Tanium Threat Response v2

Use the Tanium Threat Response integration to manage endpoint processes, evidence, alerts, files, snapshots, and connections. This integration works with Tanium Threat Response version 3.0.159 and above.

Endpoint · Tanium Threat Response

Details

IDTanium Threat Response v2
ProviderTanium
CategoryEndpoint
From Version6.0.0
Docker Imagedemisto/lxml:1.0.0.10170191
Supported ModulesAgentix XSIAM

README

Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version 3.0.159 and above.
This integration was integrated and tested with versions 3.5.284 and 4.x of Tanium Threat Response v2.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Tanium Threat Response v2 in Cortex

Parameter Required
Hostname, IP address, or server URL True
Username False
Password False
Fetch incidents False
Incident type False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) False
Maximum number of incidents to fetch each time False
Alert states to filter by in fetch incidents command. Empty list won’t filter the incidents by state. False
Trust any certificate (not secure) False
Use system proxy settings False
API Version False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

tanium-tr-get-intel-doc-by-id

Returns an intel document object based on ID.

Base Command

tanium-tr-get-intel-doc-by-id

Input

Argument Name Description Required
intel_doc_id The intel document ID. Required

Context Output

Path Type Description
Tanium.IntelDoc.AlertCount Number The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt Date The date at which this intel was first added to the system.
Tanium.IntelDoc.Description String The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID Number The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds Number The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name String The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount Number The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt Date The date when this intel was last updated.

Command Example

!tanium-tr-get-intel-doc-by-id intel_doc_id=509

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "Compiled": "{\"expressions\":[],\"terms\":[{\"condition\":\"contains\",\"negate\":false,\"value\":\"RouteTheCall\",\"object\":\"process\",\"property\":\"command_line\"},{\"condition\":\"ends with\",\"negate\":false,\"value\":\"\\\\rundll32.exe\",\"object\":\"process\",\"property\":\"path\"},{\"condition\":\"contains\",\"negate\":false,\"value\":\"zipfldr\",\"object\":\"process\",\"property\":\"command_line\"}],\"operator\":\"and\",\"text\":\"process.path ends with '\\\\\\\\rundll32.exe' AND process.command_line contains 'zipfldr' AND process.command_line contains 'RouteTheCall'\",\"syntax_version\":1}",
            "Contents": "{\"id\":\"Zipfldr Library Proxy Execution via RouteTheCall\",\"name\":\"Zipfldr Library Proxy Execution via RouteTheCall\",\"description\":\"Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary.\",\"contents\":\"process.path ends with '\\\\\\\\rundll32.exe' AND process.command_line contains 'zipfldr' AND process.command_line contains 'RouteTheCall'\",\"syntax_version\":1,\"mitreAttack\":{\"techniques\":[{\"id\":\"T1218\",\"name\":\"Signed Binary Proxy Execution\"},{\"id\":\"T1218.011\",\"name\":\"Signed Binary Proxy Execution: Rundll32\"},{\"id\":\"T1059\",\"name\":\"Command and Scripting Interpreter\"},{\"id\":\"T1059.003\",\"name\":\"Command and Scripting Interpreter: Windows Command Shell\"}]},\"platforms\":[\"windows\"]}",
            "CreatedAt": "2021-08-31T21:06:02.932Z",
            "Description": "Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary.",
            "ID": 509,
            "IntrinsicId": "Zipfldr Library Proxy Execution via RouteTheCall",
            "IsSchemaValid": true,
            "LabelIds": [
                2,
                7,
                11,
                16
            ],
            "Md5": "f3ddf06be9e182ae7ddc16192dc5b846",
            "MitreAttack": "{\"techniques\":[{\"id\":\"T1218\",\"name\":\"Signed Binary Proxy Execution\"},{\"id\":\"T1218.011\",\"name\":\"Signed Binary Proxy Execution: Rundll32\"},{\"id\":\"T1059\",\"name\":\"Command and Scripting Interpreter\"},{\"id\":\"T1059.003\",\"name\":\"Command and Scripting Interpreter: Windows Command Shell\"}]}",
            "Name": "Zipfldr Library Proxy Execution via RouteTheCall",
            "Platforms": [
                "windows"
            ],
            "RevisionId": 1,
            "Size": 795,
            "SourceId": 2,
            "Type": "tanium-signal",
            "TypeVersion": "1.0",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-08-31T21:06:02.932Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Description Alert Count Unresolved Alert Count Created At Updated At Label Ids
509 Zipfldr Library Proxy Execution via RouteTheCall tanium-signal Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary. 0 0 2021-08-31T21:06:02.932Z 2021-08-31T21:06:02.932Z 2, 7, 11, 16

tanium-tr-list-intel-docs

Returns a list of all intel documents.

Base Command

tanium-tr-list-intel-docs

Input

Argument Name Description Required
limit The maximum number of intel documents to return. Default is 50. Optional
offset The offset number to begin listing intel documents. Default is 0. Optional
name The name of the intel document to show. Optional
description The description of the intel document to show. Optional
type The type of the intel document to show. Optional
label_id The label Id of the intel document to show. Optional
mitre_technique_id The mitre technique Id of the intel document to show. Optional

Context Output

Path Type Description
Tanium.IntelDoc.AlertCount Number The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt Date The date at which this intel was first added to the system.
Tanium.IntelDoc.Description String The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID Number The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds Number The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name String The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount Number The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt Date The date when this intel was last updated.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "IntelDoc": [
            {
                "AlertCount": 0,
                "CreatedAt": "2021-09-26T20:42:12.761Z",
                "ID": 538,
                "IntrinsicId": "file",
                "IsSchemaValid": true,
                "Md5": "45d4f6197504b0cf17ca4425b27c4123",
                "Name": "file",
                "RevisionId": 1,
                "Size": 2211,
                "SourceId": 1,
                "Type": "yara",
                "TypeVersion": "3",
                "UnresolvedAlertCount": 0,
                "UpdatedAt": "2021-09-26T20:42:12.761Z"
            },
            {
                "AlertCount": 0,
                "CreatedAt": "2021-09-26T15:40:18.967Z",
                "ID": 537,
                "IntrinsicId": "111-72ad-40cc-abbf-90846fa4afec",
                "IsSchemaValid": true,
                "Md5": "45d4f619750434cf17ca4425b27c4774",
                "Name": "111-72ad-40cc-abbf-90846fa4a123",
                "RevisionId": 11,
                "Size": 2211,
                "SourceId": 1,
                "Type": "openioc",
                "TypeVersion": "1.0",
                "UnresolvedAlertCount": 0,
                "UpdatedAt": "2021-09-26T20:47:53.586Z"
            }
        ]
    }
}

Human Readable Output

Intel docs

ID Name Type Alert Count Unresolved Alert Count Created At Updated At Label Ids
538 file yara 0 0 2021-09-26T20:42:12.761Z 2021-09-26T20:42:12.761Z  
537 111-72ad-40cc-abbf-90846fa4afec openioc 0 0 2021-09-26T15:40:18.967Z 2021-09-26T20:47:53.586Z  
536 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:18:57.462Z 2021-09-26T08:18:57.462Z  
535 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:30.717Z 2021-09-26T08:11:30.717Z  
534 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:25.484Z 2021-09-26T08:11:25.484Z  
533 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:20.802Z 2021-09-26T08:11:20.802Z  
532 file.yaraaaaaa yara 0 0 2021-09-26T08:09:54.927Z 2021-09-26T08:09:54.927Z  
531 file.yaraa yara 0 0 2021-09-26T08:09:52.564Z 2021-09-26T08:09:52.564Z  
530 yar yara 0 0 2021-09-26T08:09:28.253Z 2021-09-26T08:09:28.253Z  
529 file.yar yara 0 0 2021-09-23T15:35:01.784Z 2021-09-23T15:35:01.784Z  
528 file.stix yara 0 0 2021-09-23T15:33:49.920Z 2021-09-23T15:33:49.920Z  
527 file.stix yara 0 0 2021-09-23T15:32:25.580Z 2021-09-23T15:32:25.580Z  
526 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T15:00:32.350Z 2021-09-23T15:00:32.350Z  
525 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:41:32.831Z 2021-09-23T14:41:32.831Z  
524 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:41:07.857Z 2021-09-23T14:41:07.857Z  
523 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:32:26.310Z 2021-09-23T14:32:26.310Z  
522 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T13:47:31.088Z 2021-09-23T13:47:31.088Z  
521 STUXNET VIRUS (METHODOLOGY) openioc 0 0 2021-09-23T12:18:03.865Z 2021-09-23T12:18:03.865Z  
520 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T12:04:08.473Z 2021-09-23T12:04:08.473Z  
519 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T12:03:50.295Z 2021-09-23T12:03:50.295Z  
518 New Test5 openioc 0 0 2021-09-23T12:03:10.503Z 2021-09-23T12:03:10.503Z  
517 New Test5 openioc 0 0 2021-09-23T07:21:07.201Z 2021-09-23T07:21:07.201Z  
516 New Test5 openioc 0 0 2021-09-22T16:27:09.399Z 2021-09-22T16:27:09.399Z  
515 New Test5 openioc 0 0 2021-09-22T07:52:58.242Z 2021-09-22T07:52:58.242Z  
514 New Test5 openioc 0 0 2021-09-22T07:47:43.503Z 2021-09-22T07:47:43.503Z  
513 RDP Enabled via Registry Modification tanium-signal 0 0 2021-09-22T07:47:02.110Z 2021-09-22T07:47:02.110Z  
512 New Test5 openioc 0 0 2021-09-22T07:17:26.951Z 2021-09-22T07:17:26.951Z  
511 New Test5 openioc 0 0 2021-09-19T06:33:12.579Z 2021-09-19T06:33:12.579Z  
510 file.yar yara 0 0 2021-09-12T14:02:03.769Z 2021-09-12T14:02:03.769Z  
509 Zipfldr Library Proxy Execution via RouteTheCall tanium-signal 0 0 2021-08-31T21:06:02.932Z 2021-08-31T21:06:02.932Z 2, 7, 11, 16
508 Url Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:02.639Z 2021-08-31T21:06:02.639Z 2, 7, 11, 16
507 Url Library Proxy Execution via FileProtocolHandler tanium-signal 0 0 2021-08-31T21:06:02.611Z 2021-08-31T21:06:02.611Z 2, 7, 11, 16
506 Shell32 Library Proxy Execution via ShellExec_RunDLL tanium-signal 0 0 2021-08-31T21:06:02.140Z 2021-08-31T21:06:02.140Z 2, 7, 11, 16
505 Shdocvw Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:02.116Z 2021-08-31T21:06:02.116Z 2, 7, 11, 16
504 Pcwutl Library Proxy Execution via LaunchApplication tanium-signal 0 0 2021-08-31T21:06:01.540Z 2021-08-31T21:06:01.540Z 2, 7, 11, 16
503 Ieframe Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:00.862Z 2021-08-31T21:06:00.862Z 2, 7, 11, 16
502 Reputation Malicious Hashes reputation 0 0 2021-08-19T06:54:59.350Z 2021-08-19T06:57:47.882Z  
501 file.yar yara 0 0 2021-07-28T12:37:29.611Z 2021-07-28T12:37:29.611Z  
500 file.yar yara 0 0 2021-07-28T12:35:41.367Z 2021-07-28T12:35:41.367Z  
499 file.yar yara 0 0 2021-07-28T12:35:39.670Z 2021-07-28T12:35:39.670Z  
498 Vssadmin Create Shadow Copy tanium-signal 0 0 2021-07-27T21:56:02.320Z 2021-07-27T21:56:02.320Z 2, 8, 16
497 Volume Shadow Copy Creation tanium-signal 0 0 2021-07-27T21:56:02.295Z 2021-07-27T21:56:02.295Z 2, 8, 16
496 Remote Proxy Execution tanium-signal 0 0 2021-07-27T21:56:01.712Z 2021-07-27T21:56:01.712Z 2, 7, 11, 16
495 Non-Ssms Spawned SQL Client Tools PowerShell Session tanium-signal 0 0 2021-07-27T21:56:01.246Z 2021-07-27T21:56:01.246Z 2, 7, 11, 16
494 Non-Microsoft Signed Print Spooler Driver tanium-signal 0 0 2021-07-27T21:56:01.227Z 2021-07-27T21:56:01.227Z 2, 6, 16
493 file.yar yara 0 0 2021-07-27T14:44:32.182Z 2021-07-27T14:44:32.182Z  
492 file.yar yara 0 0 2021-07-27T14:44:19.862Z 2021-07-27T14:44:19.862Z  
491 file.yar yara 0 0 2021-07-27T14:44:15.595Z 2021-07-27T14:44:15.595Z  
490 file.yar yara 0 0 2021-07-27T14:44:13.294Z 2021-07-27T14:44:13.294Z  
489 CybOX-re presented Indicator Created from OpenIOC File stix 0 0 2021-07-27T14:42:43.888Z 2021-07-27T14:42:43.888Z  

tanium-tr-list-alerts

Returns a list of all alerts.

Base Command

tanium-tr-list-alerts

Input

Argument Name Description Required
limit The maximum number of alerts to return. Default is 5. Optional
offset The offset number to begin listing alerts. Optional
computer_ip_address Filter alerts by the specified computer IP addresses. Optional
computer_name Filter alerts by the specified computer name. Optional
scan_config_id Filter alerts by the specified scan config ID. Optional
intel_doc_id Filter alerts by the specified intel document ID. Optional
severity Filter alerts by the specified severity. Optional
priority Filter alerts by the specified priority. Optional
type Filter alerts by the specified type. Optional
state Filter alerts by the specified state. Can be “Unresolved”, “In Progress”, “Dismissed” “Ignored”, or “Resolved”. Possible values are: Unresolved, In Progress, Ignored, Resolved, Dismissed. Optional

Context Output

Path Type Description
Tanium.Alert.Priority String The priority of the alert.
Tanium.Alert.ComputerName String The hostname of the computer that generated the alert.
Tanium.Alert.GUID String A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt Date The moment that the alert was generated.
Tanium.Alert.UpdatedAt Date The last time the alert state was updated.
Tanium.Alert.State String The current state of the alert. For example, “unresolved”, “inprogress”, and so on.
Tanium.Alert.ComputerIpAddress String The IP address of the computer that generated the alert.
Tanium.Alert.Type String The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID Number The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt Date The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId Number The intel document revision, if intelDocId is present.
Tanium.Alert.Severity String The severity of the alert.

Command Example

!tanium-tr-list-alerts limit=2

Context Example

{
    "Tanium": {
        "Alert": [
            {
                "AlertedAt": "2019-09-22T14:01:31.000Z",
                "ComputerIpAddress": "1.1.1.1",
                "ComputerName": "host0",
                "CreatedAt": "2019-09-22T14:01:59.768Z",
                "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
                "ID": 1,
                "IntelDocId": 64,
                "Priority": "high",
                "Severity": "info",
                "State": "Unresolved",
                "Type": "detect.match",
                "UpdatedAt": "2021-10-24T01:28:04.275Z"
            },
            {
                "AlertedAt": "2020-02-29T15:29:59.000Z",
                "ComputerIpAddress": "1.1.1.1",
                "ComputerName": "host0",
                "CreatedAt": "2020-02-29T15:30:29.893Z",
                "GUID": "626821e1-6b0a-4afb-a1f9-8fb7ef741736",
                "ID": 2,
                "IntelDocId": 17,
                "Priority": "high",
                "Severity": "info",
                "State": "Unresolved",
                "Type": "detect.match",
                "UpdatedAt": "2021-10-24T01:28:04.275Z"
            }
        ]
    }
}

Human Readable Output

Alerts

ID Type Severity Priority Alerted At Created At Updated At Computer Ip Address Computer Name GUID State Intel Doc Id
1 detect.match info high 2019-09-22T14:01:31.000Z 2019-09-22T14:01:59.768Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 a33e3482-556e-4e9d-bbbd-2fdbe330d492 Unresolved 64
2 detect.match info high 2020-02-29T15:29:59.000Z 2020-02-29T15:30:29.893Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 626821e1-6b0a-4afb-a1f9-8fb7ef741736 Unresolved 17

tanium-tr-get-alert-by-id

Returns an alert object based on alert ID.

Base Command

tanium-tr-get-alert-by-id

Input

Argument Name Description Required
alert_id The alert ID. Required

Context Output

Path Type Description
Tanium.Alert.Priority String The priority of the alert.
Tanium.Alert.ComputerName String The hostname of the computer that generated the alert.
Tanium.Alert.GUID String A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt Date The date when the alert was generated.
Tanium.Alert.UpdatedAt Date The date when the alert state was last updated.
Tanium.Alert.State String The current state of the alert. For example, “unresolved”, “inprogress”.
Tanium.Alert.ComputerIpAddress String The IP address of the computer that generated the alert.
Tanium.Alert.Type String The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID Number The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt Date The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId Number The intel document revision, if intelDocId is present.
Tanium.Alert.Severity String The severity of the alert.

Command Example

!tanium-tr-get-alert-by-id alert_id=1

Context Example

{
    "Tanium": {
        "Alert": {
            "AlertedAt": "2019-09-22T14:01:31.000Z",
            "ComputerIpAddress": "1.1.1.1",
            "ComputerName": "host0",
            "CreatedAt": "2019-09-22T14:01:59.768Z",
            "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
            "ID": 1,
            "IntelDocId": 64,
            "Priority": "high",
            "Severity": "info",
            "State": "Unresolved",
            "Type": "detect.match",
            "UpdatedAt": "2021-10-24T01:28:04.275Z"
        }
    }
}

Human Readable Output

Alert information

ID Type Severity Priority Alerted At Created At Updated At Computer Ip Address Computer Name GUID State Intel Doc Id
1 detect.match info high 2019-09-22T14:01:31.000Z 2019-09-22T14:01:59.768Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 a33e3482-556e-4e9d-bbbd-2fdbe330d492 Unresolved 64

tanium-tr-alert-update-state

Updates the state of the specified alerts.

Base Command

tanium-tr-alert-update-state

Input

Argument Name Description Required
alert_ids A comma-separated list of alert IDs to update. Required
state The new state for the alerts. Can be “Unresolved”, “In Progress”, “Dismissed”, “Ignored”, or “Resolved”. Possible values are: dismissed, unresolved, inprogress, ignored, resolved. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-alert-update-state alert_ids=1 state=resolved

Human Readable Output

Alert state updated to resolved.

tanium-tr-create-snapshot

Captures a new snapshot by connection id.

Base Command

tanium-tr-create-snapshot

Input

Argument Name Description Required
connection_id The connection id. Required

Context Output

Path Type Description
Tanium.SnapshotTask.connection String Connection id of the snapshot.
Tanium.SnapshotTask.startTime Date Snapshot start time.
Tanium.SnapshotTask.status String Snapshot creation task status.
Tanium.SnapshotTask.taskId Number Snapshot creation task id. You can get task status using `tanium-tr-get-task-by-id` command.

Command Example

!tanium-tr-create-snapshot connection_id=remote:hostname:123:

Context Example

{
    "Tanium": {
        "SnapshotTask": {
            "connection": "remote:hostname:123:",
            "startTime": "2021-10-07T12:22:29.550Z",
            "status": "STARTED",
            "taskId": 1177
        }
    }
}

Human Readable Output

Initiated snapshot creation request for remote:hostname:123:. Task id: 1177.

tanium-tr-delete-snapshot

Deletes a snapshot by connection name and snapshot ID.

Base Command

tanium-tr-delete-snapshot

Input

Argument Name Description Required
snapshot_ids The snapshot IDs to delete. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-snapshot snapshot_ids=eda5ddce-0f8c-48e8-8dd5-6aa18681d539,3893fa77-4829-4e48-9364-40a16ad6cc0f

Human Readable Output

Snapshot eda5ddce-0f8c-48e8-8dd5-6aa18681d539,3893fa77-4829-4e48-9364-40a16ad6cc0f deleted successfully.

tanium-tr-list-snapshots

Returns all local snapshots of a single connection.

Base Command

tanium-tr-list-snapshots

Input

Argument Name Description Required
limit The maximum number of local snapshots to return. Default is 50. Optional
offset The offset number to begin listing local snapshots. Default is 0. Optional

Context Output

Path Type Description
Tanium.Snapshot.size String The snapshot size.
Tanium.Snapshot.created String The snapshot creation date.
Tanium.Snapshot.completed String The snapshot completed date.
Tanium.Snapshot.name String The snapshot name.
Tanium.Snapshot.isUpload Boolean Is the snapshot uplaod.
Tanium.Snapshot.evidenceType String Evidence type.
Tanium.Snapshot.hostname String Hxstname of the snapshot.
Tanium.Snapshot.connectionId String The snapshot connection ID.
Tanium.Snapshot.recorderVersion String Recorder Version.
Tanium.Snapshot.uuid String The snapshot uuid.

Command Example

!tanium-tr-list-snapshots limit=2

Context Example

{
    "Tanium": {
        "Snapshot": [
            {
                "completed": "2021-10-06T06:42:03.260Z",
                "connectionId": "remote:hostname:123:",
                "created": "2021-10-06T06:40:48.297Z",
                "evidenceType": "snapshot",
                "hostname": "hostname2",
                "isUpload": false,
                "name": "host1-1633502448297.db",
                "recorderVersion": 2,
                "size": 152064000,
                "username": "administrator",
                "uuid": "832dec40-1cc2-4e53-881a-7f61cba835bc"
            },
            {
                "completed": "2021-10-06T06:43:21.474Z",
                "connectionId": "remote:hostname:123:",
                "created": "2021-10-06T06:42:07.010Z",
                "evidenceType": "snapshot",
                "hostname": "hostname1",
                "isUpload": false,
                "name": "host1-1633502527010.db",
                "recorderVersion": 2,
                "size": 152064000,
                "username": "administrator",
                "uuid": "340a3ac4-560d-430f-bd50-96615d763171"
            }
        ]
    }
}

Human Readable Output

Snapshots

Uuid Name Evidence Type Hostname Created
832dec40-1cc2-4e53-881a-7f61cba835bc host1-1633502448297.db snapshot hostname2 2021-10-06T06:40:48.297Z
340a3ac4-560d-430f-bd50-96615d763171 host2-1633502527010.db snapshot hostname1 2021-10-06T06:42:07.010Z

tanium-tr-delete-local-snapshot

Deletes a local snapshot by connection id.

Base Command

tanium-tr-delete-local-snapshot

Input

Argument Name Description Required
connection_id The connection id. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-local-snapshot connection_id=remote:hostname:123:

Human Readable Output

Local snapshot of connection remote:hostname:123: was deleted successfully.

tanium-tr-list-connections

Returns all connections.

Base Command

tanium-tr-list-connections

Input

Argument Name Description Required
limit The maximum number of connections to return. Default is 50. Optional
offset The offset number to begin listing connections. Default is 0. Optional
status Comma-seperated list of statuses to get the connections that match only those statuses, for example status=connected,waiting. Possible values are: disconnected, timeout, waiting, connected. Optional
ip Comma-seperated list of ips to get the connections that match only those ips, for example status=1.1.1.1,1.1.1.1. Optional
platform Comma-seperated list of platforms to get the connections that match only those platforms, for example platform=Linux,Windows. Optional
hostname Comma-seperated list of hostnames to get the connections that match only those hostnames, for example hostname=host1,host2. Optional

Context Output

Path Type Description
Tanium.Connection.id String The connection id.
Tanium.Connection.initiatedAt Date Time when the connection was first created.
Tanium.Connection.hostname String The connection hostname.
Tanium.Connection.status String Current connection state.
Tanium.Connection.platform String The connection operating system.
Tanium.Connection.ip String The connection ip.
Tanium.Connection.connectedAt String Time when the connection was connected.
Tanium.Connection.message String The connection message describing the status.
Tanium.Connection.personaId String The connection persona Id.
Tanium.Connection.clientId String The client id.
Tanium.Connection.userId String The connection user id.
Tanium.Connection.eid String The connection eid.
Tanium.Connection.hasTools Boolean Has connection tools.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "Connection": [
            {
                "clientId": "123",
                "connectedAt": "2021-09-22T12:08:39.000Z",
                "eid": "2",
                "hasTools": true,
                "hostname": "hostname",
                "id": "remote:hostname:123:",
                "initiatedAt": "2021-09-22T12:08:35.000Z",
                "ip": "1.1.1.1",
                "message": "The connection has been disconnected.",
                "personaId": 0,
                "platform": "Windows",
                "status": "disconnected",
                "userId": "1"
            },
            {
                "clientId": "11111",
                "hostname": "localhost",
                "id": "remote:localhost:11111:",
                "initiatedAt": "2021-09-09T08:17:38.000Z",
                "ip": "1.2.3.4",
                "message": "The connection has timed out.",
                "personaId": 0,
                "platform": "Linux",
                "status": "timeout",
                "userId": "1"
            }
        ]
    }
}

Human Readable Output

Connections

Id Status Hostname Message Ip Platform Connected At
rremote:hostname:123: disconnected hostname The connection has been disconnected. 1.1.1.1 Windows 2021-09-22T12:08:39.000Z
remote:localhost:1111: timeout localhost The connection has timed out. 1.2.3.4 Linux  

tanium-tr-create-connection

Creates a local or remote connection.

Base Command

tanium-tr-create-connection

Input

Argument Name Description Required
client_id Client id. Use tanium-tr-get-system-status to get all possible client_ids. Required
ip IP address to connect. Use tanium-tr-get-system-status to get all possible ips. Required
platform Commputers platform - “Windows”, “Linux”, etc. Required
hostname Hostname of the computer to connect. Use tanium-tr-get-system-status to get all possible hostnames. Required

Context Output

Path Type Description
Tanium.Connection.id String New connection id.

Command Example

!tanium-tr-create-connection client_id=123 ip=1.1.1.1 hostname=host1 platform=Windows

Context Example

{
    "Tanium": {
        "Connection": {
            "id": "remote:host1:123:"
        }
    }
}

Human Readable Output

Initiated connection request to “remote:host1:123:”.

tanium-tr-delete-connection

Deletes a connection by connection id.

Base Command

tanium-tr-delete-connection

Input

Argument Name Description Required
connection_id The connection id. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-connection connection_id=remote:host1:123:

Human Readable Output

Connection remote:host1:123: deleted successfully.

tanium-tr-close-connection

Closes a connection by connection id.

Base Command

tanium-tr-close-connection

Input

Argument Name Description Required
connection_id The connection id. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-close-connection connection_id=remote:host1:123:

Human Readable Output

Connection remote:host1:123: closed successfully.

tanium-tr-list-labels

Returns all available labels in the system.

Base Command

tanium-tr-list-labels

Input

Argument Name Description Required
limit The maximum number of labels to return. Default is 50. Optional
offset The offset number to begin listing labels. Default is 0. Optional

Context Output

Path Type Description
Tanium.Label.createdAt Date The date when this label was created.
Tanium.Label.description String An extended description of the label.
Tanium.Label.id Number The unique identifier for this label.
Tanium.Label.indicatorCount Number The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.name String The display name of the label.
Tanium.Label.signalCount Number The number of Tanium Signal documents associated with this label.
Tanium.Label.updatedAt Date The date when this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-list-labels limit=2

Context Example

{
    "Tanium": {
        "Label": [
            {
                "createdAt": "2019-07-31T18:46:28.629Z",
                "description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                "id": 1,
                "indicatorCount": 0,
                "name": "Alpha",
                "signalCount": 0,
                "updatedAt": "2019-07-31T18:46:28.629Z"
            },
            {
                "createdAt": "2019-07-31T18:46:28.629Z",
                "description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                "id": 2,
                "indicatorCount": 0,
                "name": "Beta",
                "signalCount": 420,
                "updatedAt": "2019-07-31T18:46:28.629Z"
            }
        ]
    }
}

Human Readable Output

Labels

Name Description Id Indicator Count Signal Count Created At Updated At
Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 1 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 2 0 420 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

tanium-tr-get-label-by-id

Returns a label object based on label ID.

Base Command

tanium-tr-get-label-by-id

Input

Argument Name Description Required
label_id The label ID. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs). Required

Context Output

Path Type Description
Tanium.Label.createdAt Date The date when this label was created.
Tanium.Label.description String An extended description of the label.
Tanium.Label.id Number The unique identifier for this label.
Tanium.Label.indicatorCount Number The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.name String The display name of the label.
Tanium.Label.signalCount Number The number of Tanium Signal documents associated with this label.
Tanium.Label.updatedAt Date The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-get-label-by-id label_id=1

Context Example

{
    "Tanium": {
        "Label": {
            "createdAt": "2019-07-31T18:46:28.629Z",
            "description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
            "id": 1,
            "indicatorCount": 0,
            "name": "Alpha",
            "signalCount": 0,
            "updatedAt": "2019-07-31T18:46:28.629Z"
        }
    }
}

Human Readable Output

Label information

Name Description Id Indicator Count Signal Count Created At Updated At
Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 1 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

tanium-tr-list-file-downloads

Returns all downloaded files in the system.

Base Command

tanium-tr-list-file-downloads

Input

Argument Name Description Required
limit The maximum number of files to return. Default is 50. Optional
offset Offset to start getting file downloads. Default is 0. Optional
sort Column which to sort by. Optional
hostname Comma-seperated list of hostnames to get the downloaded files that match only those hostnames, for example hostname=host1,host2. Optional
hash Comma-seperated list of hashes to get the downloaded files that match only those hashes, for example hash=123,456. Optional
process_time_start Get the downloaded files that match only to the process time start, for example process_time_start=2019-09-03T17:51:40.000Z. Optional

Context Output

Path Type Description
Tanium.FileDownload.size Number The size of the file, in bytes.
Tanium.FileDownload.path String The path of the file.
Tanium.FileDownload.downloaded Date The date when this file was downloaded.
Tanium.FileDownload.hostname String The hostname of the downloaded file.
Tanium.FileDownload.processCreationTime Date The date when the file was created.
Tanium.FileDownload.hash String The file hash.
Tanium.FileDownload.uuid Number The downloaded file uuid.
Tanium.FileDownload.lastModified Date The date when the file was last modified.
Tanium.FileDownload.createdBy String The user that created this file.
Tanium.FileDownload.createdByProc String The process path that created this file.
Tanium.FileDownload.lastModifiedBy String The user that last modified this file.
Tanium.FileDownload.lastModifiedByProc String The process path that modified this file.
Tanium.FileDownload.evidenceType String The evidence type - file.

Command Example

!tanium-tr-list-file-downloads limit=2

Context Example

{
    "Tanium": {
        "FileDownload": [
            {
                "downloaded": "2020-01-15 13:04:02.827",
                "evidenceType": "file",
                "hash": "99297a0e626ca092ff1884ad28f54453",
                "hostname": "host1",
                "lastModified": "2020-01-15T08:57:19.000Z",
                "path": "C:\\Program Files (x86)\\log1.txt",
                "processCreationTime": "2019-09-03T17:51:40.000Z",
                "size": 10485904,
                "uuid": "c0531415-87a6-4d28-a226-b485784b1881"
            },
            {
                "downloaded": "2020-01-15 18:17:10.595",
                "evidenceType": "file",
                "hash": "7d1677decbfaf1598ccd745fc197eb1c",
                "hostname": "host2",
                "lastModified": "2020-01-13T13:11:35.000Z",
                "path": "C:\\Program Files (x86)\\log8.txt",
                "processCreationTime": "2019-09-03T17:51:40.000Z",
                "size": 10485940,
                "uuid": "3043ef9c-78a9-4f19-8fb9-ddbab202d03b"
            }
        ]
    }
}

Human Readable Output

File downloads

Uuid Path Evidence Type Hostname Process Creation Time Size
c0531415-87a6-4d28-a226-b485784b1881 C:\Program Files (x86)\log1.txt file host1 2019-09-03T17:51:40.000Z 10485904
3043ef9c-78a9-4f19-8fb9-ddbab202d03b C:\Program Files (x86)\log8.txt file host2 2019-09-03T17:51:40.000Z 10485940

tanium-tr-get-downloaded-file

Gets the actual content of a downloaded file by file ID. Downloaded file password: infected.

Base Command

tanium-tr-get-downloaded-file

Input

Argument Name Description Required
file_id The file ID. Required

Context Output

Path Type Description
File.EntryID String File entry ID.
File.Extension String The extension of the file.
File.Info String Information about the file.
File.MD5 String The MD5 hash of the file.
File.Name String The name of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.SHA512 String The SHA512 hash of the file.
File.SSDeep String The SSDeep hash of the file (same as displayed in file entries).
File.Size Number The size of the file in bytes.
File.Type String The file type.

Command Example

!tanium-tr-get-downloaded-file file_id=c0531415-87a6-4d28-a226-b485784b1881

Context Example

{
    "File": {
        "EntryID": "7608@e99f97d1-7225-4c75-896c-3c960febbe8c",
        "Extension": "zip",
        "Info": "application/zip",
        "MD5": "217cac2e10c1d11ed55ab2ede6bdb0ea",
        "Name": "c0531415-87a6-4d28-a226-b485784b1881.zip",
        "SHA1": "20808150526b092f5e4e19c82af2e9b2a1303e89",
        "SHA256": "40c605face875cd53f07c1301ffc9fce0ed5b12a65c729fe73895e44cdcdebdf",
        "SHA512": "50415634cae426da763a39532f3d22eeea5a79a8868044f6b3ffca8b528cce92cbe9f4d7b98d6d1cb49a705f3182b2c43f84f628acd748fb78e6cca85939b10c",
        "SSDeep": "12288:npzKFzLrU/2fzXVPkrnjuYyTNW+o4T5SD7BDy6PFP8NjglLSAK:npeFzLI/6FknjuY4nojJm6NP8NjQi",
        "Size": 598728,
        "Type": "Zip archive data, at least v2.0 to extract"
    }
}

Human Readable Output

tanium-tr-list-events-by-connection

Queries events for a connection.

Base Command

tanium-tr-list-events-by-connection

Input

Argument Name Description Required
connection_id The connection id. Required
type The type of event. Can be “File”, “Network”, “Registry”, “Process”, “Driver”, “Combined”, “DNS”, or “Image”. The default is “Combined”. Possible values are: File, Network, Registry, Process, Driver, Combined, DNS, Image. Default is combined. Required
limit The maximum number of events to return. Default is 50. Optional
offset Offset to start getting the result set. Default is 0. Optional
filter Advanced search that filters according to event fields. For example: [[‘process_id’, ‘gt’, ‘30’], [‘username’, ‘ne’, ‘administrator’]]. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional operators: eq (equals), ne (does not equal); for integers/date: gt (greater than), gte (greater than or equals), ls (less than), lse (less than or equals); for strings: co (contains), nc (does not contain). . Optional
match Whether the results should fit all filters or at least one filter. Possible values are: all, any. Default is all. Optional
sort A comma-separated list of fields to sort on prefixed by +/- for ascending or descending and ordered by priority left to right. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional
fields A comma-separated list of fields on which to search. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time. Optional

Context Output

Path Type Description
TaniumEvent.id String The ID of the event.
TaniumEvent.groupName String The group name of the event.
TaniumEvent.file String The path of the file in the event.
TaniumEvent.operation String The event operation.
TaniumEvent.processId Number The ID of the process.
TaniumEvent.pid Number The ID of the process.
TaniumEvent.processPath String The path of the process.
TaniumEvent.processTableId Number The ID of the process table.
TaniumEvent.timestamp Date The date when the event was created.
TaniumEvent.userName String The username associated with the event.
TaniumEvent.remoteAddress String The network event destination address.
TaniumEvent.remoteAddressPort Number The network event destination port.
TaniumEvent.localAddress String The network event source address.
TaniumEvent.localAddressPort Number The network event source port.
TaniumEvent.keyPath String The registry key path.
TaniumEvent.valueName String The registry value name.
TaniumEvent.exitCode Number The process exit code.
TaniumEvent.processCommandLine String The process command line.
TaniumEvent.parentCommandLine String The parent command line.
TaniumEvent.processHash String The hash value of the process.
TaniumEvent.hashes String The hashes of the driver.
TaniumEvent.imageLoaded String The image loaded path of the driver.
TaniumEvent.signature String The signature of the driver.
TaniumEvent.signed Boolean Whether the driver is signed.
TaniumEvent.eventId Number The ID of the event.
TaniumEvent.eventOpcode Number The event opcode.
TaniumEvent.eventRecordId Number The ID of the event record.
TaniumEvent.eventTaskId Number The ID of the event task.
TaniumEvent.query String The query of the DNS.
TaniumEvent.response String The response of the DNS.
TaniumEvent.imagePath String The image path.
TaniumEvent.createTime Date The process creation time
TaniumEvent.endTime Date The process end time.
TaniumEvent.eventTaskName String The name of the event task.
TaniumEvent.hash String The process hash.

Command Example

!tanium-tr-list-events-by-connection connection_id=remote:hostname:123: type=File limit=2

Context Example

{
    "TaniumEvent": [
        {
            "eventOperationId": 0,
            "file": "C:\\Windows\\f1.dat",
            "groupName": "NT AUTHORITY",
            "id": "4611686018470089188",
            "operation": "Create",
            "pid": 736,
            "processPath": "C:\\Windows\\t.exe",
            "processTableId": "72057594038528503",
            "timestamp": "2021-07-18 07:28:04.007",
            "timestampRaw": 1626593284007,
            "userName": "LOCAL SERVICE"
        },
        {
            "eventOperationId": 1,
            "file": "C:\\Windows\\f2.dat",
            "groupName": "NT AUTHORITY",
            "id": "4611686018470089189",
            "operation": "Write",
            "pid": 736,
            "processPath": "C:\\Windows\\d.exe",
            "processTableId": "72057594038528503",
            "timestamp": "2021-07-18 07:28:04.007",
            "timestampRaw": 1626593284007,
            "userName": "LOCAL SERVICE"
        }
    ]
}

Human Readable Output

Events for remote:hostname:123

Id File Timestamp Process Table Id Process Path User Name
4611686018470089188 C:\Windows\f1.dat 2021-07-18 07:28:04.007 72057594038528503 C:\Windows\t.exe LOCAL SERVICE
4611686018470089189 C:\Windows\f2.dat 2021-07-18 07:28:04.007 72057594038528503 C:\Windows\d.exe LOCAL SERVICE

tanium-tr-get-file-download-info

Gets the metadata of a file download.

Base Command

tanium-tr-get-file-download-info

Input

Argument Name Description Required
file_id File download ID. Required

Context Output

Path Type Description
Tanium.FileDownload.size Number The size of the file, in bytes.
Tanium.FileDownload.path String The path of the file.
Tanium.FileDownload.downloaded Date The date when this file was downloaded.
Tanium.FileDownload.hostname String The hostname of the downloaded file.
Tanium.FileDownload.processCreationTime Date The date when the file was created.
Tanium.FileDownload.hash String The file hash.
Tanium.FileDownload.uuid Number The downloaded file uuid.
Tanium.FileDownload.lastModified Date The date when the file was last modified.
Tanium.FileDownload.createdBy String The user that created this file.
Tanium.FileDownload.createdByProc String The process path that created this file.
Tanium.FileDownload.lastModifiedBy String The user that last modified this file.
Tanium.FileDownload.lastModifiedByProc String The process path that modified this file.
Tanium.FileDownload.evidenceType String The evidence type - file.

Command Example

!tanium-tr-get-file-download-info file_id=c0531415-87a6-4d28-a226-b485784b1881

Context Example

{
    "Tanium": {
        "FileDownload": {
            "downloaded": "2020-01-15 13:04:02.827",
            "evidenceType": "file",
            "hash": "123456789",
            "hostname": "host1",
            "lastModified": "2020-01-15T08:57:19.000Z",
            "path": "C:\\log1.txt",
            "processCreationTime": "2019-09-03T17:51:40.000Z",
            "size": 10485904,
            "uuid": "c0531415-87a6-4d28-a226-b485784b1881"
        }
    }
}

Human Readable Output

File download

Uuid Path Evidence Type Hostname Process Creation Time Size
c0531415-87a6-4d28-a226-b485784b1881 C:\log1.txt file host1 2019-09-03T17:51:40.000Z 10485904

tanium-tr-get-process-info

Get information for a process.

Base Command

tanium-tr-get-process-info

Input

Argument Name Description Required
connection_id The connection id. Required
ptid The process table ID. Required

Context Output

Path Type Description
Tanium.ProcessInfo.childrenCount Number Nuber of process children.
Tanium.ProcessInfo.context String Process tree context.
Tanium.ProcessInfo.createTime Date Time when the process was created.
Tanium.ProcessInfo.createTimeRaw Date Timestamp when the process was created.
Tanium.ProcessInfo.dnsEventsCount Number Number of DNS events in the process.
Tanium.ProcessInfo.driverEventsCount Number Number of Driver events in the process.
Tanium.ProcessInfo.endTime Date Process termination time.
Tanium.ProcessInfo.endTimeRaw Date Process termination timestamp.
Tanium.ProcessInfo.exitCode Number Process exit code.
Tanium.ProcessInfo.fileEventsCount Number Number of File events in the process.
Tanium.ProcessInfo.groupName String Process group name.
Tanium.ProcessInfo.hashTypeName String Hash type.
Tanium.ProcessInfo.id String Process id at the tanium system.
Tanium.ProcessInfo.imageEventsCount Number Number of Image events in the process.
Tanium.ProcessInfo.networkEventsCount Number Number of network events in the process.
Tanium.ProcessInfo.parentProcessTableId String Parent process table id.
Tanium.ProcessInfo.pid Number The ID of the process.
Tanium.ProcessInfo.processEventsCount Number Number of process events in the process.
Tanium.ProcessInfo.processHash String Process hash.
Tanium.ProcessInfo.processPath String The process path.
Tanium.ProcessInfo.processTableId String The ID of the process table.
Tanium.ProcessInfo.registryEventsCount Number Number of registry events in the process.
Tanium.ProcessInfo.securityEventsCount Number Number of security events in the process.
Tanium.ProcessInfo.uniqueProcessId String Unique process id.
Tanium.ProcessInfo.userName String The username who created the process.

Command Example

!tanium-tr-get-process-info ptid=72057594038510321 connection_id=remote:hostname:123:

Context Example

{
    "Tanium": {
        "ProcessInfo": {
            "childrenCount": 0,
            "context": "node",
            "createTime": "2021-07-09 12:38:19.372",
            "createTimeRaw": 1625834299372,
            "dnsEventsCount": 0,
            "driverEventsCount": 0,
            "endTime": "2021-07-09 12:39:49.413",
            "endTimeRaw": 1625834389413,
            "exitCode": 0,
            "fileEventsCount": 0,
            "groupName": "NT AUTHORITY",
            "hashTypeName": "MD5",
            "id": "72057594038510321",
            "imageEventsCount": 0,
            "networkEventsCount": 0,
            "parentProcessTableId": "72057594038528485",
            "pid": 3648,
            "processEventsCount": 1,
            "processHash": "e1bce838cd2695999ab34215bf94b501",
            "processPath": "C:\\test.exe",
            "processTableId": "72057594038510321",
            "registryEventsCount": 0,
            "securityEventsCount": 0,
            "uniqueProcessId": "-8410859473941295552",
            "userName": "LOCAL SERVICE"
        }
    }
}

Human Readable Output

Process information for process with PTID 72057594038510321

Pid Process Table Id Parent Process Table Id Process Path
3648 72057594038510321 72057594038528485 C:\test.exe

tanium-tr-get-events-by-process

Gets the events for a process.

Base Command

tanium-tr-get-events-by-process

Input

Argument Name Description Required
connection_id The connection name. Required
ptid The process instance ID. Required
type The type of event. Can be “File”, “Network”, “Registry”, “Process”, “Driver”, “Combined”, “DNS”, or “Image”. The default is “Combined”. Possible values are: File, Network, Registry, Process, Driver, Combined, DNS, Image. Default is combined. Required
limit The maximum number of events to return. Default is 50. Optional
offset The offset number to begin listing events. Default is 0. Optional

Context Output

Path Type Description
Tanium.ProcessEvent.id Number The ID of the event.
Tanium.ProcessEvent.detail Unknown The event details.
Tanium.ProcessEvent.operation String The event operation.
Tanium.ProcessEvent.timestamp Date Time when the event was created.
Tanium.ProcessEvent.type String The event type.

Command Example

!tanium-tr-get-events-by-process connection_id=remote:hostname:123: type=Process ptid=72057594038528485 limit=2

Context Example

{
    "Tanium": {
        "ProcessEvent": [
            {
                "detail": "4428: C:\\test.exe",
                "id": "72057594038510294",
                "operation": "CreateChild",
                "timestamp": "2021-07-09 12:20:05.490",
                "timestampRaw": 1625833205490,
                "type": "Process"
            },
            {
                "detail": "1792: C:\\test.exe",
                "id": "72057594038510295",
                "operation": "CreateChild",
                "timestamp": "2021-07-09 12:20:05.541",
                "timestampRaw": 1625833205541,
                "type": "Process"
            }
        ]
    }
}

Human Readable Output

Events for process 72057594038528485

Id Detail Type Timestamp Operation
72057594038510294 4428: C:\test.exe Process 2021-07-09 12:20:05.490 CreateChild
72057594038510295 1792: C:\test.exe Process 2021-07-09 12:20:05.541 CreateChild

tanium-tr-get-process-children

Gets the children of this process instance.

Base Command

tanium-tr-get-process-children

Input

Argument Name Description Required
connection_id The connection id. Required
ptid The process table ID. Required
limit The maximum number of entries to return. Default is 50. Optional
offset The offset number to begin listing entries. Default is 0. Optional

Context Output

Path Type Description
Tanium.ProcessChildren.childrenCount Number Nuber of process children.
Tanium.ProcessChildren.context String Process tree context.
Tanium.ProcessChildren.createTime Date Time when the process was created.
Tanium.ProcessChildren.createTimeRaw Date Timestamp when the process was created.
Tanium.ProcessChildren.dnsEventsCount Number Number of DNS events in the process.
Tanium.ProcessChildren.driverEventsCount Number Number of Driver events in the process.
Tanium.ProcessChildren.endTime Date Process termination time.
Tanium.ProcessChildren.endTimeRaw Date Process termination timestamp.
Tanium.ProcessChildren.exitCode Number Process exit code.
Tanium.ProcessChildren.fileEventsCount Number Number of File events in the process.
Tanium.ProcessChildren.groupName String Process group name.
Tanium.ProcessChildren.hashTypeName String Hash type.
Tanium.ProcessChildren.id String Process id at the tanium system.
Tanium.ProcessChildren.imageEventsCount Number Number of Image events in the process.
Tanium.ProcessChildren.networkEventsCount Number Number of network events in the process.
Tanium.ProcessChildren.parentProcessTableId String Parent process table id.
Tanium.ProcessChildren.pid Number The ID of the process.
Tanium.ProcessChildren.processEventsCount Number Number of process events in the process.
Tanium.ProcessChildren.processHash String Process hash.
Tanium.ProcessChildren.processPath String The process path.
Tanium.ProcessChildren.processTableId String The ID of the process table.
Tanium.ProcessChildren.registryEventsCount Number Number of registry events in the process.
Tanium.ProcessChildren.securityEventsCount Number Number of security events in the process.
Tanium.ProcessChildren.uniqueProcessId String Unique process id.
Tanium.ProcessChildren.userName String The username who created the process.

Command Example

!tanium-tr-get-process-children connection_id=remote:hostname:123: ptid=72057594038528485

Context Example

{
    "Tanium": {
        "ProcessChildren": [
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:26:12.820",
                "createTimeRaw": 1626593172820,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:13.483",
                "endTimeRaw": 1626593173483,
                "exitCode": 0,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528483",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 5284,
                "processCommandLine": "\"Logon.exe\" /flags:0x0 /state0:0xa3856855 /state1:0x41c64e6d",
                "processEventsCount": 1,
                "processHash": "b38dfcf985d8ae5b1a17c264981e61c7",
                "processPath": "C:\\Logon1.exe",
                "processTableId": "72057594038528483",
                "registryEventsCount": 39,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151524022684478300",
                "userName": "SYSTEM"
            },
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:25:43.456",
                "createTimeRaw": 1626593143456,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:56.000",
                "endTimeRaw": 1626593216000,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528482",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 2856,
                "processCommandLine": "C:\\test.exe -secured -Embedding",
                "processEventsCount": 1,
                "processHash": "e1bce838cd2695999ab34215bf94b501",
                "processPath": "C:\\test.exe",
                "processTableId": "72057594038528482",
                "registryEventsCount": 0,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151647460044567768",
                "userName": "LOCAL SERVICE"
            }
        ]
    }
}

Human Readable Output

Children for process with PTID 72057594038528485

Pid Process Table Id Parent Process Table Id
5284 72057594038528483 72057594038528485
2856 72057594038528482 72057594038528485

tanium-tr-get-parent-process

Gets information for the parent process.

Base Command

tanium-tr-get-parent-process

Input

Argument Name Description Required
connection_id The connection id. Required
ptid The process table ID. Required

Context Output

Path Type Description
Tanium.ProcessParent.childrenCount Number Nuber of process children.
Tanium.ProcessParent.context String Process tree context.
Tanium.ProcessParent.createTime Date Time when the process was created.
Tanium.ProcessParent.createTimeRaw Date Timestamp when the process was created.
Tanium.ProcessParent.dnsEventsCount Number Number of DNS events in the process.
Tanium.ProcessParent.driverEventsCount Number Number of Driver events in the process.
Tanium.ProcessParent.endTime Date Process termination time.
Tanium.ProcessParent.endTimeRaw Date Process termination timestamp.
Tanium.ProcessParent.exitCode Number Process exit code.
Tanium.ProcessParent.fileEventsCount Number Number of File events in the process.
Tanium.ProcessParent.groupName String Process group name.
Tanium.ProcessParent.hashTypeName String Hash type.
Tanium.ProcessParent.id String Process id at the tanium system.
Tanium.ProcessParent.imageEventsCount Number Number of Image events in the process.
Tanium.ProcessParent.networkEventsCount Number Number of network events in the process.
Tanium.ProcessParent.parentProcessTableId String Parent process table id.
Tanium.ProcessParent.pid Number The ID of the process.
Tanium.ProcessParent.processEventsCount Number Number of process events in the process.
Tanium.ProcessParent.processHash String Process hash.
Tanium.ProcessParent.processPath String The process path.
Tanium.ProcessParent.processTableId String The ID of the process table.
Tanium.ProcessParent.registryEventsCount Number Number of registry events in the process.
Tanium.ProcessParent.securityEventsCount Number Number of security events in the process.
Tanium.ProcessParent.uniqueProcessId String Unique process id.
Tanium.ProcessParent.userName String The username who created the process.

Command Example

!tanium-tr-get-parent-process connection_id=remote:hostname:123: ptid=72057594038510321

Context Example

{
    "Tanium": {
        "ProcessParent": {
            "childrenCount": 5664,
            "context": "parent",
            "createTime": "2021-07-18 07:26:55.000",
            "createTimeRaw": 1626593215000,
            "dnsEventsCount": 0,
            "driverEventsCount": 0,
            "fileEventsCount": 0,
            "id": "72057594038528485",
            "imageEventsCount": 0,
            "networkEventsCount": 0,
            "parentProcessTableId": "0",
            "pid": -2,
            "processEventsCount": 1,
            "processPath": "<Pruned Process>",
            "processTableId": "72057594038528485",
            "registryEventsCount": 0,
            "securityEventsCount": 0,
            "uniqueProcessId": "-5151340193789247490"
        }
    }
}

Human Readable Output

Parent process for process with PTID 72057594038510321

Id Pid Process Table Id Parent Process Table Id
72057594038528485 -2 72057594038528485 0

tanium-tr-get-process-tree

Gets the process tree for the process instance.

Base Command

tanium-tr-get-process-tree

Input

Argument Name Description Required
connection_id The connection id. Required
ptid The process instance ID. Required
context The process context. Can be parent, node, siblings, children. Possible values are: parent, node, siblings, children. Optional

Context Output

Path Type Description
Tanium.ProcessTree.childrenCount Number Nuber of process children.
Tanium.ProcessTree.context String Process tree context.
Tanium.ProcessTree.createTime Date Time when the process was created.
Tanium.ProcessTree.createTimeRaw Date Timestamp when the process was created.
Tanium.ProcessTree.dnsEventsCount Number Number of DNS events in the process.
Tanium.ProcessTree.driverEventsCount Number Number of Driver events in the process.
Tanium.ProcessTree.endTime Date Process termination time.
Tanium.ProcessTree.endTimeRaw Date Process termination timestamp.
Tanium.ProcessTree.exitCode Number Process exit code.
Tanium.ProcessTree.fileEventsCount Number Number of File events in the process.
Tanium.ProcessTree.groupName String Process group name.
Tanium.ProcessTree.hashTypeName String Hash type.
Tanium.ProcessTree.id String Process id at the tanium system.
Tanium.ProcessTree.imageEventsCount Number Number of Image events in the process.
Tanium.ProcessTree.networkEventsCount Number Number of network events in the process.
Tanium.ProcessTree.parentProcessTableId String Parent process table id.
Tanium.ProcessTree.pid Number The ID of the process.
Tanium.ProcessTree.processEventsCount Number Number of process events in the process.
Tanium.ProcessTree.processHash String Process hash.
Tanium.ProcessTree.processPath String The process path.
Tanium.ProcessTree.processTableId String The ID of the process table.
Tanium.ProcessTree.registryEventsCount Number Number of registry events in the process.
Tanium.ProcessTree.securityEventsCount Number Number of security events in the process.
Tanium.ProcessTree.uniqueProcessId String Unique process id.
Tanium.ProcessTree.userName String The username who created the process.

Command Example

!tanium-tr-get-process-tree connection_id=remote:hostname:123: ptid=72057594038528485

Context Example

{
    "Tanium": {
        "ProcessTree": [
            {
                "childrenCount": 5664,
                "context": "node",
                "createTime": "2021-07-18 07:26:55.000",
                "createTimeRaw": 1626593215000,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "fileEventsCount": 0,
                "id": "72057594038528485",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "0",
                "pid": -2,
                "processEventsCount": 1,
                "processPath": "<Pruned Process>",
                "processTableId": "72057594038528485",
                "registryEventsCount": 0,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151340193789247490"
            },
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:26:12.820",
                "createTimeRaw": 1626593172820,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:13.483",
                "endTimeRaw": 1626593173483,
                "exitCode": 0,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528483",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 5284,
                "processCommandLine": "\"LogonUI.exe\" /flags:0x0 /state0:0xa3856855 /state1:0x41c64e6d",
                "processEventsCount": 1,
                "processHash": "b38dfcf985d8ae5b1a17c264981e61c7",
                "processPath": "C:\\Windows\\System32\\LogonUI.exe",
                "processTableId": "72057594038528483",
                "registryEventsCount": 39,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151524022684478300",
                "userName": "SYSTEM"
            }
        ]
    }
}

Human Readable Output

Process information for process with PTID 72057594038528485

Id Pid Process Table Id Parent Process Table Id
72057594038528485 -2 72057594038528485 0
72057594038528483 5284 72057594038528483 72057594038528485

tanium-tr-event-evidence-list

Returns a list of all available evidence in the system.

Base Command

tanium-tr-event-evidence-list

Input

Argument Name Description Required
limit The maximum number of evidences to return. Default is 50. Optional
offset Offset to start getting the events result set. Default is 0. Optional
sort A comma-separated list of fields by which to sort, using +/- prefixes for ascending/descending, in order of priority (left to right). Optional
hostname Comma-seperated list of hostnames to get the event evidences that match only those hostnames, for example hostname=123,456. Optional
type Get the event evidences that match only to a specific type, for example type=file. Optional

Context Output

Path Type Description
Tanium.Evidence.name String The evidence name.
Tanium.Evidence.uuid String The evidence UUID.
Tanium.Evidence.createdAt Date Time when the process was created.
Tanium.Evidence.hostname String The evidence connection hostname.
Tanium.Evidence.evidenceType Number The evidence type.
Tanium.Evidence.size Number The evidence size.

Command Example

!tanium-tr-event-evidence-list limit=3

Context Example

{
    "Tanium": {
        "Evidence": [
            {
                "createdAt": "2021-10-06T06:40:48.297Z",
                "evidenceType": "snapshot",
                "hostname": "host1",
                "name": "host1.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "832dec40-1cc2-4e53-881a-7f61cba835bc"
            },
            {
                "createdAt": "2021-10-06T06:42:07.010Z",
                "evidenceType": "snapshot",
                "hostname": "host2",
                "name": "host2.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "340a3ac4-560d-430f-bd50-96615d763171"
            },
            {
                "createdAt": "2021-10-07T12:15:30.711Z",
                "evidenceType": "snapshot",
                "hostname": "host3",
                "name": "host3.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "cf4d8628-8527-4014-8ed2-bdca6c592488"
            }
        ]
    }
}

Human Readable Output

Evidence list

Uuid Name Evidence Type Hostname Created At Username
832dec40-1cc2-4e53-881a-7f61cba835bc host1.db snapshot host1 2021-10-06T06:40:48.297Z administrator
340a3ac4-560d-430f-bd50-96615d763171 host2.db snapshot host2 2021-10-06T06:42:07.010Z administrator
cf4d8628-8527-4014-8ed2-bdca6c592488 host3.db snapshot host3 2021-10-07T12:15:30.711Z administrator

tanium-tr-event-evidence-get-properties

Returns event evidence properties for IOC generation.

Base Command

tanium-tr-event-evidence-get-properties

Input

There are no input arguments for this command.

Context Output

Path Type Description
Tanium.EvidenceProperties.type String The evidence property type.
Tanium.EvidenceProperties.value String The evidence property value.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "EvidenceProperties": [
            {
                "type": "MD5Hash",
                "value": "92ee791a630830452485e8e375f8db35"
            },
            {
                "type": "MD5Hash",
                "value": "e1bce838cd2695999ab34215bf94b501"
            },
            {
                "type": "MD5Hash",
                "value": "0e1853d3339d2963d2bc6ac1fdc1c811"
            },
            {
                "type": "MD5Hash",
                "value": "41b0ade03cd365a5cc99f748c5ffcadc"
            },
            {
                "type": "MD5Hash",
                "value": "a9a89cb1838373c365f2b8af72b1f1c2"
            }
        ]
    }
}

Human Readable Output

Evidence Properties

Type Value
MD5Hash 92ee791a630830452485e8e375f8db35
MD5Hash e1bce838cd2695999ab34215bf94b501
MD5Hash 0e1853d3339d2963d2bc6ac1fdc1c811
MD5Hash 41b0ade03cd365a5cc99f748c5ffcadc
MD5Hash a9a89cb1838373c365f2b8af72b1f1c2

tanium-tr-get-evidence-by-id

Gets event evidence by evidence ID.

Base Command

tanium-tr-get-evidence-by-id

Input

Argument Name Description Required
evidence_id The ID of the evidence. Required

Context Output

Path Type Description
Tanium.Evidence.commandline String Process command line.
Tanium.Evidence.createTime Date Time when the process was created.
Tanium.Evidence.createTimeRaw Number Timestamp when the process was created.
Tanium.Evidence.created Date Time when the event was created.
Tanium.Evidence.domain String Event domain.
Tanium.Evidence.eventtype String The event type.
Tanium.Evidence.evidencetype String The evidence type.
Tanium.Evidence.exitCode Number Process exit code.
Tanium.Evidence.hostname String Connection host name.
Tanium.Evidence.summary String Evidence summary.
Tanium.Evidence.timestamp Date Eveidence creation date.
Tanium.Evidence.type String The evidence type.
Tanium.Evidence.username String Evidence creator Username.
Tanium.Evidence.utctimecreated Date Evidence creation utc date.
Tanium.Evidence.uuid String The evidence UUID.

Command Example

!tanium-tr-get-evidence-by-id evidence_id=b684f9be-80ee-483d-8dca-a4d5cd3aeaa6

Context Example

{
    "Tanium": {
        "Evidence": {
            "createTime": "2021-07-07 11:00:01.973",
            "createTimeRaw": 1625655601973,
            "created": "2021-10-05T10:44:36.697Z",
            "endTime": "2021-07-07 11:01:32.006",
            "endTimeRaw": 1625655692006,
            "eventtype": "ProcessEvent",
            "evidencetype": "event",
            "exitCode": 0,
            "groupName": "NT AUTHORITY",
            "hash": "e1bce838cd2695999ab34215bf94b501",
            "hashTypeName": "MD5",
            "hostname": "host1",
            "id": "72057594038506412",
            "parentCommandLine": "<Pruned Process>",
            "parentPath": "<Pruned Process>",
            "parentPid": -2,
            "parentProcessTableId": "72057594038528485",
            "pid": 6056,
            "processPath": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "processTableId": "72057594038506412",
            "recorderid": "72057594038506412",
            "summary": "Test description.",
            "userName": "NETWORK SERVICE",
            "username": "administrator",
            "uuid": "b684f9be-80ee-483d-8dca-a4d5cd3aeaa6"
        }
    }
}

Human Readable Output

Evidence information

Uuid Hostname Username Summary Created Process Table Id
b684f9be-80ee-483d-8dca-a4d5cd3aeaa6 host1 administrator Test description. 2021-10-05T10:44:36.697Z 72057594038506412

tanium-tr-create-evidence

Creates an event evidence from process.

Base Command

tanium-tr-create-evidence

Input

Argument Name Description Required
connection_id The id of the connection. Required
ptid The process instance ID. Required
hostname The hostname of the connection. Required
summary The summary of the event evidence. Optional

Context Output

There is no context output for this command.

Command Example

!tanium-tr-create-evidence ptid=72057594038510321 connection_id=remote:hostname:123: hostname=host1 summary="Create Process"

Human Readable Output

Evidence have been created.

tanium-tr-delete-evidence

Deletes event evidences from tanium.

Base Command

tanium-tr-delete-evidence

Input

Argument Name Description Required
evidence_ids The IDs of the evidences to delete. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-evidence evidence_ids=53630ca0-e55a-4f6d-9451-d1c2c277530b

Human Readable Output

Evidence 53630ca0-e55a-4f6d-9451-d1c2c277530b has been deleted successfully.

tanium-tr-request-file-download

Requests a new file download.

Base Command

tanium-tr-request-file-download

Input

Argument Name Description Required
path Path to file. Required
connection_id Connection id. Required

Context Output

Path Type Description
Tanium.FileDownloadTask.compress String Is file compressed.
Tanium.FileDownloadTask.connection String The file download host.
Tanium.FileDownloadTask.taskId Number ID of the file download task.
Tanium.FileDownloadTask.paths String The file download paths.
Tanium.FileDownloadTask.startTime Date Download start time.
Tanium.FileDownloadTask.status String Status of the file download request.

Command Example

!tanium-tr-request-file-download connection_id=remote:hostname:123: path="C:\\Users\\Administrator\\Desktop\\testD.txt"

Context Example

{
    "Tanium": {
        "FileDownloadTask": {
            "compress": "true",
            "connection": "remote:hostname:123:",
            "paths": [
                "C:\\Users\\Administrator\\Desktop\\testD.txt"
            ],
            "startTime": "2021-10-07T12:23:06.824Z",
            "status": "STARTED",
            "taskId": 1178
        }
    }
}

Human Readable Output

Download request of file C:\Users\Administrator\Desktop\testD.txt has been sent successfully. Task id: 1178.

tanium-tr-delete-file-download

Deletes a file download.

Base Command

tanium-tr-delete-file-download

Input

Argument Name Description Required
file_id File download ID. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-file-download file_id=0367c8b2-eed9-4124-b173-1c83cbf3ba6f

Human Readable Output

Delete request of file with ID 0367c8b2-eed9-4124-b173-1c83cbf3ba6f has been sent successfully.

tanium-tr-list-files-in-directory

Gets a list of files in the given directory.

Base Command

tanium-tr-list-files-in-directory

Input

Argument Name Description Required
path Path to the directory. Required
connection_id Connection id. Required
limit The maximum number of files to return. Default is 50. Optional
offset Offset to start getting files. Default is 0. Optional

Context Output

Path Type Description
Tanium.File.connectionId String Connection ID.
Tanium.File.createdDate Date Time the file was created.
Tanium.File.modifiedDate Date The date that the file was last modified.
Tanium.File.name String The file name.
Tanium.File.path String The file path.
Tanium.File.permissions Number The file permissions.
Tanium.File.size Number The file size.
Tanium.File.type String The file type.

Command Example

!tanium-tr-list-files-in-directory connection_id=remote:hostname:123: path=`C:\Users\Administrator\Desktop\` limit=2

Context Example

{
    "Tanium": {
        "File": [
            {
                "connectionId": "remote:hostname:123:",
                "createdDate": "2020-02-06T08:34:17.000Z",
                "modifiedDate": "2018-08-12T11:11:02.000Z",
                "name": "ChromeSetup.exe",
                "path": "C:\\Users\\Administrator\\Desktop\\",
                "permissions": 438,
                "size": 1130840,
                "type": "FILE"
            },
            {
                "connectionId": "remote:hostname:123:",
                "createdDate": "2020-01-07T11:53:20.000Z",
                "modifiedDate": "2020-01-07T11:53:46.000Z",
                "name": "test.txt",
                "path": "C:\\Users\\Administrator\\Desktop\\",
                "permissions": 438,
                "size": 11,
                "type": "FILE"
            }
        ]
    }
}

Human Readable Output

Files in directory C:\Users\Administrator\Desktop\

Name Path Connection Id Created Date Modified Date Permissions Size
ChromeSetup.exe C:\Users\Administrator\Desktop\ remote:hostname:123: 2020-02-06T08:34:17.000Z 2018-08-12T11:11:02.000Z 438 1130840
test.txt C:\Users\Administrator\Desktop\ remote:hostname:123: 2020-01-07T11:53:20.000Z 2020-01-07T11:53:46.000Z 438 11

tanium-tr-get-file-info

Gets information about a file from a remote connection.

Base Command

tanium-tr-get-file-info

Input

Argument Name Description Required
connection_id The ID of the connection. Default is Connection id.. Required
path The path to the file. Default is Path to file.. Required

Context Output

Path Type Description
Tanium.File.canonicalPath String The file path.
Tanium.File.cid String Cid.
Tanium.File.connectionId String Connection ID.
Tanium.File.createdDate Date Time the file was created.
Tanium.File.modifiedDate Date The date that the file was last modified.
Tanium.File.name String The file name.
Tanium.File.path String The file path.
Tanium.File.permissions Number The file permissions.
Tanium.File.size Number The file size.
Tanium.File.type String The file type.
Tanium.File.sessionId String Session ID.

Command Example

!tanium-tr-get-file-info connection_id=remote:hostname:123: path="C:\\log1.txt"

Context Example

{
    "Tanium": {
        "File": {
            "canonicalPath": "C:\\log1.txt",
            "cid": "d65ba018-346c-497e-8f18-252036fd87f9",
            "connectionId": "remote:hostname:123:",
            "createdDate": "2019-09-03T17:51:40.000Z",
            "modifiedDate": "2021-09-27T19:36:07.000Z",
            "name": "C:\\log1.txt",
            "path": "C:\\log1.txt",
            "permissions": 438,
            "sessionId": "1ce0f8e7-c180-4467-bf8e-0a313c4eb5f4",
            "size": 2913,
            "type": "FILE"
        }
    }
}

Human Readable Output

Information for file C:\log1.txt

Path Name Connection Id Type Created Date Modified Date
C:\log1.txt C:\log1.txt remote:hostname:123: FILE 2019-09-03T17:51:40.000Z 2021-09-27T19:36:07.000Z

tanium-tr-delete-file-from-endpoint

Deletes a file from the given endpoint.

Base Command

tanium-tr-delete-file-from-endpoint

Input

Argument Name Description Required
connection_id Connection ID. Required
path Path to file. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-file-from-endpoint connection_id=remote:hostname:123: path=`C:\Users\Administrator\Desktop\to_delete.txt`

Human Readable Output

Delete request of file C:\Users\Administrator\Desktop\to_delete.txt from endpoint remote:hostname:123: has been sent successfully.

tanium-tr-intel-docs-labels-list

List all labels for the identified intel document.

Base Command

tanium-tr-intel-docs-labels-list

Input

Argument Name Description Required
intel_doc_id List the label IDs for the intel document with this ID. Required

Context Output

Path Type Description
Tanium.IntelDocLabel.IntelDocID String The requested intel doc ID.
Tanium.IntelDocLabel.LabelsList.ID Number The unique identifier for this label.
Tanium.IntelDocLabel.LabelsList.Name String The display name of the label.
Tanium.IntelDocLabel.LabelsList.Description String An extended description of the label.
Tanium.IntelDocLabel.LabelsList.IndicatorCount Number The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.IntelDocLabel.LabelsList.SignalCount Number The number of Tanium Signal documents associated with this label.
Tanium.IntelDocLabel.LabelsList.CreatedAt Date The date this label was created.
Tanium.IntelDocLabel.LabelsList.UpdatedAt Date The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-intel-docs-labels-list intel_doc_id=509

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                    "ID": 1,
                    "IndicatorCount": 0,
                    "Name": "Alpha",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Intel doc (509) labels

ID Name Description Indicator Count Signal Count Created At Updated At
1 Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z
11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z
16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-docs-add-label

Create a new label association for the identified intel document.

Base Command

tanium-tr-intel-docs-add-label

Input

Argument Name Description Required
intel_doc_id Associate the new label with the intel document with this ID. Required
label_id The ID of the new label to associate with the target intel document. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs). Required

Context Output

Path Type Description
Tanium.IntelDocLabel.IntelDocID String The requested intel doc ID.
Tanium.IntelDocLabel.LabelsList.ID Number The unique identifier for this label.
Tanium.IntelDocLabel.LabelsList.Name String The display name of the label.
Tanium.IntelDocLabel.LabelsList.Description String An extended description of the label.
Tanium.IntelDocLabel.LabelsList.IndicatorCount Number The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.IntelDocLabel.LabelsList.SignalCount Number The number of Tanium Signal documents associated with this label.
Tanium.IntelDocLabel.LabelsList.CreatedAt Date The date this label was created.
Tanium.IntelDocLabel.LabelsList.UpdatedAt Date The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-intel-docs-add-label intel_doc_id=509 label_id=1

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                    "ID": 1,
                    "IndicatorCount": 0,
                    "Name": "Alpha",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Successfully created a new label (1) association for the identified intel document (509)

ID Name Description Indicator Count Signal Count Created At Updated At
1 Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z
11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z
16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-docs-remove-label

Delete a label association for the identified intel document.

Base Command

tanium-tr-intel-docs-remove-label

Input

Argument Name Description Required
intel_doc_id Remove the label from the intel document with this ID. Required
label_id The ID of the label to disassociate from the target intel document. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs). Required

Context Output

Path Type Description
Tanium.IntelDocLabel.IntelDocID String Requested doc ID.
Tanium.IntelDocLabel.LabelsList.CreatedAt Date Date when label was created.
Tanium.IntelDocLabel.LabelsList.Description String Label description.
Tanium.IntelDocLabel.LabelsList.ID Number Label ID.
Tanium.IntelDocLabel.LabelsList.IndicatorCount Number Number of related indicators.
Tanium.IntelDocLabel.LabelsList.Name String Label name.
Tanium.IntelDocLabel.LabelsList.SignalCount Number Number of related signal counts.
Tanium.IntelDocLabel.LabelsList.UpdatedAt Date Date when label was last updated.

Command Example

!tanium-tr-intel-docs-remove-label intel_doc_id=509 label_id=1

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Successfully removed the label (1) association for the identified intel document (509)

ID Name Description Indicator Count Signal Count Created At Updated At
2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z
11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z
16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-doc-create

Add a new intel document to the system by providing its document contents.

Base Command

tanium-tr-intel-doc-create

Input

Argument Name Description Required
entry_id The file entry ID. Required
file_extension The suffix at the end of a filename. (Available file types - yara, stix, ioc). Possible values are: ioc, yara, stix. Required

Context Output

Path Type Description
Tanium.IntelDoc.AlertCount Number The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt Date The date at which this intel was first added to the system.
Tanium.IntelDoc.Description String The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID Number The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds Number The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name String The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount Number The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt Date The date when this intel was last updated.
Tanium.IntelDoc.revisionId Number The number of times the contents of the intel with this ID have been updated.
Tanium.IntelDoc.Type String The shortened type name of the intel. For example, “openioc”, “stix”, “yara”.
Tanium.IntelDoc.typeVersion String The version number of the intel type. For example, “1.0”, “2.3”, etc.
Tanium.IntelDoc.intrinsicId String The unique identifier claimed by the intel document, such as a guid or other built-in ID.
Tanium.IntelDoc.Md5 String The hex digest of the MD5 sum of the contents of the document that represents this intel.
Tanium.IntelDoc.Size String The size of the intel document contents, in bytes.

Command Example

!tanium-tr-intel-doc-create entry_id=7173@e99f97d1-7225-4c75-896c-3c960febbe8c file_extension=yara

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "CreatedAt": "2021-07-18T10:27:41.742Z",
            "ID": 438,
            "IntrinsicId": "file.yara",
            "IsSchemaValid": true,
            "Md5": "2bfe1da12a94fa4be3e9bcf6f59d024a",
            "Name": "file.yara",
            "RevisionId": 22,
            "Size": 3271,
            "SourceId": 1,
            "Type": "yara",
            "TypeVersion": "3",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-10-07T12:23:35.947Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Alert Count Unresolved Alert Count Created At Updated At
438 file.yara yara 0 0 2021-07-18T10:27:41.742Z 2021-10-24T09:00:52.609Z

tanium-tr-intel-doc-update

Update the contents of an existing intel document by providing the document contents.

Base Command

tanium-tr-intel-doc-update

Input

Argument Name Description Required
intel_doc_id The ID of the intel document to update. Required
entry_id The file entry ID. Required
file_extension The suffix at the end of a filename. (Available file types - yara, stix, ioc). Possible values are: ioc, yara, stix. Optional

Context Output

Path Type Description
Tanium.IntelDoc.AlertCount Number The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt Date The date at which this intel was first added to the system.
Tanium.IntelDoc.Description String The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID Number The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds Number The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name String The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount Number The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt Date The date when this intel was last updated.
Tanium.IntelDoc.revisionId Number The number of times the contents of the intel with this ID have been updated.
Tanium.IntelDoc.Type String The shortened type name of the intel. For example, “openioc”, “stix”, “yara”.
Tanium.IntelDoc.typeVersion String The version number of the intel type. For example, “1.0”, “2.3”, etc.
Tanium.IntelDoc.intrinsicId String The unique identifier claimed by the intel document, such as a guid or other built-in ID.
Tanium.IntelDoc.Md5 String The hex digest of the MD5 sum of the contents of the document that represents this intel.
Tanium.IntelDoc.Size String The size of the intel document contents, in bytes.

Command Example

!tanium-tr-intel-doc-update entry_id=7173@e99f97d1-7225-4c75-896c-3c960febbe8c intel_doc_id=438 file_extension=yara

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "CreatedAt": "2021-07-18T10:27:41.742Z",
            "ID": 438,
            "IntrinsicId": "file.yara",
            "IsSchemaValid": true,
            "Md5": "2bfe1da12a94fa4be3e9bcf6f59d024a",
            "Name": "file.yara",
            "RevisionId": 23,
            "Size": 3271,
            "SourceId": 1,
            "Type": "yara",
            "TypeVersion": "3",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-10-07T12:23:39.573Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Alert Count Unresolved Alert Count Created At Updated At
438 file.yara yara 0 0 2021-07-18T10:27:41.742Z 2021-10-07T12:23:39.573Z

tanium-tr-intel-doc-delete

Remove an intel document from the system by providing its ID

Base Command

tanium-tr-intel-doc-delete

Input

Argument Name Description Required
intel_doc_id The file entry ID. Required

Context Output

None

Command Example

!tanium-tr-intel-doc-delete intel_doc_id=509

Context Example

None

Human Readable Output

Intel Doc deleted

tanium-tr-start-quick-scan

Scan a computer group for hashes in intel document. Computer groups
can be viewed by navigating to Administration -> Computer Groups in the Threat-Response
product console. Computer group names and IDs can also be retrieved by using
the tn-list-groups command in the Tanium integration.

Base Command

tanium-tr-start-quick-scan

Input

Argument Name Description Required
intel_doc_id The intel document ID. Required
computer_group_name The name of a Tanium computer group. See command description for possible ways to retrieve this value. Required

Context Output

Path Type Description
Tanium.QuickScan.IntelDocId Number The unique identifier for this intel in this instance of the system.
Tanium.QuickScan.ComputerGroupId Number The ID of a Tanium computer group.
Tanium.QuickScan.ID Number The ID of the quick scan.
Tanium.QuickScan.AlertCount Number The number of alerts returned from the quick scan.
Tanium.QuickScan.CreatedAt Date The date the quick scan was created.
Tanium.QuickScan.UserId Number The user ID which initiated the quick scan.
Tanium.QuickScan.QuestionId Number The ID of the quick scan question.

Command Example

!tanium-tr-start-quick-scan intel_doc_id=509 computer_group_name="All Computers"

Context Example

{
    "Tanium": {
        "QuickScan": {
            "AlertCount": 0,
            "ComputerGroupId": 1,
            "CreatedAt": "2022-01-05T19:53:43.049Z",
            "ID": 1000239,
            "IntelDocId": 509,
            "QuestionId": 2025697,
            "UserId": 64
        }
    }
}

Human Readable Output

Quick Scan started

AlertCount ComputerGroupId CreatedAt ID IntelDocId QuestionId UserId
0 1 2022-01-05T19:53:43.049Z 1000239 509 2025697 64

tanium-tr-intel-deploy

Deploys intel using the service account context.

Base Command

tanium-tr-intel-deploy

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

>Successfully deployed intel.

### tanium-tr-intel-deploy-status

***
Displays status of last intel deployment.

#### Base Command

`tanium-tr-intel-deploy-status`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Tanium.IntelDeployStatus.CreatedAt | Date | The creation date of the last intel deployment. |
| Tanium.IntelDeployStatus.ModifiedAt | Date | The modification date of the last intel deployment. |
| Tanium.IntelDeployStatus.CurrentRevision | Number | Revision number, incremented each time the intel is modified |
| Tanium.IntelDeployStatus.CurrentSize | Number | The size of the intel document contents, in bytes. |

#### Command Example

```!tanium-tr-intel-deploy-status```

#### Context Example

```json
{
    "Tanium": {
        "IntelDeployStatus": {
            "CreatedAt": "2021-05-02T19:18:00.685Z",
            "CurrentRevision": 855,
            "CurrentSize": 1187840,
            "ModifiedAt": "2021-10-06T15:07:43.248Z"
        }
    }
}

Human Readable Output

Intel deploy status

Created At Modified At Current Revision Current Size
2021-05-02T19:18:00.685Z 2021-10-06T15:07:43.248Z 855 1187840

tanium-tr-get-task-by-id

Get task by ID.

Base Command

tanium-tr-get-task-by-id

Input

Argument Name Description Required
task_id The task ID. Required

Context Output

Path Type Description
Tanium.Task.createdAt Date The date at which this task was first added to the system.
Tanium.Task.id Number The unique identifier for this task in this instance of the system.
Tanium.Task.updatedAt Date The date when this task was last updated.
Tanium.Task.startTime Date The date when this task started.
Tanium.Task.endTime Date The date when this task ended.
Tanium.Task.error String Task errors.
Tanium.Task.status String Task status.
Tanium.Task.type String Task type.
Tanium.Task.metadata Unknown Task metadata.
Tanium.Task.results Unknown Task results.

Command Example

!tanium-tr-get-task-by-id task_id=833

Context Example

{
    "Tanium": {
        "Task": {
            "createdAt": "2021-09-05T13:46:16.603Z",
            "endTime": "2021-09-05T13:46:16.900Z",
            "id": 833,
            "metadata": {
                "compress": "true",
                "connection": "remote:hostname:123:",
                "paths": [
                    "C:\\test.exe"
                ]
            },
            "results": {
                "completed": [
                    "C:\\test.exe"
                ],
                "failed": [],
                "fileResults": [
                    {
                        "finalPath": "C:\\04828d87-a384-4a8b-a874-2438bf8b16ab.zip",
                        "response": {
                            "avgBytesPerSecond": 0,
                            "source": "C:\\test.exe",
                            "target": "C:\\temp\\36e80439-8866-4ada-9229-fb1e08f1a3f9",
                            "totalBytes": 55808,
                            "totalTimeMs": 205,
                            "transferHash": "a84417ee9d039891af43b267896db921a40838d8a17cc1be29785d031e5944d4"
                        }
                    }
                ]
            },
            "startTime": "2021-09-05T13:46:16.606Z",
            "status": "COMPLETED",
            "type": "fileDownload",
            "updatedAt": "2021-09-05T13:46:16.603Z"
        }
    }
}

Human Readable Output

Task information

Id Status
833 COMPLETED

tanium-tr-get-system-status

Get system status, to retrieve all possible connection’s client ids, hostnames, ips.

Base Command

tanium-tr-get-system-status

Input

Argument Name Description Required
limit The maximum number of entries to return. Default is 50. Optional
offset The offset number to begin listing entries. Default is 0. Optional
status Comma-seperated list of statuses to get the system-status that match only those statuses, for example status=Blocked,Leader. Optional
ip_server Comma-seperated list of ip servers to get the system-status that match only those ip servers, for example ip_server=1.1.1.1,2.2.2.2. Optional
ip_client Comma-seperated list of ip clients to get the system-status that match only those ip clients, for example ip_client=1.1.1.1,2.2.2.2. Optional
hostname Comma-seperated list of hostnames to get the system-status that match only those hostnames, for example hostname=host1,host2. Optional
port port to get the system-status that match only this port, for example port=80. Optional

Context Output

Path Type Description
Tanium.SystemStatus.clientId Number Client id to use when creating new connection.
Tanium.SystemStatus.computerId Number Computer ID.
Tanium.SystemStatus.hostName String Hostname to connect.
Tanium.SystemStatus.ipaddressClient String Client IP address.
Tanium.SystemStatus.ipaddressServer String Server IP address.
Tanium.SystemStatus.lastRegistration Date Host last registration time.
Tanium.SystemStatus.portNumber Number Connection port number.
Tanium.SystemStatus.protocolVersion Number Connection protocol version.
Tanium.SystemStatus.publicKeyValid Boolean Is public key valid.
Tanium.SystemStatus.status String Host status.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "SystemStatus": [
            {
                "clientId": 11111,
                "computerId": 11111,
                "fullVersion": "7.2.314.3476",
                "hostName": "tanium",
                "ipaddressClient": "1.1.1.1",
                "ipaddressServer": "1.1.1.1",
                "lastRegistration": "2021-10-07T12:23:13Z",
                "portNumber": 17472,
                "protocolVersion": 314,
                "publicKeyValid": true,
                "receiveState": "None",
                "registeredWithTls": false,
                "sendState": "None",
                "status": "Leader"
            },
            {
                "clientId": 22222,
                "computerId": 22222,
                "fullVersion": "7.4.5.1204",
                "hostName": "hostname1",
                "ipaddressClient": "1.2.3.4",
                "ipaddressServer": "1.2.3.4",
                "lastRegistration": "2021-10-07T12:23:12Z",
                "portNumber": 17472,
                "protocolVersion": 315,
                "publicKeyValid": true,
                "receiveState": "None",
                "registeredWithTls": true,
                "sendState": "None",
                "status": "Leader"
            }
        ]
    }
}

Human Readable Output

Reporting clients

Host Name Client Id Ipaddress Client Ipaddress Server Port Number
taniumlinux 11111 1.1.1.1 1.1.1.1 17472
hostname1 222222 1.2.3.4 1.2.3.4 17472

tanium-tr-get-response-actions

Returns the Response Actions matching the specified filters

Base Command

tanium-tr-get-response-actions

Input

Argument Name Description Required
offset Offset to start getting response actions (default is ‘0’). Optional
limit Max number of response actions to return (default is ‘50’). Optional
sort_order Specify whether to sort by column in ascending or descending order (default is ‘desc’). Possible values are: asc, desc. Default is desc. Optional
partial_computer_name Filter on a partial computer name. Optional
status Filter on status. Optional
type Filter on type. Optional

Context Output

Path Type Description
Tanium.ResponseActions.id String  
Tanium.ResponseActions.type String  
Tanium.ResponseActions.status String  
Tanium.ResponseActions.computerName String  
Tanium.ResponseActions.userId String  
Tanium.ResponseActions.userName String  
Tanium.ResponseActions.results.taskIds String  
Tanium.ResponseActions.results.actionIds String  
Tanium.ResponseActions.results.snapshotName String  
Tanium.ResponseActions.results.uuid String  
Tanium.ResponseActions.expirationTime Date  
Tanium.ResponseActions.createdAt Date  
Tanium.ResponseActions.updatedAt Date  
Tanium.ResponseActions.eid String  

tanium-tr-response-action-gather-snapshot

Creates a “gatherSnapshot” Response Action for the specified host

Base Command

tanium-tr-response-action-gather-snapshot

Input

Argument Name Description Required
computer_name Target computer name. Required
expiration_time Time unit to specify how long a snapshot should persist (i.e. “7 days”, “1 month”. Default is “7 days”). Optional

Context Output

Path Type Description
Tanium.ResponseActions.type String  
Tanium.ResponseActions.computerName String  
Tanium.ResponseActions.options String  
Tanium.ResponseActions.status String  
Tanium.ResponseActions.userId String  
Tanium.ResponseActions.userName String  
Tanium.ResponseActions.results String  
Tanium.ResponseActions.expirationTime Date  
Tanium.ResponseActions.createdAt Date  
Tanium.ResponseActions.updatedAt Date  
Tanium.ResponseActions.id String  
Tanium.ResponseActions.eid String  

Breaking changes from the previous version of this integration - Tanium Threat Response v2

The following sections list the changes in this version.

Commands

The following commands were removed in this version

  • tanium-tr-list-snapshots-by-connection
  • tanium-tr-list-local-snapshots-by-connection
  • tanium-tr-get-connection-by-name
  • tanium-tr-get-parent-process-tree
  • tanium-tr-list-evidence
  • tanium-tr-get-process-timeline
  • tanium-tr-get-download-file-request-status - this command was replaced by tanium-tr-get-task-by-id.

Arguments

The following arguments were removed in this version

In the tanium-tr-get-intel-doc-by-id command:

  • intel-doc-id - this argument was replaced by intel_doc_id.

In the tanium-tr-list-alerts command:

  • computer-ip-address - this argument was replaced by computer_ip_address.
  • computer-name - this argument was replaced by computer_name.
  • scan-config-id - this argument was replaced by scan_config_id.
  • intel-doc-id - this argument was replaced by intel_doc_id.

In the tanium-tr-get-alert-by-id command:

  • alert-id - this argument was replaced by alert_id.

In the tanium-tr-alert-update-state command:

  • alert-id - this argument was replaced by alert_ids.

In the tanium-tr-create-snapshot command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-snapshot command:

  • connection-name - this argument was replaced by connection_id.
  • snapshot-id - this argument was replaced by snapshot_ids.

In the tanium-tr-delete-local-snapshot command:

  • connection-name - this argument was replaced by connection_id.
  • file-name - this argument was removed.

In the tanium-tr-create-connection command:

  • remote - this argument was removed.
  • destination-type - this argument was removed.
  • destination - this argument was removed.
  • connection-timeout - this argument was removed.
  • This command receiving new arguments: client_id, ip, platform, hostname.

In the tanium-tr-delete-connection command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-label-by-id command:

  • label-id - this argument was replaced by label_id.

In the tanium-tr-list-file-downloads command:

  • host - this argument was removed.

In the tanium-tr-get-downloaded-file command:

  • file-id - this argument was replaced by file_id.

In the tanium-tr-list-events-by-connection command:

  • connection-name - this argument was replaced by connection_id.
  • event-type - this argument was replaced by type.

In the tanium-tr-get-file-download-info command:

  • host - this argument was removed.
  • path - this argument was removed.
  • id - this argument was replaced by file_id.

In the tanium-tr-get-process-info command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-events-by-process command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-process-children command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-parent-process command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-process-tree command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-evidence-by-id command:

  • evidence-id - this argument was replaced by evidence_id.

In the tanium-tr-create-evidence command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-evidence command:

  • evidence-id - this argument was replaced by evidence_ids.

In the tanium-tr-request-file-download command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-file-download command:

  • file-id - this argument was replaced by file_id.

In the tanium-tr-list-files-in-directory command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-file-info command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-file-from-endpoint command:

  • connection-name - this argument was replaced by connection_id.

The behavior of the following arguments was changed

In the tanium-tr-list-intel-docs command:

  • limit - The default value changed to ‘50’.

Outputs

The following outputs were removed in this version

In the tanium-tr-list-connections command:

  • Tanium.Connection.CreateTime - this output was removed.
  • Tanium.Connection.Name - this output was replaced by Tanium.Connection.hostname.
  • Tanium.Connection.Remote - this output was removed.
  • Tanium.Connection.State - this output was replaced by Tanium.Connection.status.
  • Tanium.Connection.Deleted - this output was removed.
  • Tanium.Connection.DestionationType - this output was removed.
  • Tanium.Connection.DST - this output was removed.
  • Tanium.Connection.OSName - this output was replaced by Tanium.Connection.platform.

In the tanium-tr-list-labels command:

  • Tanium.Label.CreatedAt - this output was replaced by Tanium.Label.createdAt.
  • Tanium.Label.Description - this output was replaced by Tanium.Label.description.
  • Tanium.Label.ID - this output was replaced by Tanium.Label.id.
  • Tanium.Label.IndicatorCount - this output was replaced by Tanium.Label.indicatorCount.
  • Tanium.Label.Name - this output was replaced by Tanium.Label.name.
  • Tanium.Label.SignalCount - this output was replaced by Tanium.Label.signalCount.
  • Tanium.Label.UpdatedAt - this output was replaced by Tanium.Label.updatedAt.

In the tanium-tr-get-label-by-id command:

  • Tanium.Label.CreatedAt - this output was replaced by Tanium.Label.createdAt.
  • Tanium.Label.Description - this output was replaced by Tanium.Label.description.
  • Tanium.Label.ID - this output was replaced by Tanium.Label.id.
  • Tanium.Label.IndicatorCount - this output was replaced by Tanium.Label.indicatorCount.
  • Tanium.Label.Name - this output was replaced by Tanium.Label.name.
  • Tanium.Label.SignalCount - this output was replaced by Tanium.Label.signalCount.
  • Tanium.Label.UpdatedAt - this output was replaced by Tanium.Label.updatedAt.

In the tanium-tr-list-file-downloads command:

  • Tanium.FileDownload.Size - this output was replaced by Tanium.FileDownload.size.
  • Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownload.path.
  • Tanium.FileDownload.Downloaded - this output was replaced by Tanium.FileDownload.downloaded.
  • Tanium.FileDownload.Host - this output was replaced by Tanium.FileDownload.hostname.
  • Tanium.FileDownload.Created - this output was replaced by Tanium.FileDownload.processCreationTime.
  • Tanium.FileDownload.Hash - this output was replaced by Tanium.FileDownload.hash.
  • Tanium.FileDownload.SPath - this output was removed.
  • Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownload.uuid.
  • Tanium.FileDownload.LastModified - this output was replaced by Tanium.FileDownload.lastModified.
  • Tanium.FileDownload.CreatedBy - this output was replaced by Tanium.FileDownload.createdBy.
  • Tanium.FileDownload.CreatedByProc - this output was replaced by Tanium.FileDownload.createdByProc.
  • Tanium.FileDownload.LastModifiedBy - this output was replaced by Tanium.FileDownload.lastModifiedBy.
  • Tanium.FileDownload.LastModifiedByProc - this output was replaced by Tanium.FileDownload.lastModifiedByProc.
  • Tanium.FileDownload.Comments - this output was removed.
  • Tanium.FileDownload.Tags - this output was removed.
  • Tanium.FileDownload.Deleted - this output was removed.

In the tanium-tr-list-events-by-connection command:

  • TaniumEvent.Domain - this output was removed.
  • TaniumEvent.File - this output was replaced by TaniumEvent.file.
  • TaniumEvent.Operation - this output was replaced by TaniumEvent.operation.
  • TaniumEvent.ProcessID - this output was replaced by TaniumEvent.pid.
  • TaniumEvent.ProcessName - this output was removed.
  • TaniumEvent.ProcessTableID - this output was replaced by TaniumEvent.processTableId.
  • TaniumEvent.Timestamp - this output was removed.
  • TaniumEvent.Username - this output was replaced by TaniumEvent.userName.
  • TaniumEvent.DestinationAddress - this output was replaced by TaniumEvent.remoteAddress.
  • TaniumEvent.DestinationPort - this output was replaced by TaniumEvent.remoteAddressPort.
  • TaniumEvent.SourceAddress - this output was replaced by TaniumEvent.localAddress.
  • TaniumEvent.SourcePort - this output was replaced by TaniumEvent.localAddressPort.
  • TaniumEvent.KeyPath - this output was replaced by TaniumEvent.keyPath.
  • TaniumEvent.ValueName - this output was replaced by TaniumEvent.valueName.
  • TaniumEvent.ExitCode - this output was replaced by TaniumEvent.exitCode.
  • TaniumEvent.ProcessCommandLine - this output was replaced by TaniumEvent.processCommandLine.
  • TaniumEvent.ProcessHash - this output was removed.
  • TaniumEvent.SID - this output was removed.
  • TaniumEvent.Hashes - this output was replaced by TaniumEvent.hashes.
  • TaniumEvent.ImageLoaded - this output was replaced by TaniumEvent.imageLoaded.
  • TaniumEvent.Signature - this output was replaced by TaniumEvent.signature.
  • TaniumEvent.Signed - this output was replaced by TaniumEvent.signed.
  • TaniumEvent.EventID - this output was replaced by TaniumEvent.eventId.
  • TaniumEvent.EventOpcode - this output was replaced by TaniumEvent.eventOpcode.
  • TaniumEvent.EventRecordID - this output was replaced by TaniumEvent.eventRecordId.
  • TaniumEvent.EventTaskID - this output was replaced by TaniumEvent.eventTaskId.
  • TaniumEvent.Query - this output was replaced by TaniumEvent.query.
  • TaniumEvent.Response - this output was replaced by TaniumEvent.response.
  • TaniumEvent.ImagePath - this output was replaced by TaniumEvent.imagePath.
  • TaniumEvent.CreationTime - this output was replaced by TaniumEvent.createTime.
  • TaniumEvent.EndTime - this output was replaced by TaniumEvent.endTime.
  • TaniumEvent.EventTaskName - this output was replaced by TaniumEvent.eventTaskName.
  • TaniumEvent.Property.Name - this output was removed.
  • TaniumEvent.Property.Value - this output was removed.

In the tanium-tr-get-file-download-info command:

  • Tanium.FileDownload.Size - this output was replaced by Tanium.FileDownload.size.
  • Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownload.path.
  • Tanium.FileDownload.Downloaded - this output was replaced by Tanium.FileDownload.downloaded.
  • Tanium.FileDownload.Host - this output was replaced by Tanium.FileDownload.hostname.
  • Tanium.FileDownload.Created - this output was replaced by Tanium.FileDownload.processCreationTime.
  • Tanium.FileDownload.Hash - this output was replaced by Tanium.FileDownload.hash.
  • Tanium.FileDownload.SPath - this output was removed.
  • Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownload.uuid.
  • Tanium.FileDownload.LastModified - this output was replaced by Tanium.FileDownload.lastModified.
  • Tanium.FileDownload.CreatedBy - this output was replaced by Tanium.FileDownload.createdBy.
  • Tanium.FileDownload.CreatedByProc - this output was replaced by Tanium.FileDownload.createdByProc.
  • Tanium.FileDownload.LastModifiedBy - this output was replaced by Tanium.FileDownload.lastModifiedBy.
  • Tanium.FileDownload.LastModifiedByProc - this output was replaced by Tanium.FileDownload.lastModifiedByProc.
  • Tanium.FileDownload.Comments - this output was removed.
  • Tanium.FileDownload.Tags - this output was removed.
  • Tanium.FileDownload.Deleted - this output was removed.

In the tanium-tr-get-process-info command:

  • Tanium.Process.CreateTime - this output was replaced by Tanium.ProcessInfo.createTime.
  • Tanium.Process.Domain - this output was removed.
  • Tanium.Process.ExitCode - this output was replaced by Tanium.ProcessInfo.exitCode.
  • Tanium.Process.ProcessCommandLine - this output was removed.
  • Tanium.Process.ProcessID - this output was replaced by Tanium.ProcessInfo.pid.
  • Tanium.Process.ProcessName - this output was removed.
  • Tanium.Process.ProcessTableId - this output was replaced by Tanium.ProcessInfo.processTableId.
  • Tanium.Process.SID - this output was removed
  • Tanium.Process.Username - this output was replaced by Tanium.ProcessInfo.userName.

In the tanium-tr-get-events-by-process command:

  • Tanium.ProcessEvent.ID - this output was replaced by Tanium.ProcessEvent.id.
  • Tanium.ProcessEvent.Detail - this output was replaced by Tanium.ProcessEvent.detail.
  • Tanium.ProcessEvent.Operation - this output was replaced by Tanium.ProcessEvent.operation.
  • Tanium.ProcessEvent.Timestamp - this output was replaced by Tanium.ProcessEvent.timestamp.
  • Tanium.ProcessEvent.Type - this output was replaced by Tanium.ProcessEvent.type.

In the tanium-tr-get-process-children command:

  • Tanium.ProcessChildren.ID - this output was replaced by Tanium.ProcessChildren.id.
  • Tanium.ProcessChildren.Name - this output was removed.
  • Tanium.ProcessChildren.PID - this output was replaced by Tanium.ProcessChildren.pid.
  • Tanium.ProcessChildren.PTID - this output was replaced by Tanium.ProcessChildren.parentProcessTableId.
  • Tanium.ProcessChildren.Parent - this output was removed.

In the tanium-tr-get-parent-process command:

  • Tanium.Process.CreateTime - this output was replaced by Tanium.ProcessParent.createTime.
  • Tanium.Process.Domain - this output was removed.
  • Tanium.Process.ExitCode - this output was replaced by Tanium.ProcessParent.exitCode.
  • Tanium.Process.ProcessCommandLine - this output was removed.
  • Tanium.Process.ProcessID - this output was replaced by Tanium.ProcessParent.pid.
  • Tanium.Process.ProcessName - this output was removed.
  • Tanium.Process.ProcessTableId - this output was replaced by Tanium.ProcessParent.processTableId.
  • Tanium.Process.SID - this output was removed.
  • Tanium.Process.Username - this output was replaced by Tanium.ProcessParent.userName.

In the tanium-tr-get-process-tree command:

  • Tanium.ProcessTree.ID - this output was replaced by Tanium.ProcessTree.id.
  • Tanium.ProcessTree.Name - this output was removed.
  • Tanium.ProcessTree.PID - this output was replaced by Tanium.ProcessTree.pid.
  • Tanium.ProcessTree.PTID - this output was replaced by Tanium.ProcessTree.parentProcessTableId.
  • Tanium.ProcessTree.Parent - this output was removed.
  • Tanium.ProcessTree.Children - this output was replaced by Tanium.ProcessTree.childrenCount.

In the tanium-tr-get-evidence-by-id command:

  • Tanium.Evidence.ID - this output was replaced by Tanium.Evidence.uuid.
  • Tanium.Evidence.CreatedAt - this output was replaced by Tanium.Evidence.createTime.
  • Tanium.Evidence.LastModified - this output was removed.
  • Tanium.Evidence.User - this output was replaced by Tanium.Evidence.username.
  • Tanium.Evidence.ConnectionName - this output was replaced by Tanium.Evidence.hostname.
  • Tanium.Evidence.Type - this output was replaced by Tanium.Evidence.type.
  • Tanium.Evidence.ProcessTableId - this output was removed.
  • Tanium.Evidence.Timestamp - this output was replaced by Tanium.Evidence.timestamp.
  • Tanium.Evidence.Summary - this output was replaced by Tanium.Evidence.summary.
  • Tanium.Evidence.Comments - this output was removed.
  • Tanium.Evidence.Tags - this output was removed.
  • Tanium.Evidence.Deleted - this output was removed.

In the tanium-tr-request-file-download command:

  • Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownloadTask.paths.
  • Tanium.FileDownload.ConnectionName - this output was replaced by Tanium.FileDownloadTask.connection.
  • Tanium.FileDownload.Downloaded - this output was removed.
  • Tanium.FileDownload.Status - this output was replaced by Tanium.FileDownloadTask.status.
  • Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownloadTask.taskId.

In the tanium-tr-list-files-in-directory command:

  • Tanium.File.Created - this output was replaced by Tanium.File.createdDate.
  • Tanium.File.Size - this output was replaced by Tanium.File.size.
  • Tanium.File.IsDirectory - this output was replaced by Tanium.File.type.
  • Tanium.File.LastModified - this output was replaced by Tanium.File.modifiedDate.
  • Tanium.File.Path - this output was replaced by Tanium.File.path.
  • Tanium.File.Permissions - this output was replaced by Tanium.File.permissions.
  • Tanium.File.ConnectionName - this output was replaced by Tanium.File.connectionId.
  • Tanium.File.Deleted - this output was removed.

In the tanium-tr-get-file-info command:

  • Tanium.File.Created - this output was replaced by Tanium.File.createdDate.
  • Tanium.File.Size - this output was replaced by Tanium.File.size.
  • Tanium.File.IsDirectory - this output was replaced by Tanium.File.type.
  • Tanium.File.LastModified - this output was replaced by Tanium.File.modifiedDate.
  • Tanium.File.Path - this output was replaced by Tanium.File.path.
  • Tanium.File.ConnectionName - this output was replaced by Tanium.File.connectionId.
  • Tanium.File.Deleted - this output was removed.

Configuration parameters

  • url — Hostname, IP address, or server URL (required)
  • credentials — Username
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Maximum number of incidents to fetch each time
  • filter_alerts_by_state — Alert states to filter by in fetch incidents command. Empty list won't filter the incidents by state.
  • filter_by_label_name — Label name to filter by in fetch incidents command. Leave empty to not filter the incidents by label name.
  • api_version — API Version
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval

Commands (47)

  • tanium-tr-alert-update-state

    Updates the state of the specified alerts.

  • tanium-tr-close-connection

    Closes a connection by connection ID.

  • tanium-tr-create-connection

    Creates a local or remote connection.

  • tanium-tr-create-evidence

    Creates event evidence from process.

  • tanium-tr-create-snapshot

    Captures a new snapshot by connection ID.

  • tanium-tr-delete-connection

    Deletes a connection by connection ID.

  • tanium-tr-delete-evidence

    Deletes event evidences from Tanium.

  • tanium-tr-delete-file-download

    Deletes a file download.

  • tanium-tr-delete-file-from-endpoint

    Deletes a file from the given endpoint.

  • tanium-tr-delete-local-snapshot

    Deletes a local snapshot by connection ID.

  • tanium-tr-delete-snapshot

    Deletes a snapshot by connection name and snapshot ID.

  • tanium-tr-event-evidence-get-properties

    Returns event evidence properties for IOC generation.

  • tanium-tr-event-evidence-list

    Returns a list of all available event evidences in the system.

  • tanium-tr-get-alert-by-id

    Returns an alert object based on alert ID.

  • tanium-tr-get-downloaded-file

    Gets the actual content of a downloaded file by file ID. Downloaded file password: `infected`.

  • tanium-tr-get-events-by-process

    Gets the events for a process.

  • tanium-tr-get-evidence-by-id

    Gets event evidence by evidence ID.

  • tanium-tr-get-file-download-info

    Gets the metadata of a file download.

  • tanium-tr-get-file-info

    Gets information about a file from a remote connection.

  • tanium-tr-get-intel-doc-by-id

    Returns an intel document object based on ID.

  • tanium-tr-get-label-by-id

    Returns a label object based on label ID.

  • tanium-tr-get-parent-process

    Gets information for the parent process.

  • tanium-tr-get-process-children

    Gets the children of this process instance.

  • tanium-tr-get-process-info

    Get information for a process.

  • tanium-tr-get-process-tree

    Gets the process tree for the process instance.

  • tanium-tr-get-response-actions

    Returns the Response Actions matching the specified filters.

  • tanium-tr-get-system-status

    Gets system status, including connections, client IDs, hostnames, and IPs.

  • tanium-tr-get-task-by-id

    Get task by ID.

  • tanium-tr-intel-deploy

    Deploys intel using the service account context.

  • tanium-tr-intel-deploy-status

    Displays status of last intel deployment.

  • tanium-tr-intel-doc-create

    Add a new intel document to the system by providing its document contents.

  • tanium-tr-intel-doc-delete

    Remove an intel document from the system by providing its ID.

  • tanium-tr-intel-doc-update

    Update the contents of an existing intel document by providing the document contents.

  • tanium-tr-intel-docs-add-label

    Create a new label association for the identified intel document.

  • tanium-tr-intel-docs-labels-list

    List all labels for the identified intel document.

  • tanium-tr-intel-docs-remove-label

    Delete a label association for the identified intel document.

  • tanium-tr-list-alerts

    Returns a comma-separated list of all alerts.

  • tanium-tr-list-connections

    Returns a list of all connections.

  • tanium-tr-list-events-by-connection

    Queries events for a connection.

  • tanium-tr-list-file-downloads

    Returns all downloaded files in the system.

  • tanium-tr-list-files-in-directory

    Gets a list of files in the given directory.

  • tanium-tr-list-intel-docs

    Returns a comma-separated list of all intel documents.

  • tanium-tr-list-labels

    Returns all available labels in the system.

  • tanium-tr-list-snapshots

    Returns all local snapshots of a single connection.

  • tanium-tr-request-file-download

    Requests a new file download.

  • tanium-tr-response-action-gather-snapshot

    Creates a "gatherSnapshot" Response Action for the specified host.

  • tanium-tr-start-quick-scan

    Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.

Source

TaniumThreatResponseV2.py TaniumThreatResponseV2_test.py TaniumThreatResponseV2.yml TaniumThreatResponseV2_description.md command_examples.txt
Download History Raw 
category: Endpoint
provider: Tanium
commonfields:
  id: Tanium Threat Response v2
  version: -1
sectionorder:
  - Connect
  - Collect
configuration:
- display: Hostname, IP address, or server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  type: 9
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- defaultvalue: 24 hours
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: '50'
  display: Maximum number of incidents to fetch each time
  name: max_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: unresolved
  display: Alert states to filter by in fetch incidents command. Empty list won't filter the incidents by state.
  section: Collect
  name: filter_alerts_by_state
  options:
  - unresolved
  - inprogress
  - resolved
  - suppressed
  type: 16
  required: false
- display: Label name to filter by in fetch incidents command. Leave empty to not filter the incidents by label name.
  name: filter_by_label_name
  type: 0
  defaultvalue: ''
  required: false
  section: Collect
- defaultvalue: 3.x
  display: API Version
  additionalinfo: the version of Tanium Threat Response your instance supports.
  section: Connect
  name: api_version
  options:
  - 3.x
  - 4.x
  type: 15
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
description: Use the Tanium Threat Response integration to manage endpoint processes, evidence, alerts, files, snapshots, and connections. This integration works with Tanium Threat Response version 3.0.159 and above.
display: Tanium Threat Response v2
name: Tanium Threat Response v2
script:
  commands:
  - arguments:
    - description: The intel document ID.
      name: intel_doc_id
      required: true
    description: Returns an intel document object based on ID.
    name: tanium-tr-get-intel-doc-by-id
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date this intel was first added to the system.
      type: Date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: Date
  - arguments:
    - defaultValue: '50'
      description: The maximum number of intel documents to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing intel documents.
      name: offset
    - description: The name of the intel document to show.
      name: name
    - description: The description of the intel document to show.
      name: description
    - description: The type of the intel document to show.
      name: type
    - description: The label ID of the intel document to show.
      name: label_id
    - description: The mitre technique ID of the intel document to show.
      name: mitre_technique_id
    description: Returns a comma-separated list of all intel documents.
    name: tanium-tr-list-intel-docs
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date this intel was first added to the system.
      type: Date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: Date
  - arguments:
    - defaultValue: '5'
      description: The maximum number of alerts to return.
      name: limit
    - description: The offset number to begin listing alerts.
      name: offset
    - description: Filter alerts by the specified computer IP address.
      name: computer_ip_address
    - description: Filter alerts by the specified computer name.
      name: computer_name
    - description: Filter alerts by the specified scan config ID.
      name: scan_config_id
    - description: Filter alerts by the specified intel document ID.
      name: intel_doc_id
    - description: Filter alerts by the specified severity.
      name: severity
    - description: Filter alerts by the specified priority.
      name: priority
    - description: Filter alerts by the specified type.
      name: type
    - auto: PREDEFINED
      description: Filter alerts by the specified state. Can be "Unresolved", "In Progress", "Dismissed", "Ignored", or "Resolved".
      name: state
      predefined:
      - Unresolved
      - In Progress
      - Ignored
      - Resolved
      - Dismissed
    description: Returns a comma-separated list of all alerts.
    name: tanium-tr-list-alerts
    outputs:
    - contextPath: Tanium.Alert.Priority
      description: The priority of the alert.
      type: String
    - contextPath: Tanium.Alert.ComputerName
      description: The hostname of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.GUID
      description: A globally unique identifier for this alert in the customer environment.
      type: String
    - contextPath: Tanium.Alert.AlertedAt
      description: The date the alert was generated.
      type: Date
    - contextPath: Tanium.Alert.UpdatedAt
      description: The date the alert state was last updated.
      type: Date
    - contextPath: Tanium.Alert.State
      description: The current state of the alert. For example, "unresolved" or "inprogress".
      type: String
    - contextPath: Tanium.Alert.ComputerIpAddress
      description: The IP address of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.Type
      description: The name of the alert type. For example, "detect.endpoint.match".
      type: String
    - contextPath: Tanium.Alert.ID
      description: The ID of the alert. For example, "123".
      type: Number
    - contextPath: Tanium.Alert.CreatedAt
      description: The date the alert was received by the Detect product.
      type: Date
    - contextPath: Tanium.Alert.IntelDocId
      description: The intel document revision, if intelDocId exists.
      type: Number
    - contextPath: Tanium.Alert.Severity
      description: The severity of the alert.
      type: String
  - arguments:
    - description: The alert ID.
      name: alert_id
      required: true
    description: Returns an alert object based on alert ID.
    name: tanium-tr-get-alert-by-id
    outputs:
    - contextPath: Tanium.Alert.Priority
      description: The priority of the alert.
      type: String
    - contextPath: Tanium.Alert.ComputerName
      description: The hostname of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.GUID
      description: A globally unique identifier for this alert in the customer environment.
      type: String
    - contextPath: Tanium.Alert.AlertedAt
      description: The date the alert was generated.
      type: Date
    - contextPath: Tanium.Alert.UpdatedAt
      description: The date the alert state was last updated.
      type: Date
    - contextPath: Tanium.Alert.State
      description: The current state of the alert. For example, "unresolved" or "inprogress".
      type: String
    - contextPath: Tanium.Alert.ComputerIpAddress
      description: The IP address of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.Type
      description: The name of the alert type. For example, "detect.endpoint.match".
      type: String
    - contextPath: Tanium.Alert.ID
      description: The ID of the alert. For example, "123".
      type: Number
    - contextPath: Tanium.Alert.CreatedAt
      description: The date the alert was received by the Detect product.
      type: Date
    - contextPath: Tanium.Alert.IntelDocId
      description: The intel document revision, if intelDocId exists.
      type: Number
    - contextPath: Tanium.Alert.Severity
      description: The severity of the alert.
      type: String
  - arguments:
    - description: A comma-separated list of alert IDs to update.
      isArray: true
      name: alert_ids
      required: true
    - auto: PREDEFINED
      description: The new state for the alerts. Can be "Unresolved", "In Progress", "Dismissed", "Ignored", or "Resolved".
      name: state
      predefined:
      - dismissed
      - unresolved
      - inprogress
      - ignored
      - resolved
      required: true
    description: Updates the state of the specified alerts.
    name: tanium-tr-alert-update-state
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    description: Captures a new snapshot by connection ID.
    name: tanium-tr-create-snapshot
    outputs:
    - contextPath: Tanium.SnapshotTask.connection
      description: Connection ID of the snapshot.
      type: String
    - contextPath: Tanium.SnapshotTask.startTime
      description: Snapshot start time.
      type: Date
    - contextPath: Tanium.SnapshotTask.status
      description: Snapshot creation task status.
      type: String
    - contextPath: Tanium.SnapshotTask.taskId
      description: Snapshot creation task ID. You can get task status using the tanium-tr-get-task-by-id command.
      type: Number
  - arguments:
    - description: A comma-separated list of snapshot IDs to delete.
      isArray: true
      name: snapshot_ids
      required: true
    description: Deletes a snapshot by connection name and snapshot ID.
    name: tanium-tr-delete-snapshot
  - arguments:
    - defaultValue: '50'
      description: The maximum number of local snapshots to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing local snapshots.
      name: offset
    description: Returns all local snapshots of a single connection.
    name: tanium-tr-list-snapshots
    outputs:
    - contextPath: Tanium.Snapshot.size
      description: The snapshot size.
      type: String
    - contextPath: Tanium.Snapshot.created
      description: The snapshot creation date.
      type: String
    - contextPath: Tanium.Snapshot.completed
      description: The snapshot completed date.
      type: String
    - contextPath: Tanium.Snapshot.name
      description: The snapshot name.
      type: String
    - contextPath: Tanium.Snapshot.isUpload
      description: Is the snapshot uploaded.
      type: Boolean
    - contextPath: Tanium.Snapshot.evidenceType
      description: The snapshot evidence type.
      type: String
    - contextPath: Tanium.Snapshot.hostname
      description: The snapshot hostname.
      type: String
    - contextPath: Tanium.Snapshot.connectionId
      description: The snapshot connection ID.
      type: String
    - contextPath: Tanium.Snapshot.recorderVersion
      description: The snapshot recorder version.
      type: String
    - contextPath: Tanium.Snapshot.uuid
      description: The snapshot UUID.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    description: Deletes a local snapshot by connection ID.
    name: tanium-tr-delete-local-snapshot
  - arguments:
    - defaultValue: '50'
      description: The maximum number of connections to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing connections.
      name: offset
    - description: A comma-separated list of connection statuses to filter connections by, for example status=connected,waiting.
      isArray: true
      name: status
      predefined:
      - disconnected
      - timeout
      - waiting
      - connected
      auto: PREDEFINED
    - description: A comma-separated list of IPs to filter connections by, for example status=1.1.1.1,1.1.1.1.
      isArray: true
      name: ip
    - description: A comma-separated list of platforms to filter connections by, for example platform=Linux,Windows.
      isArray: true
      name: platform
    - description: A comma-separated list of hostnames to filter connections by, for example hostname=host1,host2.
      isArray: true
      name: hostname
    description: Returns a list of all connections.
    name: tanium-tr-list-connections
    outputs:
    - contextPath: Tanium.Connection.id
      description: The connection ID.
      type: String
    - contextPath: Tanium.Connection.initiatedAt
      description: The date the connection was created.
      type: Date
    - contextPath: Tanium.Connection.hostname
      description: The connection hostname.
      type: String
    - contextPath: Tanium.Connection.status
      description: The current connection state.
      type: String
    - contextPath: Tanium.Connection.platform
      description: The connection operating system.
      type: String
    - contextPath: Tanium.Connection.ip
      description: The connection IP.
      type: String
    - contextPath: Tanium.Connection.connectedAt
      description: The date the connection was connected.
      type: String
    - contextPath: Tanium.Connection.message
      description: The connection message describing the status.
      type: String
    - contextPath: Tanium.Connection.personaId
      description: The connection persona ID.
      type: String
    - contextPath: Tanium.Connection.clientId
      description: The connection client ID.
      type: String
    - contextPath: Tanium.Connection.userId
      description: The connection user ID.
      type: String
    - contextPath: Tanium.Connection.eid
      description: The connection EID.
      type: String
    - contextPath: Tanium.Connection.hasTools
      description: Has connection tools.
      type: Boolean
  - arguments:
    - description: Client ID. Use tanium-tr-get-system-status to get all possible client_ids.
      name: client_id
      required: true
    - description: IP address to connect. Use tanium-tr-get-system-status to get all possible IPs.
      name: ip
      required: true
    - description: Commputer platform, for example Windows or Linux.
      name: platform
      required: true
    - description: Hostname of the computer to connect. Use tanium-tr-get-system-status to get all possible hostnames.
      name: hostname
      required: true
    description: Creates a local or remote connection.
    name: tanium-tr-create-connection
    outputs:
    - contextPath: Tanium.Connection.id
      description: New connection ID.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    description: Deletes a connection by connection ID.
    name: tanium-tr-delete-connection
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    description: Closes a connection by connection ID.
    name: tanium-tr-close-connection
  - arguments:
    - defaultValue: '50'
      description: The maximum number of labels to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing labels.
      name: offset
    description: Returns all available labels in the system.
    name: tanium-tr-list-labels
    outputs:
    - contextPath: Tanium.Label.createdAt
      description: The date this label was created.
      type: Date
    - contextPath: Tanium.Label.description
      description: An extended description of the label.
      type: String
    - contextPath: Tanium.Label.id
      description: The unique identifier for this label.
      type: Number
    - contextPath: Tanium.Label.indicatorCount
      description: The number of indicator-based intel documents associated with this label, not including Tanium Signals.
      type: Number
    - contextPath: Tanium.Label.name
      description: The label display name.
      type: String
    - contextPath: Tanium.Label.signalCount
      description: The number of Tanium Signal documents associated with this label.
      type: Number
    - contextPath: Tanium.Label.updatedAt
      description: The date this label was last updated, not including the intel and signal counts.
      type: Date
  - arguments:
    - description: The label ID. Use tanium-tr-intel-docs-labels-list command to get the available label IDs.
      name: label_id
      required: true
    description: Returns a label object based on label ID.
    name: tanium-tr-get-label-by-id
    outputs:
    - contextPath: Tanium.Label.createdAt
      description: The date this label was created.
      type: Date
    - contextPath: Tanium.Label.description
      description: An extended description of the label.
      type: String
    - contextPath: Tanium.Label.id
      description: The unique identifier for this label.
      type: Number
    - contextPath: Tanium.Label.indicatorCount
      description: The number of indicator-based intel documents associated with this label, not including Tanium Signals.
      type: Number
    - contextPath: Tanium.Label.name
      description: The label display name.
      type: String
    - contextPath: Tanium.Label.signalCount
      description: The number of Tanium Signal documents associated with this label.
      type: Number
    - contextPath: Tanium.Label.updatedAt
      description: The date this label was last updated, not including the intel and signal counts.
      type: Date
  - arguments:
    - defaultValue: '50'
      description: The maximum number of files to return.
      name: limit
    - defaultValue: '0'
      description: The offset to start getting file downloads.
      name: offset
    - description: The column to sort by.
      name: sort
    - description: A comma-separated list of hostnames to filter downloaded files by, for example hostname=host1,host2.
      isArray: true
      name: hostname
    - description: A comma-separated list of hashes to filter downloaded files by, for example hash=123,456.
      isArray: true
      name: hash
    - description: Get the downloaded files with a process start time that matches the specified date and time, for example process_time_start=2019-09-03T17:51:40.000Z.
      name: process_time_start
    description: Returns all downloaded files in the system.
    name: tanium-tr-list-file-downloads
    outputs:
    - contextPath: Tanium.FileDownload.size
      description: The size of the file in bytes.
      type: Number
    - contextPath: Tanium.FileDownload.path
      description: The path of the file.
      type: String
    - contextPath: Tanium.FileDownload.downloaded
      description: The date this file was downloaded.
      type: Date
    - contextPath: Tanium.FileDownload.hostname
      description: The hostname of the downloaded file.
      type: String
    - contextPath: Tanium.FileDownload.processCreationTime
      description: The date the file was created.
      type: Date
    - contextPath: Tanium.FileDownload.hash
      description: The file hash.
      type: String
    - contextPath: Tanium.FileDownload.uuid
      description: The downloaded file uuid.
      type: Number
    - contextPath: Tanium.FileDownload.lastModified
      description: The date the file was last modified.
      type: Date
    - contextPath: Tanium.FileDownload.createdBy
      description: The user that created this file.
      type: String
    - contextPath: Tanium.FileDownload.createdByProc
      description: The process path that created this file.
      type: String
    - contextPath: Tanium.FileDownload.lastModifiedBy
      description: The user that last modified this file.
      type: String
    - contextPath: Tanium.FileDownload.lastModifiedByProc
      description: The process path that last modified this file.
      type: String
    - contextPath: Tanium.FileDownload.evidenceType
      description: The file evidence type.
      type: String
  - arguments:
    - description: The file ID.
      name: file_id
      required: true
    description: 'Gets the actual content of a downloaded file by file ID. Downloaded file password: `infected`.'
    name: tanium-tr-get-downloaded-file
    outputs:
    - contextPath: File.EntryID
      description: The file entry ID.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
    - contextPath: File.Info
      description: Information about the file.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Name
      description: The file name.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file (same as displayed in file entries).
      type: String
    - contextPath: File.Size
      description: The file size in bytes.
      type: Number
    - contextPath: File.Type
      description: The file type.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    - auto: PREDEFINED
      defaultValue: combined
      description: The event type. Can be "File", "Network", "Registry", "Process", "Driver", "Combined", "DNS", or "Image".
      name: type
      predefined:
      - File
      - Network
      - Registry
      - Process
      - Driver
      - Combined
      - DNS
      - Image
      required: true
    - defaultValue: '50'
      description: The maximum number of events to return.
      name: limit
    - defaultValue: '0'
      description: The offset to start getting the result set.
      name: offset
    - description: "Advanced search that filters according to event fields. For example: [['process_id', 'gt', '30'], ['username', 'ne', 'administrator']]. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional operators: eq (equals), ne (does not equal); for integers/date: gt (greater than), gte (greater than or equals), ls (less than), lse (less than or equals); for strings: co (contains), nc (does not contain). "
      name: filter
    - auto: PREDEFINED
      defaultValue: all
      description: Whether the results should fit all filters or at least one filter.
      name: match
      predefined:
      - all
      - any
    - description: 'A comma-separated list of fields to sort on prefixed by +/- for ascending or descending and ordered by priority left to right. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC).'
      name: sort
    - description: 'A comma-separated list of fields on which to search. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time.'
      name: fields
    description: Queries events for a connection.
    name: tanium-tr-list-events-by-connection
    outputs:
    - contextPath: TaniumEvent.id
      description: The event ID.
      type: String
    - contextPath: TaniumEvent.groupName
      description: The event group name.
      type: String
    - contextPath: TaniumEvent.file
      description: The path of the file in the event.
      type: String
    - contextPath: TaniumEvent.operation
      description: The event operation.
      type: String
    - contextPath: TaniumEvent.processId
      description: The event process ID.
      type: Number
    - contextPath: TaniumEvent.pid
      description: The event PID.
      type: Number
    - contextPath: TaniumEvent.processPath
      description: The event process path.
      type: String
    - contextPath: TaniumEvent.processTableId
      description: The event process table ID.
      type: Number
    - contextPath: TaniumEvent.timestamp
      description: The date the event was created.
      type: Date
    - contextPath: TaniumEvent.userName
      description: The username associated with the event.
      type: String
    - contextPath: TaniumEvent.remoteAddress
      description: The network event destination address.
      type: String
    - contextPath: TaniumEvent.remoteAddressPort
      description: The network event destination port.
      type: Number
    - contextPath: TaniumEvent.localAddress
      description: The network event source address.
      type: String
    - contextPath: TaniumEvent.localAddressPort
      description: The network event source port.
      type: Number
    - contextPath: TaniumEvent.keyPath
      description: The registry key path.
      type: String
    - contextPath: TaniumEvent.valueName
      description: The registry value name.
      type: String
    - contextPath: TaniumEvent.exitCode
      description: The process exit code.
      type: Number
    - contextPath: TaniumEvent.processCommandLine
      description: The process command line.
      type: String
    - contextPath: TaniumEvent.parentCommandLine
      description: The parent command line.
      type: String
    - contextPath: TaniumEvent.processHash
      description: The process hash value.
      type: String
    - contextPath: TaniumEvent.hashes
      description: The hashes of the driver.
      type: String
    - contextPath: TaniumEvent.imageLoaded
      description: The image loaded path of the driver.
      type: String
    - contextPath: TaniumEvent.signature
      description: The signature of the driver.
      type: String
    - contextPath: TaniumEvent.signed
      description: Whether the driver is signed.
      type: Boolean
    - contextPath: TaniumEvent.eventId
      description: The event ID.
      type: Number
    - contextPath: TaniumEvent.eventOpcode
      description: The event opcode.
      type: Number
    - contextPath: TaniumEvent.eventRecordId
      description: The event record ID.
      type: Number
    - contextPath: TaniumEvent.eventTaskId
      description: The event task ID.
      type: Number
    - contextPath: TaniumEvent.query
      description: The query of the DNS.
      type: String
    - contextPath: TaniumEvent.response
      description: The response of the DNS.
      type: String
    - contextPath: TaniumEvent.imagePath
      description: The image path.
      type: String
    - contextPath: TaniumEvent.createTime
      description: The process creation date and time.
      type: Date
    - contextPath: TaniumEvent.endTime
      description: The process end date and time.
      type: Date
    - contextPath: TaniumEvent.eventTaskName
      description: The event task name.
      type: String
    - contextPath: TaniumEvent.hash
      description: The event process hash.
      type: String
  - arguments:
    - description: File download ID.
      name: file_id
      required: true
    description: Gets the metadata of a file download.
    name: tanium-tr-get-file-download-info
    outputs:
    - contextPath: Tanium.FileDownload.size
      description: The downloaded file size in bytes.
      type: Number
    - contextPath: Tanium.FileDownload.path
      description: The downloaded file path.
      type: String
    - contextPath: Tanium.FileDownload.downloaded
      description: The date this file was downloaded.
      type: Date
    - contextPath: Tanium.FileDownload.hostname
      description: The downloaded file hostname.
      type: String
    - contextPath: Tanium.FileDownload.processCreationTime
      description: The date the downloaded file was created.
      type: Date
    - contextPath: Tanium.FileDownload.hash
      description: The downloaded file hash.
      type: String
    - contextPath: Tanium.FileDownload.uuid
      description: The downloaded file UUID.
      type: Number
    - contextPath: Tanium.FileDownload.lastModified
      description: The date the downloaded file was last modified.
      type: Date
    - contextPath: Tanium.FileDownload.createdBy
      description: The user that created this file.
      type: String
    - contextPath: Tanium.FileDownload.createdByProc
      description: The process path that created this file.
      type: String
    - contextPath: Tanium.FileDownload.lastModifiedBy
      description: The user that last modified this file.
      type: String
    - contextPath: Tanium.FileDownload.lastModifiedByProc
      description: The process path that modified this file.
      type: String
    - contextPath: Tanium.FileDownload.evidenceType
      description: The downloaded file evidence type.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    - description: The process table ID.
      name: ptid
      required: true
    description: Get information for a process.
    name: tanium-tr-get-process-info
    outputs:
    - contextPath: Tanium.ProcessInfo.childrenCount
      description: The number of process children.
      type: Number
    - contextPath: Tanium.ProcessInfo.context
      description: The process tree context.
      type: String
    - contextPath: Tanium.ProcessInfo.createTime
      description: The date the process was created.
      type: Date
    - contextPath: Tanium.ProcessInfo.createTimeRaw
      description: The timestamp when the process was created.
      type: Date
    - contextPath: Tanium.ProcessInfo.dnsEventsCount
      description: The number of DNS events in the process.
      type: Number
    - contextPath: Tanium.ProcessInfo.driverEventsCount
      description: The number of driver events in the process.
      type: Number
    - contextPath: Tanium.ProcessInfo.endTime
      description: The process termination date and time.
      type: Date
    - contextPath: Tanium.ProcessInfo.endTimeRaw
      description: The process termination timestamp.
      type: Date
    - contextPath: Tanium.ProcessInfo.exitCode
      description: The process exit code.
      type: Number
    - contextPath: Tanium.ProcessInfo.fileEventsCount
      description: The number of File events in the process.
      type: Number
    - contextPath: Tanium.ProcessInfo.groupName
      description: The process group name.
      type: String
    - contextPath: Tanium.ProcessInfo.hashTypeName
      description: The process hash type.
      type: String
    - contextPath: Tanium.ProcessInfo.id
      description: The process ID in the Tanium system.
      type: String
    - contextPath: Tanium.ProcessInfo.imageEventsCount
      description: The number of image events in the process.
      type: Number
    - contextPath: Tanium.ProcessInfo.networkEventsCount
      description: The number of network events in the process.
      type: Number
    - contextPath: Tanium.ProcessInfo.parentProcessTableId
      description: The parent process table ID.
      type: String
    - contextPath: Tanium.ProcessInfo.pid
      description: The process PID.
      type: Number
    - contextPath: Tanium.ProcessInfo.processEventsCount
      description: The number of process events in the process.
      type: Number
    - contextPath: Tanium.ProcessInfo.processHash
      description: The process hash.
      type: String
    - contextPath: Tanium.ProcessInfo.processPath
      description: The process path.
      type: String
    - contextPath: Tanium.ProcessInfo.processTableId
      description: The process table ID.
      type: String
    - contextPath: Tanium.ProcessInfo.registryEventsCount
      description: The number of registry events in the process.
      type: Number
    - contextPath: Tanium.ProcessInfo.securityEventsCount
      description: The number of security events in the process.
      type: Number
    - contextPath: Tanium.ProcessInfo.uniqueProcessId
      description: The unique process ID.
      type: String
    - contextPath: Tanium.ProcessInfo.userName
      description: The username who created the process.
      type: String
  - arguments:
    - description: The connection name.
      name: connection_id
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    - auto: PREDEFINED
      defaultValue: combined
      description: The event type. Can be "File", "Network", "Registry", "Process", "Driver", "Combined", "DNS", or "Image".
      name: type
      predefined:
      - File
      - Network
      - Registry
      - Process
      - Driver
      - Combined
      - DNS
      - Image
      required: true
    - defaultValue: '50'
      description: The maximum number of events to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing events.
      name: offset
    description: Gets the events for a process.
    name: tanium-tr-get-events-by-process
    outputs:
    - contextPath: Tanium.ProcessEvent.id
      description: The event ID.
      type: Number
    - contextPath: Tanium.ProcessEvent.detail
      description: The event details.
      type: Unknown
    - contextPath: Tanium.ProcessEvent.operation
      description: The event operation.
      type: String
    - contextPath: Tanium.ProcessEvent.timestamp
      description: The date and time the event was created.
      type: Date
    - contextPath: Tanium.ProcessEvent.type
      description: The event type.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    - description: The process table ID.
      name: ptid
      required: true
    - defaultValue: '50'
      description: The maximum number of entries to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing entries.
      name: offset
    description: Gets the children of this process instance.
    name: tanium-tr-get-process-children
    outputs:
    - contextPath: Tanium.ProcessChildren.childrenCount
      description: The number of process children.
      type: Number
    - contextPath: Tanium.ProcessChildren.context
      description: The child process tree context.
      type: String
    - contextPath: Tanium.ProcessChildren.createTime
      description: The date and time the child process was created.
      type: Date
    - contextPath: Tanium.ProcessChildren.createTimeRaw
      description: The child process creation timestamp.
      type: Date
    - contextPath: Tanium.ProcessChildren.dnsEventsCount
      description: The number of DNS events in the child process.
      type: Number
    - contextPath: Tanium.ProcessChildren.driverEventsCount
      description: The number of driver events in the child process.
      type: Number
    - contextPath: Tanium.ProcessChildren.endTime
      description: The child process termination date and time.
      type: Date
    - contextPath: Tanium.ProcessChildren.endTimeRaw
      description: The child process termination timestamp.
      type: Date
    - contextPath: Tanium.ProcessChildren.exitCode
      description: The child process exit code.
      type: Number
    - contextPath: Tanium.ProcessChildren.fileEventsCount
      description: The number of file events in the child process.
      type: Number
    - contextPath: Tanium.ProcessChildren.groupName
      description: The child process group name.
      type: String
    - contextPath: Tanium.ProcessChildren.hashTypeName
      description: The child process hash type.
      type: String
    - contextPath: Tanium.ProcessChildren.id
      description: The child process ID in the Tanium system.
      type: String
    - contextPath: Tanium.ProcessChildren.imageEventsCount
      description: The number of image events in the child process.
      type: Number
    - contextPath: Tanium.ProcessChildren.networkEventsCount
      description: The number of network events in the child process.
      type: Number
    - contextPath: Tanium.ProcessChildren.parentProcessTableId
      description: The parent process table ID.
      type: String
    - contextPath: Tanium.ProcessChildren.pid
      description: The child process PID.
      type: Number
    - contextPath: Tanium.ProcessChildren.processEventsCount
      description: Number of process events in the child process.
      type: Number
    - contextPath: Tanium.ProcessChildren.processHash
      description: The child process hash.
      type: String
    - contextPath: Tanium.ProcessChildren.processPath
      description: The child process path.
      type: String
    - contextPath: Tanium.ProcessChildren.processTableId
      description: The child process table ID.
      type: String
    - contextPath: Tanium.ProcessChildren.registryEventsCount
      description: The number of registry events in the child process.
      type: Number
    - contextPath: Tanium.ProcessChildren.securityEventsCount
      description: The number of security events in the child process.
      type: Number
    - contextPath: Tanium.ProcessChildren.uniqueProcessId
      description: The unique child process ID.
      type: String
    - contextPath: Tanium.ProcessChildren.userName
      description: The username who created the child process.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    - description: The process table ID.
      name: ptid
      required: true
    description: Gets information for the parent process.
    name: tanium-tr-get-parent-process
    outputs:
    - contextPath: Tanium.ProcessParent.childrenCount
      description: The number of process children.
      type: Number
    - contextPath: Tanium.ProcessParent.context
      description: The parent process tree context.
      type: String
    - contextPath: Tanium.ProcessParent.createTime
      description: The parent process creation date and time.
      type: Date
    - contextPath: Tanium.ProcessParent.createTimeRaw
      description: The parent process creation timestamp.
      type: Date
    - contextPath: Tanium.ProcessParent.dnsEventsCount
      description: The number of DNS events in the parent process.
      type: Number
    - contextPath: Tanium.ProcessParent.driverEventsCount
      description: The number of driver events in the parent process.
      type: Number
    - contextPath: Tanium.ProcessParent.endTime
      description: The parent process termination date and time.
      type: Date
    - contextPath: Tanium.ProcessParent.endTimeRaw
      description: The parent process termination timestamp.
      type: Date
    - contextPath: Tanium.ProcessParent.exitCode
      description: The parent process exit code.
      type: Number
    - contextPath: Tanium.ProcessParent.fileEventsCount
      description: The number of file events in the parent process.
      type: Number
    - contextPath: Tanium.ProcessParent.groupName
      description: The parent process group name.
      type: String
    - contextPath: Tanium.ProcessParent.hashTypeName
      description: Tehe parent process hash type.
      type: String
    - contextPath: Tanium.ProcessParent.id
      description: The parent process ID in the Tanium system.
      type: String
    - contextPath: Tanium.ProcessParent.imageEventsCount
      description: The number of image events in the parent process.
      type: Number
    - contextPath: Tanium.ProcessParent.networkEventsCount
      description: The number of network events in the parent process.
      type: Number
    - contextPath: Tanium.ProcessParent.parentProcessTableId
      description: The parent process table ID.
      type: String
    - contextPath: Tanium.ProcessParent.pid
      description: The parent process PID.
      type: Number
    - contextPath: Tanium.ProcessParent.processEventsCount
      description: The number of parent process events in the process.
      type: Number
    - contextPath: Tanium.ProcessParent.processHash
      description: The parent process hash.
      type: String
    - contextPath: Tanium.ProcessParent.processPath
      description: The parent process path.
      type: String
    - contextPath: Tanium.ProcessParent.processTableId
      description: The parent process table ID.
      type: String
    - contextPath: Tanium.ProcessParent.registryEventsCount
      description: The number of registry events in the parent process.
      type: Number
    - contextPath: Tanium.ProcessParent.securityEventsCount
      description: The number of security events in the parent process.
      type: Number
    - contextPath: Tanium.ProcessParent.uniqueProcessId
      description: The unique parent process ID.
      type: String
    - contextPath: Tanium.ProcessParent.userName
      description: The username who created the parent process.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    - auto: PREDEFINED
      description: The process context. Can be `parent`, `node`, `siblings`, `children`.
      name: context
      predefined:
      - parent
      - node
      - siblings
      - children
    description: Gets the process tree for the process instance.
    name: tanium-tr-get-process-tree
    outputs:
    - contextPath: Tanium.ProcessTree.childrenCount
      description: The number of process tree children.
      type: Number
    - contextPath: Tanium.ProcessTree.context
      description: The process tree context.
      type: String
    - contextPath: Tanium.ProcessTree.createTime
      description: The date and time the process tree was created.
      type: Date
    - contextPath: Tanium.ProcessTree.createTimeRaw
      description: The process tree creation timestamp.
      type: Date
    - contextPath: Tanium.ProcessTree.dnsEventsCount
      description: The number of DNS events in the process tree.
      type: Number
    - contextPath: Tanium.ProcessTree.driverEventsCount
      description: The number of driver events in the process tree.
      type: Number
    - contextPath: Tanium.ProcessTree.endTime
      description: The process tree termination date and time.
      type: Date
    - contextPath: Tanium.ProcessTree.endTimeRaw
      description: The process tree termination timestamp.
      type: Date
    - contextPath: Tanium.ProcessTree.exitCode
      description: The process tree exit code.
      type: Number
    - contextPath: Tanium.ProcessTree.fileEventsCount
      description: The number of file events in the process tree.
      type: Number
    - contextPath: Tanium.ProcessTree.groupName
      description: The process tree group name.
      type: String
    - contextPath: Tanium.ProcessTree.hashTypeName
      description: The process tree hash type.
      type: String
    - contextPath: Tanium.ProcessTree.id
      description: The process tree ID in the Tanium system.
      type: String
    - contextPath: Tanium.ProcessTree.imageEventsCount
      description: The bumber of image events in the process tree.
      type: Number
    - contextPath: Tanium.ProcessTree.networkEventsCount
      description: The number of network events in the process tree.
      type: Number
    - contextPath: Tanium.ProcessTree.parentProcessTableId
      description: The process tree parent process table ID.
      type: String
    - contextPath: Tanium.ProcessTree.pid
      description: The process tree PID.
      type: Number
    - contextPath: Tanium.ProcessTree.processEventsCount
      description: The number of process tree events in the process.
      type: Number
    - contextPath: Tanium.ProcessTree.processHash
      description: The process tree hash.
      type: String
    - contextPath: Tanium.ProcessTree.processPath
      description: The process tree path.
      type: String
    - contextPath: Tanium.ProcessTree.processTableId
      description: The process tree table ID.
      type: String
    - contextPath: Tanium.ProcessTree.registryEventsCount
      description: The number of registry events in the process tree.
      type: Number
    - contextPath: Tanium.ProcessTree.securityEventsCount
      description: The number of security events in the process tree.
      type: Number
    - contextPath: Tanium.ProcessTree.uniqueProcessId
      description: The unique process tree ID.
      type: String
    - contextPath: Tanium.ProcessTree.userName
      description: The username who created the process tree.
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum number of evidences to return.
      name: limit
    - defaultValue: '0'
      description: The offset to start getting the events result set.
      name: offset
    - description: A comma-separated list of fields by which to sort, using +/- prefixes for ascending/descending, in order of priority (left to right).
      name: sort
    - description: A comma-separated list of hostnames to filter event evidences by, for example hostname=123,456.
      isArray: true
      name: hostname
    - description: Get the event evidences that match a specific type, for example type=file.
      name: type
    description: Returns a list of all available event evidences in the system.
    name: tanium-tr-event-evidence-list
    outputs:
    - contextPath: Tanium.Evidence.name
      description: The event evidence name.
      type: String
    - contextPath: Tanium.Evidence.uuid
      description: The event evidence UUID.
      type: String
    - contextPath: Tanium.Evidence.createdAt
      description: The date and time the event evidence was created.
      type: Date
    - contextPath: Tanium.Evidence.hostname
      description: The event evidence connection hostname.
      type: String
    - contextPath: Tanium.Evidence.evidenceType
      description: The event evidence type.
      type: Number
    - contextPath: Tanium.Evidence.size
      description: The event evidence size.
      type: Number
  - description: Returns event evidence properties for IOC generation.
    name: tanium-tr-event-evidence-get-properties
    outputs:
    - contextPath: Tanium.EvidenceProperties.type
      description: The event evidence property type.
      type: String
    - contextPath: Tanium.EvidenceProperties.value
      description: The event evidence property value.
      type: String
    arguments: []
  - arguments:
    - description: The event evidence ID.
      name: evidence_id
      required: true
    description: Gets event evidence by evidence ID.
    name: tanium-tr-get-evidence-by-id
    outputs:
    - contextPath: Tanium.Evidence.commandline
      description: The event evidence command line.
      type: String
    - contextPath: Tanium.Evidence.createTime
      description: Date and time the event evidence was created.
      type: Date
    - contextPath: Tanium.Evidence.createTimeRaw
      description: The event evidence creation timestamp.
      type: Number
    - contextPath: Tanium.Evidence.created
      description: The date and time the event evidence was created.
      type: Date
    - contextPath: Tanium.Evidence.domain
      description: The event evidence domain.
      type: String
    - contextPath: Tanium.Evidence.eventtype
      description: The event evidence event type.
      type: String
    - contextPath: Tanium.Evidence.evidencetype
      description: The event evidence type.
      type: String
    - contextPath: Tanium.Evidence.exitCode
      description: The event evidence exit code.
      type: Number
    - contextPath: Tanium.Evidence.hostname
      description: The event evidence host name.
      type: String
    - contextPath: Tanium.Evidence.summary
      description: The event evidence summary.
      type: String
    - contextPath: Tanium.Evidence.timestamp
      description: The event evidence creation date.
      type: Date
    - contextPath: Tanium.Evidence.type
      description: The event evidence type.
      type: String
    - contextPath: Tanium.Evidence.username
      description: The event evidence creation username.
      type: String
    - contextPath: Tanium.Evidence.utctimecreated
      description: The event evidence creation UTC date.
      type: Date
    - contextPath: Tanium.Evidence.uuid
      description: The event evidence UUID.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    - description: The connection hostname.
      name: hostname
      required: true
    - description: The summary of the event evidence.
      name: summary
    description: Creates event evidence from process.
    name: tanium-tr-create-evidence
  - arguments:
    - description: A comma separated list of the event evidence IDs to delete.
      isArray: true
      name: evidence_ids
      required: true
    description: Deletes event evidences from Tanium.
    name: tanium-tr-delete-evidence
  - arguments:
    - description: The path to the file.
      name: path
      required: true
    - description: The connection ID.
      name: connection_id
      required: true
    description: Requests a new file download.
    name: tanium-tr-request-file-download
    outputs:
    - contextPath: Tanium.FileDownloadTask.compress
      description: Is file compressed.
      type: String
    - contextPath: Tanium.FileDownloadTask.connection
      description: The file download host.
      type: String
    - contextPath: Tanium.FileDownloadTask.taskId
      description: The file download task ID.
      type: Number
    - contextPath: Tanium.FileDownloadTask.paths
      description: The file download paths.
      type: String
    - contextPath: Tanium.FileDownloadTask.startTime
      description: The download start time.
      type: Date
    - contextPath: Tanium.FileDownloadTask.status
      description: The status of the file download request.
      type: String
  - arguments:
    - description: The file download ID.
      name: file_id
      required: true
    description: Deletes a file download.
    name: tanium-tr-delete-file-download
  - arguments:
    - description: The path to the directory.
      name: path
      required: true
    - description: The connection ID.
      name: connection_id
      required: true
    - defaultValue: '50'
      description: The maximum number of files to return.
      name: limit
    - defaultValue: '0'
      description: The offset to start getting files.
      name: offset
    description: Gets a list of files in the given directory.
    name: tanium-tr-list-files-in-directory
    outputs:
    - contextPath: Tanium.File.connectionId
      description: The connection ID.
      type: String
    - contextPath: Tanium.File.createdDate
      description: The date and time the file was created.
      type: Date
    - contextPath: Tanium.File.modifiedDate
      description: The date the file was last modified.
      type: Date
    - contextPath: Tanium.File.name
      description: The file name.
      type: String
    - contextPath: Tanium.File.path
      description: The file path.
      type: String
    - contextPath: Tanium.File.permissions
      description: The file permissions.
      type: Number
    - contextPath: Tanium.File.size
      description: The file size.
      type: Number
    - contextPath: Tanium.File.type
      description: The file type.
      type: String
  - arguments:
    - defaultValue: The connection ID.
      description: The ID of the connection.
      name: connection_id
      required: true
    - defaultValue: Path to file.
      description: The file path.
      name: path
      required: true
    description: Gets information about a file from a remote connection.
    name: tanium-tr-get-file-info
    outputs:
    - contextPath: Tanium.File.canonicalPath
      description: The file path.
      type: String
    - contextPath: Tanium.File.cid
      description: The file CID.
      type: String
    - contextPath: Tanium.File.connectionId
      description: The file connection ID.
      type: String
    - contextPath: Tanium.File.createdDate
      description: The date the file was created.
      type: Date
    - contextPath: Tanium.File.modifiedDate
      description: The date the file was last modified.
      type: Date
    - contextPath: Tanium.File.name
      description: The file name.
      type: String
    - contextPath: Tanium.File.path
      description: The file path.
      type: String
    - contextPath: Tanium.File.permissions
      description: The file permissions.
      type: Number
    - contextPath: Tanium.File.size
      description: The file size.
      type: Number
    - contextPath: Tanium.File.type
      description: The file type.
      type: String
    - contextPath: Tanium.File.sessionId
      description: The file session ID.
      type: String
  - arguments:
    - description: The connection ID.
      name: connection_id
      required: true
    - description: The path to the file.
      name: path
      required: true
    description: Deletes a file from the given endpoint.
    name: tanium-tr-delete-file-from-endpoint
  - arguments:
    - description: List the label IDs for the intel document with this ID.
      name: intel_doc_id
      required: true
    description: List all labels for the identified intel document.
    name: tanium-tr-intel-docs-labels-list
    outputs:
    - contextPath: Tanium.IntelDocLabel.IntelDocID
      description: The requested intel doc ID.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.ID
      description: The unique identifier for this label.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.Name
      description: The display name of the label.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.Description
      description: An extended description of the label.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.IndicatorCount
      description: The number of indicator-based intel documents associated with this label, not including Tanium Signals.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.SignalCount
      description: The number of Tanium Signal documents associated with this label.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.CreatedAt
      description: The date this label was created.
      type: Date
    - contextPath: Tanium.IntelDocLabel.LabelsList.UpdatedAt
      description: The date this label was last updated, not including the intel and signal counts.
      type: Date
  - arguments:
    - description: Associate the new label with the intel document with this ID.
      name: intel_doc_id
      required: true
    - description: The ID of the new label to associate with the target intel document. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs).
      name: label_id
      required: true
    description: Create a new label association for the identified intel document.
    name: tanium-tr-intel-docs-add-label
    outputs:
    - contextPath: Tanium.IntelDocLabel.IntelDocID
      description: The requested intel doc ID.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.ID
      description: The unique identifier for this label.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.Name
      description: The display name of the label.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.Description
      description: An extended description of the label.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.IndicatorCount
      description: The number of indicator-based intel documents associated with this label, not including Tanium Signals.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.SignalCount
      description: The number of Tanium Signal documents associated with this label.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.CreatedAt
      description: The date this label was created.
      type: Date
    - contextPath: Tanium.IntelDocLabel.LabelsList.UpdatedAt
      description: The date this label was last updated, not including the intel and signal counts.
      type: Date
  - arguments:
    - description: Remove the label from the intel document with this ID.
      name: intel_doc_id
      required: true
    - description: The ID of the label to disassociate from the target intel document. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs).
      name: label_id
      required: true
    description: Delete a label association for the identified intel document.
    name: tanium-tr-intel-docs-remove-label
    outputs:
    - contextPath: Tanium.IntelDocLabel.IntelDocID
      description: Requested doc ID.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.CreatedAt
      description: Date when label was created.
      type: Date
    - contextPath: Tanium.IntelDocLabel.LabelsList.Description
      description: Label description.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.ID
      description: Label ID.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.IndicatorCount
      description: Number of related indicators.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.Name
      description: Label name.
      type: String
    - contextPath: Tanium.IntelDocLabel.LabelsList.SignalCount
      description: Number of related signal counts.
      type: Number
    - contextPath: Tanium.IntelDocLabel.LabelsList.UpdatedAt
      description: Date when label was last updated.
      type: Date
  - arguments:
    - description: The file entry ID.
      name: entry_id
      required: true
    - auto: PREDEFINED
      description: The suffix at the end of a filename. (Available file types - yara, stix, ioc).
      name: file_extension
      predefined:
      - ioc
      - yara
      - stix
      required: true
    description: Add a new intel document to the system by providing its document contents.
    name: tanium-tr-intel-doc-create
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date at which this intel was first added to the system.
      type: Date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: Date
    - contextPath: Tanium.IntelDoc.revisionId
      description: The number of times the contents of the intel with this ID have been updated.
      type: Number
    - contextPath: Tanium.IntelDoc.Type
      description: The shortened type name of the intel. For example, "openioc", "stix", "yara".
      type: String
    - contextPath: Tanium.IntelDoc.typeVersion
      description: The version number of the intel type. For example, "1.0", "2.3", etc.
      type: String
    - contextPath: Tanium.IntelDoc.intrinsicId
      description: The unique identifier claimed by the intel document, such as a guid or other built-in ID.
      type: String
    - contextPath: Tanium.IntelDoc.Md5
      description: The hex digest of the MD5 sum of the contents of the document that represents this intel.
      type: String
    - contextPath: Tanium.IntelDoc.Size
      description: The size of the intel document contents, in bytes.
      type: String

  - arguments:
    - description: The ID of the intel document to update.
      name: intel_doc_id
      required: true
    - description: The file entry ID.
      name: entry_id
      required: true
    - auto: PREDEFINED
      description: The suffix at the end of a filename. (Available file types - yara, stix, ioc).
      name: file_extension
      predefined:
      - ioc
      - yara
      - stix
    description: Update the contents of an existing intel document by providing the document contents.
    name: tanium-tr-intel-doc-update
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date at which this intel was first added to the system.
      type: Date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: Date
    - contextPath: Tanium.IntelDoc.revisionId
      description: The number of times the contents of the intel with this ID have been updated.
      type: Number
    - contextPath: Tanium.IntelDoc.Type
      description: The shortened type name of the intel. For example, "openioc", "stix", "yara".
      type: String
    - contextPath: Tanium.IntelDoc.typeVersion
      description: The version number of the intel type. For example, "1.0", "2.3", etc.
      type: String
    - contextPath: Tanium.IntelDoc.intrinsicId
      description: The unique identifier claimed by the intel document, such as a guid or other built-in ID.
      type: String
    - contextPath: Tanium.IntelDoc.Md5
      description: The hex digest of the MD5 sum of the contents of the document that represents this intel.
      type: String
    - contextPath: Tanium.IntelDoc.Size
      description: The size of the intel document contents, in bytes.
      type: String
  - description: Deploys intel using the service account context.
    name: tanium-tr-intel-deploy
    arguments: []
  - description: Displays status of last intel deployment.
    name: tanium-tr-intel-deploy-status
    outputs:
    - contextPath: Tanium.IntelDeployStatus.CreatedAt
      description: The creation date of the last intel deployment.
      type: Date
    - contextPath: Tanium.IntelDeployStatus.ModifiedAt
      description: The modification date of the last intel deployment.
      type: Date
    - contextPath: Tanium.IntelDeployStatus.CurrentRevision
      description: Revision number, incremented each time the intel is modified.
      type: Number
    - contextPath: Tanium.IntelDeployStatus.CurrentSize
      description: The size of the intel document contents, in bytes.
      type: Number
    arguments: []
  - arguments:
    - description: The task ID.
      name: task_id
      required: true
    description: Get task by ID.
    name: tanium-tr-get-task-by-id
    outputs:
    - contextPath: Tanium.Task.createdAt
      description: The date at which this task was first added to the system.
      type: Date
    - contextPath: Tanium.Task.id
      description: The unique identifier for this task in this instance of the system.
      type: Number
    - contextPath: Tanium.Task.updatedAt
      description: The date when this task was last updated.
      type: Date
    - contextPath: Tanium.Task.startTime
      description: The date when this task started.
      type: Date
    - contextPath: Tanium.Task.endTime
      description: The date when this task ended.
      type: Date
    - contextPath: Tanium.Task.error
      description: Task errors.
      type: String
    - contextPath: Tanium.Task.status
      description: Task status.
      type: String
    - contextPath: Tanium.Task.type
      description: Task type.
      type: String
    - contextPath: Tanium.Task.metadata
      description: Task metadata.
      type: Unknown
    - contextPath: Tanium.Task.results
      description: Task results.
      type: Unknown
  - arguments:
    - defaultValue: '50'
      description: The maximum number of entries to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing entries.
      name: offset
    - description: A comma-separated list of statuses to filter system status by, for example status=Blocked,Leader.
      isArray: true
      name: status
    - predefined:
      - Blocked
      - Leader
      - Normal
      - Slow link
      description: A comma-separated list of IP servers to filter system status by, for example ip_server=1.1.1.1,2.2.2.2.
      isArray: true
      name: ip_server
      auto: PREDEFINED
    - description: A comma-separated list of IP clients to filter system-status by, for example ip_client=1.1.1.1,2.2.2.2.
      isArray: true
      name: ip_client
    - description: A comma-separated list of hostnames to filter system-status by, for example hostname=host1,host2.
      isArray: true
      name: hostname
    - description: The port to use to get the system-status, for example port=80.
      name: port
    description: Gets system status, including connections, client IDs, hostnames, and IPs.
    name: tanium-tr-get-system-status
    outputs:
    - contextPath: Tanium.SystemStatus.clientId
      description: The client ID to use when creating a new connection.
      type: Number
    - contextPath: Tanium.SystemStatus.computerId
      description: The computer ID.
      type: Number
    - contextPath: Tanium.SystemStatus.hostName
      description: The hostname to connect.
      type: String
    - contextPath: Tanium.SystemStatus.ipaddressClient
      description: The client IP address.
      type: String
    - contextPath: Tanium.SystemStatus.ipaddressServer
      description: The server IP address.
      type: String
    - contextPath: Tanium.SystemStatus.lastRegistration
      description: The host last registration time.
      type: Date
    - contextPath: Tanium.SystemStatus.portNumber
      description: The connection port number.
      type: Number
    - contextPath: Tanium.SystemStatus.protocolVersion
      description: The connection protocol version.
      type: Number
    - contextPath: Tanium.SystemStatus.publicKeyValid
      description: Is public key valid.
      type: Boolean
    - contextPath: Tanium.SystemStatus.status
      description: The host status.
      type: String
  - name: tanium-tr-intel-doc-delete
    arguments:
    - description: The intel document ID.
      name: intel_doc_id
      required: true
    description: Remove an intel document from the system by providing its ID.
  - name: tanium-tr-start-quick-scan
    arguments:
    - description: The intel document ID.
      name: intel_doc_id
      required: true
    - description: The name of a Tanium computer group. See command description for possible ways to retrieve this value.
      name: computer_group_name
      required: true
    outputs:
    - contextPath: Tanium.QuickScan.IntelDocId
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.QuickScan.ComputerGroupId
      description: The ID of a Tanium computer group.
      type: Number
    - contextPath: Tanium.QuickScan.ID
      description: The ID of the quick scan.
      type: Number
    - contextPath: Tanium.QuickScan.AlertCount
      description: The number of alerts returned from the quick scan.
      type: Number
    - contextPath: Tanium.QuickScan.CreatedAt
      description: The date the quick scan was created.
      type: Date
    - contextPath: Tanium.QuickScan.UserId
      description: The user ID which initiated the quick scan.
      type: Number
    - contextPath: Tanium.QuickScan.QuestionId
      description: The ID of the quick scan question.
      type: Number
    description: Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.
  - arguments:
    - description: Offset to start getting response actions (default is '0').
      name: offset
    - description: Max number of response actions to return (default is '50').
      name: limit
    - auto: PREDEFINED
      defaultValue: desc
      description: Specify whether to sort by column in ascending or descending order (default is 'desc').
      name: sort_order
      predefined:
      - asc
      - desc
    - description: Filter on a partial computer name.
      name: partial_computer_name
    - description: Filter on status.
      name: status
    - description: Filter on type.
      name: type
    description: Returns the Response Actions matching the specified filters.
    name: tanium-tr-get-response-actions
    outputs:
    - contextPath: Tanium.ResponseActions.id
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.type
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.status
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.computerName
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.userId
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.userName
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.results.taskIds
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.results.actionIds
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.results.snapshotName
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.results.uuid
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.expirationTime
      description: ''
      type: Date
    - contextPath: Tanium.ResponseActions.createdAt
      description: ''
      type: Date
    - contextPath: Tanium.ResponseActions.updatedAt
      description: ''
      type: Date
    - contextPath: Tanium.ResponseActions.eid
      description: ''
      type: String
  - arguments:
    - description: Target computer name.
      name: computer_name
      required: true
    - description: Time unit to specify how long a snapshot should persist (i.e. "7 days", "1 month". Default is "7 days").
      name: expiration_time
    description: Creates a "gatherSnapshot" Response Action for the specified host.
    name: tanium-tr-response-action-gather-snapshot
    outputs:
    - contextPath: Tanium.ResponseActions.type
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.computerName
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.options
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.status
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.userId
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.userName
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.results
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.expirationTime
      description: ''
      type: Date
    - contextPath: Tanium.ResponseActions.createdAt
      description: ''
      type: Date
    - contextPath: Tanium.ResponseActions.updatedAt
      description: ''
      type: Date
    - contextPath: Tanium.ResponseActions.id
      description: ''
      type: String
    - contextPath: Tanium.ResponseActions.eid
      description: ''
      type: String
  dockerimage: demisto/lxml:1.0.0.10170191
  isfetch: true
  script: ''
  subtype: python3
  type: python
tests:
- Tanium Threat Response V2 Test
fromversion: 6.0.0