Tanium Threat Response v2

Use the Tanium Threat Response integration to manage endpoint processes, evidence, alerts, files, snapshots, and connections. This integration works with Tanium Threat Response version 3.0.159 and above.

Endpoint · Tanium Threat Response

Details

ID	`Tanium Threat Response v2`
Provider	Tanium
Category	Endpoint
From Version	6.0.0
Docker Image	`demisto/lxml:1.0.0.10170191`
Supported Modules	Agentix XSIAM

README

Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version 3.0.159 and above.
This integration was integrated and tested with versions 3.5.284 and 4.x of Tanium Threat Response v2.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Tanium Threat Response v2 in Cortex

Parameter	Required
Hostname, IP address, or server URL	True
Username	False
Password	False
Fetch incidents	False
Incident type	False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	False
Maximum number of incidents to fetch each time	False
Alert states to filter by in fetch incidents command. Empty list won’t filter the incidents by state.	False
Trust any certificate (not secure)	False
Use system proxy settings	False
API Version	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

tanium-tr-get-intel-doc-by-id

Returns an intel document object based on ID.

Base Command

tanium-tr-get-intel-doc-by-id

Input

Argument Name	Description	Required
intel_doc_id	The intel document ID.	Required

Context Output

Path	Type	Description
Tanium.IntelDoc.AlertCount	Number	The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt	Date	The date at which this intel was first added to the system.
Tanium.IntelDoc.Description	String	The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID	Number	The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds	Number	The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name	String	The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount	Number	The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt	Date	The date when this intel was last updated.

Command Example

!tanium-tr-get-intel-doc-by-id intel_doc_id=509

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "Compiled": "{\"expressions\":[],\"terms\":[{\"condition\":\"contains\",\"negate\":false,\"value\":\"RouteTheCall\",\"object\":\"process\",\"property\":\"command_line\"},{\"condition\":\"ends with\",\"negate\":false,\"value\":\"\\\\rundll32.exe\",\"object\":\"process\",\"property\":\"path\"},{\"condition\":\"contains\",\"negate\":false,\"value\":\"zipfldr\",\"object\":\"process\",\"property\":\"command_line\"}],\"operator\":\"and\",\"text\":\"process.path ends with '\\\\\\\\rundll32.exe' AND process.command_line contains 'zipfldr' AND process.command_line contains 'RouteTheCall'\",\"syntax_version\":1}",
            "Contents": "{\"id\":\"Zipfldr Library Proxy Execution via RouteTheCall\",\"name\":\"Zipfldr Library Proxy Execution via RouteTheCall\",\"description\":\"Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary.\",\"contents\":\"process.path ends with '\\\\\\\\rundll32.exe' AND process.command_line contains 'zipfldr' AND process.command_line contains 'RouteTheCall'\",\"syntax_version\":1,\"mitreAttack\":{\"techniques\":[{\"id\":\"T1218\",\"name\":\"Signed Binary Proxy Execution\"},{\"id\":\"T1218.011\",\"name\":\"Signed Binary Proxy Execution: Rundll32\"},{\"id\":\"T1059\",\"name\":\"Command and Scripting Interpreter\"},{\"id\":\"T1059.003\",\"name\":\"Command and Scripting Interpreter: Windows Command Shell\"}]},\"platforms\":[\"windows\"]}",
            "CreatedAt": "2021-08-31T21:06:02.932Z",
            "Description": "Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary.",
            "ID": 509,
            "IntrinsicId": "Zipfldr Library Proxy Execution via RouteTheCall",
            "IsSchemaValid": true,
            "LabelIds": [
                2,
                7,
                11,
                16
            ],
            "Md5": "f3ddf06be9e182ae7ddc16192dc5b846",
            "MitreAttack": "{\"techniques\":[{\"id\":\"T1218\",\"name\":\"Signed Binary Proxy Execution\"},{\"id\":\"T1218.011\",\"name\":\"Signed Binary Proxy Execution: Rundll32\"},{\"id\":\"T1059\",\"name\":\"Command and Scripting Interpreter\"},{\"id\":\"T1059.003\",\"name\":\"Command and Scripting Interpreter: Windows Command Shell\"}]}",
            "Name": "Zipfldr Library Proxy Execution via RouteTheCall",
            "Platforms": [
                "windows"
            ],
            "RevisionId": 1,
            "Size": 795,
            "SourceId": 2,
            "Type": "tanium-signal",
            "TypeVersion": "1.0",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-08-31T21:06:02.932Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Description Alert Count Unresolved Alert Count Created At Updated At Label Ids

509 Zipfldr Library Proxy Execution via RouteTheCall tanium-signal Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary. 0 0 2021-08-31T21:06:02.932Z 2021-08-31T21:06:02.932Z 2, 7, 11, 16

ID	Name	Type	Description	Alert Count	Unresolved Alert Count	Created At	Updated At	Label Ids
509	Zipfldr Library Proxy Execution via RouteTheCall	tanium-signal	Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary.	0	0	2021-08-31T21:06:02.932Z	2021-08-31T21:06:02.932Z	2, 7, 11, 16

tanium-tr-list-intel-docs

Returns a list of all intel documents.

Base Command

tanium-tr-list-intel-docs

Input

Argument Name	Description	Required
limit	The maximum number of intel documents to return. Default is 50.	Optional
offset	The offset number to begin listing intel documents. Default is 0.	Optional
name	The name of the intel document to show.	Optional
description	The description of the intel document to show.	Optional
type	The type of the intel document to show.	Optional
label_id	The label Id of the intel document to show.	Optional
mitre_technique_id	The mitre technique Id of the intel document to show.	Optional

Context Output

Path	Type	Description
Tanium.IntelDoc.AlertCount	Number	The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt	Date	The date at which this intel was first added to the system.
Tanium.IntelDoc.Description	String	The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID	Number	The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds	Number	The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name	String	The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount	Number	The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt	Date	The date when this intel was last updated.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "IntelDoc": [
            {
                "AlertCount": 0,
                "CreatedAt": "2021-09-26T20:42:12.761Z",
                "ID": 538,
                "IntrinsicId": "file",
                "IsSchemaValid": true,
                "Md5": "45d4f6197504b0cf17ca4425b27c4123",
                "Name": "file",
                "RevisionId": 1,
                "Size": 2211,
                "SourceId": 1,
                "Type": "yara",
                "TypeVersion": "3",
                "UnresolvedAlertCount": 0,
                "UpdatedAt": "2021-09-26T20:42:12.761Z"
            },
            {
                "AlertCount": 0,
                "CreatedAt": "2021-09-26T15:40:18.967Z",
                "ID": 537,
                "IntrinsicId": "111-72ad-40cc-abbf-90846fa4afec",
                "IsSchemaValid": true,
                "Md5": "45d4f619750434cf17ca4425b27c4774",
                "Name": "111-72ad-40cc-abbf-90846fa4a123",
                "RevisionId": 11,
                "Size": 2211,
                "SourceId": 1,
                "Type": "openioc",
                "TypeVersion": "1.0",
                "UnresolvedAlertCount": 0,
                "UpdatedAt": "2021-09-26T20:47:53.586Z"
            }
        ]
    }
}

Human Readable Output

Intel docs

ID Name Type Alert Count Unresolved Alert Count Created At Updated At Label Ids

538 file yara 0 0 2021-09-26T20:42:12.761Z 2021-09-26T20:42:12.761Z

537 111-72ad-40cc-abbf-90846fa4afec openioc 0 0 2021-09-26T15:40:18.967Z 2021-09-26T20:47:53.586Z

536 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:18:57.462Z 2021-09-26T08:18:57.462Z

535 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:30.717Z 2021-09-26T08:11:30.717Z

534 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:25.484Z 2021-09-26T08:11:25.484Z

533 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:20.802Z 2021-09-26T08:11:20.802Z

532 file.yaraaaaaa yara 0 0 2021-09-26T08:09:54.927Z 2021-09-26T08:09:54.927Z

531 file.yaraa yara 0 0 2021-09-26T08:09:52.564Z 2021-09-26T08:09:52.564Z

530 yar yara 0 0 2021-09-26T08:09:28.253Z 2021-09-26T08:09:28.253Z

529 file.yar yara 0 0 2021-09-23T15:35:01.784Z 2021-09-23T15:35:01.784Z

528 file.stix yara 0 0 2021-09-23T15:33:49.920Z 2021-09-23T15:33:49.920Z

527 file.stix yara 0 0 2021-09-23T15:32:25.580Z 2021-09-23T15:32:25.580Z

526 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T15:00:32.350Z 2021-09-23T15:00:32.350Z

525 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:41:32.831Z 2021-09-23T14:41:32.831Z

524 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:41:07.857Z 2021-09-23T14:41:07.857Z

523 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:32:26.310Z 2021-09-23T14:32:26.310Z

522 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T13:47:31.088Z 2021-09-23T13:47:31.088Z

521 STUXNET VIRUS (METHODOLOGY) openioc 0 0 2021-09-23T12:18:03.865Z 2021-09-23T12:18:03.865Z

520 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T12:04:08.473Z 2021-09-23T12:04:08.473Z

519 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T12:03:50.295Z 2021-09-23T12:03:50.295Z

518 New Test5 openioc 0 0 2021-09-23T12:03:10.503Z 2021-09-23T12:03:10.503Z

517 New Test5 openioc 0 0 2021-09-23T07:21:07.201Z 2021-09-23T07:21:07.201Z

516 New Test5 openioc 0 0 2021-09-22T16:27:09.399Z 2021-09-22T16:27:09.399Z

515 New Test5 openioc 0 0 2021-09-22T07:52:58.242Z 2021-09-22T07:52:58.242Z

514 New Test5 openioc 0 0 2021-09-22T07:47:43.503Z 2021-09-22T07:47:43.503Z

513 RDP Enabled via Registry Modification tanium-signal 0 0 2021-09-22T07:47:02.110Z 2021-09-22T07:47:02.110Z

512 New Test5 openioc 0 0 2021-09-22T07:17:26.951Z 2021-09-22T07:17:26.951Z

511 New Test5 openioc 0 0 2021-09-19T06:33:12.579Z 2021-09-19T06:33:12.579Z

510 file.yar yara 0 0 2021-09-12T14:02:03.769Z 2021-09-12T14:02:03.769Z

509 Zipfldr Library Proxy Execution via RouteTheCall tanium-signal 0 0 2021-08-31T21:06:02.932Z 2021-08-31T21:06:02.932Z 2, 7, 11, 16

508 Url Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:02.639Z 2021-08-31T21:06:02.639Z 2, 7, 11, 16

507 Url Library Proxy Execution via FileProtocolHandler tanium-signal 0 0 2021-08-31T21:06:02.611Z 2021-08-31T21:06:02.611Z 2, 7, 11, 16

506 Shell32 Library Proxy Execution via ShellExec_RunDLL tanium-signal 0 0 2021-08-31T21:06:02.140Z 2021-08-31T21:06:02.140Z 2, 7, 11, 16

505 Shdocvw Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:02.116Z 2021-08-31T21:06:02.116Z 2, 7, 11, 16

504 Pcwutl Library Proxy Execution via LaunchApplication tanium-signal 0 0 2021-08-31T21:06:01.540Z 2021-08-31T21:06:01.540Z 2, 7, 11, 16

503 Ieframe Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:00.862Z 2021-08-31T21:06:00.862Z 2, 7, 11, 16

502 Reputation Malicious Hashes reputation 0 0 2021-08-19T06:54:59.350Z 2021-08-19T06:57:47.882Z

501 file.yar yara 0 0 2021-07-28T12:37:29.611Z 2021-07-28T12:37:29.611Z

500 file.yar yara 0 0 2021-07-28T12:35:41.367Z 2021-07-28T12:35:41.367Z

499 file.yar yara 0 0 2021-07-28T12:35:39.670Z 2021-07-28T12:35:39.670Z

498 Vssadmin Create Shadow Copy tanium-signal 0 0 2021-07-27T21:56:02.320Z 2021-07-27T21:56:02.320Z 2, 8, 16

497 Volume Shadow Copy Creation tanium-signal 0 0 2021-07-27T21:56:02.295Z 2021-07-27T21:56:02.295Z 2, 8, 16

496 Remote Proxy Execution tanium-signal 0 0 2021-07-27T21:56:01.712Z 2021-07-27T21:56:01.712Z 2, 7, 11, 16

495 Non-Ssms Spawned SQL Client Tools PowerShell Session tanium-signal 0 0 2021-07-27T21:56:01.246Z 2021-07-27T21:56:01.246Z 2, 7, 11, 16

494 Non-Microsoft Signed Print Spooler Driver tanium-signal 0 0 2021-07-27T21:56:01.227Z 2021-07-27T21:56:01.227Z 2, 6, 16

493 file.yar yara 0 0 2021-07-27T14:44:32.182Z 2021-07-27T14:44:32.182Z

492 file.yar yara 0 0 2021-07-27T14:44:19.862Z 2021-07-27T14:44:19.862Z

491 file.yar yara 0 0 2021-07-27T14:44:15.595Z 2021-07-27T14:44:15.595Z

490 file.yar yara 0 0 2021-07-27T14:44:13.294Z 2021-07-27T14:44:13.294Z

489 CybOX-re presented Indicator Created from OpenIOC File stix 0 0 2021-07-27T14:42:43.888Z 2021-07-27T14:42:43.888Z

ID	Name	Type	Created At	Updated At	Label Ids
538	file	yara	2021-09-26T20:42:12.761Z	2021-09-26T20:42:12.761Z
537	111-72ad-40cc-abbf-90846fa4afec	openioc	2021-09-26T15:40:18.967Z	2021-09-26T20:47:53.586Z
536	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-26T08:18:57.462Z	2021-09-26T08:18:57.462Z
535	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-26T08:11:30.717Z	2021-09-26T08:11:30.717Z
534	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-26T08:11:25.484Z	2021-09-26T08:11:25.484Z
533	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-26T08:11:20.802Z	2021-09-26T08:11:20.802Z
532	file.yaraaaaaa	yara	2021-09-26T08:09:54.927Z	2021-09-26T08:09:54.927Z
531	file.yaraa	yara	2021-09-26T08:09:52.564Z	2021-09-26T08:09:52.564Z
530	yar	yara	2021-09-26T08:09:28.253Z	2021-09-26T08:09:28.253Z
529	file.yar	yara	2021-09-23T15:35:01.784Z	2021-09-23T15:35:01.784Z
528	file.stix	yara	2021-09-23T15:33:49.920Z	2021-09-23T15:33:49.920Z
527	file.stix	yara	2021-09-23T15:32:25.580Z	2021-09-23T15:32:25.580Z
526	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-23T15:00:32.350Z	2021-09-23T15:00:32.350Z
525	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-23T14:41:32.831Z	2021-09-23T14:41:32.831Z
524	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-23T14:41:07.857Z	2021-09-23T14:41:07.857Z
523	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-23T14:32:26.310Z	2021-09-23T14:32:26.310Z
522	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-23T13:47:31.088Z	2021-09-23T13:47:31.088Z
521	STUXNET VIRUS (METHODOLOGY)	openioc	2021-09-23T12:18:03.865Z	2021-09-23T12:18:03.865Z
520	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-23T12:04:08.473Z	2021-09-23T12:04:08.473Z
519	CybOX-represented Indicator Created from OpenIOC File	stix	2021-09-23T12:03:50.295Z	2021-09-23T12:03:50.295Z
518	New Test5	openioc	2021-09-23T12:03:10.503Z	2021-09-23T12:03:10.503Z
517	New Test5	openioc	2021-09-23T07:21:07.201Z	2021-09-23T07:21:07.201Z
516	New Test5	openioc	2021-09-22T16:27:09.399Z	2021-09-22T16:27:09.399Z
515	New Test5	openioc	2021-09-22T07:52:58.242Z	2021-09-22T07:52:58.242Z
514	New Test5	openioc	2021-09-22T07:47:43.503Z	2021-09-22T07:47:43.503Z
513	RDP Enabled via Registry Modification	tanium-signal	2021-09-22T07:47:02.110Z	2021-09-22T07:47:02.110Z
512	New Test5	openioc	2021-09-22T07:17:26.951Z	2021-09-22T07:17:26.951Z
511	New Test5	openioc	2021-09-19T06:33:12.579Z	2021-09-19T06:33:12.579Z
510	file.yar	yara	2021-09-12T14:02:03.769Z	2021-09-12T14:02:03.769Z
509	Zipfldr Library Proxy Execution via RouteTheCall	tanium-signal	2021-08-31T21:06:02.932Z	2021-08-31T21:06:02.932Z	2, 7, 11, 16
508	Url Library Proxy Execution via OpenURL	tanium-signal	2021-08-31T21:06:02.639Z	2021-08-31T21:06:02.639Z	2, 7, 11, 16
507	Url Library Proxy Execution via FileProtocolHandler	tanium-signal	2021-08-31T21:06:02.611Z	2021-08-31T21:06:02.611Z	2, 7, 11, 16
506	Shell32 Library Proxy Execution via ShellExec_RunDLL	tanium-signal	2021-08-31T21:06:02.140Z	2021-08-31T21:06:02.140Z	2, 7, 11, 16
505	Shdocvw Library Proxy Execution via OpenURL	tanium-signal	2021-08-31T21:06:02.116Z	2021-08-31T21:06:02.116Z	2, 7, 11, 16
504	Pcwutl Library Proxy Execution via LaunchApplication	tanium-signal	2021-08-31T21:06:01.540Z	2021-08-31T21:06:01.540Z	2, 7, 11, 16
503	Ieframe Library Proxy Execution via OpenURL	tanium-signal	2021-08-31T21:06:00.862Z	2021-08-31T21:06:00.862Z	2, 7, 11, 16
502	Reputation Malicious Hashes	reputation	2021-08-19T06:54:59.350Z	2021-08-19T06:57:47.882Z
501	file.yar	yara	2021-07-28T12:37:29.611Z	2021-07-28T12:37:29.611Z
500	file.yar	yara	2021-07-28T12:35:41.367Z	2021-07-28T12:35:41.367Z
499	file.yar	yara	2021-07-28T12:35:39.670Z	2021-07-28T12:35:39.670Z
498	Vssadmin Create Shadow Copy	tanium-signal	2021-07-27T21:56:02.320Z	2021-07-27T21:56:02.320Z	2, 8, 16
497	Volume Shadow Copy Creation	tanium-signal	2021-07-27T21:56:02.295Z	2021-07-27T21:56:02.295Z	2, 8, 16
496	Remote Proxy Execution	tanium-signal	2021-07-27T21:56:01.712Z	2021-07-27T21:56:01.712Z	2, 7, 11, 16
495	Non-Ssms Spawned SQL Client Tools PowerShell Session	tanium-signal	2021-07-27T21:56:01.246Z	2021-07-27T21:56:01.246Z	2, 7, 11, 16
494	Non-Microsoft Signed Print Spooler Driver	tanium-signal	2021-07-27T21:56:01.227Z	2021-07-27T21:56:01.227Z	2, 6, 16
493	file.yar	yara	2021-07-27T14:44:32.182Z	2021-07-27T14:44:32.182Z
492	file.yar	yara	2021-07-27T14:44:19.862Z	2021-07-27T14:44:19.862Z
491	file.yar	yara	2021-07-27T14:44:15.595Z	2021-07-27T14:44:15.595Z
490	file.yar	yara	2021-07-27T14:44:13.294Z	2021-07-27T14:44:13.294Z
489	CybOX-re presented Indicator Created from OpenIOC File	stix	2021-07-27T14:42:43.888Z	2021-07-27T14:42:43.888Z

tanium-tr-list-alerts

Returns a list of all alerts.

Base Command

tanium-tr-list-alerts

Input

Argument Name	Description	Required
limit	The maximum number of alerts to return. Default is 5.	Optional
offset	The offset number to begin listing alerts.	Optional
computer_ip_address	Filter alerts by the specified computer IP addresses.	Optional
computer_name	Filter alerts by the specified computer name.	Optional
scan_config_id	Filter alerts by the specified scan config ID.	Optional
intel_doc_id	Filter alerts by the specified intel document ID.	Optional
severity	Filter alerts by the specified severity.	Optional
priority	Filter alerts by the specified priority.	Optional
type	Filter alerts by the specified type.	Optional
state	Filter alerts by the specified state. Can be “Unresolved”, “In Progress”, “Dismissed” “Ignored”, or “Resolved”. Possible values are: Unresolved, In Progress, Ignored, Resolved, Dismissed.	Optional

Context Output

Path	Type	Description
Tanium.Alert.Priority	String	The priority of the alert.
Tanium.Alert.ComputerName	String	The hostname of the computer that generated the alert.
Tanium.Alert.GUID	String	A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt	Date	The moment that the alert was generated.
Tanium.Alert.UpdatedAt	Date	The last time the alert state was updated.
Tanium.Alert.State	String	The current state of the alert. For example, “unresolved”, “inprogress”, and so on.
Tanium.Alert.ComputerIpAddress	String	The IP address of the computer that generated the alert.
Tanium.Alert.Type	String	The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID	Number	The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt	Date	The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId	Number	The intel document revision, if intelDocId is present.
Tanium.Alert.Severity	String	The severity of the alert.

Command Example

!tanium-tr-list-alerts limit=2

Context Example

{
    "Tanium": {
        "Alert": [
            {
                "AlertedAt": "2019-09-22T14:01:31.000Z",
                "ComputerIpAddress": "1.1.1.1",
                "ComputerName": "host0",
                "CreatedAt": "2019-09-22T14:01:59.768Z",
                "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
                "ID": 1,
                "IntelDocId": 64,
                "Priority": "high",
                "Severity": "info",
                "State": "Unresolved",
                "Type": "detect.match",
                "UpdatedAt": "2021-10-24T01:28:04.275Z"
            },
            {
                "AlertedAt": "2020-02-29T15:29:59.000Z",
                "ComputerIpAddress": "1.1.1.1",
                "ComputerName": "host0",
                "CreatedAt": "2020-02-29T15:30:29.893Z",
                "GUID": "626821e1-6b0a-4afb-a1f9-8fb7ef741736",
                "ID": 2,
                "IntelDocId": 17,
                "Priority": "high",
                "Severity": "info",
                "State": "Unresolved",
                "Type": "detect.match",
                "UpdatedAt": "2021-10-24T01:28:04.275Z"
            }
        ]
    }
}

Human Readable Output

Alerts

ID Type Severity Priority Alerted At Created At Updated At Computer Ip Address Computer Name GUID State Intel Doc Id

1 detect.match info high 2019-09-22T14:01:31.000Z 2019-09-22T14:01:59.768Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 a33e3482-556e-4e9d-bbbd-2fdbe330d492 Unresolved 64

2 detect.match info high 2020-02-29T15:29:59.000Z 2020-02-29T15:30:29.893Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 626821e1-6b0a-4afb-a1f9-8fb7ef741736 Unresolved 17

ID	Type	Severity	Priority	Alerted At	Created At	Updated At	Computer Ip Address	Computer Name	GUID	State	Intel Doc Id
1	detect.match	info	high	2019-09-22T14:01:31.000Z	2019-09-22T14:01:59.768Z	2021-10-24T01:28:04.275Z	1.1.1.1	host0	a33e3482-556e-4e9d-bbbd-2fdbe330d492	Unresolved	64
2	detect.match	info	high	2020-02-29T15:29:59.000Z	2020-02-29T15:30:29.893Z	2021-10-24T01:28:04.275Z	1.1.1.1	host0	626821e1-6b0a-4afb-a1f9-8fb7ef741736	Unresolved	17

tanium-tr-get-alert-by-id

Returns an alert object based on alert ID.

Base Command

tanium-tr-get-alert-by-id

Input

Argument Name	Description	Required
alert_id	The alert ID.	Required

Context Output

Path	Type	Description
Tanium.Alert.Priority	String	The priority of the alert.
Tanium.Alert.ComputerName	String	The hostname of the computer that generated the alert.
Tanium.Alert.GUID	String	A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt	Date	The date when the alert was generated.
Tanium.Alert.UpdatedAt	Date	The date when the alert state was last updated.
Tanium.Alert.State	String	The current state of the alert. For example, “unresolved”, “inprogress”.
Tanium.Alert.ComputerIpAddress	String	The IP address of the computer that generated the alert.
Tanium.Alert.Type	String	The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID	Number	The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt	Date	The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId	Number	The intel document revision, if intelDocId is present.
Tanium.Alert.Severity	String	The severity of the alert.

Command Example

!tanium-tr-get-alert-by-id alert_id=1

Context Example

{
    "Tanium": {
        "Alert": {
            "AlertedAt": "2019-09-22T14:01:31.000Z",
            "ComputerIpAddress": "1.1.1.1",
            "ComputerName": "host0",
            "CreatedAt": "2019-09-22T14:01:59.768Z",
            "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
            "ID": 1,
            "IntelDocId": 64,
            "Priority": "high",
            "Severity": "info",
            "State": "Unresolved",
            "Type": "detect.match",
            "UpdatedAt": "2021-10-24T01:28:04.275Z"
        }
    }
}

Human Readable Output

Alert information

ID Type Severity Priority Alerted At Created At Updated At Computer Ip Address Computer Name GUID State Intel Doc Id

1 detect.match info high 2019-09-22T14:01:31.000Z 2019-09-22T14:01:59.768Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 a33e3482-556e-4e9d-bbbd-2fdbe330d492 Unresolved 64

ID	Type	Severity	Priority	Alerted At	Created At	Updated At	Computer Ip Address	Computer Name	GUID	State	Intel Doc Id
1	detect.match	info	high	2019-09-22T14:01:31.000Z	2019-09-22T14:01:59.768Z	2021-10-24T01:28:04.275Z	1.1.1.1	host0	a33e3482-556e-4e9d-bbbd-2fdbe330d492	Unresolved	64

tanium-tr-alert-update-state

Updates the state of the specified alerts.

Base Command

tanium-tr-alert-update-state

Input

Argument Name	Description	Required
alert_ids	A comma-separated list of alert IDs to update.	Required
state	The new state for the alerts. Can be “Unresolved”, “In Progress”, “Dismissed”, “Ignored”, or “Resolved”. Possible values are: dismissed, unresolved, inprogress, ignored, resolved.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-alert-update-state alert_ids=1 state=resolved

Human Readable Output

Alert state updated to resolved.

tanium-tr-create-snapshot

Captures a new snapshot by connection id.

Base Command

tanium-tr-create-snapshot

Input

Argument Name	Description	Required
connection_id	The connection id.	Required

Context Output

Path	Type	Description
Tanium.SnapshotTask.connection	String	Connection id of the snapshot.
Tanium.SnapshotTask.startTime	Date	Snapshot start time.
Tanium.SnapshotTask.status	String	Snapshot creation task status.
Tanium.SnapshotTask.taskId	Number	Snapshot creation task id. You can get task status using `tanium-tr-get-task-by-id` command.

Command Example

!tanium-tr-create-snapshot connection_id=remote:hostname:123:

Context Example

{
    "Tanium": {
        "SnapshotTask": {
            "connection": "remote:hostname:123:",
            "startTime": "2021-10-07T12:22:29.550Z",
            "status": "STARTED",
            "taskId": 1177
        }
    }
}

Human Readable Output

Initiated snapshot creation request for remote:hostname:123:. Task id: 1177.

tanium-tr-delete-snapshot

Deletes a snapshot by connection name and snapshot ID.

Base Command

tanium-tr-delete-snapshot

Input

Argument Name	Description	Required
snapshot_ids	The snapshot IDs to delete.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-snapshot snapshot_ids=eda5ddce-0f8c-48e8-8dd5-6aa18681d539,3893fa77-4829-4e48-9364-40a16ad6cc0f

Human Readable Output

Snapshot eda5ddce-0f8c-48e8-8dd5-6aa18681d539,3893fa77-4829-4e48-9364-40a16ad6cc0f deleted successfully.

tanium-tr-list-snapshots

Returns all local snapshots of a single connection.

Base Command

tanium-tr-list-snapshots

Input

Argument Name	Description	Required
limit	The maximum number of local snapshots to return. Default is 50.	Optional
offset	The offset number to begin listing local snapshots. Default is 0.	Optional

Context Output

Path	Type	Description
Tanium.Snapshot.size	String	The snapshot size.
Tanium.Snapshot.created	String	The snapshot creation date.
Tanium.Snapshot.completed	String	The snapshot completed date.
Tanium.Snapshot.name	String	The snapshot name.
Tanium.Snapshot.isUpload	Boolean	Is the snapshot uplaod.
Tanium.Snapshot.evidenceType	String	Evidence type.
Tanium.Snapshot.hostname	String	Hxstname of the snapshot.
Tanium.Snapshot.connectionId	String	The snapshot connection ID.
Tanium.Snapshot.recorderVersion	String	Recorder Version.
Tanium.Snapshot.uuid	String	The snapshot uuid.

Command Example

!tanium-tr-list-snapshots limit=2

Context Example

{
    "Tanium": {
        "Snapshot": [
            {
                "completed": "2021-10-06T06:42:03.260Z",
                "connectionId": "remote:hostname:123:",
                "created": "2021-10-06T06:40:48.297Z",
                "evidenceType": "snapshot",
                "hostname": "hostname2",
                "isUpload": false,
                "name": "host1-1633502448297.db",
                "recorderVersion": 2,
                "size": 152064000,
                "username": "administrator",
                "uuid": "832dec40-1cc2-4e53-881a-7f61cba835bc"
            },
            {
                "completed": "2021-10-06T06:43:21.474Z",
                "connectionId": "remote:hostname:123:",
                "created": "2021-10-06T06:42:07.010Z",
                "evidenceType": "snapshot",
                "hostname": "hostname1",
                "isUpload": false,
                "name": "host1-1633502527010.db",
                "recorderVersion": 2,
                "size": 152064000,
                "username": "administrator",
                "uuid": "340a3ac4-560d-430f-bd50-96615d763171"
            }
        ]
    }
}

Human Readable Output

Snapshots

Uuid Name Evidence Type Hostname Created

832dec40-1cc2-4e53-881a-7f61cba835bc host1-1633502448297.db snapshot hostname2 2021-10-06T06:40:48.297Z

340a3ac4-560d-430f-bd50-96615d763171 host2-1633502527010.db snapshot hostname1 2021-10-06T06:42:07.010Z

Uuid	Name	Evidence Type	Hostname	Created
832dec40-1cc2-4e53-881a-7f61cba835bc	host1-1633502448297.db	snapshot	hostname2	2021-10-06T06:40:48.297Z
340a3ac4-560d-430f-bd50-96615d763171	host2-1633502527010.db	snapshot	hostname1	2021-10-06T06:42:07.010Z

tanium-tr-delete-local-snapshot

Deletes a local snapshot by connection id.

Base Command

tanium-tr-delete-local-snapshot

Input

Argument Name	Description	Required
connection_id	The connection id.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-local-snapshot connection_id=remote:hostname:123:

Human Readable Output

Local snapshot of connection remote:hostname:123: was deleted successfully.

tanium-tr-list-connections

Returns all connections.

Base Command

tanium-tr-list-connections

Input

Argument Name	Description	Required
limit	The maximum number of connections to return. Default is 50.	Optional
offset	The offset number to begin listing connections. Default is 0.	Optional
status	Comma-seperated list of statuses to get the connections that match only those statuses, for example status=connected,waiting. Possible values are: disconnected, timeout, waiting, connected.	Optional
ip	Comma-seperated list of ips to get the connections that match only those ips, for example status=1.1.1.1,1.1.1.1.	Optional
platform	Comma-seperated list of platforms to get the connections that match only those platforms, for example platform=Linux,Windows.	Optional
hostname	Comma-seperated list of hostnames to get the connections that match only those hostnames, for example hostname=host1,host2.	Optional

Context Output

Path	Type	Description
Tanium.Connection.id	String	The connection id.
Tanium.Connection.initiatedAt	Date	Time when the connection was first created.
Tanium.Connection.hostname	String	The connection hostname.
Tanium.Connection.status	String	Current connection state.
Tanium.Connection.platform	String	The connection operating system.
Tanium.Connection.ip	String	The connection ip.
Tanium.Connection.connectedAt	String	Time when the connection was connected.
Tanium.Connection.message	String	The connection message describing the status.
Tanium.Connection.personaId	String	The connection persona Id.
Tanium.Connection.clientId	String	The client id.
Tanium.Connection.userId	String	The connection user id.
Tanium.Connection.eid	String	The connection eid.
Tanium.Connection.hasTools	Boolean	Has connection tools.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "Connection": [
            {
                "clientId": "123",
                "connectedAt": "2021-09-22T12:08:39.000Z",
                "eid": "2",
                "hasTools": true,
                "hostname": "hostname",
                "id": "remote:hostname:123:",
                "initiatedAt": "2021-09-22T12:08:35.000Z",
                "ip": "1.1.1.1",
                "message": "The connection has been disconnected.",
                "personaId": 0,
                "platform": "Windows",
                "status": "disconnected",
                "userId": "1"
            },
            {
                "clientId": "11111",
                "hostname": "localhost",
                "id": "remote:localhost:11111:",
                "initiatedAt": "2021-09-09T08:17:38.000Z",
                "ip": "1.2.3.4",
                "message": "The connection has timed out.",
                "personaId": 0,
                "platform": "Linux",
                "status": "timeout",
                "userId": "1"
            }
        ]
    }
}

Human Readable Output

Connections

Id Status Hostname Message Ip Platform Connected At

rremote:hostname:123: disconnected hostname The connection has been disconnected. 1.1.1.1 Windows 2021-09-22T12:08:39.000Z

remote:localhost:1111: timeout localhost The connection has timed out. 1.2.3.4 Linux

Id	Status	Hostname	Message	Ip	Platform	Connected At
rremote:hostname:123:	disconnected	hostname	The connection has been disconnected.	1.1.1.1	Windows	2021-09-22T12:08:39.000Z
remote:localhost:1111:	timeout	localhost	The connection has timed out.	1.2.3.4	Linux

tanium-tr-create-connection

Creates a local or remote connection.

Base Command

tanium-tr-create-connection

Input

Argument Name	Description	Required
client_id	Client id. Use `tanium-tr-get-system-status` to get all possible client_ids.	Required
ip	IP address to connect. Use `tanium-tr-get-system-status` to get all possible ips.	Required
platform	Commputers platform - “Windows”, “Linux”, etc.	Required
hostname	Hostname of the computer to connect. Use `tanium-tr-get-system-status` to get all possible hostnames.	Required

Context Output

Path	Type	Description
Tanium.Connection.id	String	New connection id.

Command Example

!tanium-tr-create-connection client_id=123 ip=1.1.1.1 hostname=host1 platform=Windows

Context Example

{
    "Tanium": {
        "Connection": {
            "id": "remote:host1:123:"
        }
    }
}

Human Readable Output

Initiated connection request to “remote:host1:123:”.

tanium-tr-delete-connection

Deletes a connection by connection id.

Base Command

tanium-tr-delete-connection

Input

Argument Name	Description	Required
connection_id	The connection id.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-connection connection_id=remote:host1:123:

Human Readable Output

Connection remote:host1:123: deleted successfully.

tanium-tr-close-connection

Closes a connection by connection id.

Base Command

tanium-tr-close-connection

Input

Argument Name	Description	Required
connection_id	The connection id.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-close-connection connection_id=remote:host1:123:

Human Readable Output

Connection remote:host1:123: closed successfully.

tanium-tr-list-labels

Returns all available labels in the system.

Base Command

tanium-tr-list-labels

Input

Argument Name	Description	Required
limit	The maximum number of labels to return. Default is 50.	Optional
offset	The offset number to begin listing labels. Default is 0.	Optional

Context Output

Path	Type	Description
Tanium.Label.createdAt	Date	The date when this label was created.
Tanium.Label.description	String	An extended description of the label.
Tanium.Label.id	Number	The unique identifier for this label.
Tanium.Label.indicatorCount	Number	The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.name	String	The display name of the label.
Tanium.Label.signalCount	Number	The number of Tanium Signal documents associated with this label.
Tanium.Label.updatedAt	Date	The date when this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-list-labels limit=2

Context Example

{
    "Tanium": {
        "Label": [
            {
                "createdAt": "2019-07-31T18:46:28.629Z",
                "description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                "id": 1,
                "indicatorCount": 0,
                "name": "Alpha",
                "signalCount": 0,
                "updatedAt": "2019-07-31T18:46:28.629Z"
            },
            {
                "createdAt": "2019-07-31T18:46:28.629Z",
                "description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                "id": 2,
                "indicatorCount": 0,
                "name": "Beta",
                "signalCount": 420,
                "updatedAt": "2019-07-31T18:46:28.629Z"
            }
        ]
    }
}

Human Readable Output

Labels

Name Description Id Indicator Count Signal Count Created At Updated At

Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 1 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 2 0 420 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

Name	Description	Id	Indicator Count	Signal Count	Created At	Updated At
Alpha	These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.	1	0	0	2019-07-31T18:46:28.629Z	2019-07-31T18:46:28.629Z
Beta	These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.	2	0	420	2019-07-31T18:46:28.629Z	2019-07-31T18:46:28.629Z

tanium-tr-get-label-by-id

Returns a label object based on label ID.

Base Command

tanium-tr-get-label-by-id

Input

Argument Name	Description	Required
label_id	The label ID. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs).	Required

Context Output

Path	Type	Description
Tanium.Label.createdAt	Date	The date when this label was created.
Tanium.Label.description	String	An extended description of the label.
Tanium.Label.id	Number	The unique identifier for this label.
Tanium.Label.indicatorCount	Number	The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.name	String	The display name of the label.
Tanium.Label.signalCount	Number	The number of Tanium Signal documents associated with this label.
Tanium.Label.updatedAt	Date	The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-get-label-by-id label_id=1

Context Example

{
    "Tanium": {
        "Label": {
            "createdAt": "2019-07-31T18:46:28.629Z",
            "description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
            "id": 1,
            "indicatorCount": 0,
            "name": "Alpha",
            "signalCount": 0,
            "updatedAt": "2019-07-31T18:46:28.629Z"
        }
    }
}

Human Readable Output

Label information

Name Description Id Indicator Count Signal Count Created At Updated At

Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 1 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

Name	Description	Id	Indicator Count	Signal Count	Created At	Updated At
Alpha	These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.	1	0	0	2019-07-31T18:46:28.629Z	2019-07-31T18:46:28.629Z

tanium-tr-list-file-downloads

Returns all downloaded files in the system.

Base Command

tanium-tr-list-file-downloads

Input

Argument Name	Description	Required
limit	The maximum number of files to return. Default is 50.	Optional
offset	Offset to start getting file downloads. Default is 0.	Optional
sort	Column which to sort by.	Optional
hostname	Comma-seperated list of hostnames to get the downloaded files that match only those hostnames, for example hostname=host1,host2.	Optional
hash	Comma-seperated list of hashes to get the downloaded files that match only those hashes, for example hash=123,456.	Optional
process_time_start	Get the downloaded files that match only to the process time start, for example process_time_start=2019-09-03T17:51:40.000Z.	Optional

Context Output

Path	Type	Description
Tanium.FileDownload.size	Number	The size of the file, in bytes.
Tanium.FileDownload.path	String	The path of the file.
Tanium.FileDownload.downloaded	Date	The date when this file was downloaded.
Tanium.FileDownload.hostname	String	The hostname of the downloaded file.
Tanium.FileDownload.processCreationTime	Date	The date when the file was created.
Tanium.FileDownload.hash	String	The file hash.
Tanium.FileDownload.uuid	Number	The downloaded file uuid.
Tanium.FileDownload.lastModified	Date	The date when the file was last modified.
Tanium.FileDownload.createdBy	String	The user that created this file.
Tanium.FileDownload.createdByProc	String	The process path that created this file.
Tanium.FileDownload.lastModifiedBy	String	The user that last modified this file.
Tanium.FileDownload.lastModifiedByProc	String	The process path that modified this file.
Tanium.FileDownload.evidenceType	String	The evidence type - file.

Command Example

!tanium-tr-list-file-downloads limit=2

Context Example

{
    "Tanium": {
        "FileDownload": [
            {
                "downloaded": "2020-01-15 13:04:02.827",
                "evidenceType": "file",
                "hash": "99297a0e626ca092ff1884ad28f54453",
                "hostname": "host1",
                "lastModified": "2020-01-15T08:57:19.000Z",
                "path": "C:\\Program Files (x86)\\log1.txt",
                "processCreationTime": "2019-09-03T17:51:40.000Z",
                "size": 10485904,
                "uuid": "c0531415-87a6-4d28-a226-b485784b1881"
            },
            {
                "downloaded": "2020-01-15 18:17:10.595",
                "evidenceType": "file",
                "hash": "7d1677decbfaf1598ccd745fc197eb1c",
                "hostname": "host2",
                "lastModified": "2020-01-13T13:11:35.000Z",
                "path": "C:\\Program Files (x86)\\log8.txt",
                "processCreationTime": "2019-09-03T17:51:40.000Z",
                "size": 10485940,
                "uuid": "3043ef9c-78a9-4f19-8fb9-ddbab202d03b"
            }
        ]
    }
}

Human Readable Output

File downloads

Uuid Path Evidence Type Hostname Process Creation Time Size

c0531415-87a6-4d28-a226-b485784b1881 C:\Program Files (x86)\log1.txt file host1 2019-09-03T17:51:40.000Z 10485904

3043ef9c-78a9-4f19-8fb9-ddbab202d03b C:\Program Files (x86)\log8.txt file host2 2019-09-03T17:51:40.000Z 10485940

Uuid	Path	Evidence Type	Hostname	Process Creation Time	Size
c0531415-87a6-4d28-a226-b485784b1881	C:\Program Files (x86)\log1.txt	file	host1	2019-09-03T17:51:40.000Z	10485904
3043ef9c-78a9-4f19-8fb9-ddbab202d03b	C:\Program Files (x86)\log8.txt	file	host2	2019-09-03T17:51:40.000Z	10485940

tanium-tr-get-downloaded-file

Gets the actual content of a downloaded file by file ID. Downloaded file password: infected.

Base Command

tanium-tr-get-downloaded-file

Input

Argument Name	Description	Required
file_id	The file ID.	Required

Context Output

Path	Type	Description
File.EntryID	String	File entry ID.
File.Extension	String	The extension of the file.
File.Info	String	Information about the file.
File.MD5	String	The MD5 hash of the file.
File.Name	String	The name of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.SHA512	String	The SHA512 hash of the file.
File.SSDeep	String	The SSDeep hash of the file (same as displayed in file entries).
File.Size	Number	The size of the file in bytes.
File.Type	String	The file type.

Command Example

!tanium-tr-get-downloaded-file file_id=c0531415-87a6-4d28-a226-b485784b1881

Context Example

{
    "File": {
        "EntryID": "7608@e99f97d1-7225-4c75-896c-3c960febbe8c",
        "Extension": "zip",
        "Info": "application/zip",
        "MD5": "217cac2e10c1d11ed55ab2ede6bdb0ea",
        "Name": "c0531415-87a6-4d28-a226-b485784b1881.zip",
        "SHA1": "20808150526b092f5e4e19c82af2e9b2a1303e89",
        "SHA256": "40c605face875cd53f07c1301ffc9fce0ed5b12a65c729fe73895e44cdcdebdf",
        "SHA512": "50415634cae426da763a39532f3d22eeea5a79a8868044f6b3ffca8b528cce92cbe9f4d7b98d6d1cb49a705f3182b2c43f84f628acd748fb78e6cca85939b10c",
        "SSDeep": "12288:npzKFzLrU/2fzXVPkrnjuYyTNW+o4T5SD7BDy6PFP8NjglLSAK:npeFzLI/6FknjuY4nojJm6NP8NjQi",
        "Size": 598728,
        "Type": "Zip archive data, at least v2.0 to extract"
    }
}

Human Readable Output

tanium-tr-list-events-by-connection

Queries events for a connection.

Base Command

tanium-tr-list-events-by-connection

Input

Argument Name	Description	Required
connection_id	The connection id.	Required
type	The type of event. Can be “File”, “Network”, “Registry”, “Process”, “Driver”, “Combined”, “DNS”, or “Image”. The default is “Combined”. Possible values are: File, Network, Registry, Process, Driver, Combined, DNS, Image. Default is combined.	Required
limit	The maximum number of events to return. Default is 50.	Optional
offset	Offset to start getting the result set. Default is 0.	Optional
filter	Advanced search that filters according to event fields. For example: [[‘process_id’, ‘gt’, ‘30’], [‘username’, ‘ne’, ‘administrator’]]. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional operators: eq (equals), ne (does not equal); for integers/date: gt (greater than), gte (greater than or equals), ls (less than), lse (less than or equals); for strings: co (contains), nc (does not contain). .	Optional
match	Whether the results should fit all filters or at least one filter. Possible values are: all, any. Default is all.	Optional
sort	A comma-separated list of fields to sort on prefixed by +/- for ascending or descending and ordered by priority left to right. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC).	Optional
fields	A comma-separated list of fields on which to search. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time.	Optional

Context Output

Path	Type	Description
TaniumEvent.id	String	The ID of the event.
TaniumEvent.groupName	String	The group name of the event.
TaniumEvent.file	String	The path of the file in the event.
TaniumEvent.operation	String	The event operation.
TaniumEvent.processId	Number	The ID of the process.
TaniumEvent.pid	Number	The ID of the process.
TaniumEvent.processPath	String	The path of the process.
TaniumEvent.processTableId	Number	The ID of the process table.
TaniumEvent.timestamp	Date	The date when the event was created.
TaniumEvent.userName	String	The username associated with the event.
TaniumEvent.remoteAddress	String	The network event destination address.
TaniumEvent.remoteAddressPort	Number	The network event destination port.
TaniumEvent.localAddress	String	The network event source address.
TaniumEvent.localAddressPort	Number	The network event source port.
TaniumEvent.keyPath	String	The registry key path.
TaniumEvent.valueName	String	The registry value name.
TaniumEvent.exitCode	Number	The process exit code.
TaniumEvent.processCommandLine	String	The process command line.
TaniumEvent.parentCommandLine	String	The parent command line.
TaniumEvent.processHash	String	The hash value of the process.
TaniumEvent.hashes	String	The hashes of the driver.
TaniumEvent.imageLoaded	String	The image loaded path of the driver.
TaniumEvent.signature	String	The signature of the driver.
TaniumEvent.signed	Boolean	Whether the driver is signed.
TaniumEvent.eventId	Number	The ID of the event.
TaniumEvent.eventOpcode	Number	The event opcode.
TaniumEvent.eventRecordId	Number	The ID of the event record.
TaniumEvent.eventTaskId	Number	The ID of the event task.
TaniumEvent.query	String	The query of the DNS.
TaniumEvent.response	String	The response of the DNS.
TaniumEvent.imagePath	String	The image path.
TaniumEvent.createTime	Date	The process creation time
TaniumEvent.endTime	Date	The process end time.
TaniumEvent.eventTaskName	String	The name of the event task.
TaniumEvent.hash	String	The process hash.

Command Example

!tanium-tr-list-events-by-connection connection_id=remote:hostname:123: type=File limit=2

Context Example

{
    "TaniumEvent": [
        {
            "eventOperationId": 0,
            "file": "C:\\Windows\\f1.dat",
            "groupName": "NT AUTHORITY",
            "id": "4611686018470089188",
            "operation": "Create",
            "pid": 736,
            "processPath": "C:\\Windows\\t.exe",
            "processTableId": "72057594038528503",
            "timestamp": "2021-07-18 07:28:04.007",
            "timestampRaw": 1626593284007,
            "userName": "LOCAL SERVICE"
        },
        {
            "eventOperationId": 1,
            "file": "C:\\Windows\\f2.dat",
            "groupName": "NT AUTHORITY",
            "id": "4611686018470089189",
            "operation": "Write",
            "pid": 736,
            "processPath": "C:\\Windows\\d.exe",
            "processTableId": "72057594038528503",
            "timestamp": "2021-07-18 07:28:04.007",
            "timestampRaw": 1626593284007,
            "userName": "LOCAL SERVICE"
        }
    ]
}

Human Readable Output

Events for remote:hostname:123

Id File Timestamp Process Table Id Process Path User Name

4611686018470089188 C:\Windows\f1.dat 2021-07-18 07:28:04.007 72057594038528503 C:\Windows\t.exe LOCAL SERVICE

4611686018470089189 C:\Windows\f2.dat 2021-07-18 07:28:04.007 72057594038528503 C:\Windows\d.exe LOCAL SERVICE

Id	File	Timestamp	Process Table Id	Process Path	User Name
4611686018470089188	C:\Windows\f1.dat	2021-07-18 07:28:04.007	72057594038528503	C:\Windows\t.exe	LOCAL SERVICE
4611686018470089189	C:\Windows\f2.dat	2021-07-18 07:28:04.007	72057594038528503	C:\Windows\d.exe	LOCAL SERVICE

tanium-tr-get-file-download-info

Gets the metadata of a file download.

Base Command

tanium-tr-get-file-download-info

Input

Argument Name	Description	Required
file_id	File download ID.	Required

Context Output

Path	Type	Description
Tanium.FileDownload.size	Number	The size of the file, in bytes.
Tanium.FileDownload.path	String	The path of the file.
Tanium.FileDownload.downloaded	Date	The date when this file was downloaded.
Tanium.FileDownload.hostname	String	The hostname of the downloaded file.
Tanium.FileDownload.processCreationTime	Date	The date when the file was created.
Tanium.FileDownload.hash	String	The file hash.
Tanium.FileDownload.uuid	Number	The downloaded file uuid.
Tanium.FileDownload.lastModified	Date	The date when the file was last modified.
Tanium.FileDownload.createdBy	String	The user that created this file.
Tanium.FileDownload.createdByProc	String	The process path that created this file.
Tanium.FileDownload.lastModifiedBy	String	The user that last modified this file.
Tanium.FileDownload.lastModifiedByProc	String	The process path that modified this file.
Tanium.FileDownload.evidenceType	String	The evidence type - file.

Command Example

!tanium-tr-get-file-download-info file_id=c0531415-87a6-4d28-a226-b485784b1881

Context Example

{
    "Tanium": {
        "FileDownload": {
            "downloaded": "2020-01-15 13:04:02.827",
            "evidenceType": "file",
            "hash": "123456789",
            "hostname": "host1",
            "lastModified": "2020-01-15T08:57:19.000Z",
            "path": "C:\\log1.txt",
            "processCreationTime": "2019-09-03T17:51:40.000Z",
            "size": 10485904,
            "uuid": "c0531415-87a6-4d28-a226-b485784b1881"
        }
    }
}

Human Readable Output

File download

Uuid Path Evidence Type Hostname Process Creation Time Size

c0531415-87a6-4d28-a226-b485784b1881 C:\log1.txt file host1 2019-09-03T17:51:40.000Z 10485904

Uuid	Path	Evidence Type	Hostname	Process Creation Time	Size
c0531415-87a6-4d28-a226-b485784b1881	C:\log1.txt	file	host1	2019-09-03T17:51:40.000Z	10485904

tanium-tr-get-process-info

Get information for a process.

Base Command

tanium-tr-get-process-info

Input

Argument Name	Description	Required
connection_id	The connection id.	Required
ptid	The process table ID.	Required

Context Output

Path	Type	Description
Tanium.ProcessInfo.childrenCount	Number	Nuber of process children.
Tanium.ProcessInfo.context	String	Process tree context.
Tanium.ProcessInfo.createTime	Date	Time when the process was created.
Tanium.ProcessInfo.createTimeRaw	Date	Timestamp when the process was created.
Tanium.ProcessInfo.dnsEventsCount	Number	Number of DNS events in the process.
Tanium.ProcessInfo.driverEventsCount	Number	Number of Driver events in the process.
Tanium.ProcessInfo.endTime	Date	Process termination time.
Tanium.ProcessInfo.endTimeRaw	Date	Process termination timestamp.
Tanium.ProcessInfo.exitCode	Number	Process exit code.
Tanium.ProcessInfo.fileEventsCount	Number	Number of File events in the process.
Tanium.ProcessInfo.groupName	String	Process group name.
Tanium.ProcessInfo.hashTypeName	String	Hash type.
Tanium.ProcessInfo.id	String	Process id at the tanium system.
Tanium.ProcessInfo.imageEventsCount	Number	Number of Image events in the process.
Tanium.ProcessInfo.networkEventsCount	Number	Number of network events in the process.
Tanium.ProcessInfo.parentProcessTableId	String	Parent process table id.
Tanium.ProcessInfo.pid	Number	The ID of the process.
Tanium.ProcessInfo.processEventsCount	Number	Number of process events in the process.
Tanium.ProcessInfo.processHash	String	Process hash.
Tanium.ProcessInfo.processPath	String	The process path.
Tanium.ProcessInfo.processTableId	String	The ID of the process table.
Tanium.ProcessInfo.registryEventsCount	Number	Number of registry events in the process.
Tanium.ProcessInfo.securityEventsCount	Number	Number of security events in the process.
Tanium.ProcessInfo.uniqueProcessId	String	Unique process id.
Tanium.ProcessInfo.userName	String	The username who created the process.

Command Example

!tanium-tr-get-process-info ptid=72057594038510321 connection_id=remote:hostname:123:

Context Example

{
    "Tanium": {
        "ProcessInfo": {
            "childrenCount": 0,
            "context": "node",
            "createTime": "2021-07-09 12:38:19.372",
            "createTimeRaw": 1625834299372,
            "dnsEventsCount": 0,
            "driverEventsCount": 0,
            "endTime": "2021-07-09 12:39:49.413",
            "endTimeRaw": 1625834389413,
            "exitCode": 0,
            "fileEventsCount": 0,
            "groupName": "NT AUTHORITY",
            "hashTypeName": "MD5",
            "id": "72057594038510321",
            "imageEventsCount": 0,
            "networkEventsCount": 0,
            "parentProcessTableId": "72057594038528485",
            "pid": 3648,
            "processEventsCount": 1,
            "processHash": "e1bce838cd2695999ab34215bf94b501",
            "processPath": "C:\\test.exe",
            "processTableId": "72057594038510321",
            "registryEventsCount": 0,
            "securityEventsCount": 0,
            "uniqueProcessId": "-8410859473941295552",
            "userName": "LOCAL SERVICE"
        }
    }
}

Human Readable Output

Process information for process with PTID 72057594038510321

Pid Process Table Id Parent Process Table Id Process Path

3648 72057594038510321 72057594038528485 C:\test.exe

Pid	Process Table Id	Parent Process Table Id	Process Path
3648	72057594038510321	72057594038528485	C:\test.exe

tanium-tr-get-events-by-process

Gets the events for a process.

Base Command

tanium-tr-get-events-by-process

Input

Argument Name	Description	Required
connection_id	The connection name.	Required
ptid	The process instance ID.	Required
type	The type of event. Can be “File”, “Network”, “Registry”, “Process”, “Driver”, “Combined”, “DNS”, or “Image”. The default is “Combined”. Possible values are: File, Network, Registry, Process, Driver, Combined, DNS, Image. Default is combined.	Required
limit	The maximum number of events to return. Default is 50.	Optional
offset	The offset number to begin listing events. Default is 0.	Optional

Context Output

Path	Type	Description
Tanium.ProcessEvent.id	Number	The ID of the event.
Tanium.ProcessEvent.detail	Unknown	The event details.
Tanium.ProcessEvent.operation	String	The event operation.
Tanium.ProcessEvent.timestamp	Date	Time when the event was created.
Tanium.ProcessEvent.type	String	The event type.

Command Example

!tanium-tr-get-events-by-process connection_id=remote:hostname:123: type=Process ptid=72057594038528485 limit=2

Context Example

{
    "Tanium": {
        "ProcessEvent": [
            {
                "detail": "4428: C:\\test.exe",
                "id": "72057594038510294",
                "operation": "CreateChild",
                "timestamp": "2021-07-09 12:20:05.490",
                "timestampRaw": 1625833205490,
                "type": "Process"
            },
            {
                "detail": "1792: C:\\test.exe",
                "id": "72057594038510295",
                "operation": "CreateChild",
                "timestamp": "2021-07-09 12:20:05.541",
                "timestampRaw": 1625833205541,
                "type": "Process"
            }
        ]
    }
}

Human Readable Output

Events for process 72057594038528485

Id Detail Type Timestamp Operation

72057594038510294 4428: C:\test.exe Process 2021-07-09 12:20:05.490 CreateChild

72057594038510295 1792: C:\test.exe Process 2021-07-09 12:20:05.541 CreateChild

tanium-tr-get-process-children

Gets the children of this process instance.

Base Command

tanium-tr-get-process-children

Input

Argument Name	Description	Required
connection_id	The connection id.	Required
ptid	The process table ID.	Required
limit	The maximum number of entries to return. Default is 50.	Optional
offset	The offset number to begin listing entries. Default is 0.	Optional

Context Output

Path	Type	Description
Tanium.ProcessChildren.childrenCount	Number	Nuber of process children.
Tanium.ProcessChildren.context	String	Process tree context.
Tanium.ProcessChildren.createTime	Date	Time when the process was created.
Tanium.ProcessChildren.createTimeRaw	Date	Timestamp when the process was created.
Tanium.ProcessChildren.dnsEventsCount	Number	Number of DNS events in the process.
Tanium.ProcessChildren.driverEventsCount	Number	Number of Driver events in the process.
Tanium.ProcessChildren.endTime	Date	Process termination time.
Tanium.ProcessChildren.endTimeRaw	Date	Process termination timestamp.
Tanium.ProcessChildren.exitCode	Number	Process exit code.
Tanium.ProcessChildren.fileEventsCount	Number	Number of File events in the process.
Tanium.ProcessChildren.groupName	String	Process group name.
Tanium.ProcessChildren.hashTypeName	String	Hash type.
Tanium.ProcessChildren.id	String	Process id at the tanium system.
Tanium.ProcessChildren.imageEventsCount	Number	Number of Image events in the process.
Tanium.ProcessChildren.networkEventsCount	Number	Number of network events in the process.
Tanium.ProcessChildren.parentProcessTableId	String	Parent process table id.
Tanium.ProcessChildren.pid	Number	The ID of the process.
Tanium.ProcessChildren.processEventsCount	Number	Number of process events in the process.
Tanium.ProcessChildren.processHash	String	Process hash.
Tanium.ProcessChildren.processPath	String	The process path.
Tanium.ProcessChildren.processTableId	String	The ID of the process table.
Tanium.ProcessChildren.registryEventsCount	Number	Number of registry events in the process.
Tanium.ProcessChildren.securityEventsCount	Number	Number of security events in the process.
Tanium.ProcessChildren.uniqueProcessId	String	Unique process id.
Tanium.ProcessChildren.userName	String	The username who created the process.

Command Example

!tanium-tr-get-process-children connection_id=remote:hostname:123: ptid=72057594038528485

Context Example

{
    "Tanium": {
        "ProcessChildren": [
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:26:12.820",
                "createTimeRaw": 1626593172820,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:13.483",
                "endTimeRaw": 1626593173483,
                "exitCode": 0,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528483",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 5284,
                "processCommandLine": "\"Logon.exe\" /flags:0x0 /state0:0xa3856855 /state1:0x41c64e6d",
                "processEventsCount": 1,
                "processHash": "b38dfcf985d8ae5b1a17c264981e61c7",
                "processPath": "C:\\Logon1.exe",
                "processTableId": "72057594038528483",
                "registryEventsCount": 39,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151524022684478300",
                "userName": "SYSTEM"
            },
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:25:43.456",
                "createTimeRaw": 1626593143456,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:56.000",
                "endTimeRaw": 1626593216000,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528482",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 2856,
                "processCommandLine": "C:\\test.exe -secured -Embedding",
                "processEventsCount": 1,
                "processHash": "e1bce838cd2695999ab34215bf94b501",
                "processPath": "C:\\test.exe",
                "processTableId": "72057594038528482",
                "registryEventsCount": 0,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151647460044567768",
                "userName": "LOCAL SERVICE"
            }
        ]
    }
}

Human Readable Output

Children for process with PTID 72057594038528485

Pid Process Table Id Parent Process Table Id

5284 72057594038528483 72057594038528485

2856 72057594038528482 72057594038528485

tanium-tr-get-parent-process

Gets information for the parent process.

Base Command

tanium-tr-get-parent-process

Input

Argument Name	Description	Required
connection_id	The connection id.	Required
ptid	The process table ID.	Required

Context Output

Path	Type	Description
Tanium.ProcessParent.childrenCount	Number	Nuber of process children.
Tanium.ProcessParent.context	String	Process tree context.
Tanium.ProcessParent.createTime	Date	Time when the process was created.
Tanium.ProcessParent.createTimeRaw	Date	Timestamp when the process was created.
Tanium.ProcessParent.dnsEventsCount	Number	Number of DNS events in the process.
Tanium.ProcessParent.driverEventsCount	Number	Number of Driver events in the process.
Tanium.ProcessParent.endTime	Date	Process termination time.
Tanium.ProcessParent.endTimeRaw	Date	Process termination timestamp.
Tanium.ProcessParent.exitCode	Number	Process exit code.
Tanium.ProcessParent.fileEventsCount	Number	Number of File events in the process.
Tanium.ProcessParent.groupName	String	Process group name.
Tanium.ProcessParent.hashTypeName	String	Hash type.
Tanium.ProcessParent.id	String	Process id at the tanium system.
Tanium.ProcessParent.imageEventsCount	Number	Number of Image events in the process.
Tanium.ProcessParent.networkEventsCount	Number	Number of network events in the process.
Tanium.ProcessParent.parentProcessTableId	String	Parent process table id.
Tanium.ProcessParent.pid	Number	The ID of the process.
Tanium.ProcessParent.processEventsCount	Number	Number of process events in the process.
Tanium.ProcessParent.processHash	String	Process hash.
Tanium.ProcessParent.processPath	String	The process path.
Tanium.ProcessParent.processTableId	String	The ID of the process table.
Tanium.ProcessParent.registryEventsCount	Number	Number of registry events in the process.
Tanium.ProcessParent.securityEventsCount	Number	Number of security events in the process.
Tanium.ProcessParent.uniqueProcessId	String	Unique process id.
Tanium.ProcessParent.userName	String	The username who created the process.

Command Example

!tanium-tr-get-parent-process connection_id=remote:hostname:123: ptid=72057594038510321

Context Example

{
    "Tanium": {
        "ProcessParent": {
            "childrenCount": 5664,
            "context": "parent",
            "createTime": "2021-07-18 07:26:55.000",
            "createTimeRaw": 1626593215000,
            "dnsEventsCount": 0,
            "driverEventsCount": 0,
            "fileEventsCount": 0,
            "id": "72057594038528485",
            "imageEventsCount": 0,
            "networkEventsCount": 0,
            "parentProcessTableId": "0",
            "pid": -2,
            "processEventsCount": 1,
            "processPath": "<Pruned Process>",
            "processTableId": "72057594038528485",
            "registryEventsCount": 0,
            "securityEventsCount": 0,
            "uniqueProcessId": "-5151340193789247490"
        }
    }
}

Human Readable Output

Parent process for process with PTID 72057594038510321

Id Pid Process Table Id Parent Process Table Id

72057594038528485 -2 72057594038528485 0

tanium-tr-get-process-tree

Gets the process tree for the process instance.

Base Command

tanium-tr-get-process-tree

Input

Argument Name	Description	Required
connection_id	The connection id.	Required
ptid	The process instance ID.	Required
context	The process context. Can be `parent`, `node`, `siblings`, `children`. Possible values are: parent, node, siblings, children.	Optional

Context Output

Path	Type	Description
Tanium.ProcessTree.childrenCount	Number	Nuber of process children.
Tanium.ProcessTree.context	String	Process tree context.
Tanium.ProcessTree.createTime	Date	Time when the process was created.
Tanium.ProcessTree.createTimeRaw	Date	Timestamp when the process was created.
Tanium.ProcessTree.dnsEventsCount	Number	Number of DNS events in the process.
Tanium.ProcessTree.driverEventsCount	Number	Number of Driver events in the process.
Tanium.ProcessTree.endTime	Date	Process termination time.
Tanium.ProcessTree.endTimeRaw	Date	Process termination timestamp.
Tanium.ProcessTree.exitCode	Number	Process exit code.
Tanium.ProcessTree.fileEventsCount	Number	Number of File events in the process.
Tanium.ProcessTree.groupName	String	Process group name.
Tanium.ProcessTree.hashTypeName	String	Hash type.
Tanium.ProcessTree.id	String	Process id at the tanium system.
Tanium.ProcessTree.imageEventsCount	Number	Number of Image events in the process.
Tanium.ProcessTree.networkEventsCount	Number	Number of network events in the process.
Tanium.ProcessTree.parentProcessTableId	String	Parent process table id.
Tanium.ProcessTree.pid	Number	The ID of the process.
Tanium.ProcessTree.processEventsCount	Number	Number of process events in the process.
Tanium.ProcessTree.processHash	String	Process hash.
Tanium.ProcessTree.processPath	String	The process path.
Tanium.ProcessTree.processTableId	String	The ID of the process table.
Tanium.ProcessTree.registryEventsCount	Number	Number of registry events in the process.
Tanium.ProcessTree.securityEventsCount	Number	Number of security events in the process.
Tanium.ProcessTree.uniqueProcessId	String	Unique process id.
Tanium.ProcessTree.userName	String	The username who created the process.

Command Example

!tanium-tr-get-process-tree connection_id=remote:hostname:123: ptid=72057594038528485

Context Example

{
    "Tanium": {
        "ProcessTree": [
            {
                "childrenCount": 5664,
                "context": "node",
                "createTime": "2021-07-18 07:26:55.000",
                "createTimeRaw": 1626593215000,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "fileEventsCount": 0,
                "id": "72057594038528485",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "0",
                "pid": -2,
                "processEventsCount": 1,
                "processPath": "<Pruned Process>",
                "processTableId": "72057594038528485",
                "registryEventsCount": 0,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151340193789247490"
            },
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:26:12.820",
                "createTimeRaw": 1626593172820,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:13.483",
                "endTimeRaw": 1626593173483,
                "exitCode": 0,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528483",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 5284,
                "processCommandLine": "\"LogonUI.exe\" /flags:0x0 /state0:0xa3856855 /state1:0x41c64e6d",
                "processEventsCount": 1,
                "processHash": "b38dfcf985d8ae5b1a17c264981e61c7",
                "processPath": "C:\\Windows\\System32\\LogonUI.exe",
                "processTableId": "72057594038528483",
                "registryEventsCount": 39,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151524022684478300",
                "userName": "SYSTEM"
            }
        ]
    }
}

Human Readable Output

Process information for process with PTID 72057594038528485

Id Pid Process Table Id Parent Process Table Id

72057594038528485 -2 72057594038528485 0

72057594038528483 5284 72057594038528483 72057594038528485

tanium-tr-event-evidence-list

Returns a list of all available evidence in the system.

Base Command

tanium-tr-event-evidence-list

Input

Argument Name	Description	Required
limit	The maximum number of evidences to return. Default is 50.	Optional
offset	Offset to start getting the events result set. Default is 0.	Optional
sort	A comma-separated list of fields by which to sort, using +/- prefixes for ascending/descending, in order of priority (left to right).	Optional
hostname	Comma-seperated list of hostnames to get the event evidences that match only those hostnames, for example hostname=123,456.	Optional
type	Get the event evidences that match only to a specific type, for example type=file.	Optional

Context Output

Path	Type	Description
Tanium.Evidence.name	String	The evidence name.
Tanium.Evidence.uuid	String	The evidence UUID.
Tanium.Evidence.createdAt	Date	Time when the process was created.
Tanium.Evidence.hostname	String	The evidence connection hostname.
Tanium.Evidence.evidenceType	Number	The evidence type.
Tanium.Evidence.size	Number	The evidence size.

Command Example

!tanium-tr-event-evidence-list limit=3

Context Example

{
    "Tanium": {
        "Evidence": [
            {
                "createdAt": "2021-10-06T06:40:48.297Z",
                "evidenceType": "snapshot",
                "hostname": "host1",
                "name": "host1.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "832dec40-1cc2-4e53-881a-7f61cba835bc"
            },
            {
                "createdAt": "2021-10-06T06:42:07.010Z",
                "evidenceType": "snapshot",
                "hostname": "host2",
                "name": "host2.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "340a3ac4-560d-430f-bd50-96615d763171"
            },
            {
                "createdAt": "2021-10-07T12:15:30.711Z",
                "evidenceType": "snapshot",
                "hostname": "host3",
                "name": "host3.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "cf4d8628-8527-4014-8ed2-bdca6c592488"
            }
        ]
    }
}

Human Readable Output

Evidence list

Uuid Name Evidence Type Hostname Created At Username

832dec40-1cc2-4e53-881a-7f61cba835bc host1.db snapshot host1 2021-10-06T06:40:48.297Z administrator

340a3ac4-560d-430f-bd50-96615d763171 host2.db snapshot host2 2021-10-06T06:42:07.010Z administrator

cf4d8628-8527-4014-8ed2-bdca6c592488 host3.db snapshot host3 2021-10-07T12:15:30.711Z administrator

tanium-tr-event-evidence-get-properties

Returns event evidence properties for IOC generation.

Base Command

tanium-tr-event-evidence-get-properties

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
Tanium.EvidenceProperties.type	String	The evidence property type.
Tanium.EvidenceProperties.value	String	The evidence property value.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "EvidenceProperties": [
            {
                "type": "MD5Hash",
                "value": "92ee791a630830452485e8e375f8db35"
            },
            {
                "type": "MD5Hash",
                "value": "e1bce838cd2695999ab34215bf94b501"
            },
            {
                "type": "MD5Hash",
                "value": "0e1853d3339d2963d2bc6ac1fdc1c811"
            },
            {
                "type": "MD5Hash",
                "value": "41b0ade03cd365a5cc99f748c5ffcadc"
            },
            {
                "type": "MD5Hash",
                "value": "a9a89cb1838373c365f2b8af72b1f1c2"
            }
        ]
    }
}

Human Readable Output

Evidence Properties

Type Value

MD5Hash 92ee791a630830452485e8e375f8db35

MD5Hash e1bce838cd2695999ab34215bf94b501

MD5Hash 0e1853d3339d2963d2bc6ac1fdc1c811

MD5Hash 41b0ade03cd365a5cc99f748c5ffcadc

MD5Hash a9a89cb1838373c365f2b8af72b1f1c2

tanium-tr-get-evidence-by-id

Gets event evidence by evidence ID.

Base Command

tanium-tr-get-evidence-by-id

Input

Argument Name	Description	Required
evidence_id	The ID of the evidence.	Required

Context Output

Path	Type	Description
Tanium.Evidence.commandline	String	Process command line.
Tanium.Evidence.createTime	Date	Time when the process was created.
Tanium.Evidence.createTimeRaw	Number	Timestamp when the process was created.
Tanium.Evidence.created	Date	Time when the event was created.
Tanium.Evidence.domain	String	Event domain.
Tanium.Evidence.eventtype	String	The event type.
Tanium.Evidence.evidencetype	String	The evidence type.
Tanium.Evidence.exitCode	Number	Process exit code.
Tanium.Evidence.hostname	String	Connection host name.
Tanium.Evidence.summary	String	Evidence summary.
Tanium.Evidence.timestamp	Date	Eveidence creation date.
Tanium.Evidence.type	String	The evidence type.
Tanium.Evidence.username	String	Evidence creator Username.
Tanium.Evidence.utctimecreated	Date	Evidence creation utc date.
Tanium.Evidence.uuid	String	The evidence UUID.

Command Example

!tanium-tr-get-evidence-by-id evidence_id=b684f9be-80ee-483d-8dca-a4d5cd3aeaa6

Context Example

{
    "Tanium": {
        "Evidence": {
            "createTime": "2021-07-07 11:00:01.973",
            "createTimeRaw": 1625655601973,
            "created": "2021-10-05T10:44:36.697Z",
            "endTime": "2021-07-07 11:01:32.006",
            "endTimeRaw": 1625655692006,
            "eventtype": "ProcessEvent",
            "evidencetype": "event",
            "exitCode": 0,
            "groupName": "NT AUTHORITY",
            "hash": "e1bce838cd2695999ab34215bf94b501",
            "hashTypeName": "MD5",
            "hostname": "host1",
            "id": "72057594038506412",
            "parentCommandLine": "<Pruned Process>",
            "parentPath": "<Pruned Process>",
            "parentPid": -2,
            "parentProcessTableId": "72057594038528485",
            "pid": 6056,
            "processPath": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "processTableId": "72057594038506412",
            "recorderid": "72057594038506412",
            "summary": "Test description.",
            "userName": "NETWORK SERVICE",
            "username": "administrator",
            "uuid": "b684f9be-80ee-483d-8dca-a4d5cd3aeaa6"
        }
    }
}

Human Readable Output

Evidence information

Uuid Hostname Username Summary Created Process Table Id

b684f9be-80ee-483d-8dca-a4d5cd3aeaa6 host1 administrator Test description. 2021-10-05T10:44:36.697Z 72057594038506412

tanium-tr-create-evidence

Creates an event evidence from process.

Base Command

tanium-tr-create-evidence

Input

Argument Name	Description	Required
connection_id	The id of the connection.	Required
ptid	The process instance ID.	Required
hostname	The hostname of the connection.	Required
summary	The summary of the event evidence.	Optional

Context Output

There is no context output for this command.

Command Example

!tanium-tr-create-evidence ptid=72057594038510321 connection_id=remote:hostname:123: hostname=host1 summary="Create Process"

Human Readable Output

Evidence have been created.

tanium-tr-delete-evidence

Deletes event evidences from tanium.

Base Command

tanium-tr-delete-evidence

Input

Argument Name	Description	Required
evidence_ids	The IDs of the evidences to delete.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-evidence evidence_ids=53630ca0-e55a-4f6d-9451-d1c2c277530b

Human Readable Output

Evidence 53630ca0-e55a-4f6d-9451-d1c2c277530b has been deleted successfully.

tanium-tr-request-file-download

Requests a new file download.

Base Command

tanium-tr-request-file-download

Input

Argument Name	Description	Required
path	Path to file.	Required
connection_id	Connection id.	Required

Context Output

Path	Type	Description
Tanium.FileDownloadTask.compress	String	Is file compressed.
Tanium.FileDownloadTask.connection	String	The file download host.
Tanium.FileDownloadTask.taskId	Number	ID of the file download task.
Tanium.FileDownloadTask.paths	String	The file download paths.
Tanium.FileDownloadTask.startTime	Date	Download start time.
Tanium.FileDownloadTask.status	String	Status of the file download request.

Command Example

!tanium-tr-request-file-download connection_id=remote:hostname:123: path="C:\\Users\\Administrator\\Desktop\\testD.txt"

Context Example

{
    "Tanium": {
        "FileDownloadTask": {
            "compress": "true",
            "connection": "remote:hostname:123:",
            "paths": [
                "C:\\Users\\Administrator\\Desktop\\testD.txt"
            ],
            "startTime": "2021-10-07T12:23:06.824Z",
            "status": "STARTED",
            "taskId": 1178
        }
    }
}

Human Readable Output

Download request of file C:\Users\Administrator\Desktop\testD.txt has been sent successfully. Task id: 1178.

tanium-tr-delete-file-download

Deletes a file download.

Base Command

tanium-tr-delete-file-download

Input

Argument Name	Description	Required
file_id	File download ID.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-file-download file_id=0367c8b2-eed9-4124-b173-1c83cbf3ba6f

Human Readable Output

Delete request of file with ID 0367c8b2-eed9-4124-b173-1c83cbf3ba6f has been sent successfully.

tanium-tr-list-files-in-directory

Gets a list of files in the given directory.

Base Command

tanium-tr-list-files-in-directory

Input

Argument Name	Description	Required
path	Path to the directory.	Required
connection_id	Connection id.	Required
limit	The maximum number of files to return. Default is 50.	Optional
offset	Offset to start getting files. Default is 0.	Optional

Context Output

Path	Type	Description
Tanium.File.connectionId	String	Connection ID.
Tanium.File.createdDate	Date	Time the file was created.
Tanium.File.modifiedDate	Date	The date that the file was last modified.
Tanium.File.name	String	The file name.
Tanium.File.path	String	The file path.
Tanium.File.permissions	Number	The file permissions.
Tanium.File.size	Number	The file size.
Tanium.File.type	String	The file type.

Command Example

!tanium-tr-list-files-in-directory connection_id=remote:hostname:123: path=`C:\Users\Administrator\Desktop\` limit=2

Context Example

{
    "Tanium": {
        "File": [
            {
                "connectionId": "remote:hostname:123:",
                "createdDate": "2020-02-06T08:34:17.000Z",
                "modifiedDate": "2018-08-12T11:11:02.000Z",
                "name": "ChromeSetup.exe",
                "path": "C:\\Users\\Administrator\\Desktop\\",
                "permissions": 438,
                "size": 1130840,
                "type": "FILE"
            },
            {
                "connectionId": "remote:hostname:123:",
                "createdDate": "2020-01-07T11:53:20.000Z",
                "modifiedDate": "2020-01-07T11:53:46.000Z",
                "name": "test.txt",
                "path": "C:\\Users\\Administrator\\Desktop\\",
                "permissions": 438,
                "size": 11,
                "type": "FILE"
            }
        ]
    }
}

Human Readable Output

Files in directory C:\Users\Administrator\Desktop\

Name Path Connection Id Created Date Modified Date Permissions Size

ChromeSetup.exe C:\Users\Administrator\Desktop\ remote:hostname:123: 2020-02-06T08:34:17.000Z 2018-08-12T11:11:02.000Z 438 1130840

test.txt C:\Users\Administrator\Desktop\ remote:hostname:123: 2020-01-07T11:53:20.000Z 2020-01-07T11:53:46.000Z 438 11

tanium-tr-get-file-info

Gets information about a file from a remote connection.

Base Command

tanium-tr-get-file-info

Input

Argument Name	Description	Required
connection_id	The ID of the connection. Default is Connection id..	Required
path	The path to the file. Default is Path to file..	Required

Context Output

Path	Type	Description
Tanium.File.canonicalPath	String	The file path.
Tanium.File.cid	String	Cid.
Tanium.File.connectionId	String	Connection ID.
Tanium.File.createdDate	Date	Time the file was created.
Tanium.File.modifiedDate	Date	The date that the file was last modified.
Tanium.File.name	String	The file name.
Tanium.File.path	String	The file path.
Tanium.File.permissions	Number	The file permissions.
Tanium.File.size	Number	The file size.
Tanium.File.type	String	The file type.
Tanium.File.sessionId	String	Session ID.

Command Example

!tanium-tr-get-file-info connection_id=remote:hostname:123: path="C:\\log1.txt"

Context Example

{
    "Tanium": {
        "File": {
            "canonicalPath": "C:\\log1.txt",
            "cid": "d65ba018-346c-497e-8f18-252036fd87f9",
            "connectionId": "remote:hostname:123:",
            "createdDate": "2019-09-03T17:51:40.000Z",
            "modifiedDate": "2021-09-27T19:36:07.000Z",
            "name": "C:\\log1.txt",
            "path": "C:\\log1.txt",
            "permissions": 438,
            "sessionId": "1ce0f8e7-c180-4467-bf8e-0a313c4eb5f4",
            "size": 2913,
            "type": "FILE"
        }
    }
}

Human Readable Output

Information for file C:\log1.txt

Path Name Connection Id Type Created Date Modified Date

C:\log1.txt C:\log1.txt remote:hostname:123: FILE 2019-09-03T17:51:40.000Z 2021-09-27T19:36:07.000Z

tanium-tr-delete-file-from-endpoint

Deletes a file from the given endpoint.

Base Command

tanium-tr-delete-file-from-endpoint

Input

Argument Name	Description	Required
connection_id	Connection ID.	Required
path	Path to file.	Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-file-from-endpoint connection_id=remote:hostname:123: path=`C:\Users\Administrator\Desktop\to_delete.txt`

Human Readable Output

Delete request of file C:\Users\Administrator\Desktop\to_delete.txt from endpoint remote:hostname:123: has been sent successfully.

tanium-tr-intel-docs-labels-list

List all labels for the identified intel document.

Base Command

tanium-tr-intel-docs-labels-list

Input

Argument Name	Description	Required
intel_doc_id	List the label IDs for the intel document with this ID.	Required

Context Output

Path	Type	Description
Tanium.IntelDocLabel.IntelDocID	String	The requested intel doc ID.
Tanium.IntelDocLabel.LabelsList.ID	Number	The unique identifier for this label.
Tanium.IntelDocLabel.LabelsList.Name	String	The display name of the label.
Tanium.IntelDocLabel.LabelsList.Description	String	An extended description of the label.
Tanium.IntelDocLabel.LabelsList.IndicatorCount	Number	The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.IntelDocLabel.LabelsList.SignalCount	Number	The number of Tanium Signal documents associated with this label.
Tanium.IntelDocLabel.LabelsList.CreatedAt	Date	The date this label was created.
Tanium.IntelDocLabel.LabelsList.UpdatedAt	Date	The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-intel-docs-labels-list intel_doc_id=509

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                    "ID": 1,
                    "IndicatorCount": 0,
                    "Name": "Alpha",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Intel doc (509) labels

ID Name Description Indicator Count Signal Count Created At Updated At

1 Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z

11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z

16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-docs-add-label

Create a new label association for the identified intel document.

Base Command

tanium-tr-intel-docs-add-label

Input

Argument Name	Description	Required
intel_doc_id	Associate the new label with the intel document with this ID.	Required
label_id	The ID of the new label to associate with the target intel document. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs).	Required

Context Output

Path	Type	Description
Tanium.IntelDocLabel.IntelDocID	String	The requested intel doc ID.
Tanium.IntelDocLabel.LabelsList.ID	Number	The unique identifier for this label.
Tanium.IntelDocLabel.LabelsList.Name	String	The display name of the label.
Tanium.IntelDocLabel.LabelsList.Description	String	An extended description of the label.
Tanium.IntelDocLabel.LabelsList.IndicatorCount	Number	The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.IntelDocLabel.LabelsList.SignalCount	Number	The number of Tanium Signal documents associated with this label.
Tanium.IntelDocLabel.LabelsList.CreatedAt	Date	The date this label was created.
Tanium.IntelDocLabel.LabelsList.UpdatedAt	Date	The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-intel-docs-add-label intel_doc_id=509 label_id=1

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                    "ID": 1,
                    "IndicatorCount": 0,
                    "Name": "Alpha",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Successfully created a new label (1) association for the identified intel document (509)

ID Name Description Indicator Count Signal Count Created At Updated At

1 Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z

11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z

16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-docs-remove-label

Delete a label association for the identified intel document.

Base Command

tanium-tr-intel-docs-remove-label

Input

Argument Name	Description	Required
intel_doc_id	Remove the label from the intel document with this ID.	Required
label_id	The ID of the label to disassociate from the target intel document. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs).	Required

Context Output

Path	Type	Description
Tanium.IntelDocLabel.IntelDocID	String	Requested doc ID.
Tanium.IntelDocLabel.LabelsList.CreatedAt	Date	Date when label was created.
Tanium.IntelDocLabel.LabelsList.Description	String	Label description.
Tanium.IntelDocLabel.LabelsList.ID	Number	Label ID.
Tanium.IntelDocLabel.LabelsList.IndicatorCount	Number	Number of related indicators.
Tanium.IntelDocLabel.LabelsList.Name	String	Label name.
Tanium.IntelDocLabel.LabelsList.SignalCount	Number	Number of related signal counts.
Tanium.IntelDocLabel.LabelsList.UpdatedAt	Date	Date when label was last updated.

Command Example

!tanium-tr-intel-docs-remove-label intel_doc_id=509 label_id=1

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Successfully removed the label (1) association for the identified intel document (509)

ID Name Description Indicator Count Signal Count Created At Updated At

2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z

11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z

16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-doc-create

Add a new intel document to the system by providing its document contents.

Base Command

tanium-tr-intel-doc-create

Input

Argument Name	Description	Required
entry_id	The file entry ID.	Required
file_extension	The suffix at the end of a filename. (Available file types - yara, stix, ioc). Possible values are: ioc, yara, stix.	Required

Context Output

Path	Type	Description
Tanium.IntelDoc.AlertCount	Number	The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt	Date	The date at which this intel was first added to the system.
Tanium.IntelDoc.Description	String	The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID	Number	The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds	Number	The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name	String	The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount	Number	The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt	Date	The date when this intel was last updated.
Tanium.IntelDoc.revisionId	Number	The number of times the contents of the intel with this ID have been updated.
Tanium.IntelDoc.Type	String	The shortened type name of the intel. For example, “openioc”, “stix”, “yara”.
Tanium.IntelDoc.typeVersion	String	The version number of the intel type. For example, “1.0”, “2.3”, etc.
Tanium.IntelDoc.intrinsicId	String	The unique identifier claimed by the intel document, such as a guid or other built-in ID.
Tanium.IntelDoc.Md5	String	The hex digest of the MD5 sum of the contents of the document that represents this intel.
Tanium.IntelDoc.Size	String	The size of the intel document contents, in bytes.

Command Example

!tanium-tr-intel-doc-create entry_id=7173@e99f97d1-7225-4c75-896c-3c960febbe8c file_extension=yara

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "CreatedAt": "2021-07-18T10:27:41.742Z",
            "ID": 438,
            "IntrinsicId": "file.yara",
            "IsSchemaValid": true,
            "Md5": "2bfe1da12a94fa4be3e9bcf6f59d024a",
            "Name": "file.yara",
            "RevisionId": 22,
            "Size": 3271,
            "SourceId": 1,
            "Type": "yara",
            "TypeVersion": "3",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-10-07T12:23:35.947Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Alert Count Unresolved Alert Count Created At Updated At

438 file.yara yara 0 0 2021-07-18T10:27:41.742Z 2021-10-24T09:00:52.609Z

tanium-tr-intel-doc-update

Update the contents of an existing intel document by providing the document contents.

Base Command

tanium-tr-intel-doc-update

Input

Argument Name	Description	Required
intel_doc_id	The ID of the intel document to update.	Required
entry_id	The file entry ID.	Required
file_extension	The suffix at the end of a filename. (Available file types - yara, stix, ioc). Possible values are: ioc, yara, stix.	Optional

Context Output

Path	Type	Description
Tanium.IntelDoc.AlertCount	Number	The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt	Date	The date at which this intel was first added to the system.
Tanium.IntelDoc.Description	String	The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID	Number	The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds	Number	The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name	String	The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount	Number	The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt	Date	The date when this intel was last updated.
Tanium.IntelDoc.revisionId	Number	The number of times the contents of the intel with this ID have been updated.
Tanium.IntelDoc.Type	String	The shortened type name of the intel. For example, “openioc”, “stix”, “yara”.
Tanium.IntelDoc.typeVersion	String	The version number of the intel type. For example, “1.0”, “2.3”, etc.
Tanium.IntelDoc.intrinsicId	String	The unique identifier claimed by the intel document, such as a guid or other built-in ID.
Tanium.IntelDoc.Md5	String	The hex digest of the MD5 sum of the contents of the document that represents this intel.
Tanium.IntelDoc.Size	String	The size of the intel document contents, in bytes.

Command Example

!tanium-tr-intel-doc-update entry_id=7173@e99f97d1-7225-4c75-896c-3c960febbe8c intel_doc_id=438 file_extension=yara

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "CreatedAt": "2021-07-18T10:27:41.742Z",
            "ID": 438,
            "IntrinsicId": "file.yara",
            "IsSchemaValid": true,
            "Md5": "2bfe1da12a94fa4be3e9bcf6f59d024a",
            "Name": "file.yara",
            "RevisionId": 23,
            "Size": 3271,
            "SourceId": 1,
            "Type": "yara",
            "TypeVersion": "3",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-10-07T12:23:39.573Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Alert Count Unresolved Alert Count Created At Updated At

438 file.yara yara 0 0 2021-07-18T10:27:41.742Z 2021-10-07T12:23:39.573Z

tanium-tr-intel-doc-delete

Remove an intel document from the system by providing its ID

Base Command

tanium-tr-intel-doc-delete

Input

Argument Name	Description	Required
intel_doc_id	The file entry ID.	Required

Context Output

None

Command Example

!tanium-tr-intel-doc-delete intel_doc_id=509

Context Example

None

Human Readable Output

Intel Doc deleted

tanium-tr-start-quick-scan

Scan a computer group for hashes in intel document. Computer groups
can be viewed by navigating to Administration -> Computer Groups in the Threat-Response
product console. Computer group names and IDs can also be retrieved by using
the tn-list-groups command in the Tanium integration.

Base Command

tanium-tr-start-quick-scan

Input

Argument Name	Description	Required
intel_doc_id	The intel document ID.	Required
computer_group_name	The name of a Tanium computer group. See command description for possible ways to retrieve this value.	Required

Context Output

Path	Type	Description
Tanium.QuickScan.IntelDocId	Number	The unique identifier for this intel in this instance of the system.
Tanium.QuickScan.ComputerGroupId	Number	The ID of a Tanium computer group.
Tanium.QuickScan.ID	Number	The ID of the quick scan.
Tanium.QuickScan.AlertCount	Number	The number of alerts returned from the quick scan.
Tanium.QuickScan.CreatedAt	Date	The date the quick scan was created.
Tanium.QuickScan.UserId	Number	The user ID which initiated the quick scan.
Tanium.QuickScan.QuestionId	Number	The ID of the quick scan question.

Command Example

!tanium-tr-start-quick-scan intel_doc_id=509 computer_group_name="All Computers"

Context Example

{
    "Tanium": {
        "QuickScan": {
            "AlertCount": 0,
            "ComputerGroupId": 1,
            "CreatedAt": "2022-01-05T19:53:43.049Z",
            "ID": 1000239,
            "IntelDocId": 509,
            "QuestionId": 2025697,
            "UserId": 64
        }
    }
}

Human Readable Output

Quick Scan started

AlertCount ComputerGroupId CreatedAt ID IntelDocId QuestionId UserId

0 1 2022-01-05T19:53:43.049Z 1000239 509 2025697 64

tanium-tr-intel-deploy

Deploys intel using the service account context.

Base Command

tanium-tr-intel-deploy

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

>Successfully deployed intel.

### tanium-tr-intel-deploy-status

***
Displays status of last intel deployment.

#### Base Command

`tanium-tr-intel-deploy-status`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Tanium.IntelDeployStatus.CreatedAt | Date | The creation date of the last intel deployment. |
| Tanium.IntelDeployStatus.ModifiedAt | Date | The modification date of the last intel deployment. |
| Tanium.IntelDeployStatus.CurrentRevision | Number | Revision number, incremented each time the intel is modified |
| Tanium.IntelDeployStatus.CurrentSize | Number | The size of the intel document contents, in bytes. |

#### Command Example

```!tanium-tr-intel-deploy-status```

#### Context Example

```json
{
    "Tanium": {
        "IntelDeployStatus": {
            "CreatedAt": "2021-05-02T19:18:00.685Z",
            "CurrentRevision": 855,
            "CurrentSize": 1187840,
            "ModifiedAt": "2021-10-06T15:07:43.248Z"
        }
    }
}

Human Readable Output

Intel deploy status

Created At Modified At Current Revision Current Size

2021-05-02T19:18:00.685Z 2021-10-06T15:07:43.248Z 855 1187840

tanium-tr-get-task-by-id

Get task by ID.

Base Command

tanium-tr-get-task-by-id

Input

Argument Name	Description	Required
task_id	The task ID.	Required

Context Output

Path	Type	Description
Tanium.Task.createdAt	Date	The date at which this task was first added to the system.
Tanium.Task.id	Number	The unique identifier for this task in this instance of the system.
Tanium.Task.updatedAt	Date	The date when this task was last updated.
Tanium.Task.startTime	Date	The date when this task started.
Tanium.Task.endTime	Date	The date when this task ended.
Tanium.Task.error	String	Task errors.
Tanium.Task.status	String	Task status.
Tanium.Task.type	String	Task type.
Tanium.Task.metadata	Unknown	Task metadata.
Tanium.Task.results	Unknown	Task results.

Command Example

!tanium-tr-get-task-by-id task_id=833

Context Example

{
    "Tanium": {
        "Task": {
            "createdAt": "2021-09-05T13:46:16.603Z",
            "endTime": "2021-09-05T13:46:16.900Z",
            "id": 833,
            "metadata": {
                "compress": "true",
                "connection": "remote:hostname:123:",
                "paths": [
                    "C:\\test.exe"
                ]
            },
            "results": {
                "completed": [
                    "C:\\test.exe"
                ],
                "failed": [],
                "fileResults": [
                    {
                        "finalPath": "C:\\04828d87-a384-4a8b-a874-2438bf8b16ab.zip",
                        "response": {
                            "avgBytesPerSecond": 0,
                            "source": "C:\\test.exe",
                            "target": "C:\\temp\\36e80439-8866-4ada-9229-fb1e08f1a3f9",
                            "totalBytes": 55808,
                            "totalTimeMs": 205,
                            "transferHash": "a84417ee9d039891af43b267896db921a40838d8a17cc1be29785d031e5944d4"
                        }
                    }
                ]
            },
            "startTime": "2021-09-05T13:46:16.606Z",
            "status": "COMPLETED",
            "type": "fileDownload",
            "updatedAt": "2021-09-05T13:46:16.603Z"
        }
    }
}

Human Readable Output

Task information

Id Status

833 COMPLETED

tanium-tr-get-system-status

Get system status, to retrieve all possible connection’s client ids, hostnames, ips.

Base Command

tanium-tr-get-system-status

Input

Argument Name	Description	Required
limit	The maximum number of entries to return. Default is 50.	Optional
offset	The offset number to begin listing entries. Default is 0.	Optional
status	Comma-seperated list of statuses to get the system-status that match only those statuses, for example status=Blocked,Leader.	Optional
ip_server	Comma-seperated list of ip servers to get the system-status that match only those ip servers, for example ip_server=1.1.1.1,2.2.2.2.	Optional
ip_client	Comma-seperated list of ip clients to get the system-status that match only those ip clients, for example ip_client=1.1.1.1,2.2.2.2.	Optional
hostname	Comma-seperated list of hostnames to get the system-status that match only those hostnames, for example hostname=host1,host2.	Optional
port	port to get the system-status that match only this port, for example port=80.	Optional

Context Output

Path	Type	Description
Tanium.SystemStatus.clientId	Number	Client id to use when creating new connection.
Tanium.SystemStatus.computerId	Number	Computer ID.
Tanium.SystemStatus.hostName	String	Hostname to connect.
Tanium.SystemStatus.ipaddressClient	String	Client IP address.
Tanium.SystemStatus.ipaddressServer	String	Server IP address.
Tanium.SystemStatus.lastRegistration	Date	Host last registration time.
Tanium.SystemStatus.portNumber	Number	Connection port number.
Tanium.SystemStatus.protocolVersion	Number	Connection protocol version.
Tanium.SystemStatus.publicKeyValid	Boolean	Is public key valid.
Tanium.SystemStatus.status	String	Host status.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "SystemStatus": [
            {
                "clientId": 11111,
                "computerId": 11111,
                "fullVersion": "7.2.314.3476",
                "hostName": "tanium",
                "ipaddressClient": "1.1.1.1",
                "ipaddressServer": "1.1.1.1",
                "lastRegistration": "2021-10-07T12:23:13Z",
                "portNumber": 17472,
                "protocolVersion": 314,
                "publicKeyValid": true,
                "receiveState": "None",
                "registeredWithTls": false,
                "sendState": "None",
                "status": "Leader"
            },
            {
                "clientId": 22222,
                "computerId": 22222,
                "fullVersion": "7.4.5.1204",
                "hostName": "hostname1",
                "ipaddressClient": "1.2.3.4",
                "ipaddressServer": "1.2.3.4",
                "lastRegistration": "2021-10-07T12:23:12Z",
                "portNumber": 17472,
                "protocolVersion": 315,
                "publicKeyValid": true,
                "receiveState": "None",
                "registeredWithTls": true,
                "sendState": "None",
                "status": "Leader"
            }
        ]
    }
}

Human Readable Output

Reporting clients

Host Name Client Id Ipaddress Client Ipaddress Server Port Number

taniumlinux 11111 1.1.1.1 1.1.1.1 17472

hostname1 222222 1.2.3.4 1.2.3.4 17472

tanium-tr-get-response-actions

Returns the Response Actions matching the specified filters

Base Command

tanium-tr-get-response-actions

Input

Argument Name	Description	Required
offset	Offset to start getting response actions (default is ‘0’).	Optional
limit	Max number of response actions to return (default is ‘50’).	Optional
sort_order	Specify whether to sort by column in ascending or descending order (default is ‘desc’). Possible values are: asc, desc. Default is desc.	Optional
partial_computer_name	Filter on a partial computer name.	Optional
status	Filter on status.	Optional
type	Filter on type.	Optional

Context Output

Path	Type	Description
Tanium.ResponseActions.id	String
Tanium.ResponseActions.type	String
Tanium.ResponseActions.status	String
Tanium.ResponseActions.computerName	String
Tanium.ResponseActions.userId	String
Tanium.ResponseActions.userName	String
Tanium.ResponseActions.results.taskIds	String
Tanium.ResponseActions.results.actionIds	String
Tanium.ResponseActions.results.snapshotName	String
Tanium.ResponseActions.results.uuid	String
Tanium.ResponseActions.expirationTime	Date
Tanium.ResponseActions.createdAt	Date
Tanium.ResponseActions.updatedAt	Date
Tanium.ResponseActions.eid	String

tanium-tr-response-action-gather-snapshot

Creates a “gatherSnapshot” Response Action for the specified host

Base Command

tanium-tr-response-action-gather-snapshot

Input

Argument Name	Description	Required
computer_name	Target computer name.	Required
expiration_time	Time unit to specify how long a snapshot should persist (i.e. “7 days”, “1 month”. Default is “7 days”).	Optional

Context Output

Path	Type	Description
Tanium.ResponseActions.type	String
Tanium.ResponseActions.computerName	String
Tanium.ResponseActions.options	String
Tanium.ResponseActions.status	String
Tanium.ResponseActions.userId	String
Tanium.ResponseActions.userName	String
Tanium.ResponseActions.results	String
Tanium.ResponseActions.expirationTime	Date
Tanium.ResponseActions.createdAt	Date
Tanium.ResponseActions.updatedAt	Date
Tanium.ResponseActions.id	String
Tanium.ResponseActions.eid	String

Breaking changes from the previous version of this integration - Tanium Threat Response v2

The following sections list the changes in this version.

Commands

The following commands were removed in this version

tanium-tr-list-snapshots-by-connection
tanium-tr-list-local-snapshots-by-connection
tanium-tr-get-connection-by-name
tanium-tr-get-parent-process-tree
tanium-tr-list-evidence
tanium-tr-get-process-timeline
tanium-tr-get-download-file-request-status - this command was replaced by tanium-tr-get-task-by-id.

Arguments

The following arguments were removed in this version

In the tanium-tr-get-intel-doc-by-id command:

intel-doc-id - this argument was replaced by intel_doc_id.

In the tanium-tr-list-alerts command:

computer-ip-address - this argument was replaced by computer_ip_address.
computer-name - this argument was replaced by computer_name.
scan-config-id - this argument was replaced by scan_config_id.
intel-doc-id - this argument was replaced by intel_doc_id.

In the tanium-tr-get-alert-by-id command:

alert-id - this argument was replaced by alert_id.

In the tanium-tr-alert-update-state command:

alert-id - this argument was replaced by alert_ids.

In the tanium-tr-create-snapshot command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-snapshot command:

connection-name - this argument was replaced by connection_id.
snapshot-id - this argument was replaced by snapshot_ids.

In the tanium-tr-delete-local-snapshot command:

connection-name - this argument was replaced by connection_id.
file-name - this argument was removed.

In the tanium-tr-create-connection command:

remote - this argument was removed.
destination-type - this argument was removed.
destination - this argument was removed.
connection-timeout - this argument was removed.
This command receiving new arguments: client_id, ip, platform, hostname.

In the tanium-tr-delete-connection command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-label-by-id command:

label-id - this argument was replaced by label_id.

In the tanium-tr-list-file-downloads command:

host - this argument was removed.

In the tanium-tr-get-downloaded-file command:

file-id - this argument was replaced by file_id.

In the tanium-tr-list-events-by-connection command:

connection-name - this argument was replaced by connection_id.
event-type - this argument was replaced by type.

In the tanium-tr-get-file-download-info command:

host - this argument was removed.
path - this argument was removed.
id - this argument was replaced by file_id.

In the tanium-tr-get-process-info command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-events-by-process command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-process-children command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-parent-process command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-process-tree command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-evidence-by-id command:

evidence-id - this argument was replaced by evidence_id.

In the tanium-tr-create-evidence command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-evidence command:

evidence-id - this argument was replaced by evidence_ids.

In the tanium-tr-request-file-download command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-file-download command:

file-id - this argument was replaced by file_id.

In the tanium-tr-list-files-in-directory command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-file-info command:

connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-file-from-endpoint command:

connection-name - this argument was replaced by connection_id.

The behavior of the following arguments was changed

In the tanium-tr-list-intel-docs command:

limit - The default value changed to ‘50’.

Outputs

The following outputs were removed in this version

In the tanium-tr-list-connections command:

Tanium.Connection.CreateTime - this output was removed.
Tanium.Connection.Name - this output was replaced by Tanium.Connection.hostname.
Tanium.Connection.Remote - this output was removed.
Tanium.Connection.State - this output was replaced by Tanium.Connection.status.
Tanium.Connection.Deleted - this output was removed.
Tanium.Connection.DestionationType - this output was removed.
Tanium.Connection.DST - this output was removed.
Tanium.Connection.OSName - this output was replaced by Tanium.Connection.platform.

In the tanium-tr-list-labels command:

Tanium.Label.CreatedAt - this output was replaced by Tanium.Label.createdAt.
Tanium.Label.Description - this output was replaced by Tanium.Label.description.
Tanium.Label.ID - this output was replaced by Tanium.Label.id.
Tanium.Label.IndicatorCount - this output was replaced by Tanium.Label.indicatorCount.
Tanium.Label.Name - this output was replaced by Tanium.Label.name.
Tanium.Label.SignalCount - this output was replaced by Tanium.Label.signalCount.
Tanium.Label.UpdatedAt - this output was replaced by Tanium.Label.updatedAt.

In the tanium-tr-get-label-by-id command:

Tanium.Label.CreatedAt - this output was replaced by Tanium.Label.createdAt.
Tanium.Label.Description - this output was replaced by Tanium.Label.description.
Tanium.Label.ID - this output was replaced by Tanium.Label.id.
Tanium.Label.IndicatorCount - this output was replaced by Tanium.Label.indicatorCount.
Tanium.Label.Name - this output was replaced by Tanium.Label.name.
Tanium.Label.SignalCount - this output was replaced by Tanium.Label.signalCount.
Tanium.Label.UpdatedAt - this output was replaced by Tanium.Label.updatedAt.

In the tanium-tr-list-file-downloads command:

Tanium.FileDownload.Size - this output was replaced by Tanium.FileDownload.size.
Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownload.path.
Tanium.FileDownload.Downloaded - this output was replaced by Tanium.FileDownload.downloaded.
Tanium.FileDownload.Host - this output was replaced by Tanium.FileDownload.hostname.
Tanium.FileDownload.Created - this output was replaced by Tanium.FileDownload.processCreationTime.
Tanium.FileDownload.Hash - this output was replaced by Tanium.FileDownload.hash.
Tanium.FileDownload.SPath - this output was removed.
Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownload.uuid.
Tanium.FileDownload.LastModified - this output was replaced by Tanium.FileDownload.lastModified.
Tanium.FileDownload.CreatedBy - this output was replaced by Tanium.FileDownload.createdBy.
Tanium.FileDownload.CreatedByProc - this output was replaced by Tanium.FileDownload.createdByProc.
Tanium.FileDownload.LastModifiedBy - this output was replaced by Tanium.FileDownload.lastModifiedBy.
Tanium.FileDownload.LastModifiedByProc - this output was replaced by Tanium.FileDownload.lastModifiedByProc.
Tanium.FileDownload.Comments - this output was removed.
Tanium.FileDownload.Tags - this output was removed.
Tanium.FileDownload.Deleted - this output was removed.

In the tanium-tr-list-events-by-connection command:

TaniumEvent.Domain - this output was removed.
TaniumEvent.File - this output was replaced by TaniumEvent.file.
TaniumEvent.Operation - this output was replaced by TaniumEvent.operation.
TaniumEvent.ProcessID - this output was replaced by TaniumEvent.pid.
TaniumEvent.ProcessName - this output was removed.
TaniumEvent.ProcessTableID - this output was replaced by TaniumEvent.processTableId.
TaniumEvent.Timestamp - this output was removed.
TaniumEvent.Username - this output was replaced by TaniumEvent.userName.
TaniumEvent.DestinationAddress - this output was replaced by TaniumEvent.remoteAddress.
TaniumEvent.DestinationPort - this output was replaced by TaniumEvent.remoteAddressPort.
TaniumEvent.SourceAddress - this output was replaced by TaniumEvent.localAddress.
TaniumEvent.SourcePort - this output was replaced by TaniumEvent.localAddressPort.
TaniumEvent.KeyPath - this output was replaced by TaniumEvent.keyPath.
TaniumEvent.ValueName - this output was replaced by TaniumEvent.valueName.
TaniumEvent.ExitCode - this output was replaced by TaniumEvent.exitCode.
TaniumEvent.ProcessCommandLine - this output was replaced by TaniumEvent.processCommandLine.
TaniumEvent.ProcessHash - this output was removed.
TaniumEvent.SID - this output was removed.
TaniumEvent.Hashes - this output was replaced by TaniumEvent.hashes.
TaniumEvent.ImageLoaded - this output was replaced by TaniumEvent.imageLoaded.
TaniumEvent.Signature - this output was replaced by TaniumEvent.signature.
TaniumEvent.Signed - this output was replaced by TaniumEvent.signed.
TaniumEvent.EventID - this output was replaced by TaniumEvent.eventId.
TaniumEvent.EventOpcode - this output was replaced by TaniumEvent.eventOpcode.
TaniumEvent.EventRecordID - this output was replaced by TaniumEvent.eventRecordId.
TaniumEvent.EventTaskID - this output was replaced by TaniumEvent.eventTaskId.
TaniumEvent.Query - this output was replaced by TaniumEvent.query.
TaniumEvent.Response - this output was replaced by TaniumEvent.response.
TaniumEvent.ImagePath - this output was replaced by TaniumEvent.imagePath.
TaniumEvent.CreationTime - this output was replaced by TaniumEvent.createTime.
TaniumEvent.EndTime - this output was replaced by TaniumEvent.endTime.
TaniumEvent.EventTaskName - this output was replaced by TaniumEvent.eventTaskName.
TaniumEvent.Property.Name - this output was removed.
TaniumEvent.Property.Value - this output was removed.

In the tanium-tr-get-file-download-info command:

Tanium.FileDownload.Size - this output was replaced by Tanium.FileDownload.size.
Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownload.path.
Tanium.FileDownload.Downloaded - this output was replaced by Tanium.FileDownload.downloaded.
Tanium.FileDownload.Host - this output was replaced by Tanium.FileDownload.hostname.
Tanium.FileDownload.Created - this output was replaced by Tanium.FileDownload.processCreationTime.
Tanium.FileDownload.Hash - this output was replaced by Tanium.FileDownload.hash.
Tanium.FileDownload.SPath - this output was removed.
Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownload.uuid.
Tanium.FileDownload.LastModified - this output was replaced by Tanium.FileDownload.lastModified.
Tanium.FileDownload.CreatedBy - this output was replaced by Tanium.FileDownload.createdBy.
Tanium.FileDownload.CreatedByProc - this output was replaced by Tanium.FileDownload.createdByProc.
Tanium.FileDownload.LastModifiedBy - this output was replaced by Tanium.FileDownload.lastModifiedBy.
Tanium.FileDownload.LastModifiedByProc - this output was replaced by Tanium.FileDownload.lastModifiedByProc.
Tanium.FileDownload.Comments - this output was removed.
Tanium.FileDownload.Tags - this output was removed.
Tanium.FileDownload.Deleted - this output was removed.

In the tanium-tr-get-process-info command:

Tanium.Process.CreateTime - this output was replaced by Tanium.ProcessInfo.createTime.
Tanium.Process.Domain - this output was removed.
Tanium.Process.ExitCode - this output was replaced by Tanium.ProcessInfo.exitCode.
Tanium.Process.ProcessCommandLine - this output was removed.
Tanium.Process.ProcessID - this output was replaced by Tanium.ProcessInfo.pid.
Tanium.Process.ProcessName - this output was removed.
Tanium.Process.ProcessTableId - this output was replaced by Tanium.ProcessInfo.processTableId.
Tanium.Process.SID - this output was removed
Tanium.Process.Username - this output was replaced by Tanium.ProcessInfo.userName.

In the tanium-tr-get-events-by-process command:

Tanium.ProcessEvent.ID - this output was replaced by Tanium.ProcessEvent.id.
Tanium.ProcessEvent.Detail - this output was replaced by Tanium.ProcessEvent.detail.
Tanium.ProcessEvent.Operation - this output was replaced by Tanium.ProcessEvent.operation.
Tanium.ProcessEvent.Timestamp - this output was replaced by Tanium.ProcessEvent.timestamp.
Tanium.ProcessEvent.Type - this output was replaced by Tanium.ProcessEvent.type.

In the tanium-tr-get-process-children command:

Tanium.ProcessChildren.ID - this output was replaced by Tanium.ProcessChildren.id.
Tanium.ProcessChildren.Name - this output was removed.
Tanium.ProcessChildren.PID - this output was replaced by Tanium.ProcessChildren.pid.
Tanium.ProcessChildren.PTID - this output was replaced by Tanium.ProcessChildren.parentProcessTableId.
Tanium.ProcessChildren.Parent - this output was removed.

In the tanium-tr-get-parent-process command:

Tanium.Process.CreateTime - this output was replaced by Tanium.ProcessParent.createTime.
Tanium.Process.Domain - this output was removed.
Tanium.Process.ExitCode - this output was replaced by Tanium.ProcessParent.exitCode.
Tanium.Process.ProcessCommandLine - this output was removed.
Tanium.Process.ProcessID - this output was replaced by Tanium.ProcessParent.pid.
Tanium.Process.ProcessName - this output was removed.
Tanium.Process.ProcessTableId - this output was replaced by Tanium.ProcessParent.processTableId.
Tanium.Process.SID - this output was removed.
Tanium.Process.Username - this output was replaced by Tanium.ProcessParent.userName.

In the tanium-tr-get-process-tree command:

Tanium.ProcessTree.ID - this output was replaced by Tanium.ProcessTree.id.
Tanium.ProcessTree.Name - this output was removed.
Tanium.ProcessTree.PID - this output was replaced by Tanium.ProcessTree.pid.
Tanium.ProcessTree.PTID - this output was replaced by Tanium.ProcessTree.parentProcessTableId.
Tanium.ProcessTree.Parent - this output was removed.
Tanium.ProcessTree.Children - this output was replaced by Tanium.ProcessTree.childrenCount.

In the tanium-tr-get-evidence-by-id command:

Tanium.Evidence.ID - this output was replaced by Tanium.Evidence.uuid.
Tanium.Evidence.CreatedAt - this output was replaced by Tanium.Evidence.createTime.
Tanium.Evidence.LastModified - this output was removed.
Tanium.Evidence.User - this output was replaced by Tanium.Evidence.username.
Tanium.Evidence.ConnectionName - this output was replaced by Tanium.Evidence.hostname.
Tanium.Evidence.Type - this output was replaced by Tanium.Evidence.type.
Tanium.Evidence.ProcessTableId - this output was removed.
Tanium.Evidence.Timestamp - this output was replaced by Tanium.Evidence.timestamp.
Tanium.Evidence.Summary - this output was replaced by Tanium.Evidence.summary.
Tanium.Evidence.Comments - this output was removed.
Tanium.Evidence.Tags - this output was removed.
Tanium.Evidence.Deleted - this output was removed.

In the tanium-tr-request-file-download command:

Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownloadTask.paths.
Tanium.FileDownload.ConnectionName - this output was replaced by Tanium.FileDownloadTask.connection.
Tanium.FileDownload.Downloaded - this output was removed.
Tanium.FileDownload.Status - this output was replaced by Tanium.FileDownloadTask.status.
Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownloadTask.taskId.

In the tanium-tr-list-files-in-directory command:

Tanium.File.Created - this output was replaced by Tanium.File.createdDate.
Tanium.File.Size - this output was replaced by Tanium.File.size.
Tanium.File.IsDirectory - this output was replaced by Tanium.File.type.
Tanium.File.LastModified - this output was replaced by Tanium.File.modifiedDate.
Tanium.File.Path - this output was replaced by Tanium.File.path.
Tanium.File.Permissions - this output was replaced by Tanium.File.permissions.
Tanium.File.ConnectionName - this output was replaced by Tanium.File.connectionId.
Tanium.File.Deleted - this output was removed.

In the tanium-tr-get-file-info command:

Tanium.File.Created - this output was replaced by Tanium.File.createdDate.
Tanium.File.Size - this output was replaced by Tanium.File.size.
Tanium.File.IsDirectory - this output was replaced by Tanium.File.type.
Tanium.File.LastModified - this output was replaced by Tanium.File.modifiedDate.
Tanium.File.Path - this output was replaced by Tanium.File.path.
Tanium.File.ConnectionName - this output was replaced by Tanium.File.connectionId.
Tanium.File.Deleted - this output was removed.

Configuration parameters

url — Hostname, IP address, or server URL (required)
credentials — Username
isFetch — Fetch incidents
incidentType — Incident type
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — Maximum number of incidents to fetch each time
filter_alerts_by_state — Alert states to filter by in fetch incidents command. Empty list won't filter the incidents by state.
filter_by_label_name — Label name to filter by in fetch incidents command. Leave empty to not filter the incidents by label name.
api_version — API Version
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentFetchInterval — Incidents Fetch Interval

Commands (47)

tanium-tr-alert-update-state
Updates the state of the specified alerts.
tanium-tr-close-connection
Closes a connection by connection ID.
tanium-tr-create-connection
Creates a local or remote connection.
tanium-tr-create-evidence
Creates event evidence from process.
tanium-tr-create-snapshot
Captures a new snapshot by connection ID.
tanium-tr-delete-connection
Deletes a connection by connection ID.
tanium-tr-delete-evidence
Deletes event evidences from Tanium.
tanium-tr-delete-file-download
Deletes a file download.
tanium-tr-delete-file-from-endpoint
Deletes a file from the given endpoint.
tanium-tr-delete-local-snapshot
Deletes a local snapshot by connection ID.
tanium-tr-delete-snapshot
Deletes a snapshot by connection name and snapshot ID.
tanium-tr-event-evidence-get-properties
Returns event evidence properties for IOC generation.
tanium-tr-event-evidence-list
Returns a list of all available event evidences in the system.
tanium-tr-get-alert-by-id
Returns an alert object based on alert ID.
tanium-tr-get-downloaded-file
Gets the actual content of a downloaded file by file ID. Downloaded file password: `infected`.
tanium-tr-get-events-by-process
Gets the events for a process.
tanium-tr-get-evidence-by-id
Gets event evidence by evidence ID.
tanium-tr-get-file-download-info
Gets the metadata of a file download.
tanium-tr-get-file-info
Gets information about a file from a remote connection.
tanium-tr-get-intel-doc-by-id
Returns an intel document object based on ID.
tanium-tr-get-label-by-id
Returns a label object based on label ID.
tanium-tr-get-parent-process
Gets information for the parent process.
tanium-tr-get-process-children
Gets the children of this process instance.
tanium-tr-get-process-info
Get information for a process.
tanium-tr-get-process-tree
Gets the process tree for the process instance.
tanium-tr-get-response-actions
Returns the Response Actions matching the specified filters.
tanium-tr-get-system-status
Gets system status, including connections, client IDs, hostnames, and IPs.
tanium-tr-get-task-by-id
Get task by ID.
tanium-tr-intel-deploy
Deploys intel using the service account context.
tanium-tr-intel-deploy-status
Displays status of last intel deployment.
tanium-tr-intel-doc-create
Add a new intel document to the system by providing its document contents.
tanium-tr-intel-doc-delete
Remove an intel document from the system by providing its ID.
tanium-tr-intel-doc-update
Update the contents of an existing intel document by providing the document contents.
tanium-tr-intel-docs-add-label
Create a new label association for the identified intel document.
tanium-tr-intel-docs-labels-list
List all labels for the identified intel document.
tanium-tr-intel-docs-remove-label
Delete a label association for the identified intel document.
tanium-tr-list-alerts
Returns a comma-separated list of all alerts.
tanium-tr-list-connections
Returns a list of all connections.
tanium-tr-list-events-by-connection
Queries events for a connection.
tanium-tr-list-file-downloads
Returns all downloaded files in the system.
tanium-tr-list-files-in-directory
Gets a list of files in the given directory.
tanium-tr-list-intel-docs
Returns a comma-separated list of all intel documents.
tanium-tr-list-labels
Returns all available labels in the system.
tanium-tr-list-snapshots
Returns all local snapshots of a single connection.
tanium-tr-request-file-download
Requests a new file download.
tanium-tr-response-action-gather-snapshot
Creates a "gatherSnapshot" Response Action for the specified host.
tanium-tr-start-quick-scan
Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.

Source

TaniumThreatResponseV2.py TaniumThreatResponseV2_test.py TaniumThreatResponseV2.yml TaniumThreatResponseV2_description.md command_examples.txt

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401
import ast
import copy
import json
import os
import traceback
import urllib.parse
from typing import Any
from datetime import datetime

import urllib3
from dateutil.parser import parse
from lxml import etree

""" IMPORTS """

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

""" GLOBALS/PARAMS """
DATE_FORMAT = "%Y-%m-%dT%H:%M:%S.%fZ"

PROCESS_TEXT = "Process information for process with PTID"
PARENT_PROCESS_TEXT = "Parent process for process with PTID"
PROCESS_CHILDREN_TEXT = "Children for process with PTID"

# The commands below won't work unless the connection passed in `connection_name` argument is active.
COMMANDS_DEPEND_ON_CONNECTIVITY = [
    "tanium-tr-create-snapshot",
    "tanium-tr-list-events-by-connection",
    "tanium-tr-get-process-info",
    "tanium-tr-get-events-by-process",
    "tanium-tr-get-process-children",
    "tanium-tr-get-parent-process",
    "tanium-tr-get-process-tree",
    "tanium-tr-create-evidence",
    "tanium-tr-request-file-download",
    "tanium-tr-list-files-in-directory",
    "tanium-tr-get-file-info",
    "tanium-tr-delete-file-from-endpoint",
]
DEPENDENT_COMMANDS_ERROR_MSG = "\nPlease verify that the connection you have specified is active."


class Client(BaseClient):
    def __init__(self, base_url, username, password, api_version, api_token=None, **kwargs):  # pragma: no cover
        self.username = username
        self.password = password
        self.session = ""
        self.api_token = api_token
        self.api_version = api_version
        super().__init__(base_url, **kwargs)

    def do_request(
        self,
        method: str,
        url_suffix: str,
        data: dict = None,
        params: dict = None,
        resp_type: str = "json",
        headers: dict = None,
        body: Any = None,
    ):  # pragma: no cover
        if headers is None:
            headers = {}
        if not self.session:
            self.update_session()
        headers["session"] = self.session
        res = self._http_request(
            method,
            url_suffix,
            headers=headers,
            json_data=data,
            data=body,
            params=params,
            resp_type="response",
            ok_codes=(200, 201, 202, 204, 400, 401, 403, 404),
        )

        if res.status_code == 401:
            if self.api_token:
                err_msg = (
                    "Unauthorized Error: please verify that the given API token is valid and that the IP of the "
                    "client is listed in the api_token_trusted_ip_address_list global setting.\n"
                )
            else:
                err_msg = ""
            try:
                err_msg += str(res.json())
            except ValueError:
                err_msg += str(res)
            return_error(err_msg)

        # if session expired
        if res.status_code == 403:
            self.update_session()
            res = self._http_request(
                method, url_suffix, headers=headers, json_data=data, data=body, params=params, ok_codes=(200, 400, 404)
            )
            return res

        if res.status_code == 404 or res.status_code == 400:
            if res.content:
                raise requests.HTTPError(str(res.content))
            if res.reason:
                raise requests.HTTPError(str(res.reason))
            raise requests.HTTPError(res.json().get("text"))

        if resp_type == "json":
            try:
                return res.json()
            except json.JSONDecodeError:
                return res.content
        if resp_type == "text":
            return res.text, res.headers.get("Content-Disposition")
        if resp_type == "content":
            return res.content, res.headers.get("Content-Disposition")

        return res

    def update_session(self):  # pragma: no cover
        if self.api_token:
            res = self._http_request("GET", "api/v2/session/current", headers={"session": self.api_token}, ok_codes=(200,))
            if res.get("data"):
                self.session = self.api_token
        elif self.username and self.password:
            body = {"username": self.username, "password": self.password}

            res = self._http_request("POST", "/api/v2/session/login", json_data=body, ok_codes=(200,))

            self.session = res.get("data").get("session")
        else:  # no API token and no credentials were provided, raise an error:
            return_error("Please provide either an API Token or Username & Password.")
        return self.session

    def login(self):
        return self.update_session()

    def get_threat_response_endpoint(self):
        return "threat-response" if self.api_version == "4.x" else "detect3"


""" GENERAL HELPER FUNCTIONS """


def format_context_data(context_to_format: Union[list, dict]) -> Union[list, dict]:
    """Format a context dictionary to the standard demisto format.
    :type context_to_format: ``dict``
    :param context_to_format:
        The object to convert.

    :return: the formatted dictionary
    :rtype: ``dict``
    """

    def format_context_dict(context_dict: dict) -> dict:
        # The API result keys are in camelCase and the context is expecting PascalCase
        formatted_context = camelize(snakify(context_dict), "_")
        cur_id = formatted_context.get("Id")
        if cur_id:
            formatted_context["ID"] = cur_id
            del formatted_context["Id"]
        return formatted_context

    if isinstance(context_to_format, list):
        return [format_context_dict(item) for item in context_to_format]
    else:
        return format_context_dict(context_to_format)


def convert_to_int(int_to_parse: Any) -> Optional[int]:
    """Tries to convert an object to int.

    :type int_to_parse: ``Any``
    :param int_to_parse:
        The object to convert.

    :return: the converted number or None if the number cannot be converted
    :rtype: ``int`` or ``None``

    """
    try:
        res: Optional[int] = int(int_to_parse)
    except (TypeError, ValueError):
        res = None
    return res


def are_filters_match_response_content(all_filter_arguments: list[tuple[list, str]], api_response: dict) -> bool:
    """
    Verify whether any filter arguments of a command match the api response content.

    Args:
        all_filter_arguments (list[tuple]): pairs of filter arguments inputs & a response key.
        api_response (dict): api response.

    Returns:
        bool: True if in any of the filter arguments there was a match, False otherwise.
    """
    for arguments in all_filter_arguments:
        command_args, resp_key = arguments
        for arg in command_args:
            if arg == api_response.get(resp_key):
                return True
    return False


def filter_to_tanium_api_syntax(filter_str):  # pragma: no cover
    filter_dict = {}
    try:
        if filter_str:
            filter_expressions = ast.literal_eval(filter_str)
            for i, expression in enumerate(filter_expressions):
                filter_dict["f" + str(i)] = expression[0]
                filter_dict["o" + str(i)] = expression[1]
                filter_dict["v" + str(i)] = expression[2]
        return filter_dict
    except IndexError:
        raise ValueError("Invalid filter argument.")


def get_file_data(entry_id: str) -> tuple[str, str, str]:
    """Gets a file name and content from the file's entry ID.

    :type entry_id: ``str``
    :param entry_id:
        the file's entry ID.

    :return: file name, path and content
    :rtype: ``tuple``

    """
    file = demisto.getFilePath(entry_id)
    file_path = file.get("path")
    file_name = file.get("name")
    with open(file_path) as f:
        file_content = f.read()
    return file_name, file_path, file_content


def get_future_date(date_string: str) -> str:
    """Gets a date string and returns an ISO 8061 formatted datetime string

    :type date_string: ``str``
    :param date_string:
        The date string in "<number> <unit>" format (i.e. "7 days")

    :return: ISO8061 formatted datetime string
    :rtype: ``str``

    """
    try:
        if "in" not in date_string:
            date_string = f"in {date_string}"
        parsed_date = dateparser.parse(date_string)
        if parsed_date:
            return parsed_date.isoformat()
        else:
            raise ValueError
    except Exception:
        raise DemistoException('Invalid date string format. Must be "<amount> <unit>"')


""" EVIDENCE HELPER FUNCTIONS """


def get_event_header(event_type):  # pragma: no cover
    if event_type == "combined":
        headers = ["id", "type", "processPath", "detail", "timestamp", "operation"]

    elif event_type == "file":
        headers = ["id", "file", "timestamp", "processTableId", "processPath", "userName"]

    elif event_type == "network":
        headers = [
            "id",
            "timestamp",
            "groupName",
            "processTableId",
            "pid",
            "processPath",
            "userName",
            "operation",
            "localAddress",
            "localAddressPort",
            "remoteAddress",
            "remoteAddressPort",
        ]

    elif event_type == "registry":
        headers = ["id", "timestamp", "groupName", "processTableId", "pid", "processPath", "userName", "keyPath", "valueName"]

    elif event_type == "process":
        headers = [
            "groupName",
            "processTableId",
            "processCommandLine",
            "pid",
            "processPath",
            "exitCode",
            "userName",
            "createTime",
            "endTime",
        ]

    elif event_type == "driver":
        headers = [
            "id",
            "timestamp",
            "processTableID",
            "hashes",
            "imageLoaded",
            "signature",
            "signed",
            "eventId",
            "eventOpcode",
            "eventRecordId",
            "eventTaskId",
        ]

    elif event_type == "dns":
        headers = [
            "id",
            "timestamp",
            "groupName",
            "processTableId",
            "pid",
            "processPath",
            "userName",
            "operation",
            "query",
            "response",
        ]

    else:  # if event_type == 'image'
        headers = ["id", "timestamp", "imagePath", "processTableID", "processID", "processName", "username", "hash", "signature"]
    return headers


""" GENERAL HELPER FUNCTIONS"""


def normalize_api_response(raw_response):
    """parse the api response. from 4.x version of the api, the response is returned with a data dict
    :param raw_response:
        The raw response returned from api call

    :return: the parsed api response.
    :rtype: ``dict or list``

    """
    return raw_response.get("data", raw_response) if type(raw_response) is dict else raw_response


""" INTEL DOCS HELPER FUNCTIONS """


def get_intel_doc_item(intel_doc: dict) -> dict:
    """Gets the relevant fields from a given intel doc.

    :type intel_doc: ``dict``
    :param intel_doc:
        The intel doc obtained from api call

    :return: a dictionary containing only the relevant fields.
    :rtype: ``dict``

    """
    intel_doc_data = normalize_api_response(intel_doc)  # 4.x version parses info in a data dict into the intel_doc dict
    return {
        "ID": intel_doc_data.get("id"),
        "Name": intel_doc_data.get("name"),
        "Type": intel_doc_data.get("type"),
        "Description": intel_doc_data.get("description"),
        "AlertCount": intel_doc_data.get("alertCount"),
        "UnresolvedAlertCount": intel_doc_data.get("unresolvedAlertCount"),
        "CreatedAt": intel_doc_data.get("createdAt"),
        "UpdatedAt": intel_doc_data.get("updatedAt"),
        "LabelIds": intel_doc_data.get("labelIds"),
    }


def get_intel_doc_label_item(intel_doc_label: dict) -> dict:
    """Gets the relevant fields from a given intel doc label.

    :type intel_doc_label: ``dict``
    :param intel_doc_label:
        The intel doc label obtained from api call

    :return: a dictionary containing only the relevant fields.
    :rtype: ``dict``

    """
    return {
        "ID": intel_doc_label.get("id"),
        "Name": intel_doc_label.get("name"),
        "Description": intel_doc_label.get("description"),
        "IndicatorCount": intel_doc_label.get("indicatorCount"),
        "SignalCount": intel_doc_label.get("signalCount"),
        "CreatedAt": intel_doc_label.get("createdAt"),
        "UpdatedAt": intel_doc_label.get("updatedAt"),
    }


def get_intel_doc_status(status_data):
    return {
        "CreatedAt": status_data.get("createdAt"),
        "ModifiedAt": status_data.get("modifiedAt"),
        "CurrentRevision": status_data.get("currentRevision"),
        "CurrentSize": status_data.get("currentSize"),
    }


def update_content_from_xml(file_path: str, intrinsic_id: str) -> str:
    """Parse an xml file, and update the content to match the same intrinsic_id as the current content.
    the api will update docs only if the intel doc content (before update) has the same intrinsic_id as the new content,
    otherwise it will create a new intel doc.
    this function will force update so if they are not equal it changes the new ID to be equal to the previous ID.

    :type file_path: ``str``
    :param file_path:
        The xml file path

    :type intrinsic_id: ``str``
    :param intrinsic_id:
        The current intel doc id (before update)

    :return: an updated xml content where the id matches the previous intrinsic_id
    :rtype: ``str``

    """
    for _, xml_root in etree.iterparse(file_path, events=("start",), resolve_entities=False):
        content_id = xml_root.attrib.get("id")
        if content_id is not None and intrinsic_id != content_id:
            xml_root.attrib["id"] = intrinsic_id
            return etree.tostring(xml_root, encoding="unicode", pretty_print=True)
    return ""


def get_quick_scan_item(quick_scan):
    return {
        "IntelDocId": quick_scan.get("intelDocId"),
        "ComputerGroupId": quick_scan.get("computerGroupId"),
        "ID": quick_scan.get("id"),
        "AlertCount": quick_scan.get("alertCount"),
        "CreatedAt": quick_scan.get("createdAt"),
        "UserId": quick_scan.get("userId"),
        "QuestionId": quick_scan.get("questionId"),
    }


""" ALERTS DOCS HELPER FUNCTIONS """


def get_alert_item(alert):
    return {
        "ID": alert.get("id"),
        "AlertedAt": alert.get("alertedAt"),
        "ComputerIpAddress": alert.get("computerIpAddress"),
        "ComputerName": alert.get("computerName"),
        "CreatedAt": alert.get("createdAt"),
        "GUID": alert.get("guid"),
        "IntelDocId": alert.get("intelDocId"),
        "Priority": alert.get("priority"),
        "Severity": alert.get("severity"),
        "State": alert.get("state").title(),
        "Type": alert.get("type"),
        "UpdatedAt": alert.get("updatedAt"),
    }


""" FETCH INCIDENTS HELPER FUNCTIONS """


def alarm_to_incident(client, alarm):  # pragma: no cover
    host = alarm.get("computerName", "")

    if details := alarm.get("details"):
        alarm_details = json.loads(details)
        alarm["details"] = alarm_details

    intel_doc = ""
    if intel_doc_id := alarm.get("intelDocId", ""):
        raw_response = client.do_request(
            "GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/{intel_doc_id}"
        )
        raw_response_data = normalize_api_response(raw_response)
        intel_doc = raw_response_data.get("name")
        alarm["intelDocDetails"] = raw_response_data
        intel_doc_labels = []
        intel_doc_labels_resp = client.do_request(
            "GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/{intel_doc_id}/labels"
        )

        labels_list = normalize_api_response(intel_doc_labels_resp)

        for label in labels_list:
            intel_doc_labels.append(label["name"])
        alarm["labels"] = intel_doc_labels

    return {
        "name": f"{host} found {intel_doc}",
        "occurred": alarm.get("alertedAt"),
        "starttime": alarm.get("createdAt"),
        "alertid": alarm.get("id"),
        "rawJSON": json.dumps(alarm),
    }


def state_params_suffix(alerts_states_to_retrieve):
    valid_alert_states = ["unresolved", "inprogress", "resolved", "suppressed"]

    for state in alerts_states_to_retrieve:
        if state.lower() not in valid_alert_states:
            raise ValueError(
                f"Invalid state '{state}' in filter_alerts_by_state parameter."
                f"Possible values are 'unresolved', 'inprogress', 'resolved' or 'suppressed'."
            )

    return "&".join(["state=" + state.lower() for state in alerts_states_to_retrieve])


""" COMMANDS + REQUESTS FUNCTIONS """
""" GENERAL COMMANDS FUNCTIONS """


def test_module(client, data_args):
    try:
        if client.login():
            return demisto.results("ok")
    except Exception as e:
        raise ValueError(f"Please check your credentials and try again. Error is:\n{str(e)}")


def fetch_incidents(
    client: Client, alerts_states_to_retrieve: str, label_name_to_retrieve: str, last_run: dict, fetch_time: str, max_fetch: int
):  # pragma: no cover
    """
    Fetch events from this integration and return them as Demisto incidents

    returns:
        Demisto incidents
    """
    # Get the last fetch time and data if it exists
    last_fetch = last_run.get("time")
    last_id = int(last_run.get("id", "0"))
    alerts_states = argToList(alerts_states_to_retrieve)
    offset = 0
    label_name_suffix = ""

    # Handle first time fetch, fetch incidents retroactively
    if not last_fetch:
        last_fetch, _ = parse_date_range(fetch_time, date_format=DATE_FORMAT)

    demisto.debug(f"Get last run: last_id {last_id}, last_time: {last_fetch}.\n")

    last_fetch = parse(last_fetch)

    alerts_states_suffix = state_params_suffix(alerts_states)
    if label_name_to_retrieve:
        label_name_suffix = f"&labelName={urllib.parse.quote(label_name_to_retrieve)}"
    incidents = []

    while True:
        demisto.debug(f"Sending new alerts api request with offset: {offset}.")
        url_suffix = (
            "/plugin/products/"
            f"{client.get_threat_response_endpoint()}/api/v1/alerts?"
            + alerts_states_suffix
            + f"&sort=-createdAt&limit=500&offset={offset}"
            + label_name_suffix
        )

        raw_response = client.do_request("GET", url_suffix)
        raw_response_data = normalize_api_response(raw_response)
        if not raw_response_data:
            demisto.debug("Stop fetch loop, no incidents in raw response.")
            break

        # convert the data/events to demisto incidents
        for alarm in raw_response_data:
            incident = alarm_to_incident(client, alarm)
            temp_date = parse(incident.get("starttime"))
            new_id = incident.get("alertid")
            demisto.debug(f"Fetched new alert, id: {new_id}, created_at: {temp_date}.\n")

            if temp_date >= last_fetch and new_id > last_id:
                demisto.debug(f"Adding new incident with id: {new_id}")
                incidents.append(incident)
            else:
                demisto.debug(f"Stop fetch loop, temp date < last fetch: {temp_date} < {last_fetch}.")
                break

        if temp_date >= last_fetch:
            offset += 500
        else:
            demisto.debug(f"Stop fetch loop, temp date < last fetch: {temp_date} < {last_fetch}.")
            break

    if len(incidents) > max_fetch:
        demisto.debug("Re-sizing incidents list.")
        incidents = incidents[len(incidents) - max_fetch :]

    if incidents:
        last_incident = incidents[0]
        last_fetch = parse(last_incident.get("starttime"))
        last_id = last_incident.get("alertid")

    next_run = {"time": datetime.strftime(last_fetch, DATE_FORMAT), "id": str(last_id)}

    demisto.debug(f"Set last run: last_id {last_id}, last_time: {last_fetch}.\n")
    demisto.debug(f"Fetched {len(incidents)} incidents.")

    return incidents, next_run


""" INTEL DOCS COMMANDS FUNCTIONS """


def get_intel_doc(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Gets a single intel doc from a given id.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    id_ = data_args.get("intel_doc_id")
    try:
        raw_response = client.do_request("GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/{id_}")
    # If the user provided a intel doc ID which does not exist, the do_request will throw HTTPError exception
    # with a "Not Found" message.
    except requests.HTTPError as e:
        if "not found" in str(e):
            raise DemistoException(f"Check the intel doc ID and try again.\n({str(e)})")
        raise
    intel_doc = get_intel_doc_item(raw_response)
    # A more readable format for the human readable section.
    if intel_doc:
        intel_doc["LabelIds"] = str(intel_doc.get("LabelIds", [])).strip("[]")
    context_data = format_context_data(normalize_api_response(raw_response))
    context = createContext(context_data, removeNull=True)
    outputs = {"Tanium.IntelDoc(val.ID && val.ID === obj.ID)": context}

    headers = ["ID", "Name", "Type", "Description", "AlertCount", "UnresolvedAlertCount", "CreatedAt", "UpdatedAt", "LabelIds"]
    human_readable = tableToMarkdown(
        "Intel Doc information", intel_doc, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def get_intel_docs(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Gets a single intel doc from a given id.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    # data_args contains some fields which can filter the intel docs result.
    params = (
        assign_params(
            name=data_args.get("name"),
            description=data_args.get("description"),
            type=data_args.get("type"),
            limit=convert_to_int(data_args.get("limit")),
            offset=convert_to_int(data_args.get("offset")),
            labelId=data_args.get("label_id"),
            mitreTechniqueId=data_args.get("mitre_technique_id"),
        )
        if data_args
        else {}
    )
    raw_response = client.do_request(
        "GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/", params=params
    )

    intel_docs = []
    intel_doc = {}

    raw_response = normalize_api_response(raw_response)
    # append raw response to a list in case raw_response is a dictionary
    tmp_list = [raw_response] if type(raw_response) is dict else raw_response
    for item in tmp_list:
        intel_doc = get_intel_doc_item(item)
        if intel_doc:
            intel_doc["LabelIds"] = str(intel_doc.get("LabelIds", [])).strip("[]")
        intel_docs.append(intel_doc)
    context_data = format_context_data(raw_response)
    context = createContext(context_data, removeNull=True)
    outputs = {"Tanium.IntelDoc(val.ID && val.ID === obj.ID)": context}

    headers = ["ID", "Name", "Type", "Description", "AlertCount", "UnresolvedAlertCount", "CreatedAt", "UpdatedAt", "LabelIds"]
    human_readable = tableToMarkdown("Intel docs", intel_docs, headers=headers, headerTransform=pascalToSpace, removeNull=True)
    return human_readable, outputs, raw_response


def get_intel_docs_labels_list(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Gets the labels list of a given intel doc.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    id_ = data_args.get("intel_doc_id")
    try:
        raw_response = client.do_request(
            "GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/{id_}/labels"
        )
    except requests.HTTPError as e:
        raise DemistoException(f"Check the intel doc ID and try again.\n({str(e)})")

    intel_docs_labels = []
    intel_doc_label = {}
    raw_response_data = normalize_api_response(raw_response)
    # append raw response to a list in case raw_response is a dictionary
    tmp_list = [raw_response_data] if type(raw_response_data) is dict else raw_response_data
    for item in tmp_list:
        intel_doc_label = get_intel_doc_label_item(item)
        intel_docs_labels.append(intel_doc_label)
    context_data = format_context_data(raw_response_data)
    context = createContext({"IntelDocID": id_, "LabelsList": context_data}, removeNull=True)
    outputs = {"Tanium.IntelDocLabel(val.IntelDocID && val.IntelDocID === obj.IntelDocID)": context}
    headers = ["ID", "Name", "Description", "IndicatorCount", "SignalCount", "CreatedAt", "UpdatedAt"]
    human_readable = tableToMarkdown(
        f"Intel doc ({id_}) labels", intel_docs_labels, headerTransform=pascalToSpace, headers=headers, removeNull=True
    )
    return human_readable, outputs, raw_response


def add_intel_docs_label(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Creates a new label (given label ID) association for an identified intel document (given intel-doc ID).

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    intel_doc_id = data_args.get("intel_doc_id")
    label_id = data_args.get("label_id")
    params = assign_params(id=label_id)

    try:
        raw_response = client.do_request(
            "PUT",
            f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/{intel_doc_id}/labels",
            data=params,
        )
    # If the user provided a intel doc ID which does not exist, the do_request will throw HTTPError exception
    # with a "Not Found" message.
    except requests.HTTPError as e:
        if "not found" in str(e):
            raise DemistoException(f"Check the intel doc ID and try again.\n({str(e)})")
        raise
    # If the user provided a label ID which does not exist, the do_request will throw a DemistoException
    # with "internal server error" message.
    except DemistoException as e:
        if "internal server error" in str(e):
            raise DemistoException(f"Check the given label ID.\n({str(e)})")
        raise

    intel_docs_labels = []
    intel_doc_label = {}
    raw_response_data = normalize_api_response(raw_response)
    tmp_list = [raw_response_data] if type(raw_response_data) is dict else raw_response_data
    for item in tmp_list:
        intel_doc_label = get_intel_doc_label_item(item)
        intel_docs_labels.append(intel_doc_label)
    context_data = format_context_data(raw_response_data)
    context = createContext({"IntelDocID": intel_doc_id, "LabelsList": context_data}, removeNull=True)
    outputs = {"Tanium.IntelDocLabel(val.IntelDocID && val.IntelDocID === obj.IntelDocID)": context}
    headers = ["ID", "Name", "Description", "IndicatorCount", "SignalCount", "CreatedAt", "UpdatedAt"]
    human_readable = tableToMarkdown(
        f"Successfully created a new label ({label_id}) association for the identified intel document ({intel_doc_id}).",
        intel_docs_labels,
        headers=headers,
        headerTransform=pascalToSpace,
        removeNull=True,
    )
    return human_readable, outputs, raw_response


def remove_intel_docs_label(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Removes a label (given label ID) association for an identified intel document (given intel-doc ID).

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """

    intel_doc_id = data_args.get("intel_doc_id")
    label_id_to_delete = data_args.get("label_id")
    try:
        raw_response = client.do_request(
            "DELETE",
            "/plugin/products/"
            f"{client.get_threat_response_endpoint()}"
            f"/api/v1/intels/{intel_doc_id}/labels/{label_id_to_delete}",
        )
    # If the user provided a intel doc ID which does not exist, the do_request will throw HTTPError exception
    # with a "Not Found" message.
    except requests.HTTPError as e:
        if "not found" in str(e):
            raise DemistoException(f"Check the intel doc ID and try again.\n({str(e)})")
        raise
    # If the user provided a label ID which does not exist, the do_request will throw a DemistoException
    # with "internal server error" message.
    except DemistoException as e:
        if "internal server error" in str(e):
            raise DemistoException(f"Check the given label ID.\n({str(e)})")
        raise

    intel_docs_labels = []
    intel_doc_label = {}
    raw_response_data = normalize_api_response(raw_response)
    tmp_list = [raw_response_data] if type(raw_response_data) is dict else raw_response_data
    for item in tmp_list:
        intel_doc_label = get_intel_doc_label_item(item)
        intel_docs_labels.append(intel_doc_label)

    # This API call returns the latest labels associated to the given intel-doc ID.
    # This gives us the ability to update the context on deletion.
    context_data = format_context_data(raw_response_data)
    context = createContext({"IntelDocID": intel_doc_id, "LabelsList": context_data}, removeNull=True)
    outputs = {"Tanium.IntelDocLabel(val.IntelDocID && val.IntelDocID === obj.IntelDocID)": context}
    headers = ["ID", "Name", "Description", "IndicatorCount", "SignalCount", "CreatedAt", "UpdatedAt"]
    human_readable = tableToMarkdown(
        f"Successfully removed the label ({label_id_to_delete}) association for the identified intel document ({intel_doc_id}).",
        intel_docs_labels,
        headers=headers,
        headerTransform=pascalToSpace,
        removeNull=True,
    )
    return human_readable, outputs, raw_response


def create_intel_doc(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Adds a new intel-doc to the system by providing its document contents with an appropriate content-type header.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    entry_id = data_args.get("entry_id")
    file_extension = data_args.get("file_extension")
    raw_response = {}
    try:
        file_name, _, file_content = get_file_data(str(entry_id))
    except Exception as e:
        raise DemistoException(f"Check your file entry ID.\n{str(e)}")

    raw_response = client.do_request(
        "POST",
        f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels",
        headers={"Content-Disposition": f"attachment; filename=file.{file_extension}", "Content-Type": "application/xml"},
        body=file_content,
    )

    intel_doc = get_intel_doc_item(raw_response)
    # A more readable format for the human readable section.
    if intel_doc:
        intel_doc["LabelIds"] = str(intel_doc.get("LabelIds", [])).strip("[]")

    context_data = format_context_data(normalize_api_response(raw_response))
    context = createContext(context_data, removeNull=True)
    outputs = {"Tanium.IntelDoc(val.ID && val.ID === obj.ID)": context}

    headers = ["ID", "Name", "Type", "AlertCount", "UnresolvedAlertCount", "CreatedAt", "UpdatedAt", "LabelIds"]
    human_readable = tableToMarkdown(
        "Intel Doc information", intel_doc, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def update_intel_doc(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Updates the contents of an existing intel document by providing the document contents with an appropriate
    content-type header.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """

    id_ = data_args.get("intel_doc_id")
    intrinsic_id = ""
    try:
        # get intel doc intrinsicId
        raw_response = client.do_request("GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/{id_}")
        raw_response_data = normalize_api_response(raw_response)
        intrinsic_id = raw_response_data.get("intrinsicId")
    # If the user provided a intel doc ID which does not exist, the do_request will throw HTTPError exception
    # with a "Not Found" message.
    except requests.HTTPError as e:
        if "not found" in str(e):
            raise DemistoException(f"Check the intel doc ID and try again.\n({str(e)})")
        raise

    entry_id = data_args.get("entry_id")
    file_extension = data_args.get("file_extension")
    content_disposition = f"filename=file.{file_extension}"
    raw_response = {}
    try:
        file_name, file_path, file_content = get_file_data(str(entry_id))
    except Exception as e:
        raise DemistoException(f"Check your file entry ID.\n{str(e)}")

    updated_content = file_content
    if file_extension in ["ioc", "stix"]:
        updated_content = update_content_from_xml(file_path, intrinsic_id)

    elif file_extension == "yara":
        # in yara files the update will take place when the previous intrinsic_id is entered in the Content Disposition
        content_disposition = f"filename={intrinsic_id}"

    content_disposition = f"attachment; {content_disposition}"
    raw_response = client.do_request(
        "PUT",
        f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/{id_}",
        headers={"Content-Disposition": content_disposition, "Content-Type": "application/xml"},
        body=updated_content,
    )

    intel_doc = get_intel_doc_item(raw_response)
    # A more readable format for the human readble section.
    if intel_doc:
        intel_doc["LabelIds"] = str(intel_doc.get("LabelIds", [])).strip("[]")

    context_data = format_context_data(normalize_api_response(raw_response))
    context = createContext(context_data, removeNull=True)
    outputs = {"Tanium.IntelDoc(val.ID && val.ID === obj.ID)": context}

    headers = ["ID", "Name", "Type", "Description", "AlertCount", "UnresolvedAlertCount", "CreatedAt", "UpdatedAt", "LabelIds"]
    human_readable = tableToMarkdown(
        "Intel Doc information", intel_doc, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def delete_intel_doc(client, data_args):
    params = {"id": data_args.get("intel_doc_id")}
    try:
        raw_response = client.do_request(
            "DELETE", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/intels/", params=params
        )

    # If the user provided a intel doc ID which does not exist, the do_request will throw HTTPError exception
    # with a "Not Found" message.
    except requests.HTTPError as e:
        if "not found" in str(e):
            raise DemistoException(f"Could not find the intel doc ID.\n({str(e)})")
        raise

    return "Intel doc deleted", {}, str(raw_response)


def start_quick_scan(client, data_args):
    # get computer group ID from computer group name
    computer_group_name = data_args.get("computer_group_name")
    raw_response = client.do_request("GET", f"/api/v2/groups/by-name/{computer_group_name}")
    raw_response_data = normalize_api_response(raw_response)
    if not raw_response_data:
        msg = (
            f"No group exists with name {computer_group_name} or"
            f" your account does not have sufficient permissions to access the groups"
        )
        raise DemistoException(msg)

    data = {"intelDocId": int(data_args.get("intel_doc_id")), "computerGroupId": int(raw_response_data.get("id"))}
    if client.api_version == "4.x":
        url_suffix = "/plugin/products/threat-response/api/v1/on-demand-scans/"
    else:
        url_suffix = "/plugin/products/detect3/api/v1/quick-scans/"
    raw_response = client.do_request("POST", url_suffix, data=data)
    quick_scan = get_quick_scan_item(raw_response.get("data", raw_response))

    context = createContext(quick_scan, removeNull=True)
    outputs = {"Tanium.QuickScan(val.ID && val.ID === obj.ID)": context}

    human_readable = tableToMarkdown("Quick Scan started", quick_scan, headerTransform=pascalToSpace, removeNull=True)

    return human_readable, outputs, raw_response


def deploy_intel(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Deploys intel using the service account context.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    raw_response = client.do_request("POST", "/plugin/products/threat-response/api/v1/intel/deploy")
    human_readable = ""

    # The response is of the form:
    # {
    #     "data": {
    #         "taskId": 779
    #     }
    # }
    if raw_response and raw_response.get("data"):
        human_readable = "Successfully deployed intel."
    else:
        raise DemistoException("Something went wrong while deploying intel docs.")
    return human_readable, {}, raw_response


def get_deploy_status(client: Client, data_args: dict) -> tuple[str, dict, Union[list, dict]]:
    """Displays status of last intel deployment.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    raw_response = client.do_request("GET", "/plugin/products/threat-response/api/v1/intel/status")

    status_data = raw_response.get("data", {})
    status = get_intel_doc_status(status_data)
    context_data = format_context_data(status_data)
    context = createContext(context_data, removeNull=True)

    outputs = {"Tanium.IntelDeployStatus": context}

    headers = ["CreatedAt", "ModifiedAt", "CurrentRevision", "CurrentSize"]
    human_readable = tableToMarkdown(
        "Intel deploy status", status, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


""" ALERTS COMMANDS FUNCTIONS """


def get_alerts(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get alerts from tanium.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    limit = arg_to_number(data_args.get("limit"))
    offset = arg_to_number(data_args.get("offset"))
    ip_address = data_args.get("computer_ip_address")
    computer_name = data_args.get("computer_name")
    scan_config_id = data_args.get("scan_config_id")
    intel_doc_id = data_args.get("intel_doc_id")
    severity = data_args.get("severity")
    priority = data_args.get("priority")
    type_ = data_args.get("type")
    state = data_args.get("state")

    params = assign_params(
        type=type_,
        priority=priority,
        severity=severity,
        intelDocId=intel_doc_id,
        scanConfigId=scan_config_id,
        computerName=computer_name,
        computerIpAddress=ip_address,
        limit=limit,
        offset=offset,
        state=state.lower() if state else None,
    )

    raw_response = client.do_request(
        "GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/alerts/", params=params
    )

    alerts = []
    raw_response_data = normalize_api_response(raw_response)
    for item in raw_response_data:
        alert = get_alert_item(item)
        alerts.append(alert)

    context = createContext(alerts, removeNull=True)
    headers = [
        "ID",
        "Type",
        "Severity",
        "Priority",
        "AlertedAt",
        "CreatedAt",
        "UpdatedAt",
        "ComputerIpAddress",
        "ComputerName",
        "GUID",
        "State",
        "IntelDocId",
    ]
    outputs = {"Tanium.Alert(val.ID && val.ID === obj.ID)": context}
    human_readable = tableToMarkdown("Alerts", alerts, headers=headers, headerTransform=pascalToSpace, removeNull=True)
    return human_readable, outputs, raw_response


def get_alert(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get alert by id.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    alert_id = data_args.get("alert_id")
    raw_response = client.do_request("GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/alerts/{alert_id}")
    raw_response_data = raw_response.get("data", raw_response)
    alert = get_alert_item(raw_response_data)

    context = createContext(alert, removeNull=True)
    outputs = {"Tanium.Alert(val.ID && val.ID === obj.ID)": context}
    headers = [
        "ID",
        "Name",
        "Type",
        "Severity",
        "Priority",
        "AlertedAt",
        "CreatedAt",
        "UpdatedAt",
        "ComputerIpAddress",
        "ComputerName",
        "GUID",
        "State",
        "IntelDocId",
    ]
    human_readable = tableToMarkdown("Alert information", alert, headers=headers, headerTransform=pascalToSpace, removeNull=True)
    return human_readable, outputs, raw_response


def alert_update_state(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Update alert status by alert ids.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    alert_ids = argToList(data_args.get("alert_ids"))
    state = data_args.get("state")

    body = {"state": state.lower()}
    if client.api_version == "4.x":
        if len(alert_ids) == 1:
            client.do_request("PUT", f"/plugin/products/threat-response/api/v1/alerts/{alert_ids[0]}", data=body)
        else:
            client.do_request("PUT", "/plugin/products/threat-response/api/v1/alerts/", data=body, params={"id": alert_ids})

    else:
        client.do_request("PUT", "/plugin/products/detect3/api/v1/alerts/", data=body.update({"id": alert_ids}))

    return f"Alert state updated to {state}.", {}, {}


""" SANPSHOTS COMMANDS FUNCTIONS """


def list_snapshots(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """List all snapshots at the system.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    limit = arg_to_number(data_args.get("limit"))
    offset = arg_to_number(data_args.get("offset"))

    params = assign_params(limit=limit, offset=offset)
    raw_response = client.do_request(method="GET", url_suffix="/plugin/products/threat-response/api/v1/snapshot", params=params)
    snapshots = raw_response.get("snapshots", [])

    for snapshot in snapshots:
        if created := snapshot.get("created"):
            try:
                snapshot["created"] = timestamp_to_datestring(created)
            except ValueError:
                pass

    context = createContext(snapshots, removeNull=True)
    headers = ["uuid", "name", "evidenceType", "hostname", "created"]
    outputs = {"Tanium.Snapshot(val.uuid === obj.uuid)": context}
    human_readable = tableToMarkdown("Snapshots:", snapshots, headers=headers, headerTransform=pascalToSpace, removeNull=True)
    return human_readable, outputs, raw_response


def create_snapshot(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Create new snapshot of the connection.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    connection_id = data_args.get("connection_id")
    raw_response = client.do_request("POST", f"/plugin/products/threat-response/api/v1/conns/{connection_id}/snapshot")
    hr = f"Initiated snapshot creation request for {connection_id}."

    context = {"connection": connection_id}
    if task_id := raw_response.get("taskInfo", {}).get("id"):
        hr += f" Task id: {task_id}."

        context = copy.deepcopy(raw_response.get("taskInfo"))
        context.update(context.get("metadata", {}))
        context["taskId"] = task_id

        del context["id"]
        del context["metadata"]

    outputs = {"Tanium.SnapshotTask(val.taskId === obj.taskId && val.connection === obj.connection)": context} if context else {}
    return hr, outputs, raw_response


def delete_snapshot(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Delete exsisting snapshot from the system.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    snapshot_ids = argToList(data_args.get("snapshot_ids"))
    body = {"ids": snapshot_ids}
    client.do_request("DELETE", "/plugin/products/threat-response/api/v1/snapshot", data=body)
    return f'Snapshot {",".join(snapshot_ids)} deleted successfully.', {}, {}


def delete_local_snapshot(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Delete local snapshot from the system.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    connection_id = data_args.get("connection_id")
    client.do_request("DELETE", f"/plugin/products/threat-response/api/v1/conns/{connection_id}", resp_type="content")
    return f"Local snapshot of connection {connection_id} was deleted successfully.", {}, {}


""" CONNECTIONS COMMANDS FUNCTIONS """


def get_connections(client, command_args) -> tuple[str, dict, Union[list, dict]]:
    """
    Implement the 'tanium-tr-list-connections' command - Get list of user connections.

    Note:
        Given either ip/status/hostname/platform as command arguments, the output of the connections will be filtered.

    Args:
        client (Client): client that connects to the Tanium-Threat-Response API.
        command_args (dict): command arguments entered by the user. (limit, offset, ip, status, hostname, platform).

    Returns:
        tuple (str, dict, list[dict]): table output, context output and raw response by the Tanium-Threat-Response API.
    """
    limit = arg_to_number(command_args.get("limit"))
    offset = arg_to_number(command_args.get("offset", 0))
    ips = argToList(arg=command_args.get("ip"))
    statuses = argToList(arg=command_args.get("status"))
    hostnames = argToList(arg=command_args.get("hostname"))
    platforms = argToList(arg=command_args.get("platform"))

    raw_response = client.do_request(method="GET", url_suffix="/plugin/products/threat-response/api/v1/conns")
    assert offset is not None
    from_idx = min(offset, len(raw_response))
    to_idx = min(offset + limit, len(raw_response))  # type: ignore

    is_resp_filtering_required = ips or statuses or hostnames or platforms
    filter_arguments = [(ips, "ip"), (statuses, "status"), (hostnames, "hostname"), (platforms, "platform")]

    connections = raw_response[from_idx:to_idx]
    filtered_connections = []

    for connection in connections:
        if connected_at := connection.get("connectedAt"):
            connection["connectedAt"] = timestamp_to_datestring(connected_at)
        if initiated_at := connection.get("initiatedAt"):
            connection["initiatedAt"] = timestamp_to_datestring(initiated_at)

        if is_resp_filtering_required and are_filters_match_response_content(
            all_filter_arguments=filter_arguments, api_response=connection
        ):
            filtered_connections.append(connection)

    if is_resp_filtering_required:
        connections = filtered_connections

    context = createContext(data=connections, removeNull=True)
    outputs = {"Tanium.Connection(val.id === obj.id)": context}
    table_headers = ["id", "status", "hostname", "message", "ip", "platform", "connectedAt"]
    output_table = tableToMarkdown(
        name="Connections", t=connections, headers=table_headers, headerTransform=pascalToSpace, removeNull=True
    )
    return output_table, outputs, raw_response


def create_connection(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Create new connection.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    ip = str(data_args.get("ip"))
    client_id = str(data_args.get("client_id"))
    hostname = str(data_args.get("hostname"))
    platform = str(data_args.get("platform"))

    target = assign_params(hostname=hostname, clientId=client_id, ip=ip, platform=platform)
    body = {"target": target}

    connection_id, _ = client.do_request(
        "POST", "/plugin/products/threat-response/api/v1/conns/connect", data=body, resp_type="content"
    )
    outputs = {"Tanium.Connection(val.id === obj.id)": {"id": connection_id.decode("utf-8").strip('"')}}
    return f'Initiated connection request to {connection_id.decode("utf-8")}.', outputs, {}


def close_connection(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Close exsisting connection

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    cid = data_args.get("connection_id")
    client.do_request("DELETE", f"/plugin/products/threat-response/api/v1/conns/close/{cid}")
    return f"Connection `{cid}` closed successfully.", {}, {}


def delete_connection(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Delete exsisting connection

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    cid = data_args.get("connection_id")
    client.do_request("DELETE", f"/plugin/products/threat-response/api/v1/conns/delete/{cid}")
    return f"Connection `{cid}` deleted successfully.", {}, {}


def get_events_by_connection(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """List all events in the given connection.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    limit = arg_to_number(data_args.get("limit"))
    offset = arg_to_number(data_args.get("offset"))
    cid = data_args.get("connection_id")
    sort = data_args.get("sort")
    fields = data_args.get("fields")
    event_type = data_args.get("type").lower()
    filter_dict = filter_to_tanium_api_syntax(data_args.get("filter"))
    match = data_args.get("match")

    params = assign_params(limit=limit, offset=offset, sort=sort, fields=fields, match=match)

    if filter_dict:
        g1 = ",".join([str(i) for i in range(len(filter_dict) // 3)])  # A weird param that must be passed
        params["gm1"] = match
        params["g1"] = g1
        params.update(filter_dict)

    if client.api_version == "4.x":
        params["cid"] = cid
        params["type"] = event_type

    raw_response = client.do_request(
        "GET", f"/plugin/products/threat-response/api/v1/conns/{cid}/views/{event_type}/events", params=params
    )

    context = createContext(raw_response, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"TaniumEvent(val.id === obj.id)": context}
    headers = get_event_header(event_type)
    human_readable = tableToMarkdown(
        f"Events for {cid}", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


""" RESPONSE ACTIONS COMMANDS FUNCTIONS"""


def get_response_actions(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """List all Response Actions based on the filters provided

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    limit = arg_to_number(data_args.get("limit", 50))
    offset = arg_to_number(data_args.get("offset", 0))
    sort_order = data_args.get("sort_order", "desc")
    partial_computer_name = data_args.get("partial_computer_name", None)
    status = data_args.get("status", None)
    _type = data_args.get("type", None)

    params = {"limit": limit, "offset": offset, "sortOrder": sort_order}
    if partial_computer_name:
        params["queryPartialComputerName"] = partial_computer_name
    if status:
        params["queryStatus"] = status
    if _type:
        params["queryType"] = _type

    raw_response = client.do_request("GET", "/plugin/products/threat-response/api/v1/response-actions", params=params)
    raw_response_data = normalize_api_response(raw_response)  # This is a list of dicts

    context = createContext(raw_response, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.ResponseActions(val.id === obj.id)": context}

    headers = ["id", "type", "status", "computerName", "userId", "userName", "results", "expirationTime"]
    human_readable = tableToMarkdown(
        "Response Actions", raw_response_data, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )

    return human_readable, outputs, raw_response


def response_action_gather_snapshot(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Creates a "gatherSnapshot" Response Action for the specified host.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    payload = {
        "type": "gatherSnapshot",
        "options": {},  # Empty options dict is expected for this type
    }

    payload["computerName"] = data_args.get("computer_name")

    if data_args.get("expiration_time"):
        expiration_time = get_future_date(data_args.get("expiration_time"))
        payload["expirationTime"] = expiration_time

    raw_response = client.do_request("POST", "/plugin/products/threat-response/api/v1/response-actions", data=payload)

    raw_response_data = normalize_api_response(raw_response)
    context = createContext(raw_response, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.ResponseActions(val.id === obj.id)": context}

    headers = [
        "id",
        "type",
        "status",
        "computerName",
        "userId",
        "userName",
        "results",
        "expirationTime",
        "createdAt",
        "updatedAt",
    ]
    human_readable = tableToMarkdown(
        "Response Actions", raw_response_data, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )

    return human_readable, outputs, raw_response


""" LABELS COMMANDS FUNCTIONS """


def get_labels(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """List all labels.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    limit = arg_to_number(data_args.get("limit", 50))
    offset = arg_to_number(data_args.get("offset", 0))
    raw_response = client.do_request("GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/labels/")
    assert offset is not None
    raw_response_data = normalize_api_response(raw_response)
    from_idx = min(offset, len(raw_response_data))
    to_idx = min(offset + limit, len(raw_response_data))  # type: ignore

    labels = raw_response_data[from_idx:to_idx]

    context = createContext(labels, removeNull=True)
    outputs = {"Tanium.Label(val.id === obj.id)": context}
    headers = ["name", "description", "id", "indicatorCount", "signalCount", "createdAt", "updatedAt"]
    human_readable = tableToMarkdown("Labels", labels, headers=headers, headerTransform=pascalToSpace, removeNull=True)
    return human_readable, outputs, raw_response


def get_label(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get label by label id.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    label_id = data_args.get("label_id")
    raw_response = client.do_request("GET", f"/plugin/products/{client.get_threat_response_endpoint()}/api/v1/labels/{label_id}")

    raw_response_data = normalize_api_response(raw_response)
    context = createContext(raw_response_data, removeNull=True)
    outputs = {"Tanium.Label(val.id && val.id === obj.id)": context}
    headers = ["name", "description", "id", "indicatorCount", "signalCount", "createdAt", "updatedAt"]
    human_readable = tableToMarkdown(
        "Label information", raw_response_data, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


""" FILES COMMANDS FUNCTIONS """


def get_file_downloads(client, command_args) -> tuple[str, dict, Union[list, dict]]:
    """
    Implement the 'tanium-tr-list-file-downloads' command - get a list of all file evidences.

    Note:
        Given either hash, hostname, process_time_start as command arguments,
        the output of the connections will be filtered.

    Args:
        client (Client): client that connects to the Tanium-Threat-Response API.
        command_args (dict): command arguments entered by the user. (limit, offset, ip, status, hostname, platform).

    Returns:
        tuple (str, dict, list[dict]): table output, context output and raw response by the Tanium-Threat-Response API.
    """
    limit = arg_to_number(command_args.get("limit"))
    offset = arg_to_number(command_args.get("offset"))
    sort = command_args.get("sort")
    hashes = argToList(arg=command_args.get("hash"))
    hostnames = argToList(arg=command_args.get("hostname"))
    process_time_start = command_args.get("process_time_start")

    is_filtering_resp_required = hashes or hostnames or process_time_start
    filter_arguments = [(hostnames, "hostname"), (hashes, "hash"), ([process_time_start], "process_creation_time")]

    params = assign_params(limit=limit, offset=offset, sort=sort)
    raw_response = client.do_request("GET", "/plugin/products/threat-response/api/v1/filedownload", params=params)

    files = raw_response.get("fileEvidence", [])
    filtered_files = []

    for file in files:
        if evidence_type := file.get("evidenceType"):
            file["evidence_type"] = evidence_type
            del file["evidenceType"]
        if is_filtering_resp_required and are_filters_match_response_content(
            all_filter_arguments=filter_arguments, api_response=file
        ):
            filtered_files.append(file)

    if is_filtering_resp_required:
        files = filtered_files

    context = createContext(files, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.FileDownload(val.uuid === obj.uuid)": context}
    table_headers = ["uuid", "path", "evidenceType", "hostname", "processCreationTime", "size"]
    table = tableToMarkdown("File downloads", context, headers=table_headers, headerTransform=pascalToSpace, removeNull=True)
    return table, outputs, raw_response


def get_downloaded_file(client, data_args):
    """Download file by file id. Return file result.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    file_id = data_args.get("file_id")
    file_content, content_desc = client.do_request(
        "GET", f"plugin/products/threat-response/api/v1/filedownload/data/{file_id}", resp_type="content"
    )

    filename = re.findall("(?s)(?<=filename=)(.*$)", content_desc)[0]

    demisto.results(fileResult(filename, file_content))


def get_file_download_info(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get file download info by file id.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    file_id = data_args.get("file_id")
    raw_response = client.do_request("GET", f"/plugin/products/threat-response/api/v1/filedownload/{file_id}")

    file = raw_response.get("evidence", {})
    if evidence_type := file.get("evidenceType"):
        file["evidence_type"] = evidence_type
        del file["evidenceType"]

    context = createContext(file, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.FileDownload(val.uuid === obj.uuid)": context}
    headers = ["uuid", "path", "evidenceType", "hostname", "processCreationTime", "size"]
    human_readable = tableToMarkdown("File download", context, headers=headers, headerTransform=pascalToSpace, removeNull=True)
    return human_readable, outputs, raw_response


def request_file_download(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Request file download at the given path.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    cid = data_args.get("connection_id")
    path = data_args.get("path")
    body = {
        "path": path,
    }
    raw_response = client.do_request("POST", f"/plugin/products/threat-response/api/v1/conns/{cid}/file", data=body)

    filename = os.path.basename(path)
    hr = f"Download request of file {filename} has been sent successfully."
    context = {}
    if task_id := raw_response.get("taskInfo", {}).get("id"):
        hr += f" Task id: {task_id}."

        context = copy.deepcopy(raw_response.get("taskInfo"))
        context.update(context.get("metadata", {}))
        context["taskId"] = task_id

        del context["id"]
        del context["metadata"]

    outputs = {"Tanium.FileDownloadTask(val.taskId === obj.taskId && val.connection === obj.connection)": context}

    return hr, outputs, raw_response


def delete_file_download(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Delete file download from tanium system.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    file_id = data_args.get("file_id")
    client.do_request("DELETE", f"/plugin/products/threat-response/api/v1/filedownload/{file_id}")
    return f"Delete request of file with ID {file_id} has been sent successfully.", {}, {}


def list_files_in_dir(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """List all files in the given directory path.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    connection_id = data_args.get("connection_id")
    dir_path_name = data_args.get("path")
    dir_path = urllib.parse.quote(dir_path_name, safe="")
    limit = int(data_args.get("limit"))
    offset = int(data_args.get("offset"))

    raw_response = client.do_request("GET", f"/plugin/products/threat-response/api/v1/conns/{connection_id}/file/list/{dir_path}")

    files = raw_response.get("entries", [])
    from_idx = min(offset, len(files))
    to_idx = min(offset + limit, len(files))
    files = files[from_idx:to_idx]

    for file in files:
        file["connectionId"] = connection_id
        file["path"] = dir_path_name
        if created := file.get("createdDate"):
            file["createdDate"] = timestamp_to_datestring(created)
        if created := file.get("modifiedDate"):
            file["modifiedDate"] = timestamp_to_datestring(created)

    context = createContext(files, removeNull=True)
    outputs = {"Tanium.File(val.name === obj.name && val.connectionId === obj.connectionId)": context}
    headers = ["name", "path", "connectionId", "createdDate", "modifiedDate", "permissions", "size"]
    human_readable = tableToMarkdown(
        f"Files in directory `{dir_path_name}`", files, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def get_file_info(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get file info by file path.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    cid = data_args.get("connection_id")
    path_name = data_args.get("path")
    path = urllib.parse.quote(path_name, safe="")

    raw_response = client.do_request("GET", f"/plugin/products/threat-response/api/v1/conns/{cid}/file/info/{path}")

    context = copy.deepcopy(raw_response)
    info = context.get("info")
    context["connectionId"] = cid
    try:
        if created := info.get("createdDate"):
            info["createdDate"] = timestamp_to_datestring(created)
        if modified := info.get("modifiedDate"):
            info["modifiedDate"] = timestamp_to_datestring(modified)
    except ValueError:
        pass
    context.update(info)
    if info:
        del context["info"]

    outputs = {"Tanium.File(val.path === obj.path && val.connectionId === obj.connectionId)": context}
    headers = ["path", "name", "connectionId", "type", "createdDate", "modifiedDate"]
    human_readable = tableToMarkdown(
        f"Information for file `{path_name}`", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def delete_file_from_endpoint(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Delete file by file path from connection.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    cid = data_args.get("connection_id")
    full_path = data_args.get("path")
    path = urllib.parse.quote(full_path)
    client.do_request("DELETE", f"/plugin/products/threat-response/api/v1/conns/{cid}/file/delete/{path}")
    return f"Delete request of file {full_path} from endpoint {cid} has been sent successfully.", {}, {}


""" PROCESS COMMANDS FUNCTIONS """


def get_process_info(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get process info

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    connection_id = data_args.get("connection_id")
    ptid = data_args.get("ptid")
    raw_response = client.do_request(
        "GET", f"/plugin/products/threat-response/api/v1/conns/{connection_id}/processtrees/{ptid}", params={"context": "node"}
    )

    context = createContext(raw_response, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.ProcessInfo(val.id === obj.id)": context}
    headers = ["pid", "processTableId", "parentProcessTableId", "processPath"]
    human_readable = tableToMarkdown(
        f"{PROCESS_TEXT} {ptid}", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def get_events_by_process(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get events by type by proccess.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    limit = arg_to_number(data_args.get("limit"))
    offset = arg_to_number(data_args.get("offset"))
    cid = data_args.get("connection_id")
    ptid = data_args.get("ptid")
    event_type = data_args.get("type").lower()
    params = {"limit": limit, "offset": offset}
    if client.api_version == "4.x":
        params.update({"cid": cid, "ptid": ptid, "type": event_type})

    raw_response = client.do_request(
        "GET",
        f"plugin/products/threat-response/api/v1/conns/{cid}/processevents/{ptid}/{event_type}",
        params={"limit": limit, "offset": offset},
    )

    context = createContext(raw_response, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.ProcessEvent(val.id && val.id === obj.id)": context}
    headers = ["id", "detail", "type", "timestamp", "operation"]
    human_readable = tableToMarkdown(
        f"Events for process {ptid}", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def get_process_children(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get all process childrens data

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    limit = arg_to_number(data_args.get("limit"))
    offset = arg_to_number(data_args.get("offset"))
    connection_id = data_args.get("connection_id")
    ptid = data_args.get("ptid")
    raw_response = client.do_request(
        "GET",
        f"/plugin/products/threat-response/api/v1/conns/{connection_id}/processtrees/{ptid}",
        params={"context": "children", "limit": limit, "offset": offset},
    )

    context = createContext(raw_response, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.ProcessChildren(val.id === obj.id)": context}
    headers = ["pid", "processTableId", "parentProcessTableId"]
    human_readable = tableToMarkdown(
        f"{PROCESS_CHILDREN_TEXT} {ptid}", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def get_parent_process(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get parent process data, using ptid

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    connection_id = data_args.get("connection_id")
    ptid = data_args.get("ptid")
    raw_response = client.do_request(
        "GET", f"/plugin/products/threat-response/api/v1/conns/{connection_id}/processtrees/{ptid}", params={"context": "parent"}
    )

    context = createContext(raw_response, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.ProcessParent(val.id === obj.id)": context}
    headers = ["id", "pid", "processTableId", "parentProcessTableId"]
    human_readable = tableToMarkdown(
        f"{PARENT_PROCESS_TEXT} {ptid}", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def get_process_tree(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get all proccess related data - process tree

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    limit = arg_to_number(data_args.get("limit"))
    offset = arg_to_number(data_args.get("offset"))
    cid = data_args.get("connection_id")
    ptid = data_args.get("ptid")
    context = data_args.get("context")
    params = assign_params(context=context, limit=limit, offset=offset)
    raw_response = client.do_request(
        "GET", f"plugin/products/threat-response/api/v1/conns/{cid}/processtrees/{ptid}", params=params
    )

    headers = ["id", "pid", "processTableId", "parentProcessTableId"]

    context = createContext(raw_response, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))

    human_readable = tableToMarkdown(
        f"{PROCESS_TEXT} {ptid}", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )

    outputs = {"Tanium.ProcessTree(val.id && val.id === obj.id)": context}

    return human_readable, outputs, raw_response


""" EVIDENCE COMMANDS FUNCTIONS """


def list_evidence(client, commands_args) -> tuple[str, dict, Union[list, dict]]:
    """
    Implement the 'tanium-tr-event-evidence-list' command - get combined evidence across all types.

    Note:
        Given either type/hostname as command arguments, the output of the connections will be filtered.

    Args:
        client (Clinet): client that connects to the Tanium-Threat-Response API.
        command_args (dict): command arguments entered by the user. (limit, offset, hostname, sort, type).

    Returns:
        tuple (str, dict, list[dict]): table output, context output and raw response by the Tanium-Threat-Response API.
    """
    limit = arg_to_number(commands_args.get("limit", 50))
    offset = arg_to_number(commands_args.get("offset", 0))
    hostnames = argToList(arg=commands_args.get("hostname"))
    sort = commands_args.get("sort")
    type = commands_args.get("type")

    params = assign_params(sort=sort, type=type)
    raw_response = client.do_request("GET", "/plugin/products/threat-response/api/v1/evidence", params=params)

    filter_arguments = [(hostnames, "hostname")]
    assert offset is not None
    from_idx = min(offset, len(raw_response))
    to_idx = min(offset + limit, len(raw_response))  # type: ignore

    evidences = raw_response[from_idx:to_idx]
    filtered_evidences_by_hostname = []

    for item in evidences:
        if created := item.get("createdAt"):
            try:
                item["createdAt"] = timestamp_to_datestring(created)
            except ValueError:
                pass
        if hostnames and are_filters_match_response_content(all_filter_arguments=filter_arguments, api_response=item):
            filtered_evidences_by_hostname.append(item)

    if hostnames:
        evidences = filtered_evidences_by_hostname

    context = createContext(data=evidences, removeNull=True)
    outputs = {"Tanium.Evidence(val.uuid && val.uuid === obj.uuid)": context}
    table_headers = ["uuid", "name", "evidenceType", "hostname", "createdAt", "username"]
    table_output = tableToMarkdown(
        name="Evidence list", t=evidences, headers=table_headers, headerTransform=pascalToSpace, removeNull=True
    )
    return table_output, outputs, raw_response


def event_evidence_get_properties(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get evidences properties

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    evidence_properties = client.do_request("GET", "plugin/products/threat-response/api/v1/event-evidence/properties")

    outputs = {"Tanium.EvidenceProperties(val.value === obj.value)": evidence_properties}
    human_readable = tableToMarkdown("Evidence Properties", evidence_properties, headerTransform=pascalToSpace, removeNull=True)
    return human_readable, outputs, evidence_properties


def get_evidence_by_id(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get evidence by id

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    evidence_id = data_args.get("evidence_id")
    raw_response = client.do_request("GET", f"/plugin/products/threat-response/api/v1/event-evidence/{evidence_id}")

    evidence = raw_response.get("evidence", {})
    data = evidence.get("data", {})
    context = copy.deepcopy(evidence)
    context.update(data)
    if data:
        del context["data"]

    context = createContext(context, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.Evidence(val.uuid && val.uuid === obj.uuid)": context}
    headers = ["uuid", "timestamp", "hostname", "username", "summary", "evidenceType", "created", "processTableId"]
    human_readable = tableToMarkdown(
        "Evidence information", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


def create_evidence(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Create evidence from event, using client id and process table id

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    cid = data_args.get("connection_id")
    ptid = data_args.get("ptid")
    hostname = data_args.get("hostname")
    summary = data_args.get("summary")

    params = {"match": "all", "f1": "process_table_id", "o1": "eq", "v1": ptid}
    # call get-events-by-connection
    process_data = client.do_request(
        "GET", f"/plugin/products/threat-response/api/v1/conns/{cid}/views/process/events", params=params
    )

    if not process_data:
        raise ValueError("Invalid connection_id or ptid.")

    evidence = {
        "recorderId": ptid,
        "connectionId": cid,
        "hostname": hostname,
        "data": process_data[0],
        "eventType": "ProcessEvent",
        "summary": summary if summary else process_data[0].get("process_path"),
    }

    body = {"evidence": evidence}

    client.do_request("POST", "/plugin/products/threat-response/api/v1/event-evidence", data=body)
    return "Evidence have been created.", {}, {}


def delete_evidence(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Delete event evidence from tanuim, using evidence ids.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    evidence_ids = argToList(data_args.get("evidence_ids"))
    body = {"ids": evidence_ids}
    client.do_request("DELETE", "/plugin/products/threat-response/api/v1/event-evidence", data=body)
    return f'Evidence {",".join(evidence_ids)} has been deleted successfully.', {}, {}


def get_task_by_id(client, data_args) -> tuple[str, dict, Union[list, dict]]:
    """Get task status by task id.

    :type client: ``Client``
    :param client: client which connects to api.
    :type data_args: ``dict``
    :param data_args: request arguments.

    :return: human readable format, context output and the original raw response.
    :rtype: ``tuple``

    """
    task_id = data_args.get("task_id")
    raw_response = client.do_request("GET", f"/plugin/products/threat-response/api/v1/tasks/{task_id}")

    data = raw_response.get("data")
    context = copy.deepcopy(raw_response)
    context.update(data)
    if data:
        del context["data"]

    context = createContext(context, removeNull=True)
    outputs = {"Tanium.Task(val.id === obj.id)": context}
    headers = ["id", "status"]
    human_readable = tableToMarkdown("Task information", context, headers=headers, headerTransform=pascalToSpace, removeNull=True)
    return human_readable, outputs, raw_response


def get_system_status(client, command_args) -> tuple[str, dict, Union[list, dict]]:
    """
    Implement the 'tanium-tr-get-system-status' command - get system status, to get client-id for
    `create-connection` command.

    Note:
        Given either ip/status/hostname/platform as command arguments, the output of the connections will be filtered.

    Args:
        client (Client): client that connects to the Tanium-Threat-Response API.
        command_args (dict): command arguments entered by the user. (limit, offset, ip, status, hostname, platform).

    Returns:
        tuple (str, dict, list[dict]): table output, context output and raw response by the Tanium-Threat-Response API.
    """
    limit = arg_to_number(command_args.get("limit", 50))
    offset = arg_to_number(command_args.get("offset", 0))
    statuses = argToList(arg=command_args.get("status"))
    hostnames = argToList(arg=command_args.get("hostname"))
    ipaddrs_client = argToList(arg=command_args.get("ip_client"))
    ipaddrs_server = argToList(arg=command_args.get("ip_server"))
    port = arg_to_number(arg=command_args.get("port"))

    is_resp_filtering_required = statuses or hostnames or ipaddrs_client or ipaddrs_client or ipaddrs_server or port
    filter_arguments = [
        (statuses, "status"),
        (hostnames, "host_name"),
        (ipaddrs_client, "ipaddress_client"),
        (ipaddrs_server, "ipaddress_server"),
        ([port], "port_number"),
    ]

    raw_response = client.do_request("GET", "/api/v2/system_status")
    data = raw_response.get("data", [{}])
    active_computers = []
    assert offset is not None
    from_idx = min(offset, len(data))
    to_idx = min(offset + limit, len(data))  # type: ignore

    for item in data[from_idx:to_idx]:
        if client_id := item.get("computer_id"):
            item["client_id"] = client_id
            if is_resp_filtering_required:
                if are_filters_match_response_content(all_filter_arguments=filter_arguments, api_response=item):
                    active_computers.append(item)
            else:
                active_computers.append(item)

    context = createContext(active_computers, removeNull=True, keyTransform=lambda x: underscoreToCamelCase(x, upper_camel=False))
    outputs = {"Tanium.SystemStatus(val.clientId === obj.clientId)": context}
    headers = ["hostName", "clientId", "ipaddressClient", "ipaddressServer", "portNumber"]
    human_readable = tableToMarkdown(
        "Reporting clients", context, headers=headers, headerTransform=pascalToSpace, removeNull=True
    )
    return human_readable, outputs, raw_response


""" COMMANDS MANAGER / SWITCH PANEL """


def main():
    params = demisto.params()
    username = params.get("credentials", {}).get("identifier")
    password = params.get("credentials", {}).get("password")

    # Remove proxy if not set to true in params
    handle_proxy()
    command = demisto.command()

    client = Client(
        params.get("url").strip("/"),
        username,
        password,
        api_token=password if "_token" in username else None,
        verify=not params.get("insecure", False),
        api_version=params.get("api_version", "3.x"),
    )

    demisto.info(f"Command being called is {command}")

    commands = {
        "test-module": test_module,
        "tanium-tr-get-intel-doc-by-id": get_intel_doc,
        "tanium-tr-list-intel-docs": get_intel_docs,
        "tanium-tr-intel-docs-labels-list": get_intel_docs_labels_list,
        "tanium-tr-intel-docs-add-label": add_intel_docs_label,
        "tanium-tr-intel-docs-remove-label": remove_intel_docs_label,
        "tanium-tr-intel-doc-create": create_intel_doc,
        "tanium-tr-intel-doc-update": update_intel_doc,
        "tanium-tr-intel-doc-delete": delete_intel_doc,
        "tanium-tr-intel-deploy": deploy_intel,
        "tanium-tr-intel-deploy-status": get_deploy_status,
        "tanium-tr-start-quick-scan": start_quick_scan,
        "tanium-tr-list-alerts": get_alerts,
        "tanium-tr-get-alert-by-id": get_alert,
        "tanium-tr-alert-update-state": alert_update_state,
        "tanium-tr-create-snapshot": create_snapshot,
        "tanium-tr-delete-snapshot": delete_snapshot,
        "tanium-tr-list-snapshots": list_snapshots,
        "tanium-tr-delete-local-snapshot": delete_local_snapshot,
        "tanium-tr-list-connections": get_connections,
        "tanium-tr-create-connection": create_connection,
        "tanium-tr-delete-connection": delete_connection,
        "tanium-tr-close-connection": close_connection,
        "tanium-tr-list-labels": get_labels,
        "tanium-tr-get-label-by-id": get_label,
        "tanium-tr-list-events-by-connection": get_events_by_connection,
        "tanium-tr-get-events-by-process": get_events_by_process,
        "tanium-tr-get-process-info": get_process_info,
        "tanium-tr-get-process-children": get_process_children,
        "tanium-tr-get-parent-process": get_parent_process,
        "tanium-tr-get-process-tree": get_process_tree,
        "tanium-tr-event-evidence-list": list_evidence,
        "tanium-tr-event-evidence-get-properties": event_evidence_get_properties,
        "tanium-tr-get-evidence-by-id": get_evidence_by_id,
        "tanium-tr-create-evidence": create_evidence,
        "tanium-tr-delete-evidence": delete_evidence,
        "tanium-tr-list-file-downloads": get_file_downloads,
        "tanium-tr-get-file-download-info": get_file_download_info,
        "tanium-tr-request-file-download": request_file_download,
        "tanium-tr-delete-file-download": delete_file_download,
        "tanium-tr-list-files-in-directory": list_files_in_dir,
        "tanium-tr-get-file-info": get_file_info,
        "tanium-tr-delete-file-from-endpoint": delete_file_from_endpoint,
        "tanium-tr-get-task-by-id": get_task_by_id,
        "tanium-tr-get-system-status": get_system_status,
        "tanium-tr-get-response-actions": get_response_actions,
        "tanium-tr-response-action-gather-snapshot": response_action_gather_snapshot,
    }

    try:
        if command == "fetch-incidents":
            # demisto.getLastRun() will returns an obj with the previous run in it.
            last_run = demisto.getLastRun()
            alerts_states_to_retrieve = demisto.params().get("filter_alerts_by_state")
            filter_label_name = demisto.params().get("filter_by_label_name", "")
            first_fetch = demisto.params().get("first_fetch")
            max_fetch = int(demisto.params().get("max_fetch", "50"))

            incidents, next_run = fetch_incidents(
                client, alerts_states_to_retrieve, filter_label_name, last_run, first_fetch, max_fetch
            )

            demisto.setLastRun(next_run)
            demisto.incidents(incidents)

        if command == "tanium-tr-get-downloaded-file":
            get_downloaded_file(client, demisto.args())

        if command in commands:
            human_readable, outputs, raw_response = commands[command](client, demisto.args())
            return_results(results=CommandResults(readable_output=human_readable, outputs=outputs, raw_response=raw_response))

    except Exception as e:
        if command == "fetch-incidents":
            LOG(traceback.format_exc())
            LOG.print_log()
            raise

        else:
            error_msg = str(e)
            if command in COMMANDS_DEPEND_ON_CONNECTIVITY:
                error_msg += DEPENDENT_COMMANDS_ERROR_MSG
            return_error(f"Error in Tanium Threat Response Integration: {error_msg}", traceback.format_exc())


if __name__ in ("__builtin__", "builtins", "__main__"):
    main()

Id	Detail	Type	Timestamp	Operation
72057594038510294	4428: C:\test.exe	Process	2021-07-09 12:20:05.490	CreateChild
72057594038510295	1792: C:\test.exe	Process	2021-07-09 12:20:05.541	CreateChild

Pid	Process Table Id	Parent Process Table Id
5284	72057594038528483	72057594038528485
2856	72057594038528482	72057594038528485

Uuid	Name	Evidence Type	Hostname	Created At	Username
832dec40-1cc2-4e53-881a-7f61cba835bc	host1.db	snapshot	host1	2021-10-06T06:40:48.297Z	administrator
340a3ac4-560d-430f-bd50-96615d763171	host2.db	snapshot	host2	2021-10-06T06:42:07.010Z	administrator
cf4d8628-8527-4014-8ed2-bdca6c592488	host3.db	snapshot	host3	2021-10-07T12:15:30.711Z	administrator

Type	Value
MD5Hash	92ee791a630830452485e8e375f8db35
MD5Hash	e1bce838cd2695999ab34215bf94b501
MD5Hash	0e1853d3339d2963d2bc6ac1fdc1c811
MD5Hash	41b0ade03cd365a5cc99f748c5ffcadc
MD5Hash	a9a89cb1838373c365f2b8af72b1f1c2

Name	Path	Connection Id	Created Date	Modified Date	Permissions	Size
ChromeSetup.exe	C:\Users\Administrator\Desktop\	remote:hostname:123:	2020-02-06T08:34:17.000Z	2018-08-12T11:11:02.000Z	438	1130840
test.txt	C:\Users\Administrator\Desktop\	remote:hostname:123:	2020-01-07T11:53:20.000Z	2020-01-07T11:53:46.000Z	438	11

Host Name	Client Id	Ipaddress Client	Ipaddress Server	Port Number
taniumlinux	11111	1.1.1.1	1.1.1.1	17472
hostname1	222222	1.2.3.4	1.2.3.4	17472