr-get-intel-doc-by-id
Returns an intel document object based on ID.
tanium-tr-get-label-by-id
Returns a label object based on label ID.
tanium-tr-get-parent-process
Gets information for the parent process.
tanium-tr-get-parent-process-tree
Gets the parent process tree for the process instance.
tanium-tr-get-process-children
Gets the children of this process instance.
tanium-tr-get-process-info
Get information for a process.
tanium-tr-get-process-timeline
Gets the process timeline.
tanium-tr-get-process-tree
Gets the process tree for the process instance.
tanium-tr-intel-doc-create
Add a new intel document to the system by providing its document contents.
tanium-tr-list-alerts
Returns a list of all alerts.
tanium-tr-list-connections
Returns all connections.
tanium-tr-list-events-by-connection
Queries events for a connection.
tanium-tr-list-evidence
Returns a list of all available evidence in the system.
tanium-tr-list-file-downloads
Returns all downloaded files in the system.
tanium-tr-list-files-in-directory
Gets a list of files in the given directory.
tanium-tr-list-intel-docs
Returns a list of all intel documents.
tanium-tr-list-labels
Returns all available labels in the system.
tanium-tr-list-local-snapshots-by-connection
Returns all local snapshots of a single connection.
tanium-tr-list-snapshots-by-connection
Returns all snapshots of a single connection.
tanium-tr-request-file-download
Requests a new file download.
tanium-tr-start-quick-scan
Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.

Source

TaniumThreatResponse.py TaniumThreatResponse_test.py TaniumThreatResponse.yml TaniumThreatResponse_description.md

Download History Raw

category: Endpoint
sectionorder:
- Connect
- Collect
provider: Tanium
commonfields:
  id: Tanium Threat Response
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Hostname, IP address, or server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: 24 hours
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  required: false
  section: Collect
- defaultvalue: unresolved
  display: 'A comma-separated list of alert states to filter by in fetch incidents command. Possible options are: unresolved, in progress, resolved or suppressed. Empty list won''t filter the incidents by state.'
  name: filter_alerts_by_state
  options:
  - unresolved
  - inprogress
  - resolved
  - suppressed
  type: 16
  required: false
  section: Collect
description: Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version below 3.0.159. In order to use Tanium Threat Response version 3.0.159 and above, use Tanium Threat Response V2 Integration.
display: Tanium Threat Response
name: Tanium Threat Response
script:
  commands:
  - arguments:
    - description: The intel document ID.
      name: intel-doc-id
      required: true
    description: Returns an intel document object based on ID.
    name: tanium-tr-get-intel-doc-by-id
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date at which this intel was first added to the system.
      type: Date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: Date
  - arguments:
    - defaultValue: '5'
      description: The maximum number of intel documents to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing intel documents.
      name: offset
    description: Returns a list of all intel documents.
    name: tanium-tr-list-intel-docs
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date at which this intel was first added to the system.
      type: Date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: Date
  - arguments:
    - defaultValue: '5'
      description: The maximum number of alerts to return. The default value is 5.
      name: limit
    - description: The offset number to begin listing alerts.
      name: offset
    - description: Filter alerts by the specified computer IP addresses.
      name: computer-ip-address
    - description: Filter alerts by the specified computer name.
      name: computer-name
    - description: Filter alerts by the specified scan config ID.
      name: scan-config-id
    - description: Filter alerts by the specified intel document ID.
      name: intel-doc-id
    - description: Filter alerts by the specified severity.
      name: severity
    - description: Filter alerts by the specified priority.
      name: priority
    - description: Filter alerts by the specified type.
      name: type
    - auto: PREDEFINED
      description: Filter alerts by the specified state. Can be "Unresolved", "In Progress", "Ignored", or "Resolved".
      name: state
      predefined:
      - Unresolved
      - In Progress
      - Ignored
      - Resolved
    description: Returns a list of all alerts.
    name: tanium-tr-list-alerts
    outputs:
    - contextPath: Tanium.Alert.Priority
      description: The priority of the alert.
      type: String
    - contextPath: Tanium.Alert.ComputerName
      description: The hostname of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.GUID
      description: A globally unique identifier for this alert in the customer environment.
      type: String
    - contextPath: Tanium.Alert.AlertedAt
      description: The moment that the alert was generated.
      type: Date
    - contextPath: Tanium.Alert.UpdatedAt
      description: The last time the alert state was updated.
      type: Date
    - contextPath: Tanium.Alert.State
      description: The current state of the alert. For example, "unresolved", "inprogress", and so on.
      type: String
    - contextPath: Tanium.Alert.ComputerIpAddress
      description: The IP address of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.Type
      description: The name of the alert type. For example, "detect.endpoint.match".
      type: String
    - contextPath: Tanium.Alert.ID
      description: The ID of the alert. For example, "123".
      type: Number
    - contextPath: Tanium.Alert.CreatedAt
      description: The date when the alert was received by the Detect product.
      type: Date
    - contextPath: Tanium.Alert.IntelDocId
      description: The intel document revision, if intelDocId is present.
      type: Number
    - contextPath: Tanium.Alert.Severity
      description: The severity of the alert.
      type: String
  - arguments:
    - description: The alert ID.
      name: alert-id
      required: true
    description: Returns an alert object based on alert ID.
    name: tanium-tr-get-alert-by-id
    outputs:
    - contextPath: Tanium.Alert.Priority
      description: The priority of the alert.
      type: String
    - contextPath: Tanium.Alert.ComputerName
      description: The hostname of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.GUID
      description: A globally unique identifier for this alert in the customer environment.
      type: String
    - contextPath: Tanium.Alert.AlertedAt
      description: The date when the alert was generated.
      type: Date
    - contextPath: Tanium.Alert.UpdatedAt
      description: The date when the alert state was last updated.
      type: Date
    - contextPath: Tanium.Alert.State
      description: The current state of the alert. For example, "unresolved", "inprogress".
      type: String
    - contextPath: Tanium.Alert.ComputerIpAddress
      description: The IP address of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.Type
      description: The name of the alert type. For example, "detect.endpoint.match".
      type: String
    - contextPath: Tanium.Alert.ID
      description: The ID of the alert. For example, "123".
      type: Number
    - contextPath: Tanium.Alert.CreatedAt
      description: The date when the alert was received by the Detect product.
      type: Date
    - contextPath: Tanium.Alert.IntelDocId
      description: The intel document revision, if intelDocId is present.
      type: Number
    - contextPath: Tanium.Alert.Severity
      description: The severity of the alert.
      type: String
  - arguments:
    - description: The ID of the alert to update.
      name: alert-id
      required: true
    - auto: PREDEFINED
      description: The new state for the alert. Can be "Unresolved", "In Progress", "Ignored", or "Resolved".
      name: state
      predefined:
      - Unresolved
      - In Progress
      - Ignored
      - Resolved
      required: true
    description: Updates the state of a single alert.
    name: tanium-tr-alert-update-state
    outputs:
    - contextPath: Tanium.Alert.Priority
      description: The priority of the alert.
      type: String
    - contextPath: Tanium.Alert.ComputerName
      description: The hostname of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.GUID
      description: A globally unique identifier for this alert in the customer environment.
      type: String
    - contextPath: Tanium.Alert.AlertedAt
      description: The date when the alert was generated.
      type: Date
    - contextPath: Tanium.Alert.UpdatedAt
      description: The date when the alert state was last updated.
      type: Date
    - contextPath: Tanium.Alert.State
      description: The current state of the alert. For example, "unresolved", "inprogress".
      type: String
    - contextPath: Tanium.Alert.ComputerIpAddress
      description: The IP address of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.Type
      description: The name of the alert type. For example, "detect.endpoint.match".
      type: String
    - contextPath: Tanium.Alert.ID
      description: The ID of the alert. For example, "123".
      type: Number
    - contextPath: Tanium.Alert.CreatedAt
      description: The date when the alert was received by the Detect product.
      type: Date
    - contextPath: Tanium.Alert.IntelDocId
      description: The intel document revision, if intelDocId is present.
      type: Number
    - contextPath: Tanium.Alert.Severity
      description: The severity of the alert.
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum number of snapshots to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing snapshots.
      name: offset
    - description: The connection name.
      name: connection-name
      required: true
    description: Returns all snapshots of a single connection.
    name: tanium-tr-list-snapshots-by-connection
    outputs:
    - contextPath: Tanium.Snapshot.ConnectionName
      description: The snapshot connection name.
      type: String
    - contextPath: Tanium.Snapshot.Error
      description: The snapshot error message.
      type: String
    - contextPath: Tanium.Snapshot.ID
      description: The snapshot id.
      type: String
    - contextPath: Tanium.Snapshot.Started
      description: The date when the snapshot was created.
      type: Date
    - contextPath: Tanium.Snapshot.State
      description: The current state of the snapshot.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    description: Captures a new snapshot by connection name.
    name: tanium-tr-create-snapshot
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The snapshot ID.
      name: snapshot-id
      required: true
    description: Deletes a snapshot by connection name and snapshot ID.
    name: tanium-tr-delete-snapshot
    outputs:
    - contextPath: Tanium.Snapshot.ID
      description: The snapshot ID.
      type: String
    - contextPath: Tanium.Snapshot.ConnectionName
      description: The connection name.
      type: String
    - contextPath: Tanium.Snapshot.Deleted
      description: Whether the snapshot has been deleted.
      type: Boolean
  - arguments:
    - defaultValue: '50'
      description: The maximum number of local snapshots to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing local snapshots.
      name: offset
    - description: The connection name.
      name: connection-name
      required: true
    description: Returns all local snapshots of a single connection.
    name: tanium-tr-list-local-snapshots-by-connection
    outputs:
    - contextPath: Tanium.LocalSnapshot.ConnectionName
      description: The snapshot connection name.
      type: String
    - contextPath: Tanium.LocalSnapshot.FileName
      description: The snapshot file name.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The file name.
      name: file-name
      required: true
    description: Deletes a local snapshot by connection name and file name.
    name: tanium-tr-delete-local-snapshot
    outputs:
    - contextPath: Tanium.LocalSnapshot.FileName
      description: The snapshot file name.
      type: String
    - contextPath: Tanium.LocalSnapshot.Deleted
      description: Whether the local snapshot has been deleted.
      type: Boolean
  - arguments:
    - defaultValue: '50'
      description: The maximum number of connections to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing connections.
      name: offset
    description: Returns all connections.
    name: tanium-tr-list-connections
    outputs:
    - contextPath: Tanium.Connection.CreateTime
      description: Time when the connection was first created.
      type: Date
    - contextPath: Tanium.Connection.Name
      description: The connection name.
      type: String
    - contextPath: Tanium.Connection.Remote
      description: Whether it is a remote connection.
      type: Boolean
    - contextPath: Tanium.Connection.State
      description: Current connection state. Can be "closed", "pending", "active", "timeout", or "migrating".
      type: String
    - contextPath: Tanium.Connection.Deleted
      description: Whether the connection has been deleted.
      type: Boolean
    - contextPath: Tanium.Connection.DestionationType
      description: The destionation type (computer_name or ip_address).
      type: String
    - contextPath: Tanium.Connection.DST
      description: The connection's DST.
      type: String
    - contextPath: Tanium.Connection.OSName
      description: The connection's operating system.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    description: Returns a connection object based on connection name.
    name: tanium-tr-get-connection-by-name
    outputs:
    - contextPath: Tanium.Connection.CreateTime
      description: Time when the connection was first created.
      type: Date
    - contextPath: Tanium.Connection.Name
      description: The connection name.
      type: String
    - contextPath: Tanium.Connection.Remote
      description: Whether it is a remote connection.
      type: Boolean
    - contextPath: Tanium.Connection.State
      description: Current connection state. Can be "closed", "pending", "active", "timeout", or "migrating".
      type: String
    - contextPath: Tanium.Connection.Deleted
      description: Whether the connection has been deleted.
      type: Boolean
    - contextPath: Tanium.Connection.DestionationType
      description: The destionation type (computer_name or ip_address).
      type: String
    - contextPath: Tanium.Connection.DST
      description: The connection's DST.
      type: String
    - contextPath: Tanium.Connection.OSName
      description: The connection's operating system.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: Whether it is a remote connection. Can be "True" or "False".
      name: remote
      predefined:
      - 'True'
      - 'False'
      required: true
    - auto: PREDEFINED
      description: Type of destination. Can be "ip_address" or "computer_name".
      name: destination-type
      predefined:
      - ip_address
      - computer_name
      required: true
    - description: Computer name or IP address.
      name: destination
      required: true
    - defaultValue: '30000'
      description: connection timeout, in milliseconds.
      name: connection-timeout
    description: Creates a local or remote connection.
    name: tanium-tr-create-connection
  - arguments:
    - description: The name of the connection.
      name: connection-name
      required: true
    description: Deletes a connection by connection name.
    name: tanium-tr-delete-connection
    outputs:
    - contextPath: Tanium.Connection.Name
      description: The connection name.
      type: String
    - contextPath: Tanium.Connection.Deleted
      description: Whether the connection has been deleted.
      type: Boolean
  - arguments:
    - defaultValue: '50'
      description: The maximum number of labels to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing labels.
      name: offset
    description: Returns all available labels in the system.
    name: tanium-tr-list-labels
    outputs:
    - contextPath: Tanium.Label.CreatedAt
      description: The date when this label was created.
      type: Date
    - contextPath: Tanium.Label.Description
      description: An extended description of the label.
      type: String
    - contextPath: Tanium.Label.ID
      description: The unique identifier for this label.
      type: Number
    - contextPath: Tanium.Label.IndicatorCount
      description: The number of indicator-based intel documents associated with this label, not including Tanium Signals.
      type: Number
    - contextPath: Tanium.Label.Name
      description: The display name of the label.
      type: String
    - contextPath: Tanium.Label.SignalCount
      description: The number of Tanium Signal documents associated with this label.
      type: Number
    - contextPath: Tanium.Label.UpdatedAt
      description: The date when this label was last updated, not including the intel and signal counts.
      type: Date
  - arguments:
    - description: The label ID.
      name: label-id
      required: true
    description: Returns a label object based on label ID.
    name: tanium-tr-get-label-by-id
    outputs:
    - contextPath: Tanium.Label.CreatedAt
      description: The date when this label was created.
      type: Date
    - contextPath: Tanium.Label.Description
      description: An extended description of the label.
      type: String
    - contextPath: Tanium.Label.ID
      description: The unique identifier for this label.
      type: Number
    - contextPath: Tanium.Label.IndicatorCount
      description: The number of indicator-based intel documents associated with this label, not including Tanium Signals.
      type: Number
    - contextPath: Tanium.Label.Name
      description: The display name of the label.
      type: String
    - contextPath: Tanium.Label.SignalCount
      description: The number of Tanium Signal documents associated with this label.
      type: Number
    - contextPath: Tanium.Label.UpdatedAt
      description: The date this label was last updated, not including the intel and signal counts.
      type: Date
  - arguments:
    - defaultValue: '50'
      description: The maximum number of files to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting file downloads. The default is 0.
      name: offset
    - description: Filter downloaded files by host.
      name: host
    description: Returns all downloaded files in the system.
    name: tanium-tr-list-file-downloads
    outputs:
    - contextPath: Tanium.FileDownload.Size
      description: The size of the file, in bytes.
      type: Number
    - contextPath: Tanium.FileDownload.Path
      description: The path of the file.
      type: String
    - contextPath: Tanium.FileDownload.Downloaded
      description: The date when this file was downloaded.
      type: Date
    - contextPath: Tanium.FileDownload.Host
      description: The hostname of the downloaded file.
      type: String
    - contextPath: Tanium.FileDownload.Created
      description: The date when the file was created.
      type: Date
    - contextPath: Tanium.FileDownload.Hash
      description: The file hash.
      type: String
    - contextPath: Tanium.FileDownload.SPath
      description: The file SPath.
      type: String
    - contextPath: Tanium.FileDownload.ID
      description: The downloaded file ID.
      type: Number
    - contextPath: Tanium.FileDownload.LastModified
      description: The date when the file was last modified.
      type: Date
    - contextPath: Tanium.FileDownload.CreatedBy
      description: The user that created this file.
      type: String
    - contextPath: Tanium.FileDownload.CreatedByProc
      description: The process path that created this file.
      type: String
    - contextPath: Tanium.FileDownload.LastModifiedBy
      description: The user that last modified this file.
      type: String
    - contextPath: Tanium.FileDownload.LastModifiedByProc
      description: The process path that modified this file.
      type: String
    - contextPath: Tanium.FileDownload.Comments
      description: Additional comments for the downloaded file.
      type: String
    - contextPath: Tanium.FileDownload.Tags
      description: The downloaded file tags.
      type: String
    - contextPath: Tanium.FileDownload.Deleted
      description: Whether the file download has been deleted.
      type: Boolean
  - arguments:
    - description: The file ID.
      name: file-id
      required: true
    description: Gets the actual content of a downloaded file by file ID.
    name: tanium-tr-get-downloaded-file
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - auto: PREDEFINED
      defaultValue: combined
      description: The type of event. Can be "File", "Network", "Registry", "Process", "Driver", "Security", "Combined", "DNS", or "Image". The default is "Combined".
      name: event-type
      predefined:
      - File
      - Network
      - Registry
      - Process
      - Driver
      - Security
      - Combined
      - DNS
      - Image
      required: true
    - defaultValue: '50'
      description: The maximum number of events to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting the result set. The default is 0.
      name: offset
    - description: 'Advanced search that filters according to event fields. For example: [[''process_id'', ''gt'', ''30''], [''username'', ''ne'', ''administrator'']]. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional operators: eq (equals), ne (does not equal); for integers/date: gt (greater than), gte (greater than or equals), ls (less than), lse (less than or equals); for strings: co (contains), nc (does not contain). '
      name: filter
    - auto: PREDEFINED
      defaultValue: all
      description: Whether the results should fit all filters or at least one filter.
      name: match
      predefined:
      - all
      - any
    - description: 'A comma-separated list of fields to sort on prefixed by +/- for ascending or descending and ordered by priority left to right. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC).'
      name: sort
    - description: 'A comma-separated list of fields on which to search. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time.'
      name: fields
    description: Queries events for a connection.
    name: tanium-tr-list-events-by-connection
    outputs:
    - contextPath: TaniumEvent.Domain
      description: The domain of the event.
      type: String
    - contextPath: TaniumEvent.File
      description: The path of the file in the event.
      type: String
    - contextPath: TaniumEvent.Operation
      description: The event operation.
      type: String
    - contextPath: TaniumEvent.ProcessID
      description: The ID of the process.
      type: Number
    - contextPath: TaniumEvent.ProcessName
      description: The name of the process.
      type: String
    - contextPath: TaniumEvent.ProcessTableID
      description: The ID of the process table.
      type: Number
    - contextPath: TaniumEvent.Timestamp
      description: The date when the event was created.
      type: Date
    - contextPath: TaniumEvent.Username
      description: The username associated with the event.
      type: String
    - contextPath: TaniumEvent.DestinationAddress
      description: The network event destination address.
      type: String
    - contextPath: TaniumEvent.DestinationPort
      description: The network event destination port.
      type: Number
    - contextPath: TaniumEvent.SourceAddress
      description: The network event source address.
      type: String
    - contextPath: TaniumEvent.SourcePort
      description: The network event source port.
      type: Number
    - contextPath: TaniumEvent.KeyPath
      description: The registry key path.
      type: String
    - contextPath: TaniumEvent.ValueName
      description: The registry value name.
      type: String
    - contextPath: TaniumEvent.ExitCode
      description: The process exit code.
      type: Number
    - contextPath: TaniumEvent.ProcessCommandLine
      description: The process command line.
      type: String
    - contextPath: TaniumEvent.ProcessHash
      description: The hash value of the process.
      type: String
    - contextPath: TaniumEvent.SID
      description: The process SID.
      type: Number
    - contextPath: TaniumEvent.Hashes
      description: The hashes of the driver.
      type: String
    - contextPath: TaniumEvent.ImageLoaded
      description: The image loaded path of the driver.
      type: String
    - contextPath: TaniumEvent.Signature
      description: The signature of the driver.
      type: String
    - contextPath: TaniumEvent.Signed
      description: Whether the driver is signed.
      type: Boolean
    - contextPath: TaniumEvent.EventID
      description: The ID of the event.
      type: Number
    - contextPath: TaniumEvent.EventOpcode
      description: The event opcode.
      type: Number
    - contextPath: TaniumEvent.EventRecordID
      description: The ID of the event record.
      type: Number
    - contextPath: TaniumEvent.EventTaskID
      description: The ID of the event task.
      type: Number
    - contextPath: TaniumEvent.Query
      description: The query of the DNS.
      type: String
    - contextPath: TaniumEvent.Response
      description: The response of the DNS.
      type: String
    - contextPath: TaniumEvent.ImagePath
      description: The image path.
      type: String
    - contextPath: TaniumEvent.CreationTime
      description: The process creation time.
      type: Date
    - contextPath: TaniumEvent.EndTime
      description: The process end time.
      type: Date
    - contextPath: TaniumEvent.EventTaskName
      description: The name of the event task.
      type: String
    - contextPath: TaniumEvent.Property.Name
      description: The name of the event's property.
      type: String
    - contextPath: TaniumEvent.Property.Value
      description: The value of the event's property.
      type: String
  - arguments:
    - description: The hostname of the downloaded file.
      name: host
      required: true
    - description: The path of the file.
      name: path
    - description: File download ID.
      name: id
    description: Gets the metadata of a file download. You must supply either the `path` or `id` argument for the command to run successfully.
    name: tanium-tr-get-file-download-info
    outputs:
    - contextPath: Tanium.FileDownload.Size
      description: The size of the file, in bytes.
      type: Number
    - contextPath: Tanium.FileDownload.Path
      description: The path of the file.
      type: String
    - contextPath: Tanium.FileDownload.Downloaded
      description: The date when this file was downloaded.
      type: Date
    - contextPath: Tanium.FileDownload.Host
      description: The hostname of the downloaded file.
      type: String
    - contextPath: Tanium.FileDownload.Created
      description: The date when the file was created.
      type: Date
    - contextPath: Tanium.FileDownload.Hash
      description: The file hash.
      type: String
    - contextPath: Tanium.FileDownload.SPath
      description: The file SPath.
      type: String
    - contextPath: Tanium.FileDownload.ID
      description: The downloaded file ID.
      type: Number
    - contextPath: Tanium.FileDownload.LastModified
      description: The date when the file was last modified.
      type: Date
    - contextPath: Tanium.FileDownload.CreatedBy
      description: The user that created this file.
      type: String
    - contextPath: Tanium.FileDownload.CreatedByProc
      description: The process path that created this file.
      type: String
    - contextPath: Tanium.FileDownload.LastModifiedBy
      description: The user that last modified this file.
      type: String
    - contextPath: Tanium.FileDownload.LastModifiedByProc
      description: The process path that modified this file.
      type: String
    - contextPath: Tanium.FileDownload.Comments
      description: The downloaded file comments.
      type: String
    - contextPath: Tanium.FileDownload.Tags
      description: The downloaded file tags.
      type: String
    - contextPath: Tanium.FileDownload.Deleted
      description: Whether the file download has been deleted.
      type: Boolean
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Get information for a process.
    name: tanium-tr-get-process-info
    outputs:
    - contextPath: Tanium.Process.CreateTime
      description: Time when the process was created.
      type: Date
    - contextPath: Tanium.Process.Domain
      description: The domain of the process.
      type: String
    - contextPath: Tanium.Process.ExitCode
      description: The process exit code.
      type: Number
    - contextPath: Tanium.Process.ProcessCommandLine
      description: The process command line.
      type: String
    - contextPath: Tanium.Process.ProcessID
      description: The ID of the process.
      type: Number
    - contextPath: Tanium.Process.ProcessName
      description: File of the process.
      type: String
    - contextPath: Tanium.Process.ProcessTableId
      description: The ID of the process table.
      type: Number
    - contextPath: Tanium.Process.SID
      description: The security ID of the process.
      type: String
    - contextPath: Tanium.Process.Username
      description: The username who created the process.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    - defaultValue: '50'
      description: The maximum number of events to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing events.
      name: offset
    description: Gets the events for a process.
    name: tanium-tr-get-events-by-process
    outputs:
    - contextPath: Tanium.ProcessEvent.ID
      description: The ID of the event.
      type: Number
    - contextPath: Tanium.ProcessEvent.Detail
      description: The event details.
      type: Unknown
    - contextPath: Tanium.ProcessEvent.Operation
      description: The event operation.
      type: String
    - contextPath: Tanium.ProcessEvent.Timestamp
      description: Time when the event was created.
      type: Date
    - contextPath: Tanium.ProcessEvent.Type
      description: The event type.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Gets the children of this process instance.
    name: tanium-tr-get-process-children
    outputs:
    - contextPath: Tanium.ProcessChildren.ID
      description: The ID of the process.
      type: Number
    - contextPath: Tanium.ProcessChildren.Name
      description: File of the process.
      type: String
    - contextPath: Tanium.ProcessChildren.PID
      description: The PID of the process.
      type: Number
    - contextPath: Tanium.ProcessChildren.PTID
      description: The process instance ID.
      type: Number
    - contextPath: Tanium.ProcessChildren.Parent
      description: The parent process name.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Gets information for the parent process.
    name: tanium-tr-get-parent-process
    outputs:
    - contextPath: Tanium.Process.CreateTime
      description: Time when the process was created.
      type: Date
    - contextPath: Tanium.Process.Domain
      description: The domain of the process.
      type: String
    - contextPath: Tanium.Process.ExitCode
      description: The process exit code.
      type: Number
    - contextPath: Tanium.Process.ProcessCommandLine
      description: The process command line.
      type: String
    - contextPath: Tanium.Process.ProcessID
      description: The ID of the process.
      type: Number
    - contextPath: Tanium.Process.ProcessName
      description: File of the process.
      type: String
    - contextPath: Tanium.Process.ProcessTableId
      description: The ID of the process table.
      type: Number
    - contextPath: Tanium.Process.SID
      description: The security ID of the process.
      type: String
    - contextPath: Tanium.Process.Username
      description: The username who created the process.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Gets the parent process tree for the process instance.
    name: tanium-tr-get-parent-process-tree
    outputs:
    - contextPath: Tanium.ParentProcessTree.ID
      description: The parent process ID.
      type: Number
    - contextPath: Tanium.ParentProcessTree.Name
      description: File of the parent process.
      type: String
    - contextPath: Tanium.ParentProcessTree.PID
      description: The parent process PID.
      type: Number
    - contextPath: Tanium.ParentProcessTree.PTID
      description: The parent process instance ID.
      type: Number
    - contextPath: Tanium.ParentProcessTree.Parent
      description: The parent process name.
      type: String
    - contextPath: Tanium.ParentProcessTree.Children
      description: The parent process children.
      type: Unknown
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Gets the process tree for the process instance.
    name: tanium-tr-get-process-tree
    outputs:
    - contextPath: Tanium.ProcessTree.ID
      description: The process ID.
      type: Number
    - contextPath: Tanium.ProcessTree.Name
      description: File of the process.
      type: String
    - contextPath: Tanium.ProcessTree.PID
      description: The process PID.
      type: Number
    - contextPath: Tanium.ProcessTree.PTID
      description: The process instance ID.
      type: Number
    - contextPath: Tanium.ProcessTree.Parent
      description: The parent process name.
      type: String
    - contextPath: Tanium.ProcessTree.Children
      description: The process children.
      type: Unknown
  - arguments:
    - defaultValue: '50'
      description: The maximum number of evidences to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting the events result set. The default is 0.
      name: offset
    - description: A comma-separated list of fields by which to sort, using +/- prefixes for ascending/descending, in order of priority (left to right).
      name: sort
    description: Returns a list of all available evidence in the system.
    name: tanium-tr-list-evidence
    outputs:
    - contextPath: Tanium.Evidence.ID
      description: The evidence ID.
      type: Number
    - contextPath: Tanium.Evidence.CreatedAt
      description: Time when the process was created.
      type: Date
    - contextPath: Tanium.Evidence.LastModified
      description: The date that the file was last modified.
      type: Date
    - contextPath: Tanium.Evidence.User
      description: The user of the evidence.
      type: String
    - contextPath: Tanium.Evidence.ConnectionName
      description: The evidence connection name.
      type: String
    - contextPath: Tanium.Evidence.Type
      description: The evidence type.
      type: Number
    - contextPath: Tanium.Evidence.ProcessTableId
      description: The evidence process table ID.
      type: Number
    - contextPath: Tanium.Evidence.Timestamp
      description: The evidence timestamp.
      type: Date
    - contextPath: Tanium.Evidence.Summary
      description: The evidence summary.
      type: String
    - contextPath: Tanium.Evidence.Comments
      description: The evidence comments.
      type: String
    - contextPath: Tanium.Evidence.Tags
      description: The evidence tags.
      type: String
    - contextPath: Tanium.Evidence.Deleted
      description: Whether the evident has been deleted.
      type: Boolean
  - arguments:
    - description: The ID of the evidence.
      name: evidence-id
      required: true
    description: Gets evidence by evidence ID.
    name: tanium-tr-get-evidence-by-id
    outputs:
    - contextPath: Tanium.Evidence.ID
      description: The evidence ID.
      type: Number
    - contextPath: Tanium.Evidence.CreatedAt
      description: Time when the process was created.
      type: Date
    - contextPath: Tanium.Evidence.LastModified
      description: The date that the file was last modified.
      type: Date
    - contextPath: Tanium.Evidence.User
      description: The user of the evidence.
      type: String
    - contextPath: Tanium.Evidence.ConnectionName
      description: The evidence connection name.
      type: String
    - contextPath: Tanium.Evidence.Type
      description: The evidence type.
      type: Number
    - contextPath: Tanium.Evidence.ProcessTableId
      description: The evidence process table ID.
      type: Number
    - contextPath: Tanium.Evidence.Timestamp
      description: The evidence timestamp.
      type: Date
    - contextPath: Tanium.Evidence.Summary
      description: The evidence summary.
      type: String
    - contextPath: Tanium.Evidence.Comments
      description: The evidence comments.
      type: String
    - contextPath: Tanium.Evidence.Tags
      description: The evidence tags.
      type: String
    - contextPath: Tanium.Evidence.Deleted
      description: Whether the evident has been deleted.
      type: Boolean
  - arguments:
    - description: The name of the connection.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Creates an evidence.
    name: tanium-tr-create-evidence
  - arguments:
    - description: The ID of the evidence.
      name: evidence-id
      required: true
    description: Deletes an evidence.
    name: tanium-tr-delete-evidence
    outputs:
    - contextPath: Tanium.Evidence.ID
      description: The evidence ID.
      type: String
    - contextPath: Tanium.Evidence.Deleted
      description: Whether the evidence has been deleted.
      type: Boolean
  - arguments:
    - description: Path to file.
      name: path
      required: true
    - description: Connection name.
      name: connection-name
      required: true
    description: Requests a new file download.
    name: tanium-tr-request-file-download
    outputs:
    - contextPath: Tanium.FileDownload.Path
      description: The file download path.
      type: String
    - contextPath: Tanium.FileDownload.ConnectionName
      description: The file download host.
      type: String
    - contextPath: Tanium.FileDownload.Downloaded
      description: Date of the download request.
      type: Date
    - contextPath: Tanium.FileDownload.Status
      description: Status of the file download request.
      type: String
    - contextPath: Tanium.FileDownload.ID
      description: ID of the file download.
      type: Number
  - arguments:
    - description: File download ID.
      name: file-id
      required: true
    description: Deletes a file download.
    name: tanium-tr-delete-file-download
    outputs:
    - contextPath: Tanium.FileDownload.ID
      description: The file download ID.
      type: String
    - contextPath: Tanium.FileDownload.Deleted
      description: Whether the file download has been deleted.
      type: Boolean
  - arguments:
    - description: Path to the directory.
      name: path
      required: true
    - description: Connection name.
      name: connection-name
      required: true
    - defaultValue: '50'
      description: The maximum number of files to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting files. The default is 0.
      name: offset
    description: Gets a list of files in the given directory.
    name: tanium-tr-list-files-in-directory
    outputs:
    - contextPath: Tanium.File.Created
      description: Time the file was created.
      type: Date
    - contextPath: Tanium.File.Size
      description: The file size.
      type: Number
    - contextPath: Tanium.File.IsDirectory
      description: Whether or not the file is a directory.
      type: Boolean
    - contextPath: Tanium.File.LastModified
      description: The date that the file was last modified.
      type: Date
    - contextPath: Tanium.File.Path
      description: The file path.
      type: Boolean
    - contextPath: Tanium.File.Permissions
      description: The file permissions.
      type: Date
    - contextPath: Tanium.File.ConnectionName
      description: The host of the file.
      type: String
    - contextPath: Tanium.File.Deleted
      description: Whether the file has been deleted.
      type: Boolean
  - arguments:
    - defaultValue: Connection name.
      description: The name of the connection.
      name: connection-name
      required: true
    - defaultValue: Path to file.
      description: The path to the file.
      name: path
      required: true
    description: Gets information about a file from a remote connection.
    name: tanium-tr-get-file-info
    outputs:
    - contextPath: Tanium.File.Created
      description: The file creation timestamp.
      type: Date
    - contextPath: Tanium.File.Size
      description: The file size.
      type: Number
    - contextPath: Tanium.File.IsDirectory
      description: Whether or not the file is a directory.
      type: Boolean
    - contextPath: Tanium.File.LastModified
      description: The date that the file was last modified.
      type: Date
    - contextPath: Tanium.File.Path
      description: The file path.
      type: String
    - contextPath: Tanium.File.ConnectionName
      description: The host of the file.
      type: String
    - contextPath: Tanium.File.Deleted
      description: Whether the file has been deleted.
      type: Boolean
  - arguments:
    - description: Connection name.
      name: connection-name
      required: true
    - description: Path to file.
      name: path
      required: true
    description: Deletes a file from the given endpoint.
    name: tanium-tr-delete-file-from-endpoint
    outputs:
    - contextPath: Tanium.File.Path
      description: The file path.
      type: String
    - contextPath: Tanium.File.ConnectionName
      description: The host of the file.
      type: String
    - contextPath: Tanium.File.Deleted
      description: Whether the file has been deleted.
      type: Boolean
  - arguments:
    - description: Connection name.
      name: connection-name
      required: true
    - description: Process table ID.
      name: ptid
      required: true
    - auto: PREDEFINED
      description: The event categories to retrieve. Can be "File", "DNS", "Registry", "Network", "Image", or "Process".
      name: category
      predefined:
      - File
      - DNS
      - Registry
      - Network
      - Image
      - Process
      required: true
    - defaultValue: '50'
      description: The maximum number of events to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting the events. The default is 0.
      name: offset
    description: Gets the process timeline.
    name: tanium-tr-get-process-timeline
    outputs:
    - contextPath: Tanium.ProcessTimeline.ProcessTableID
      description: The process instance ID.
      type: Number
    - contextPath: Tanium.ProcessTimeline.ConnectionName
      description: The connection name of the process.
      type: String
    - contextPath: Tanium.ProcessTimeline.Date
      description: Events date of the process.
      type: Date
    - contextPath: Tanium.ProcessTimeline.Event
      description: Event of the process.
      type: String
    - contextPath: Tanium.ProcessTimeline.Category
      description: The event category of the process.
      type: String
  - arguments:
    - description: 'Date of the download file request, or example: 2019-09-23T12:55:08.622.'
      name: request-date
      required: true
    - description: The connection to which the request was made.
      name: connection-name
    - description: The file path.
      name: path
    description: Gets the status of the download file request.
    name: tanium-tr-get-download-file-request-status
    outputs:
    - contextPath: Tanium.DownloadFile.ID
      description: ID of the file download.
      type: Number
    - contextPath: Tanium.DownloadFile.ConnectionName
      description: Host of the file.
      type: String
    - contextPath: Tanium.DownloadFile.Path
      description: Path of the file.
      type: String
    - contextPath: Tanium.DownloadFile.Status
      description: Status of the file download request.
      type: String
    - contextPath: Tanium.DownloadFile.Downloaded
      description: The date of the download request.
      type: Date
  - arguments:
    - description: The file entry ID.
      name: entry_id
      required: true
    - auto: PREDEFINED
      description: The suffix at the end of a filename. (Available file types - yara, stix, ioc).
      name: file_extension
      predefined:
      - ioc
      - yara
      - stix
      required: true
    description: Add a new intel document to the system by providing its document contents.
    name: tanium-tr-intel-doc-create
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date at which this intel was first added to the system.
      type: date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: string
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: string
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: date
    - contextPath: Tanium.IntelDoc.Type
      description: The shortened type name of the intel. For example, "openioc", "stix", "yara".
      type: String
  - arguments:
    - description: The intel document ID.
      name: intel_doc_id
      required: true
    - description: The name of a Tanium computer group. See command description for possible ways to retrieve this value.
      name: computer_group_name
      required: true
    description: Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.
    name: tanium-tr-start-quick-scan
    outputs:
    - contextPath: Tanium.QuickScan.IntelDocId
      description: The unique identifier for this intel in this instance of the system.
      type: number
    - contextPath: Tanium.QuickScan.ComputerGroupId
      description: The ID of a Tanium computer group.
      type: number
    - contextPath: Tanium.QuickScan.ID
      description: The ID of the quick scan.
      type: number
    - contextPath: Tanium.QuickScan.AlertCount
      description: The number of alerts returned from the quick scan.
      type: number
    - contextPath: Tanium.QuickScan.CreatedAt
      description: The date the quick scan was created.
      type: date
    - contextPath: Tanium.QuickScan.UserID
      description: The user ID which initiated the quick scan.
      type: number
    - contextPath: Tanium.QuickScan.QuestionID
      description: The ID of the quick scan question.
      type: number
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Tanium Threat Response Test
fromversion: 5.0.0