Tanium Threat Response v2

Use the Tanium Threat Response integration to manage endpoint processes, evidence, alerts, files, snapshots, and connections. This integration works with Tanium Threat Response version 3.0.159 and above.

Endpoint · Tanium Threat Response

Configuration parameters

  • url — Hostname, IP address, or server URL (required)
  • credentials — Username
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Maximum number of incidents to fetch each time
  • filter_alerts_by_state — Alert states to filter by in fetch incidents command. Empty list won't filter the incidents by state.
  • filter_by_label_name — Label name to filter by in fetch incidents command. Leave empty to not filter the incidents by label name.
  • api_version — API Version
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval

Commands (47)

  • tanium-tr-alert-update-state

    Updates the state of the specified alerts.

  • tanium-tr-close-connection

    Closes a connection by connection ID.

  • tanium-tr-create-connection

    Creates a local or remote connection.

  • tanium-tr-create-evidence

    Creates event evidence from process.

  • tanium-tr-create-snapshot

    Captures a new snapshot by connection ID.

  • tanium-tr-delete-connection

    Deletes a connection by connection ID.

  • tanium-tr-delete-evidence

    Deletes event evidences from Tanium.

  • tanium-tr-delete-file-download

    Deletes a file download.

  • tanium-tr-delete-file-from-endpoint

    Deletes a file from the given endpoint.

  • tanium-tr-delete-local-snapshot

    Deletes a local snapshot by connection ID.

  • tanium-tr-delete-snapshot

    Deletes a snapshot by connection name and snapshot ID.

  • tanium-tr-event-evidence-get-properties

    Returns event evidence properties for IOC generation.

  • tanium-tr-event-evidence-list

    Returns a list of all available event evidences in the system.

  • tanium-tr-get-alert-by-id

    Returns an alert object based on alert ID.

  • tanium-tr-get-downloaded-file

    Gets the actual content of a downloaded file by file ID. Downloaded file password: `infected`.

  • tanium-tr-get-events-by-process

    Gets the events for a process.

  • tanium-tr-get-evidence-by-id

    Gets event evidence by evidence ID.

  • tanium-tr-get-file-download-info

    Gets the metadata of a file download.

  • tanium-tr-get-file-info

    Gets information about a file from a remote connection.

  • tanium-tr-get-intel-doc-by-id

    Returns an intel document object based on ID.

  • tanium-tr-get-label-by-id

    Returns a label object based on label ID.

  • tanium-tr-get-parent-process

    Gets information for the parent process.

  • tanium-tr-get-process-children

    Gets the children of this process instance.

  • tanium-tr-get-process-info

    Get information for a process.

  • tanium-tr-get-process-tree

    Gets the process tree for the process instance.

  • tanium-tr-get-response-actions

    Returns the Response Actions matching the specified filters.

  • tanium-tr-get-system-status

    Gets system status, including connections, client IDs, hostnames, and IPs.

  • tanium-tr-get-task-by-id

    Get task by ID.

  • tanium-tr-intel-deploy

    Deploys intel using the service account context.

  • tanium-tr-intel-deploy-status

    Displays status of last intel deployment.

  • tanium-tr-intel-doc-create

    Add a new intel document to the system by providing its document contents.

  • tanium-tr-intel-doc-delete

    Remove an intel document from the system by providing its ID.

  • tanium-tr-intel-doc-update

    Update the contents of an existing intel document by providing the document contents.

  • tanium-tr-intel-docs-add-label

    Create a new label association for the identified intel document.

  • tanium-tr-intel-docs-labels-list

    List all labels for the identified intel document.

  • tanium-tr-intel-docs-remove-label

    Delete a label association for the identified intel document.

  • tanium-tr-list-alerts

    Returns a comma-separated list of all alerts.

  • tanium-tr-list-connections

    Returns a list of all connections.

  • tanium-tr-list-events-by-connection

    Queries events for a connection.

  • tanium-tr-list-file-downloads

    Returns all downloaded files in the system.

  • tanium-tr-list-files-in-directory

    Gets a list of files in the given directory.

  • tanium-tr-list-intel-docs

    Returns a comma-separated list of all intel documents.

  • tanium-tr-list-labels

    Returns all available labels in the system.

  • tanium-tr-list-snapshots

    Returns all local snapshots of a single connection.

  • tanium-tr-request-file-download

    Requests a new file download.

  • tanium-tr-response-action-gather-snapshot

    Creates a "gatherSnapshot" Response Action for the specified host.

  • tanium-tr-start-quick-scan

    Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.