Tanium Threat Response v2

Use the Tanium Threat Response integration to manage endpoint processes, evidence, alerts, files, snapshots, and connections. This integration works with Tanium Threat Response version 3.0.159 and above.

Endpoint · Tanium Threat Response

Details

IDTanium Threat Response v2
ProviderTanium
CategoryEndpoint
From Version6.0.0
Docker Imagedemisto/lxml:1.0.0.10170191
Supported ModulesAgentix XSIAM

README

Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version 3.0.159 and above.
This integration was integrated and tested with versions 3.5.284 and 4.x of Tanium Threat Response v2.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Tanium Threat Response v2 in Cortex

Parameter Required
Hostname, IP address, or server URL True
Username False
Password False
Fetch incidents False
Incident type False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) False
Maximum number of incidents to fetch each time False
Alert states to filter by in fetch incidents command. Empty list won’t filter the incidents by state. False
Trust any certificate (not secure) False
Use system proxy settings False
API Version False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

tanium-tr-get-intel-doc-by-id

Returns an intel document object based on ID.

Base Command

tanium-tr-get-intel-doc-by-id

Input

Argument Name Description Required
intel_doc_id The intel document ID. Required

Context Output

Path Type Description
Tanium.IntelDoc.AlertCount Number The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt Date The date at which this intel was first added to the system.
Tanium.IntelDoc.Description String The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID Number The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds Number The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name String The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount Number The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt Date The date when this intel was last updated.

Command Example

!tanium-tr-get-intel-doc-by-id intel_doc_id=509

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "Compiled": "{\"expressions\":[],\"terms\":[{\"condition\":\"contains\",\"negate\":false,\"value\":\"RouteTheCall\",\"object\":\"process\",\"property\":\"command_line\"},{\"condition\":\"ends with\",\"negate\":false,\"value\":\"\\\\rundll32.exe\",\"object\":\"process\",\"property\":\"path\"},{\"condition\":\"contains\",\"negate\":false,\"value\":\"zipfldr\",\"object\":\"process\",\"property\":\"command_line\"}],\"operator\":\"and\",\"text\":\"process.path ends with '\\\\\\\\rundll32.exe' AND process.command_line contains 'zipfldr' AND process.command_line contains 'RouteTheCall'\",\"syntax_version\":1}",
            "Contents": "{\"id\":\"Zipfldr Library Proxy Execution via RouteTheCall\",\"name\":\"Zipfldr Library Proxy Execution via RouteTheCall\",\"description\":\"Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary.\",\"contents\":\"process.path ends with '\\\\\\\\rundll32.exe' AND process.command_line contains 'zipfldr' AND process.command_line contains 'RouteTheCall'\",\"syntax_version\":1,\"mitreAttack\":{\"techniques\":[{\"id\":\"T1218\",\"name\":\"Signed Binary Proxy Execution\"},{\"id\":\"T1218.011\",\"name\":\"Signed Binary Proxy Execution: Rundll32\"},{\"id\":\"T1059\",\"name\":\"Command and Scripting Interpreter\"},{\"id\":\"T1059.003\",\"name\":\"Command and Scripting Interpreter: Windows Command Shell\"}]},\"platforms\":[\"windows\"]}",
            "CreatedAt": "2021-08-31T21:06:02.932Z",
            "Description": "Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary.",
            "ID": 509,
            "IntrinsicId": "Zipfldr Library Proxy Execution via RouteTheCall",
            "IsSchemaValid": true,
            "LabelIds": [
                2,
                7,
                11,
                16
            ],
            "Md5": "f3ddf06be9e182ae7ddc16192dc5b846",
            "MitreAttack": "{\"techniques\":[{\"id\":\"T1218\",\"name\":\"Signed Binary Proxy Execution\"},{\"id\":\"T1218.011\",\"name\":\"Signed Binary Proxy Execution: Rundll32\"},{\"id\":\"T1059\",\"name\":\"Command and Scripting Interpreter\"},{\"id\":\"T1059.003\",\"name\":\"Command and Scripting Interpreter: Windows Command Shell\"}]}",
            "Name": "Zipfldr Library Proxy Execution via RouteTheCall",
            "Platforms": [
                "windows"
            ],
            "RevisionId": 1,
            "Size": 795,
            "SourceId": 2,
            "Type": "tanium-signal",
            "TypeVersion": "1.0",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-08-31T21:06:02.932Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Description Alert Count Unresolved Alert Count Created At Updated At Label Ids
509 Zipfldr Library Proxy Execution via RouteTheCall tanium-signal Detects the use of rundll32.exe to execute the RouteTheCall function in zipfldr.dll. This can be used for proxy execution to bypass AppLocker or to execute an arbitrary binary. 0 0 2021-08-31T21:06:02.932Z 2021-08-31T21:06:02.932Z 2, 7, 11, 16

tanium-tr-list-intel-docs

Returns a list of all intel documents.

Base Command

tanium-tr-list-intel-docs

Input

Argument Name Description Required
limit The maximum number of intel documents to return. Default is 50. Optional
offset The offset number to begin listing intel documents. Default is 0. Optional
name The name of the intel document to show. Optional
description The description of the intel document to show. Optional
type The type of the intel document to show. Optional
label_id The label Id of the intel document to show. Optional
mitre_technique_id The mitre technique Id of the intel document to show. Optional

Context Output

Path Type Description
Tanium.IntelDoc.AlertCount Number The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt Date The date at which this intel was first added to the system.
Tanium.IntelDoc.Description String The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID Number The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds Number The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name String The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount Number The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt Date The date when this intel was last updated.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "IntelDoc": [
            {
                "AlertCount": 0,
                "CreatedAt": "2021-09-26T20:42:12.761Z",
                "ID": 538,
                "IntrinsicId": "file",
                "IsSchemaValid": true,
                "Md5": "45d4f6197504b0cf17ca4425b27c4123",
                "Name": "file",
                "RevisionId": 1,
                "Size": 2211,
                "SourceId": 1,
                "Type": "yara",
                "TypeVersion": "3",
                "UnresolvedAlertCount": 0,
                "UpdatedAt": "2021-09-26T20:42:12.761Z"
            },
            {
                "AlertCount": 0,
                "CreatedAt": "2021-09-26T15:40:18.967Z",
                "ID": 537,
                "IntrinsicId": "111-72ad-40cc-abbf-90846fa4afec",
                "IsSchemaValid": true,
                "Md5": "45d4f619750434cf17ca4425b27c4774",
                "Name": "111-72ad-40cc-abbf-90846fa4a123",
                "RevisionId": 11,
                "Size": 2211,
                "SourceId": 1,
                "Type": "openioc",
                "TypeVersion": "1.0",
                "UnresolvedAlertCount": 0,
                "UpdatedAt": "2021-09-26T20:47:53.586Z"
            }
        ]
    }
}

Human Readable Output

Intel docs

ID Name Type Alert Count Unresolved Alert Count Created At Updated At Label Ids
538 file yara 0 0 2021-09-26T20:42:12.761Z 2021-09-26T20:42:12.761Z  
537 111-72ad-40cc-abbf-90846fa4afec openioc 0 0 2021-09-26T15:40:18.967Z 2021-09-26T20:47:53.586Z  
536 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:18:57.462Z 2021-09-26T08:18:57.462Z  
535 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:30.717Z 2021-09-26T08:11:30.717Z  
534 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:25.484Z 2021-09-26T08:11:25.484Z  
533 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-26T08:11:20.802Z 2021-09-26T08:11:20.802Z  
532 file.yaraaaaaa yara 0 0 2021-09-26T08:09:54.927Z 2021-09-26T08:09:54.927Z  
531 file.yaraa yara 0 0 2021-09-26T08:09:52.564Z 2021-09-26T08:09:52.564Z  
530 yar yara 0 0 2021-09-26T08:09:28.253Z 2021-09-26T08:09:28.253Z  
529 file.yar yara 0 0 2021-09-23T15:35:01.784Z 2021-09-23T15:35:01.784Z  
528 file.stix yara 0 0 2021-09-23T15:33:49.920Z 2021-09-23T15:33:49.920Z  
527 file.stix yara 0 0 2021-09-23T15:32:25.580Z 2021-09-23T15:32:25.580Z  
526 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T15:00:32.350Z 2021-09-23T15:00:32.350Z  
525 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:41:32.831Z 2021-09-23T14:41:32.831Z  
524 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:41:07.857Z 2021-09-23T14:41:07.857Z  
523 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T14:32:26.310Z 2021-09-23T14:32:26.310Z  
522 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T13:47:31.088Z 2021-09-23T13:47:31.088Z  
521 STUXNET VIRUS (METHODOLOGY) openioc 0 0 2021-09-23T12:18:03.865Z 2021-09-23T12:18:03.865Z  
520 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T12:04:08.473Z 2021-09-23T12:04:08.473Z  
519 CybOX-represented Indicator Created from OpenIOC File stix 0 0 2021-09-23T12:03:50.295Z 2021-09-23T12:03:50.295Z  
518 New Test5 openioc 0 0 2021-09-23T12:03:10.503Z 2021-09-23T12:03:10.503Z  
517 New Test5 openioc 0 0 2021-09-23T07:21:07.201Z 2021-09-23T07:21:07.201Z  
516 New Test5 openioc 0 0 2021-09-22T16:27:09.399Z 2021-09-22T16:27:09.399Z  
515 New Test5 openioc 0 0 2021-09-22T07:52:58.242Z 2021-09-22T07:52:58.242Z  
514 New Test5 openioc 0 0 2021-09-22T07:47:43.503Z 2021-09-22T07:47:43.503Z  
513 RDP Enabled via Registry Modification tanium-signal 0 0 2021-09-22T07:47:02.110Z 2021-09-22T07:47:02.110Z  
512 New Test5 openioc 0 0 2021-09-22T07:17:26.951Z 2021-09-22T07:17:26.951Z  
511 New Test5 openioc 0 0 2021-09-19T06:33:12.579Z 2021-09-19T06:33:12.579Z  
510 file.yar yara 0 0 2021-09-12T14:02:03.769Z 2021-09-12T14:02:03.769Z  
509 Zipfldr Library Proxy Execution via RouteTheCall tanium-signal 0 0 2021-08-31T21:06:02.932Z 2021-08-31T21:06:02.932Z 2, 7, 11, 16
508 Url Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:02.639Z 2021-08-31T21:06:02.639Z 2, 7, 11, 16
507 Url Library Proxy Execution via FileProtocolHandler tanium-signal 0 0 2021-08-31T21:06:02.611Z 2021-08-31T21:06:02.611Z 2, 7, 11, 16
506 Shell32 Library Proxy Execution via ShellExec_RunDLL tanium-signal 0 0 2021-08-31T21:06:02.140Z 2021-08-31T21:06:02.140Z 2, 7, 11, 16
505 Shdocvw Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:02.116Z 2021-08-31T21:06:02.116Z 2, 7, 11, 16
504 Pcwutl Library Proxy Execution via LaunchApplication tanium-signal 0 0 2021-08-31T21:06:01.540Z 2021-08-31T21:06:01.540Z 2, 7, 11, 16
503 Ieframe Library Proxy Execution via OpenURL tanium-signal 0 0 2021-08-31T21:06:00.862Z 2021-08-31T21:06:00.862Z 2, 7, 11, 16
502 Reputation Malicious Hashes reputation 0 0 2021-08-19T06:54:59.350Z 2021-08-19T06:57:47.882Z  
501 file.yar yara 0 0 2021-07-28T12:37:29.611Z 2021-07-28T12:37:29.611Z  
500 file.yar yara 0 0 2021-07-28T12:35:41.367Z 2021-07-28T12:35:41.367Z  
499 file.yar yara 0 0 2021-07-28T12:35:39.670Z 2021-07-28T12:35:39.670Z  
498 Vssadmin Create Shadow Copy tanium-signal 0 0 2021-07-27T21:56:02.320Z 2021-07-27T21:56:02.320Z 2, 8, 16
497 Volume Shadow Copy Creation tanium-signal 0 0 2021-07-27T21:56:02.295Z 2021-07-27T21:56:02.295Z 2, 8, 16
496 Remote Proxy Execution tanium-signal 0 0 2021-07-27T21:56:01.712Z 2021-07-27T21:56:01.712Z 2, 7, 11, 16
495 Non-Ssms Spawned SQL Client Tools PowerShell Session tanium-signal 0 0 2021-07-27T21:56:01.246Z 2021-07-27T21:56:01.246Z 2, 7, 11, 16
494 Non-Microsoft Signed Print Spooler Driver tanium-signal 0 0 2021-07-27T21:56:01.227Z 2021-07-27T21:56:01.227Z 2, 6, 16
493 file.yar yara 0 0 2021-07-27T14:44:32.182Z 2021-07-27T14:44:32.182Z  
492 file.yar yara 0 0 2021-07-27T14:44:19.862Z 2021-07-27T14:44:19.862Z  
491 file.yar yara 0 0 2021-07-27T14:44:15.595Z 2021-07-27T14:44:15.595Z  
490 file.yar yara 0 0 2021-07-27T14:44:13.294Z 2021-07-27T14:44:13.294Z  
489 CybOX-re presented Indicator Created from OpenIOC File stix 0 0 2021-07-27T14:42:43.888Z 2021-07-27T14:42:43.888Z  

tanium-tr-list-alerts

Returns a list of all alerts.

Base Command

tanium-tr-list-alerts

Input

Argument Name Description Required
limit The maximum number of alerts to return. Default is 5. Optional
offset The offset number to begin listing alerts. Optional
computer_ip_address Filter alerts by the specified computer IP addresses. Optional
computer_name Filter alerts by the specified computer name. Optional
scan_config_id Filter alerts by the specified scan config ID. Optional
intel_doc_id Filter alerts by the specified intel document ID. Optional
severity Filter alerts by the specified severity. Optional
priority Filter alerts by the specified priority. Optional
type Filter alerts by the specified type. Optional
state Filter alerts by the specified state. Can be “Unresolved”, “In Progress”, “Dismissed” “Ignored”, or “Resolved”. Possible values are: Unresolved, In Progress, Ignored, Resolved, Dismissed. Optional

Context Output

Path Type Description
Tanium.Alert.Priority String The priority of the alert.
Tanium.Alert.ComputerName String The hostname of the computer that generated the alert.
Tanium.Alert.GUID String A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt Date The moment that the alert was generated.
Tanium.Alert.UpdatedAt Date The last time the alert state was updated.
Tanium.Alert.State String The current state of the alert. For example, “unresolved”, “inprogress”, and so on.
Tanium.Alert.ComputerIpAddress String The IP address of the computer that generated the alert.
Tanium.Alert.Type String The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID Number The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt Date The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId Number The intel document revision, if intelDocId is present.
Tanium.Alert.Severity String The severity of the alert.

Command Example

!tanium-tr-list-alerts limit=2

Context Example

{
    "Tanium": {
        "Alert": [
            {
                "AlertedAt": "2019-09-22T14:01:31.000Z",
                "ComputerIpAddress": "1.1.1.1",
                "ComputerName": "host0",
                "CreatedAt": "2019-09-22T14:01:59.768Z",
                "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
                "ID": 1,
                "IntelDocId": 64,
                "Priority": "high",
                "Severity": "info",
                "State": "Unresolved",
                "Type": "detect.match",
                "UpdatedAt": "2021-10-24T01:28:04.275Z"
            },
            {
                "AlertedAt": "2020-02-29T15:29:59.000Z",
                "ComputerIpAddress": "1.1.1.1",
                "ComputerName": "host0",
                "CreatedAt": "2020-02-29T15:30:29.893Z",
                "GUID": "626821e1-6b0a-4afb-a1f9-8fb7ef741736",
                "ID": 2,
                "IntelDocId": 17,
                "Priority": "high",
                "Severity": "info",
                "State": "Unresolved",
                "Type": "detect.match",
                "UpdatedAt": "2021-10-24T01:28:04.275Z"
            }
        ]
    }
}

Human Readable Output

Alerts

ID Type Severity Priority Alerted At Created At Updated At Computer Ip Address Computer Name GUID State Intel Doc Id
1 detect.match info high 2019-09-22T14:01:31.000Z 2019-09-22T14:01:59.768Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 a33e3482-556e-4e9d-bbbd-2fdbe330d492 Unresolved 64
2 detect.match info high 2020-02-29T15:29:59.000Z 2020-02-29T15:30:29.893Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 626821e1-6b0a-4afb-a1f9-8fb7ef741736 Unresolved 17

tanium-tr-get-alert-by-id

Returns an alert object based on alert ID.

Base Command

tanium-tr-get-alert-by-id

Input

Argument Name Description Required
alert_id The alert ID. Required

Context Output

Path Type Description
Tanium.Alert.Priority String The priority of the alert.
Tanium.Alert.ComputerName String The hostname of the computer that generated the alert.
Tanium.Alert.GUID String A globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAt Date The date when the alert was generated.
Tanium.Alert.UpdatedAt Date The date when the alert state was last updated.
Tanium.Alert.State String The current state of the alert. For example, “unresolved”, “inprogress”.
Tanium.Alert.ComputerIpAddress String The IP address of the computer that generated the alert.
Tanium.Alert.Type String The name of the alert type. For example, “detect.endpoint.match”.
Tanium.Alert.ID Number The ID of the alert. For example, “123”.
Tanium.Alert.CreatedAt Date The date when the alert was received by the Detect product.
Tanium.Alert.IntelDocId Number The intel document revision, if intelDocId is present.
Tanium.Alert.Severity String The severity of the alert.

Command Example

!tanium-tr-get-alert-by-id alert_id=1

Context Example

{
    "Tanium": {
        "Alert": {
            "AlertedAt": "2019-09-22T14:01:31.000Z",
            "ComputerIpAddress": "1.1.1.1",
            "ComputerName": "host0",
            "CreatedAt": "2019-09-22T14:01:59.768Z",
            "GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
            "ID": 1,
            "IntelDocId": 64,
            "Priority": "high",
            "Severity": "info",
            "State": "Unresolved",
            "Type": "detect.match",
            "UpdatedAt": "2021-10-24T01:28:04.275Z"
        }
    }
}

Human Readable Output

Alert information

ID Type Severity Priority Alerted At Created At Updated At Computer Ip Address Computer Name GUID State Intel Doc Id
1 detect.match info high 2019-09-22T14:01:31.000Z 2019-09-22T14:01:59.768Z 2021-10-24T01:28:04.275Z 1.1.1.1 host0 a33e3482-556e-4e9d-bbbd-2fdbe330d492 Unresolved 64

tanium-tr-alert-update-state

Updates the state of the specified alerts.

Base Command

tanium-tr-alert-update-state

Input

Argument Name Description Required
alert_ids A comma-separated list of alert IDs to update. Required
state The new state for the alerts. Can be “Unresolved”, “In Progress”, “Dismissed”, “Ignored”, or “Resolved”. Possible values are: dismissed, unresolved, inprogress, ignored, resolved. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-alert-update-state alert_ids=1 state=resolved

Human Readable Output

Alert state updated to resolved.

tanium-tr-create-snapshot

Captures a new snapshot by connection id.

Base Command

tanium-tr-create-snapshot

Input

Argument Name Description Required
connection_id The connection id. Required

Context Output

Path Type Description
Tanium.SnapshotTask.connection String Connection id of the snapshot.
Tanium.SnapshotTask.startTime Date Snapshot start time.
Tanium.SnapshotTask.status String Snapshot creation task status.
Tanium.SnapshotTask.taskId Number Snapshot creation task id. You can get task status using `tanium-tr-get-task-by-id` command.

Command Example

!tanium-tr-create-snapshot connection_id=remote:hostname:123:

Context Example

{
    "Tanium": {
        "SnapshotTask": {
            "connection": "remote:hostname:123:",
            "startTime": "2021-10-07T12:22:29.550Z",
            "status": "STARTED",
            "taskId": 1177
        }
    }
}

Human Readable Output

Initiated snapshot creation request for remote:hostname:123:. Task id: 1177.

tanium-tr-delete-snapshot

Deletes a snapshot by connection name and snapshot ID.

Base Command

tanium-tr-delete-snapshot

Input

Argument Name Description Required
snapshot_ids The snapshot IDs to delete. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-snapshot snapshot_ids=eda5ddce-0f8c-48e8-8dd5-6aa18681d539,3893fa77-4829-4e48-9364-40a16ad6cc0f

Human Readable Output

Snapshot eda5ddce-0f8c-48e8-8dd5-6aa18681d539,3893fa77-4829-4e48-9364-40a16ad6cc0f deleted successfully.

tanium-tr-list-snapshots

Returns all local snapshots of a single connection.

Base Command

tanium-tr-list-snapshots

Input

Argument Name Description Required
limit The maximum number of local snapshots to return. Default is 50. Optional
offset The offset number to begin listing local snapshots. Default is 0. Optional

Context Output

Path Type Description
Tanium.Snapshot.size String The snapshot size.
Tanium.Snapshot.created String The snapshot creation date.
Tanium.Snapshot.completed String The snapshot completed date.
Tanium.Snapshot.name String The snapshot name.
Tanium.Snapshot.isUpload Boolean Is the snapshot uplaod.
Tanium.Snapshot.evidenceType String Evidence type.
Tanium.Snapshot.hostname String Hxstname of the snapshot.
Tanium.Snapshot.connectionId String The snapshot connection ID.
Tanium.Snapshot.recorderVersion String Recorder Version.
Tanium.Snapshot.uuid String The snapshot uuid.

Command Example

!tanium-tr-list-snapshots limit=2

Context Example

{
    "Tanium": {
        "Snapshot": [
            {
                "completed": "2021-10-06T06:42:03.260Z",
                "connectionId": "remote:hostname:123:",
                "created": "2021-10-06T06:40:48.297Z",
                "evidenceType": "snapshot",
                "hostname": "hostname2",
                "isUpload": false,
                "name": "host1-1633502448297.db",
                "recorderVersion": 2,
                "size": 152064000,
                "username": "administrator",
                "uuid": "832dec40-1cc2-4e53-881a-7f61cba835bc"
            },
            {
                "completed": "2021-10-06T06:43:21.474Z",
                "connectionId": "remote:hostname:123:",
                "created": "2021-10-06T06:42:07.010Z",
                "evidenceType": "snapshot",
                "hostname": "hostname1",
                "isUpload": false,
                "name": "host1-1633502527010.db",
                "recorderVersion": 2,
                "size": 152064000,
                "username": "administrator",
                "uuid": "340a3ac4-560d-430f-bd50-96615d763171"
            }
        ]
    }
}

Human Readable Output

Snapshots

Uuid Name Evidence Type Hostname Created
832dec40-1cc2-4e53-881a-7f61cba835bc host1-1633502448297.db snapshot hostname2 2021-10-06T06:40:48.297Z
340a3ac4-560d-430f-bd50-96615d763171 host2-1633502527010.db snapshot hostname1 2021-10-06T06:42:07.010Z

tanium-tr-delete-local-snapshot

Deletes a local snapshot by connection id.

Base Command

tanium-tr-delete-local-snapshot

Input

Argument Name Description Required
connection_id The connection id. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-local-snapshot connection_id=remote:hostname:123:

Human Readable Output

Local snapshot of connection remote:hostname:123: was deleted successfully.

tanium-tr-list-connections

Returns all connections.

Base Command

tanium-tr-list-connections

Input

Argument Name Description Required
limit The maximum number of connections to return. Default is 50. Optional
offset The offset number to begin listing connections. Default is 0. Optional
status Comma-seperated list of statuses to get the connections that match only those statuses, for example status=connected,waiting. Possible values are: disconnected, timeout, waiting, connected. Optional
ip Comma-seperated list of ips to get the connections that match only those ips, for example status=1.1.1.1,1.1.1.1. Optional
platform Comma-seperated list of platforms to get the connections that match only those platforms, for example platform=Linux,Windows. Optional
hostname Comma-seperated list of hostnames to get the connections that match only those hostnames, for example hostname=host1,host2. Optional

Context Output

Path Type Description
Tanium.Connection.id String The connection id.
Tanium.Connection.initiatedAt Date Time when the connection was first created.
Tanium.Connection.hostname String The connection hostname.
Tanium.Connection.status String Current connection state.
Tanium.Connection.platform String The connection operating system.
Tanium.Connection.ip String The connection ip.
Tanium.Connection.connectedAt String Time when the connection was connected.
Tanium.Connection.message String The connection message describing the status.
Tanium.Connection.personaId String The connection persona Id.
Tanium.Connection.clientId String The client id.
Tanium.Connection.userId String The connection user id.
Tanium.Connection.eid String The connection eid.
Tanium.Connection.hasTools Boolean Has connection tools.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "Connection": [
            {
                "clientId": "123",
                "connectedAt": "2021-09-22T12:08:39.000Z",
                "eid": "2",
                "hasTools": true,
                "hostname": "hostname",
                "id": "remote:hostname:123:",
                "initiatedAt": "2021-09-22T12:08:35.000Z",
                "ip": "1.1.1.1",
                "message": "The connection has been disconnected.",
                "personaId": 0,
                "platform": "Windows",
                "status": "disconnected",
                "userId": "1"
            },
            {
                "clientId": "11111",
                "hostname": "localhost",
                "id": "remote:localhost:11111:",
                "initiatedAt": "2021-09-09T08:17:38.000Z",
                "ip": "1.2.3.4",
                "message": "The connection has timed out.",
                "personaId": 0,
                "platform": "Linux",
                "status": "timeout",
                "userId": "1"
            }
        ]
    }
}

Human Readable Output

Connections

Id Status Hostname Message Ip Platform Connected At
rremote:hostname:123: disconnected hostname The connection has been disconnected. 1.1.1.1 Windows 2021-09-22T12:08:39.000Z
remote:localhost:1111: timeout localhost The connection has timed out. 1.2.3.4 Linux  

tanium-tr-create-connection

Creates a local or remote connection.

Base Command

tanium-tr-create-connection

Input

Argument Name Description Required
client_id Client id. Use tanium-tr-get-system-status to get all possible client_ids. Required
ip IP address to connect. Use tanium-tr-get-system-status to get all possible ips. Required
platform Commputers platform - “Windows”, “Linux”, etc. Required
hostname Hostname of the computer to connect. Use tanium-tr-get-system-status to get all possible hostnames. Required

Context Output

Path Type Description
Tanium.Connection.id String New connection id.

Command Example

!tanium-tr-create-connection client_id=123 ip=1.1.1.1 hostname=host1 platform=Windows

Context Example

{
    "Tanium": {
        "Connection": {
            "id": "remote:host1:123:"
        }
    }
}

Human Readable Output

Initiated connection request to “remote:host1:123:”.

tanium-tr-delete-connection

Deletes a connection by connection id.

Base Command

tanium-tr-delete-connection

Input

Argument Name Description Required
connection_id The connection id. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-connection connection_id=remote:host1:123:

Human Readable Output

Connection remote:host1:123: deleted successfully.

tanium-tr-close-connection

Closes a connection by connection id.

Base Command

tanium-tr-close-connection

Input

Argument Name Description Required
connection_id The connection id. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-close-connection connection_id=remote:host1:123:

Human Readable Output

Connection remote:host1:123: closed successfully.

tanium-tr-list-labels

Returns all available labels in the system.

Base Command

tanium-tr-list-labels

Input

Argument Name Description Required
limit The maximum number of labels to return. Default is 50. Optional
offset The offset number to begin listing labels. Default is 0. Optional

Context Output

Path Type Description
Tanium.Label.createdAt Date The date when this label was created.
Tanium.Label.description String An extended description of the label.
Tanium.Label.id Number The unique identifier for this label.
Tanium.Label.indicatorCount Number The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.name String The display name of the label.
Tanium.Label.signalCount Number The number of Tanium Signal documents associated with this label.
Tanium.Label.updatedAt Date The date when this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-list-labels limit=2

Context Example

{
    "Tanium": {
        "Label": [
            {
                "createdAt": "2019-07-31T18:46:28.629Z",
                "description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                "id": 1,
                "indicatorCount": 0,
                "name": "Alpha",
                "signalCount": 0,
                "updatedAt": "2019-07-31T18:46:28.629Z"
            },
            {
                "createdAt": "2019-07-31T18:46:28.629Z",
                "description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                "id": 2,
                "indicatorCount": 0,
                "name": "Beta",
                "signalCount": 420,
                "updatedAt": "2019-07-31T18:46:28.629Z"
            }
        ]
    }
}

Human Readable Output

Labels

Name Description Id Indicator Count Signal Count Created At Updated At
Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 1 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 2 0 420 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

tanium-tr-get-label-by-id

Returns a label object based on label ID.

Base Command

tanium-tr-get-label-by-id

Input

Argument Name Description Required
label_id The label ID. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs). Required

Context Output

Path Type Description
Tanium.Label.createdAt Date The date when this label was created.
Tanium.Label.description String An extended description of the label.
Tanium.Label.id Number The unique identifier for this label.
Tanium.Label.indicatorCount Number The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.name String The display name of the label.
Tanium.Label.signalCount Number The number of Tanium Signal documents associated with this label.
Tanium.Label.updatedAt Date The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-get-label-by-id label_id=1

Context Example

{
    "Tanium": {
        "Label": {
            "createdAt": "2019-07-31T18:46:28.629Z",
            "description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
            "id": 1,
            "indicatorCount": 0,
            "name": "Alpha",
            "signalCount": 0,
            "updatedAt": "2019-07-31T18:46:28.629Z"
        }
    }
}

Human Readable Output

Label information

Name Description Id Indicator Count Signal Count Created At Updated At
Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 1 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z

tanium-tr-list-file-downloads

Returns all downloaded files in the system.

Base Command

tanium-tr-list-file-downloads

Input

Argument Name Description Required
limit The maximum number of files to return. Default is 50. Optional
offset Offset to start getting file downloads. Default is 0. Optional
sort Column which to sort by. Optional
hostname Comma-seperated list of hostnames to get the downloaded files that match only those hostnames, for example hostname=host1,host2. Optional
hash Comma-seperated list of hashes to get the downloaded files that match only those hashes, for example hash=123,456. Optional
process_time_start Get the downloaded files that match only to the process time start, for example process_time_start=2019-09-03T17:51:40.000Z. Optional

Context Output

Path Type Description
Tanium.FileDownload.size Number The size of the file, in bytes.
Tanium.FileDownload.path String The path of the file.
Tanium.FileDownload.downloaded Date The date when this file was downloaded.
Tanium.FileDownload.hostname String The hostname of the downloaded file.
Tanium.FileDownload.processCreationTime Date The date when the file was created.
Tanium.FileDownload.hash String The file hash.
Tanium.FileDownload.uuid Number The downloaded file uuid.
Tanium.FileDownload.lastModified Date The date when the file was last modified.
Tanium.FileDownload.createdBy String The user that created this file.
Tanium.FileDownload.createdByProc String The process path that created this file.
Tanium.FileDownload.lastModifiedBy String The user that last modified this file.
Tanium.FileDownload.lastModifiedByProc String The process path that modified this file.
Tanium.FileDownload.evidenceType String The evidence type - file.

Command Example

!tanium-tr-list-file-downloads limit=2

Context Example

{
    "Tanium": {
        "FileDownload": [
            {
                "downloaded": "2020-01-15 13:04:02.827",
                "evidenceType": "file",
                "hash": "99297a0e626ca092ff1884ad28f54453",
                "hostname": "host1",
                "lastModified": "2020-01-15T08:57:19.000Z",
                "path": "C:\\Program Files (x86)\\log1.txt",
                "processCreationTime": "2019-09-03T17:51:40.000Z",
                "size": 10485904,
                "uuid": "c0531415-87a6-4d28-a226-b485784b1881"
            },
            {
                "downloaded": "2020-01-15 18:17:10.595",
                "evidenceType": "file",
                "hash": "7d1677decbfaf1598ccd745fc197eb1c",
                "hostname": "host2",
                "lastModified": "2020-01-13T13:11:35.000Z",
                "path": "C:\\Program Files (x86)\\log8.txt",
                "processCreationTime": "2019-09-03T17:51:40.000Z",
                "size": 10485940,
                "uuid": "3043ef9c-78a9-4f19-8fb9-ddbab202d03b"
            }
        ]
    }
}

Human Readable Output

File downloads

Uuid Path Evidence Type Hostname Process Creation Time Size
c0531415-87a6-4d28-a226-b485784b1881 C:\Program Files (x86)\log1.txt file host1 2019-09-03T17:51:40.000Z 10485904
3043ef9c-78a9-4f19-8fb9-ddbab202d03b C:\Program Files (x86)\log8.txt file host2 2019-09-03T17:51:40.000Z 10485940

tanium-tr-get-downloaded-file

Gets the actual content of a downloaded file by file ID. Downloaded file password: infected.

Base Command

tanium-tr-get-downloaded-file

Input

Argument Name Description Required
file_id The file ID. Required

Context Output

Path Type Description
File.EntryID String File entry ID.
File.Extension String The extension of the file.
File.Info String Information about the file.
File.MD5 String The MD5 hash of the file.
File.Name String The name of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.SHA512 String The SHA512 hash of the file.
File.SSDeep String The SSDeep hash of the file (same as displayed in file entries).
File.Size Number The size of the file in bytes.
File.Type String The file type.

Command Example

!tanium-tr-get-downloaded-file file_id=c0531415-87a6-4d28-a226-b485784b1881

Context Example

{
    "File": {
        "EntryID": "7608@e99f97d1-7225-4c75-896c-3c960febbe8c",
        "Extension": "zip",
        "Info": "application/zip",
        "MD5": "217cac2e10c1d11ed55ab2ede6bdb0ea",
        "Name": "c0531415-87a6-4d28-a226-b485784b1881.zip",
        "SHA1": "20808150526b092f5e4e19c82af2e9b2a1303e89",
        "SHA256": "40c605face875cd53f07c1301ffc9fce0ed5b12a65c729fe73895e44cdcdebdf",
        "SHA512": "50415634cae426da763a39532f3d22eeea5a79a8868044f6b3ffca8b528cce92cbe9f4d7b98d6d1cb49a705f3182b2c43f84f628acd748fb78e6cca85939b10c",
        "SSDeep": "12288:npzKFzLrU/2fzXVPkrnjuYyTNW+o4T5SD7BDy6PFP8NjglLSAK:npeFzLI/6FknjuY4nojJm6NP8NjQi",
        "Size": 598728,
        "Type": "Zip archive data, at least v2.0 to extract"
    }
}

Human Readable Output

tanium-tr-list-events-by-connection

Queries events for a connection.

Base Command

tanium-tr-list-events-by-connection

Input

Argument Name Description Required
connection_id The connection id. Required
type The type of event. Can be “File”, “Network”, “Registry”, “Process”, “Driver”, “Combined”, “DNS”, or “Image”. The default is “Combined”. Possible values are: File, Network, Registry, Process, Driver, Combined, DNS, Image. Default is combined. Required
limit The maximum number of events to return. Default is 50. Optional
offset Offset to start getting the result set. Default is 0. Optional
filter Advanced search that filters according to event fields. For example: [[‘process_id’, ‘gt’, ‘30’], [‘username’, ‘ne’, ‘administrator’]]. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional operators: eq (equals), ne (does not equal); for integers/date: gt (greater than), gte (greater than or equals), ls (less than), lse (less than or equals); for strings: co (contains), nc (does not contain). . Optional
match Whether the results should fit all filters or at least one filter. Possible values are: all, any. Default is all. Optional
sort A comma-separated list of fields to sort on prefixed by +/- for ascending or descending and ordered by priority left to right. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional
fields A comma-separated list of fields on which to search. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time. Optional

Context Output

Path Type Description
TaniumEvent.id String The ID of the event.
TaniumEvent.groupName String The group name of the event.
TaniumEvent.file String The path of the file in the event.
TaniumEvent.operation String The event operation.
TaniumEvent.processId Number The ID of the process.
TaniumEvent.pid Number The ID of the process.
TaniumEvent.processPath String The path of the process.
TaniumEvent.processTableId Number The ID of the process table.
TaniumEvent.timestamp Date The date when the event was created.
TaniumEvent.userName String The username associated with the event.
TaniumEvent.remoteAddress String The network event destination address.
TaniumEvent.remoteAddressPort Number The network event destination port.
TaniumEvent.localAddress String The network event source address.
TaniumEvent.localAddressPort Number The network event source port.
TaniumEvent.keyPath String The registry key path.
TaniumEvent.valueName String The registry value name.
TaniumEvent.exitCode Number The process exit code.
TaniumEvent.processCommandLine String The process command line.
TaniumEvent.parentCommandLine String The parent command line.
TaniumEvent.processHash String The hash value of the process.
TaniumEvent.hashes String The hashes of the driver.
TaniumEvent.imageLoaded String The image loaded path of the driver.
TaniumEvent.signature String The signature of the driver.
TaniumEvent.signed Boolean Whether the driver is signed.
TaniumEvent.eventId Number The ID of the event.
TaniumEvent.eventOpcode Number The event opcode.
TaniumEvent.eventRecordId Number The ID of the event record.
TaniumEvent.eventTaskId Number The ID of the event task.
TaniumEvent.query String The query of the DNS.
TaniumEvent.response String The response of the DNS.
TaniumEvent.imagePath String The image path.
TaniumEvent.createTime Date The process creation time
TaniumEvent.endTime Date The process end time.
TaniumEvent.eventTaskName String The name of the event task.
TaniumEvent.hash String The process hash.

Command Example

!tanium-tr-list-events-by-connection connection_id=remote:hostname:123: type=File limit=2

Context Example

{
    "TaniumEvent": [
        {
            "eventOperationId": 0,
            "file": "C:\\Windows\\f1.dat",
            "groupName": "NT AUTHORITY",
            "id": "4611686018470089188",
            "operation": "Create",
            "pid": 736,
            "processPath": "C:\\Windows\\t.exe",
            "processTableId": "72057594038528503",
            "timestamp": "2021-07-18 07:28:04.007",
            "timestampRaw": 1626593284007,
            "userName": "LOCAL SERVICE"
        },
        {
            "eventOperationId": 1,
            "file": "C:\\Windows\\f2.dat",
            "groupName": "NT AUTHORITY",
            "id": "4611686018470089189",
            "operation": "Write",
            "pid": 736,
            "processPath": "C:\\Windows\\d.exe",
            "processTableId": "72057594038528503",
            "timestamp": "2021-07-18 07:28:04.007",
            "timestampRaw": 1626593284007,
            "userName": "LOCAL SERVICE"
        }
    ]
}

Human Readable Output

Events for remote:hostname:123

Id File Timestamp Process Table Id Process Path User Name
4611686018470089188 C:\Windows\f1.dat 2021-07-18 07:28:04.007 72057594038528503 C:\Windows\t.exe LOCAL SERVICE
4611686018470089189 C:\Windows\f2.dat 2021-07-18 07:28:04.007 72057594038528503 C:\Windows\d.exe LOCAL SERVICE

tanium-tr-get-file-download-info

Gets the metadata of a file download.

Base Command

tanium-tr-get-file-download-info

Input

Argument Name Description Required
file_id File download ID. Required

Context Output

Path Type Description
Tanium.FileDownload.size Number The size of the file, in bytes.
Tanium.FileDownload.path String The path of the file.
Tanium.FileDownload.downloaded Date The date when this file was downloaded.
Tanium.FileDownload.hostname String The hostname of the downloaded file.
Tanium.FileDownload.processCreationTime Date The date when the file was created.
Tanium.FileDownload.hash String The file hash.
Tanium.FileDownload.uuid Number The downloaded file uuid.
Tanium.FileDownload.lastModified Date The date when the file was last modified.
Tanium.FileDownload.createdBy String The user that created this file.
Tanium.FileDownload.createdByProc String The process path that created this file.
Tanium.FileDownload.lastModifiedBy String The user that last modified this file.
Tanium.FileDownload.lastModifiedByProc String The process path that modified this file.
Tanium.FileDownload.evidenceType String The evidence type - file.

Command Example

!tanium-tr-get-file-download-info file_id=c0531415-87a6-4d28-a226-b485784b1881

Context Example

{
    "Tanium": {
        "FileDownload": {
            "downloaded": "2020-01-15 13:04:02.827",
            "evidenceType": "file",
            "hash": "123456789",
            "hostname": "host1",
            "lastModified": "2020-01-15T08:57:19.000Z",
            "path": "C:\\log1.txt",
            "processCreationTime": "2019-09-03T17:51:40.000Z",
            "size": 10485904,
            "uuid": "c0531415-87a6-4d28-a226-b485784b1881"
        }
    }
}

Human Readable Output

File download

Uuid Path Evidence Type Hostname Process Creation Time Size
c0531415-87a6-4d28-a226-b485784b1881 C:\log1.txt file host1 2019-09-03T17:51:40.000Z 10485904

tanium-tr-get-process-info

Get information for a process.

Base Command

tanium-tr-get-process-info

Input

Argument Name Description Required
connection_id The connection id. Required
ptid The process table ID. Required

Context Output

Path Type Description
Tanium.ProcessInfo.childrenCount Number Nuber of process children.
Tanium.ProcessInfo.context String Process tree context.
Tanium.ProcessInfo.createTime Date Time when the process was created.
Tanium.ProcessInfo.createTimeRaw Date Timestamp when the process was created.
Tanium.ProcessInfo.dnsEventsCount Number Number of DNS events in the process.
Tanium.ProcessInfo.driverEventsCount Number Number of Driver events in the process.
Tanium.ProcessInfo.endTime Date Process termination time.
Tanium.ProcessInfo.endTimeRaw Date Process termination timestamp.
Tanium.ProcessInfo.exitCode Number Process exit code.
Tanium.ProcessInfo.fileEventsCount Number Number of File events in the process.
Tanium.ProcessInfo.groupName String Process group name.
Tanium.ProcessInfo.hashTypeName String Hash type.
Tanium.ProcessInfo.id String Process id at the tanium system.
Tanium.ProcessInfo.imageEventsCount Number Number of Image events in the process.
Tanium.ProcessInfo.networkEventsCount Number Number of network events in the process.
Tanium.ProcessInfo.parentProcessTableId String Parent process table id.
Tanium.ProcessInfo.pid Number The ID of the process.
Tanium.ProcessInfo.processEventsCount Number Number of process events in the process.
Tanium.ProcessInfo.processHash String Process hash.
Tanium.ProcessInfo.processPath String The process path.
Tanium.ProcessInfo.processTableId String The ID of the process table.
Tanium.ProcessInfo.registryEventsCount Number Number of registry events in the process.
Tanium.ProcessInfo.securityEventsCount Number Number of security events in the process.
Tanium.ProcessInfo.uniqueProcessId String Unique process id.
Tanium.ProcessInfo.userName String The username who created the process.

Command Example

!tanium-tr-get-process-info ptid=72057594038510321 connection_id=remote:hostname:123:

Context Example

{
    "Tanium": {
        "ProcessInfo": {
            "childrenCount": 0,
            "context": "node",
            "createTime": "2021-07-09 12:38:19.372",
            "createTimeRaw": 1625834299372,
            "dnsEventsCount": 0,
            "driverEventsCount": 0,
            "endTime": "2021-07-09 12:39:49.413",
            "endTimeRaw": 1625834389413,
            "exitCode": 0,
            "fileEventsCount": 0,
            "groupName": "NT AUTHORITY",
            "hashTypeName": "MD5",
            "id": "72057594038510321",
            "imageEventsCount": 0,
            "networkEventsCount": 0,
            "parentProcessTableId": "72057594038528485",
            "pid": 3648,
            "processEventsCount": 1,
            "processHash": "e1bce838cd2695999ab34215bf94b501",
            "processPath": "C:\\test.exe",
            "processTableId": "72057594038510321",
            "registryEventsCount": 0,
            "securityEventsCount": 0,
            "uniqueProcessId": "-8410859473941295552",
            "userName": "LOCAL SERVICE"
        }
    }
}

Human Readable Output

Process information for process with PTID 72057594038510321

Pid Process Table Id Parent Process Table Id Process Path
3648 72057594038510321 72057594038528485 C:\test.exe

tanium-tr-get-events-by-process

Gets the events for a process.

Base Command

tanium-tr-get-events-by-process

Input

Argument Name Description Required
connection_id The connection name. Required
ptid The process instance ID. Required
type The type of event. Can be “File”, “Network”, “Registry”, “Process”, “Driver”, “Combined”, “DNS”, or “Image”. The default is “Combined”. Possible values are: File, Network, Registry, Process, Driver, Combined, DNS, Image. Default is combined. Required
limit The maximum number of events to return. Default is 50. Optional
offset The offset number to begin listing events. Default is 0. Optional

Context Output

Path Type Description
Tanium.ProcessEvent.id Number The ID of the event.
Tanium.ProcessEvent.detail Unknown The event details.
Tanium.ProcessEvent.operation String The event operation.
Tanium.ProcessEvent.timestamp Date Time when the event was created.
Tanium.ProcessEvent.type String The event type.

Command Example

!tanium-tr-get-events-by-process connection_id=remote:hostname:123: type=Process ptid=72057594038528485 limit=2

Context Example

{
    "Tanium": {
        "ProcessEvent": [
            {
                "detail": "4428: C:\\test.exe",
                "id": "72057594038510294",
                "operation": "CreateChild",
                "timestamp": "2021-07-09 12:20:05.490",
                "timestampRaw": 1625833205490,
                "type": "Process"
            },
            {
                "detail": "1792: C:\\test.exe",
                "id": "72057594038510295",
                "operation": "CreateChild",
                "timestamp": "2021-07-09 12:20:05.541",
                "timestampRaw": 1625833205541,
                "type": "Process"
            }
        ]
    }
}

Human Readable Output

Events for process 72057594038528485

Id Detail Type Timestamp Operation
72057594038510294 4428: C:\test.exe Process 2021-07-09 12:20:05.490 CreateChild
72057594038510295 1792: C:\test.exe Process 2021-07-09 12:20:05.541 CreateChild

tanium-tr-get-process-children

Gets the children of this process instance.

Base Command

tanium-tr-get-process-children

Input

Argument Name Description Required
connection_id The connection id. Required
ptid The process table ID. Required
limit The maximum number of entries to return. Default is 50. Optional
offset The offset number to begin listing entries. Default is 0. Optional

Context Output

Path Type Description
Tanium.ProcessChildren.childrenCount Number Nuber of process children.
Tanium.ProcessChildren.context String Process tree context.
Tanium.ProcessChildren.createTime Date Time when the process was created.
Tanium.ProcessChildren.createTimeRaw Date Timestamp when the process was created.
Tanium.ProcessChildren.dnsEventsCount Number Number of DNS events in the process.
Tanium.ProcessChildren.driverEventsCount Number Number of Driver events in the process.
Tanium.ProcessChildren.endTime Date Process termination time.
Tanium.ProcessChildren.endTimeRaw Date Process termination timestamp.
Tanium.ProcessChildren.exitCode Number Process exit code.
Tanium.ProcessChildren.fileEventsCount Number Number of File events in the process.
Tanium.ProcessChildren.groupName String Process group name.
Tanium.ProcessChildren.hashTypeName String Hash type.
Tanium.ProcessChildren.id String Process id at the tanium system.
Tanium.ProcessChildren.imageEventsCount Number Number of Image events in the process.
Tanium.ProcessChildren.networkEventsCount Number Number of network events in the process.
Tanium.ProcessChildren.parentProcessTableId String Parent process table id.
Tanium.ProcessChildren.pid Number The ID of the process.
Tanium.ProcessChildren.processEventsCount Number Number of process events in the process.
Tanium.ProcessChildren.processHash String Process hash.
Tanium.ProcessChildren.processPath String The process path.
Tanium.ProcessChildren.processTableId String The ID of the process table.
Tanium.ProcessChildren.registryEventsCount Number Number of registry events in the process.
Tanium.ProcessChildren.securityEventsCount Number Number of security events in the process.
Tanium.ProcessChildren.uniqueProcessId String Unique process id.
Tanium.ProcessChildren.userName String The username who created the process.

Command Example

!tanium-tr-get-process-children connection_id=remote:hostname:123: ptid=72057594038528485

Context Example

{
    "Tanium": {
        "ProcessChildren": [
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:26:12.820",
                "createTimeRaw": 1626593172820,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:13.483",
                "endTimeRaw": 1626593173483,
                "exitCode": 0,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528483",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 5284,
                "processCommandLine": "\"Logon.exe\" /flags:0x0 /state0:0xa3856855 /state1:0x41c64e6d",
                "processEventsCount": 1,
                "processHash": "b38dfcf985d8ae5b1a17c264981e61c7",
                "processPath": "C:\\Logon1.exe",
                "processTableId": "72057594038528483",
                "registryEventsCount": 39,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151524022684478300",
                "userName": "SYSTEM"
            },
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:25:43.456",
                "createTimeRaw": 1626593143456,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:56.000",
                "endTimeRaw": 1626593216000,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528482",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 2856,
                "processCommandLine": "C:\\test.exe -secured -Embedding",
                "processEventsCount": 1,
                "processHash": "e1bce838cd2695999ab34215bf94b501",
                "processPath": "C:\\test.exe",
                "processTableId": "72057594038528482",
                "registryEventsCount": 0,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151647460044567768",
                "userName": "LOCAL SERVICE"
            }
        ]
    }
}

Human Readable Output

Children for process with PTID 72057594038528485

Pid Process Table Id Parent Process Table Id
5284 72057594038528483 72057594038528485
2856 72057594038528482 72057594038528485

tanium-tr-get-parent-process

Gets information for the parent process.

Base Command

tanium-tr-get-parent-process

Input

Argument Name Description Required
connection_id The connection id. Required
ptid The process table ID. Required

Context Output

Path Type Description
Tanium.ProcessParent.childrenCount Number Nuber of process children.
Tanium.ProcessParent.context String Process tree context.
Tanium.ProcessParent.createTime Date Time when the process was created.
Tanium.ProcessParent.createTimeRaw Date Timestamp when the process was created.
Tanium.ProcessParent.dnsEventsCount Number Number of DNS events in the process.
Tanium.ProcessParent.driverEventsCount Number Number of Driver events in the process.
Tanium.ProcessParent.endTime Date Process termination time.
Tanium.ProcessParent.endTimeRaw Date Process termination timestamp.
Tanium.ProcessParent.exitCode Number Process exit code.
Tanium.ProcessParent.fileEventsCount Number Number of File events in the process.
Tanium.ProcessParent.groupName String Process group name.
Tanium.ProcessParent.hashTypeName String Hash type.
Tanium.ProcessParent.id String Process id at the tanium system.
Tanium.ProcessParent.imageEventsCount Number Number of Image events in the process.
Tanium.ProcessParent.networkEventsCount Number Number of network events in the process.
Tanium.ProcessParent.parentProcessTableId String Parent process table id.
Tanium.ProcessParent.pid Number The ID of the process.
Tanium.ProcessParent.processEventsCount Number Number of process events in the process.
Tanium.ProcessParent.processHash String Process hash.
Tanium.ProcessParent.processPath String The process path.
Tanium.ProcessParent.processTableId String The ID of the process table.
Tanium.ProcessParent.registryEventsCount Number Number of registry events in the process.
Tanium.ProcessParent.securityEventsCount Number Number of security events in the process.
Tanium.ProcessParent.uniqueProcessId String Unique process id.
Tanium.ProcessParent.userName String The username who created the process.

Command Example

!tanium-tr-get-parent-process connection_id=remote:hostname:123: ptid=72057594038510321

Context Example

{
    "Tanium": {
        "ProcessParent": {
            "childrenCount": 5664,
            "context": "parent",
            "createTime": "2021-07-18 07:26:55.000",
            "createTimeRaw": 1626593215000,
            "dnsEventsCount": 0,
            "driverEventsCount": 0,
            "fileEventsCount": 0,
            "id": "72057594038528485",
            "imageEventsCount": 0,
            "networkEventsCount": 0,
            "parentProcessTableId": "0",
            "pid": -2,
            "processEventsCount": 1,
            "processPath": "<Pruned Process>",
            "processTableId": "72057594038528485",
            "registryEventsCount": 0,
            "securityEventsCount": 0,
            "uniqueProcessId": "-5151340193789247490"
        }
    }
}

Human Readable Output

Parent process for process with PTID 72057594038510321

Id Pid Process Table Id Parent Process Table Id
72057594038528485 -2 72057594038528485 0

tanium-tr-get-process-tree

Gets the process tree for the process instance.

Base Command

tanium-tr-get-process-tree

Input

Argument Name Description Required
connection_id The connection id. Required
ptid The process instance ID. Required
context The process context. Can be parent, node, siblings, children. Possible values are: parent, node, siblings, children. Optional

Context Output

Path Type Description
Tanium.ProcessTree.childrenCount Number Nuber of process children.
Tanium.ProcessTree.context String Process tree context.
Tanium.ProcessTree.createTime Date Time when the process was created.
Tanium.ProcessTree.createTimeRaw Date Timestamp when the process was created.
Tanium.ProcessTree.dnsEventsCount Number Number of DNS events in the process.
Tanium.ProcessTree.driverEventsCount Number Number of Driver events in the process.
Tanium.ProcessTree.endTime Date Process termination time.
Tanium.ProcessTree.endTimeRaw Date Process termination timestamp.
Tanium.ProcessTree.exitCode Number Process exit code.
Tanium.ProcessTree.fileEventsCount Number Number of File events in the process.
Tanium.ProcessTree.groupName String Process group name.
Tanium.ProcessTree.hashTypeName String Hash type.
Tanium.ProcessTree.id String Process id at the tanium system.
Tanium.ProcessTree.imageEventsCount Number Number of Image events in the process.
Tanium.ProcessTree.networkEventsCount Number Number of network events in the process.
Tanium.ProcessTree.parentProcessTableId String Parent process table id.
Tanium.ProcessTree.pid Number The ID of the process.
Tanium.ProcessTree.processEventsCount Number Number of process events in the process.
Tanium.ProcessTree.processHash String Process hash.
Tanium.ProcessTree.processPath String The process path.
Tanium.ProcessTree.processTableId String The ID of the process table.
Tanium.ProcessTree.registryEventsCount Number Number of registry events in the process.
Tanium.ProcessTree.securityEventsCount Number Number of security events in the process.
Tanium.ProcessTree.uniqueProcessId String Unique process id.
Tanium.ProcessTree.userName String The username who created the process.

Command Example

!tanium-tr-get-process-tree connection_id=remote:hostname:123: ptid=72057594038528485

Context Example

{
    "Tanium": {
        "ProcessTree": [
            {
                "childrenCount": 5664,
                "context": "node",
                "createTime": "2021-07-18 07:26:55.000",
                "createTimeRaw": 1626593215000,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "fileEventsCount": 0,
                "id": "72057594038528485",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "0",
                "pid": -2,
                "processEventsCount": 1,
                "processPath": "<Pruned Process>",
                "processTableId": "72057594038528485",
                "registryEventsCount": 0,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151340193789247490"
            },
            {
                "childrenCount": 0,
                "context": "child",
                "createTime": "2021-07-18 07:26:12.820",
                "createTimeRaw": 1626593172820,
                "dnsEventsCount": 0,
                "driverEventsCount": 0,
                "endTime": "2021-07-18 07:26:13.483",
                "endTimeRaw": 1626593173483,
                "exitCode": 0,
                "fileEventsCount": 0,
                "groupName": "NT AUTHORITY",
                "hashTypeName": "MD5",
                "id": "72057594038528483",
                "imageEventsCount": 0,
                "networkEventsCount": 0,
                "parentProcessTableId": "72057594038528485",
                "pid": 5284,
                "processCommandLine": "\"LogonUI.exe\" /flags:0x0 /state0:0xa3856855 /state1:0x41c64e6d",
                "processEventsCount": 1,
                "processHash": "b38dfcf985d8ae5b1a17c264981e61c7",
                "processPath": "C:\\Windows\\System32\\LogonUI.exe",
                "processTableId": "72057594038528483",
                "registryEventsCount": 39,
                "securityEventsCount": 0,
                "uniqueProcessId": "-5151524022684478300",
                "userName": "SYSTEM"
            }
        ]
    }
}

Human Readable Output

Process information for process with PTID 72057594038528485

Id Pid Process Table Id Parent Process Table Id
72057594038528485 -2 72057594038528485 0
72057594038528483 5284 72057594038528483 72057594038528485

tanium-tr-event-evidence-list

Returns a list of all available evidence in the system.

Base Command

tanium-tr-event-evidence-list

Input

Argument Name Description Required
limit The maximum number of evidences to return. Default is 50. Optional
offset Offset to start getting the events result set. Default is 0. Optional
sort A comma-separated list of fields by which to sort, using +/- prefixes for ascending/descending, in order of priority (left to right). Optional
hostname Comma-seperated list of hostnames to get the event evidences that match only those hostnames, for example hostname=123,456. Optional
type Get the event evidences that match only to a specific type, for example type=file. Optional

Context Output

Path Type Description
Tanium.Evidence.name String The evidence name.
Tanium.Evidence.uuid String The evidence UUID.
Tanium.Evidence.createdAt Date Time when the process was created.
Tanium.Evidence.hostname String The evidence connection hostname.
Tanium.Evidence.evidenceType Number The evidence type.
Tanium.Evidence.size Number The evidence size.

Command Example

!tanium-tr-event-evidence-list limit=3

Context Example

{
    "Tanium": {
        "Evidence": [
            {
                "createdAt": "2021-10-06T06:40:48.297Z",
                "evidenceType": "snapshot",
                "hostname": "host1",
                "name": "host1.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "832dec40-1cc2-4e53-881a-7f61cba835bc"
            },
            {
                "createdAt": "2021-10-06T06:42:07.010Z",
                "evidenceType": "snapshot",
                "hostname": "host2",
                "name": "host2.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "340a3ac4-560d-430f-bd50-96615d763171"
            },
            {
                "createdAt": "2021-10-07T12:15:30.711Z",
                "evidenceType": "snapshot",
                "hostname": "host3",
                "name": "host3.db",
                "size": 152064000,
                "username": "administrator",
                "uuid": "cf4d8628-8527-4014-8ed2-bdca6c592488"
            }
        ]
    }
}

Human Readable Output

Evidence list

Uuid Name Evidence Type Hostname Created At Username
832dec40-1cc2-4e53-881a-7f61cba835bc host1.db snapshot host1 2021-10-06T06:40:48.297Z administrator
340a3ac4-560d-430f-bd50-96615d763171 host2.db snapshot host2 2021-10-06T06:42:07.010Z administrator
cf4d8628-8527-4014-8ed2-bdca6c592488 host3.db snapshot host3 2021-10-07T12:15:30.711Z administrator

tanium-tr-event-evidence-get-properties

Returns event evidence properties for IOC generation.

Base Command

tanium-tr-event-evidence-get-properties

Input

There are no input arguments for this command.

Context Output

Path Type Description
Tanium.EvidenceProperties.type String The evidence property type.
Tanium.EvidenceProperties.value String The evidence property value.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "EvidenceProperties": [
            {
                "type": "MD5Hash",
                "value": "92ee791a630830452485e8e375f8db35"
            },
            {
                "type": "MD5Hash",
                "value": "e1bce838cd2695999ab34215bf94b501"
            },
            {
                "type": "MD5Hash",
                "value": "0e1853d3339d2963d2bc6ac1fdc1c811"
            },
            {
                "type": "MD5Hash",
                "value": "41b0ade03cd365a5cc99f748c5ffcadc"
            },
            {
                "type": "MD5Hash",
                "value": "a9a89cb1838373c365f2b8af72b1f1c2"
            }
        ]
    }
}

Human Readable Output

Evidence Properties

Type Value
MD5Hash 92ee791a630830452485e8e375f8db35
MD5Hash e1bce838cd2695999ab34215bf94b501
MD5Hash 0e1853d3339d2963d2bc6ac1fdc1c811
MD5Hash 41b0ade03cd365a5cc99f748c5ffcadc
MD5Hash a9a89cb1838373c365f2b8af72b1f1c2

tanium-tr-get-evidence-by-id

Gets event evidence by evidence ID.

Base Command

tanium-tr-get-evidence-by-id

Input

Argument Name Description Required
evidence_id The ID of the evidence. Required

Context Output

Path Type Description
Tanium.Evidence.commandline String Process command line.
Tanium.Evidence.createTime Date Time when the process was created.
Tanium.Evidence.createTimeRaw Number Timestamp when the process was created.
Tanium.Evidence.created Date Time when the event was created.
Tanium.Evidence.domain String Event domain.
Tanium.Evidence.eventtype String The event type.
Tanium.Evidence.evidencetype String The evidence type.
Tanium.Evidence.exitCode Number Process exit code.
Tanium.Evidence.hostname String Connection host name.
Tanium.Evidence.summary String Evidence summary.
Tanium.Evidence.timestamp Date Eveidence creation date.
Tanium.Evidence.type String The evidence type.
Tanium.Evidence.username String Evidence creator Username.
Tanium.Evidence.utctimecreated Date Evidence creation utc date.
Tanium.Evidence.uuid String The evidence UUID.

Command Example

!tanium-tr-get-evidence-by-id evidence_id=b684f9be-80ee-483d-8dca-a4d5cd3aeaa6

Context Example

{
    "Tanium": {
        "Evidence": {
            "createTime": "2021-07-07 11:00:01.973",
            "createTimeRaw": 1625655601973,
            "created": "2021-10-05T10:44:36.697Z",
            "endTime": "2021-07-07 11:01:32.006",
            "endTimeRaw": 1625655692006,
            "eventtype": "ProcessEvent",
            "evidencetype": "event",
            "exitCode": 0,
            "groupName": "NT AUTHORITY",
            "hash": "e1bce838cd2695999ab34215bf94b501",
            "hashTypeName": "MD5",
            "hostname": "host1",
            "id": "72057594038506412",
            "parentCommandLine": "<Pruned Process>",
            "parentPath": "<Pruned Process>",
            "parentPid": -2,
            "parentProcessTableId": "72057594038528485",
            "pid": 6056,
            "processPath": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "processTableId": "72057594038506412",
            "recorderid": "72057594038506412",
            "summary": "Test description.",
            "userName": "NETWORK SERVICE",
            "username": "administrator",
            "uuid": "b684f9be-80ee-483d-8dca-a4d5cd3aeaa6"
        }
    }
}

Human Readable Output

Evidence information

Uuid Hostname Username Summary Created Process Table Id
b684f9be-80ee-483d-8dca-a4d5cd3aeaa6 host1 administrator Test description. 2021-10-05T10:44:36.697Z 72057594038506412

tanium-tr-create-evidence

Creates an event evidence from process.

Base Command

tanium-tr-create-evidence

Input

Argument Name Description Required
connection_id The id of the connection. Required
ptid The process instance ID. Required
hostname The hostname of the connection. Required
summary The summary of the event evidence. Optional

Context Output

There is no context output for this command.

Command Example

!tanium-tr-create-evidence ptid=72057594038510321 connection_id=remote:hostname:123: hostname=host1 summary="Create Process"

Human Readable Output

Evidence have been created.

tanium-tr-delete-evidence

Deletes event evidences from tanium.

Base Command

tanium-tr-delete-evidence

Input

Argument Name Description Required
evidence_ids The IDs of the evidences to delete. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-evidence evidence_ids=53630ca0-e55a-4f6d-9451-d1c2c277530b

Human Readable Output

Evidence 53630ca0-e55a-4f6d-9451-d1c2c277530b has been deleted successfully.

tanium-tr-request-file-download

Requests a new file download.

Base Command

tanium-tr-request-file-download

Input

Argument Name Description Required
path Path to file. Required
connection_id Connection id. Required

Context Output

Path Type Description
Tanium.FileDownloadTask.compress String Is file compressed.
Tanium.FileDownloadTask.connection String The file download host.
Tanium.FileDownloadTask.taskId Number ID of the file download task.
Tanium.FileDownloadTask.paths String The file download paths.
Tanium.FileDownloadTask.startTime Date Download start time.
Tanium.FileDownloadTask.status String Status of the file download request.

Command Example

!tanium-tr-request-file-download connection_id=remote:hostname:123: path="C:\\Users\\Administrator\\Desktop\\testD.txt"

Context Example

{
    "Tanium": {
        "FileDownloadTask": {
            "compress": "true",
            "connection": "remote:hostname:123:",
            "paths": [
                "C:\\Users\\Administrator\\Desktop\\testD.txt"
            ],
            "startTime": "2021-10-07T12:23:06.824Z",
            "status": "STARTED",
            "taskId": 1178
        }
    }
}

Human Readable Output

Download request of file C:\Users\Administrator\Desktop\testD.txt has been sent successfully. Task id: 1178.

tanium-tr-delete-file-download

Deletes a file download.

Base Command

tanium-tr-delete-file-download

Input

Argument Name Description Required
file_id File download ID. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-file-download file_id=0367c8b2-eed9-4124-b173-1c83cbf3ba6f

Human Readable Output

Delete request of file with ID 0367c8b2-eed9-4124-b173-1c83cbf3ba6f has been sent successfully.

tanium-tr-list-files-in-directory

Gets a list of files in the given directory.

Base Command

tanium-tr-list-files-in-directory

Input

Argument Name Description Required
path Path to the directory. Required
connection_id Connection id. Required
limit The maximum number of files to return. Default is 50. Optional
offset Offset to start getting files. Default is 0. Optional

Context Output

Path Type Description
Tanium.File.connectionId String Connection ID.
Tanium.File.createdDate Date Time the file was created.
Tanium.File.modifiedDate Date The date that the file was last modified.
Tanium.File.name String The file name.
Tanium.File.path String The file path.
Tanium.File.permissions Number The file permissions.
Tanium.File.size Number The file size.
Tanium.File.type String The file type.

Command Example

!tanium-tr-list-files-in-directory connection_id=remote:hostname:123: path=`C:\Users\Administrator\Desktop\` limit=2

Context Example

{
    "Tanium": {
        "File": [
            {
                "connectionId": "remote:hostname:123:",
                "createdDate": "2020-02-06T08:34:17.000Z",
                "modifiedDate": "2018-08-12T11:11:02.000Z",
                "name": "ChromeSetup.exe",
                "path": "C:\\Users\\Administrator\\Desktop\\",
                "permissions": 438,
                "size": 1130840,
                "type": "FILE"
            },
            {
                "connectionId": "remote:hostname:123:",
                "createdDate": "2020-01-07T11:53:20.000Z",
                "modifiedDate": "2020-01-07T11:53:46.000Z",
                "name": "test.txt",
                "path": "C:\\Users\\Administrator\\Desktop\\",
                "permissions": 438,
                "size": 11,
                "type": "FILE"
            }
        ]
    }
}

Human Readable Output

Files in directory C:\Users\Administrator\Desktop\

Name Path Connection Id Created Date Modified Date Permissions Size
ChromeSetup.exe C:\Users\Administrator\Desktop\ remote:hostname:123: 2020-02-06T08:34:17.000Z 2018-08-12T11:11:02.000Z 438 1130840
test.txt C:\Users\Administrator\Desktop\ remote:hostname:123: 2020-01-07T11:53:20.000Z 2020-01-07T11:53:46.000Z 438 11

tanium-tr-get-file-info

Gets information about a file from a remote connection.

Base Command

tanium-tr-get-file-info

Input

Argument Name Description Required
connection_id The ID of the connection. Default is Connection id.. Required
path The path to the file. Default is Path to file.. Required

Context Output

Path Type Description
Tanium.File.canonicalPath String The file path.
Tanium.File.cid String Cid.
Tanium.File.connectionId String Connection ID.
Tanium.File.createdDate Date Time the file was created.
Tanium.File.modifiedDate Date The date that the file was last modified.
Tanium.File.name String The file name.
Tanium.File.path String The file path.
Tanium.File.permissions Number The file permissions.
Tanium.File.size Number The file size.
Tanium.File.type String The file type.
Tanium.File.sessionId String Session ID.

Command Example

!tanium-tr-get-file-info connection_id=remote:hostname:123: path="C:\\log1.txt"

Context Example

{
    "Tanium": {
        "File": {
            "canonicalPath": "C:\\log1.txt",
            "cid": "d65ba018-346c-497e-8f18-252036fd87f9",
            "connectionId": "remote:hostname:123:",
            "createdDate": "2019-09-03T17:51:40.000Z",
            "modifiedDate": "2021-09-27T19:36:07.000Z",
            "name": "C:\\log1.txt",
            "path": "C:\\log1.txt",
            "permissions": 438,
            "sessionId": "1ce0f8e7-c180-4467-bf8e-0a313c4eb5f4",
            "size": 2913,
            "type": "FILE"
        }
    }
}

Human Readable Output

Information for file C:\log1.txt

Path Name Connection Id Type Created Date Modified Date
C:\log1.txt C:\log1.txt remote:hostname:123: FILE 2019-09-03T17:51:40.000Z 2021-09-27T19:36:07.000Z

tanium-tr-delete-file-from-endpoint

Deletes a file from the given endpoint.

Base Command

tanium-tr-delete-file-from-endpoint

Input

Argument Name Description Required
connection_id Connection ID. Required
path Path to file. Required

Context Output

There is no context output for this command.

Command Example

!tanium-tr-delete-file-from-endpoint connection_id=remote:hostname:123: path=`C:\Users\Administrator\Desktop\to_delete.txt`

Human Readable Output

Delete request of file C:\Users\Administrator\Desktop\to_delete.txt from endpoint remote:hostname:123: has been sent successfully.

tanium-tr-intel-docs-labels-list

List all labels for the identified intel document.

Base Command

tanium-tr-intel-docs-labels-list

Input

Argument Name Description Required
intel_doc_id List the label IDs for the intel document with this ID. Required

Context Output

Path Type Description
Tanium.IntelDocLabel.IntelDocID String The requested intel doc ID.
Tanium.IntelDocLabel.LabelsList.ID Number The unique identifier for this label.
Tanium.IntelDocLabel.LabelsList.Name String The display name of the label.
Tanium.IntelDocLabel.LabelsList.Description String An extended description of the label.
Tanium.IntelDocLabel.LabelsList.IndicatorCount Number The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.IntelDocLabel.LabelsList.SignalCount Number The number of Tanium Signal documents associated with this label.
Tanium.IntelDocLabel.LabelsList.CreatedAt Date The date this label was created.
Tanium.IntelDocLabel.LabelsList.UpdatedAt Date The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-intel-docs-labels-list intel_doc_id=509

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                    "ID": 1,
                    "IndicatorCount": 0,
                    "Name": "Alpha",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Intel doc (509) labels

ID Name Description Indicator Count Signal Count Created At Updated At
1 Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z
11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z
16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-docs-add-label

Create a new label association for the identified intel document.

Base Command

tanium-tr-intel-docs-add-label

Input

Argument Name Description Required
intel_doc_id Associate the new label with the intel document with this ID. Required
label_id The ID of the new label to associate with the target intel document. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs). Required

Context Output

Path Type Description
Tanium.IntelDocLabel.IntelDocID String The requested intel doc ID.
Tanium.IntelDocLabel.LabelsList.ID Number The unique identifier for this label.
Tanium.IntelDocLabel.LabelsList.Name String The display name of the label.
Tanium.IntelDocLabel.LabelsList.Description String An extended description of the label.
Tanium.IntelDocLabel.LabelsList.IndicatorCount Number The number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.IntelDocLabel.LabelsList.SignalCount Number The number of Tanium Signal documents associated with this label.
Tanium.IntelDocLabel.LabelsList.CreatedAt Date The date this label was created.
Tanium.IntelDocLabel.LabelsList.UpdatedAt Date The date this label was last updated, not including the intel and signal counts.

Command Example

!tanium-tr-intel-docs-add-label intel_doc_id=509 label_id=1

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
                    "ID": 1,
                    "IndicatorCount": 0,
                    "Name": "Alpha",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Successfully created a new label (1) association for the identified intel document (509)

ID Name Description Indicator Count Signal Count Created At Updated At
1 Alpha These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z
11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z
16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-docs-remove-label

Delete a label association for the identified intel document.

Base Command

tanium-tr-intel-docs-remove-label

Input

Argument Name Description Required
intel_doc_id Remove the label from the intel document with this ID. Required
label_id The ID of the label to disassociate from the target intel document. (Use tanium-tr-intel-docs-labels-list command in order to get the available label IDs). Required

Context Output

Path Type Description
Tanium.IntelDocLabel.IntelDocID String Requested doc ID.
Tanium.IntelDocLabel.LabelsList.CreatedAt Date Date when label was created.
Tanium.IntelDocLabel.LabelsList.Description String Label description.
Tanium.IntelDocLabel.LabelsList.ID Number Label ID.
Tanium.IntelDocLabel.LabelsList.IndicatorCount Number Number of related indicators.
Tanium.IntelDocLabel.LabelsList.Name String Label name.
Tanium.IntelDocLabel.LabelsList.SignalCount Number Number of related signal counts.
Tanium.IntelDocLabel.LabelsList.UpdatedAt Date Date when label was last updated.

Command Example

!tanium-tr-intel-docs-remove-label intel_doc_id=509 label_id=1

Context Example

{
    "Tanium": {
        "IntelDocLabel": {
            "IntelDocID": "509",
            "LabelsList": [
                {
                    "CreatedAt": "2019-07-31T18:46:28.629Z",
                    "Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
                    "ID": 2,
                    "IndicatorCount": 0,
                    "Name": "Beta",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.629Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.644Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 7,
                    "IndicatorCount": 0,
                    "Name": "Defense Evasion",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.644Z"
                },
                {
                    "CreatedAt": "2019-07-31T18:46:28.660Z",
                    "Description": "MITRE ATT&CK matrix category",
                    "ID": 11,
                    "IndicatorCount": 0,
                    "Name": "Execution",
                    "SignalCount": 0,
                    "UpdatedAt": "2019-07-31T18:46:28.660Z"
                },
                {
                    "CreatedAt": "2020-01-14T21:37:30.528Z",
                    "Description": "These signals are built for Windows hosts.",
                    "ID": 16,
                    "IndicatorCount": 0,
                    "Name": "Windows",
                    "SignalCount": 0,
                    "UpdatedAt": "2020-01-14T21:37:30.528Z"
                }
            ]
        }
    }
}

Human Readable Output

Successfully removed the label (1) association for the identified intel document (509)

ID Name Description Indicator Count Signal Count Created At Updated At
2 Beta These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed. 0 0 2019-07-31T18:46:28.629Z 2019-07-31T18:46:28.629Z
7 Defense Evasion MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.644Z 2019-07-31T18:46:28.644Z
11 Execution MITRE ATT&CK matrix category 0 0 2019-07-31T18:46:28.660Z 2019-07-31T18:46:28.660Z
16 Windows These signals are built for Windows hosts. 0 0 2020-01-14T21:37:30.528Z 2020-01-14T21:37:30.528Z

tanium-tr-intel-doc-create

Add a new intel document to the system by providing its document contents.

Base Command

tanium-tr-intel-doc-create

Input

Argument Name Description Required
entry_id The file entry ID. Required
file_extension The suffix at the end of a filename. (Available file types - yara, stix, ioc). Possible values are: ioc, yara, stix. Required

Context Output

Path Type Description
Tanium.IntelDoc.AlertCount Number The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt Date The date at which this intel was first added to the system.
Tanium.IntelDoc.Description String The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID Number The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds Number The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name String The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount Number The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt Date The date when this intel was last updated.
Tanium.IntelDoc.revisionId Number The number of times the contents of the intel with this ID have been updated.
Tanium.IntelDoc.Type String The shortened type name of the intel. For example, “openioc”, “stix”, “yara”.
Tanium.IntelDoc.typeVersion String The version number of the intel type. For example, “1.0”, “2.3”, etc.
Tanium.IntelDoc.intrinsicId String The unique identifier claimed by the intel document, such as a guid or other built-in ID.
Tanium.IntelDoc.Md5 String The hex digest of the MD5 sum of the contents of the document that represents this intel.
Tanium.IntelDoc.Size String The size of the intel document contents, in bytes.

Command Example

!tanium-tr-intel-doc-create entry_id=7173@e99f97d1-7225-4c75-896c-3c960febbe8c file_extension=yara

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "CreatedAt": "2021-07-18T10:27:41.742Z",
            "ID": 438,
            "IntrinsicId": "file.yara",
            "IsSchemaValid": true,
            "Md5": "2bfe1da12a94fa4be3e9bcf6f59d024a",
            "Name": "file.yara",
            "RevisionId": 22,
            "Size": 3271,
            "SourceId": 1,
            "Type": "yara",
            "TypeVersion": "3",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-10-07T12:23:35.947Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Alert Count Unresolved Alert Count Created At Updated At
438 file.yara yara 0 0 2021-07-18T10:27:41.742Z 2021-10-24T09:00:52.609Z

tanium-tr-intel-doc-update

Update the contents of an existing intel document by providing the document contents.

Base Command

tanium-tr-intel-doc-update

Input

Argument Name Description Required
intel_doc_id The ID of the intel document to update. Required
entry_id The file entry ID. Required
file_extension The suffix at the end of a filename. (Available file types - yara, stix, ioc). Possible values are: ioc, yara, stix. Optional

Context Output

Path Type Description
Tanium.IntelDoc.AlertCount Number The number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAt Date The date at which this intel was first added to the system.
Tanium.IntelDoc.Description String The description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.ID Number The unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIds Number The IDs of all labels applied to this intel.
Tanium.IntelDoc.Name String The name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCount Number The number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAt Date The date when this intel was last updated.
Tanium.IntelDoc.revisionId Number The number of times the contents of the intel with this ID have been updated.
Tanium.IntelDoc.Type String The shortened type name of the intel. For example, “openioc”, “stix”, “yara”.
Tanium.IntelDoc.typeVersion String The version number of the intel type. For example, “1.0”, “2.3”, etc.
Tanium.IntelDoc.intrinsicId String The unique identifier claimed by the intel document, such as a guid or other built-in ID.
Tanium.IntelDoc.Md5 String The hex digest of the MD5 sum of the contents of the document that represents this intel.
Tanium.IntelDoc.Size String The size of the intel document contents, in bytes.

Command Example

!tanium-tr-intel-doc-update entry_id=7173@e99f97d1-7225-4c75-896c-3c960febbe8c intel_doc_id=438 file_extension=yara

Context Example

{
    "Tanium": {
        "IntelDoc": {
            "AlertCount": 0,
            "CreatedAt": "2021-07-18T10:27:41.742Z",
            "ID": 438,
            "IntrinsicId": "file.yara",
            "IsSchemaValid": true,
            "Md5": "2bfe1da12a94fa4be3e9bcf6f59d024a",
            "Name": "file.yara",
            "RevisionId": 23,
            "Size": 3271,
            "SourceId": 1,
            "Type": "yara",
            "TypeVersion": "3",
            "UnresolvedAlertCount": 0,
            "UpdatedAt": "2021-10-07T12:23:39.573Z"
        }
    }
}

Human Readable Output

Intel Doc information

ID Name Type Alert Count Unresolved Alert Count Created At Updated At
438 file.yara yara 0 0 2021-07-18T10:27:41.742Z 2021-10-07T12:23:39.573Z

tanium-tr-intel-doc-delete

Remove an intel document from the system by providing its ID

Base Command

tanium-tr-intel-doc-delete

Input

Argument Name Description Required
intel_doc_id The file entry ID. Required

Context Output

None

Command Example

!tanium-tr-intel-doc-delete intel_doc_id=509

Context Example

None

Human Readable Output

Intel Doc deleted

tanium-tr-start-quick-scan

Scan a computer group for hashes in intel document. Computer groups
can be viewed by navigating to Administration -> Computer Groups in the Threat-Response
product console. Computer group names and IDs can also be retrieved by using
the tn-list-groups command in the Tanium integration.

Base Command

tanium-tr-start-quick-scan

Input

Argument Name Description Required
intel_doc_id The intel document ID. Required
computer_group_name The name of a Tanium computer group. See command description for possible ways to retrieve this value. Required

Context Output

Path Type Description
Tanium.QuickScan.IntelDocId Number The unique identifier for this intel in this instance of the system.
Tanium.QuickScan.ComputerGroupId Number The ID of a Tanium computer group.
Tanium.QuickScan.ID Number The ID of the quick scan.
Tanium.QuickScan.AlertCount Number The number of alerts returned from the quick scan.
Tanium.QuickScan.CreatedAt Date The date the quick scan was created.
Tanium.QuickScan.UserId Number The user ID which initiated the quick scan.
Tanium.QuickScan.QuestionId Number The ID of the quick scan question.

Command Example

!tanium-tr-start-quick-scan intel_doc_id=509 computer_group_name="All Computers"

Context Example

{
    "Tanium": {
        "QuickScan": {
            "AlertCount": 0,
            "ComputerGroupId": 1,
            "CreatedAt": "2022-01-05T19:53:43.049Z",
            "ID": 1000239,
            "IntelDocId": 509,
            "QuestionId": 2025697,
            "UserId": 64
        }
    }
}

Human Readable Output

Quick Scan started

AlertCount ComputerGroupId CreatedAt ID IntelDocId QuestionId UserId
0 1 2022-01-05T19:53:43.049Z 1000239 509 2025697 64

tanium-tr-intel-deploy

Deploys intel using the service account context.

Base Command

tanium-tr-intel-deploy

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

>Successfully deployed intel.

### tanium-tr-intel-deploy-status

***
Displays status of last intel deployment.

#### Base Command

`tanium-tr-intel-deploy-status`

#### Input

There are no input arguments for this command.

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Tanium.IntelDeployStatus.CreatedAt | Date | The creation date of the last intel deployment. |
| Tanium.IntelDeployStatus.ModifiedAt | Date | The modification date of the last intel deployment. |
| Tanium.IntelDeployStatus.CurrentRevision | Number | Revision number, incremented each time the intel is modified |
| Tanium.IntelDeployStatus.CurrentSize | Number | The size of the intel document contents, in bytes. |

#### Command Example

```!tanium-tr-intel-deploy-status```

#### Context Example

```json
{
    "Tanium": {
        "IntelDeployStatus": {
            "CreatedAt": "2021-05-02T19:18:00.685Z",
            "CurrentRevision": 855,
            "CurrentSize": 1187840,
            "ModifiedAt": "2021-10-06T15:07:43.248Z"
        }
    }
}

Human Readable Output

Intel deploy status

Created At Modified At Current Revision Current Size
2021-05-02T19:18:00.685Z 2021-10-06T15:07:43.248Z 855 1187840

tanium-tr-get-task-by-id

Get task by ID.

Base Command

tanium-tr-get-task-by-id

Input

Argument Name Description Required
task_id The task ID. Required

Context Output

Path Type Description
Tanium.Task.createdAt Date The date at which this task was first added to the system.
Tanium.Task.id Number The unique identifier for this task in this instance of the system.
Tanium.Task.updatedAt Date The date when this task was last updated.
Tanium.Task.startTime Date The date when this task started.
Tanium.Task.endTime Date The date when this task ended.
Tanium.Task.error String Task errors.
Tanium.Task.status String Task status.
Tanium.Task.type String Task type.
Tanium.Task.metadata Unknown Task metadata.
Tanium.Task.results Unknown Task results.

Command Example

!tanium-tr-get-task-by-id task_id=833

Context Example

{
    "Tanium": {
        "Task": {
            "createdAt": "2021-09-05T13:46:16.603Z",
            "endTime": "2021-09-05T13:46:16.900Z",
            "id": 833,
            "metadata": {
                "compress": "true",
                "connection": "remote:hostname:123:",
                "paths": [
                    "C:\\test.exe"
                ]
            },
            "results": {
                "completed": [
                    "C:\\test.exe"
                ],
                "failed": [],
                "fileResults": [
                    {
                        "finalPath": "C:\\04828d87-a384-4a8b-a874-2438bf8b16ab.zip",
                        "response": {
                            "avgBytesPerSecond": 0,
                            "source": "C:\\test.exe",
                            "target": "C:\\temp\\36e80439-8866-4ada-9229-fb1e08f1a3f9",
                            "totalBytes": 55808,
                            "totalTimeMs": 205,
                            "transferHash": "a84417ee9d039891af43b267896db921a40838d8a17cc1be29785d031e5944d4"
                        }
                    }
                ]
            },
            "startTime": "2021-09-05T13:46:16.606Z",
            "status": "COMPLETED",
            "type": "fileDownload",
            "updatedAt": "2021-09-05T13:46:16.603Z"
        }
    }
}

Human Readable Output

Task information

Id Status
833 COMPLETED

tanium-tr-get-system-status

Get system status, to retrieve all possible connection’s client ids, hostnames, ips.

Base Command

tanium-tr-get-system-status

Input

Argument Name Description Required
limit The maximum number of entries to return. Default is 50. Optional
offset The offset number to begin listing entries. Default is 0. Optional
status Comma-seperated list of statuses to get the system-status that match only those statuses, for example status=Blocked,Leader. Optional
ip_server Comma-seperated list of ip servers to get the system-status that match only those ip servers, for example ip_server=1.1.1.1,2.2.2.2. Optional
ip_client Comma-seperated list of ip clients to get the system-status that match only those ip clients, for example ip_client=1.1.1.1,2.2.2.2. Optional
hostname Comma-seperated list of hostnames to get the system-status that match only those hostnames, for example hostname=host1,host2. Optional
port port to get the system-status that match only this port, for example port=80. Optional

Context Output

Path Type Description
Tanium.SystemStatus.clientId Number Client id to use when creating new connection.
Tanium.SystemStatus.computerId Number Computer ID.
Tanium.SystemStatus.hostName String Hostname to connect.
Tanium.SystemStatus.ipaddressClient String Client IP address.
Tanium.SystemStatus.ipaddressServer String Server IP address.
Tanium.SystemStatus.lastRegistration Date Host last registration time.
Tanium.SystemStatus.portNumber Number Connection port number.
Tanium.SystemStatus.protocolVersion Number Connection protocol version.
Tanium.SystemStatus.publicKeyValid Boolean Is public key valid.
Tanium.SystemStatus.status String Host status.

Command Example


#### Context Example

```json
{
    "Tanium": {
        "SystemStatus": [
            {
                "clientId": 11111,
                "computerId": 11111,
                "fullVersion": "7.2.314.3476",
                "hostName": "tanium",
                "ipaddressClient": "1.1.1.1",
                "ipaddressServer": "1.1.1.1",
                "lastRegistration": "2021-10-07T12:23:13Z",
                "portNumber": 17472,
                "protocolVersion": 314,
                "publicKeyValid": true,
                "receiveState": "None",
                "registeredWithTls": false,
                "sendState": "None",
                "status": "Leader"
            },
            {
                "clientId": 22222,
                "computerId": 22222,
                "fullVersion": "7.4.5.1204",
                "hostName": "hostname1",
                "ipaddressClient": "1.2.3.4",
                "ipaddressServer": "1.2.3.4",
                "lastRegistration": "2021-10-07T12:23:12Z",
                "portNumber": 17472,
                "protocolVersion": 315,
                "publicKeyValid": true,
                "receiveState": "None",
                "registeredWithTls": true,
                "sendState": "None",
                "status": "Leader"
            }
        ]
    }
}

Human Readable Output

Reporting clients

Host Name Client Id Ipaddress Client Ipaddress Server Port Number
taniumlinux 11111 1.1.1.1 1.1.1.1 17472
hostname1 222222 1.2.3.4 1.2.3.4 17472

tanium-tr-get-response-actions

Returns the Response Actions matching the specified filters

Base Command

tanium-tr-get-response-actions

Input

Argument Name Description Required
offset Offset to start getting response actions (default is ‘0’). Optional
limit Max number of response actions to return (default is ‘50’). Optional
sort_order Specify whether to sort by column in ascending or descending order (default is ‘desc’). Possible values are: asc, desc. Default is desc. Optional
partial_computer_name Filter on a partial computer name. Optional
status Filter on status. Optional
type Filter on type. Optional

Context Output

Path Type Description
Tanium.ResponseActions.id String  
Tanium.ResponseActions.type String  
Tanium.ResponseActions.status String  
Tanium.ResponseActions.computerName String  
Tanium.ResponseActions.userId String  
Tanium.ResponseActions.userName String  
Tanium.ResponseActions.results.taskIds String  
Tanium.ResponseActions.results.actionIds String  
Tanium.ResponseActions.results.snapshotName String  
Tanium.ResponseActions.results.uuid String  
Tanium.ResponseActions.expirationTime Date  
Tanium.ResponseActions.createdAt Date  
Tanium.ResponseActions.updatedAt Date  
Tanium.ResponseActions.eid String  

tanium-tr-response-action-gather-snapshot

Creates a “gatherSnapshot” Response Action for the specified host

Base Command

tanium-tr-response-action-gather-snapshot

Input

Argument Name Description Required
computer_name Target computer name. Required
expiration_time Time unit to specify how long a snapshot should persist (i.e. “7 days”, “1 month”. Default is “7 days”). Optional

Context Output

Path Type Description
Tanium.ResponseActions.type String  
Tanium.ResponseActions.computerName String  
Tanium.ResponseActions.options String  
Tanium.ResponseActions.status String  
Tanium.ResponseActions.userId String  
Tanium.ResponseActions.userName String  
Tanium.ResponseActions.results String  
Tanium.ResponseActions.expirationTime Date  
Tanium.ResponseActions.createdAt Date  
Tanium.ResponseActions.updatedAt Date  
Tanium.ResponseActions.id String  
Tanium.ResponseActions.eid String  

Breaking changes from the previous version of this integration - Tanium Threat Response v2

The following sections list the changes in this version.

Commands

The following commands were removed in this version

  • tanium-tr-list-snapshots-by-connection
  • tanium-tr-list-local-snapshots-by-connection
  • tanium-tr-get-connection-by-name
  • tanium-tr-get-parent-process-tree
  • tanium-tr-list-evidence
  • tanium-tr-get-process-timeline
  • tanium-tr-get-download-file-request-status - this command was replaced by tanium-tr-get-task-by-id.

Arguments

The following arguments were removed in this version

In the tanium-tr-get-intel-doc-by-id command:

  • intel-doc-id - this argument was replaced by intel_doc_id.

In the tanium-tr-list-alerts command:

  • computer-ip-address - this argument was replaced by computer_ip_address.
  • computer-name - this argument was replaced by computer_name.
  • scan-config-id - this argument was replaced by scan_config_id.
  • intel-doc-id - this argument was replaced by intel_doc_id.

In the tanium-tr-get-alert-by-id command:

  • alert-id - this argument was replaced by alert_id.

In the tanium-tr-alert-update-state command:

  • alert-id - this argument was replaced by alert_ids.

In the tanium-tr-create-snapshot command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-snapshot command:

  • connection-name - this argument was replaced by connection_id.
  • snapshot-id - this argument was replaced by snapshot_ids.

In the tanium-tr-delete-local-snapshot command:

  • connection-name - this argument was replaced by connection_id.
  • file-name - this argument was removed.

In the tanium-tr-create-connection command:

  • remote - this argument was removed.
  • destination-type - this argument was removed.
  • destination - this argument was removed.
  • connection-timeout - this argument was removed.
  • This command receiving new arguments: client_id, ip, platform, hostname.

In the tanium-tr-delete-connection command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-label-by-id command:

  • label-id - this argument was replaced by label_id.

In the tanium-tr-list-file-downloads command:

  • host - this argument was removed.

In the tanium-tr-get-downloaded-file command:

  • file-id - this argument was replaced by file_id.

In the tanium-tr-list-events-by-connection command:

  • connection-name - this argument was replaced by connection_id.
  • event-type - this argument was replaced by type.

In the tanium-tr-get-file-download-info command:

  • host - this argument was removed.
  • path - this argument was removed.
  • id - this argument was replaced by file_id.

In the tanium-tr-get-process-info command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-events-by-process command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-process-children command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-parent-process command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-process-tree command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-evidence-by-id command:

  • evidence-id - this argument was replaced by evidence_id.

In the tanium-tr-create-evidence command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-evidence command:

  • evidence-id - this argument was replaced by evidence_ids.

In the tanium-tr-request-file-download command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-file-download command:

  • file-id - this argument was replaced by file_id.

In the tanium-tr-list-files-in-directory command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-get-file-info command:

  • connection-name - this argument was replaced by connection_id.

In the tanium-tr-delete-file-from-endpoint command:

  • connection-name - this argument was replaced by connection_id.

The behavior of the following arguments was changed

In the tanium-tr-list-intel-docs command:

  • limit - The default value changed to ‘50’.

Outputs

The following outputs were removed in this version

In the tanium-tr-list-connections command:

  • Tanium.Connection.CreateTime - this output was removed.
  • Tanium.Connection.Name - this output was replaced by Tanium.Connection.hostname.
  • Tanium.Connection.Remote - this output was removed.
  • Tanium.Connection.State - this output was replaced by Tanium.Connection.status.
  • Tanium.Connection.Deleted - this output was removed.
  • Tanium.Connection.DestionationType - this output was removed.
  • Tanium.Connection.DST - this output was removed.
  • Tanium.Connection.OSName - this output was replaced by Tanium.Connection.platform.

In the tanium-tr-list-labels command:

  • Tanium.Label.CreatedAt - this output was replaced by Tanium.Label.createdAt.
  • Tanium.Label.Description - this output was replaced by Tanium.Label.description.
  • Tanium.Label.ID - this output was replaced by Tanium.Label.id.
  • Tanium.Label.IndicatorCount - this output was replaced by Tanium.Label.indicatorCount.
  • Tanium.Label.Name - this output was replaced by Tanium.Label.name.
  • Tanium.Label.SignalCount - this output was replaced by Tanium.Label.signalCount.
  • Tanium.Label.UpdatedAt - this output was replaced by Tanium.Label.updatedAt.

In the tanium-tr-get-label-by-id command:

  • Tanium.Label.CreatedAt - this output was replaced by Tanium.Label.createdAt.
  • Tanium.Label.Description - this output was replaced by Tanium.Label.description.
  • Tanium.Label.ID - this output was replaced by Tanium.Label.id.
  • Tanium.Label.IndicatorCount - this output was replaced by Tanium.Label.indicatorCount.
  • Tanium.Label.Name - this output was replaced by Tanium.Label.name.
  • Tanium.Label.SignalCount - this output was replaced by Tanium.Label.signalCount.
  • Tanium.Label.UpdatedAt - this output was replaced by Tanium.Label.updatedAt.

In the tanium-tr-list-file-downloads command:

  • Tanium.FileDownload.Size - this output was replaced by Tanium.FileDownload.size.
  • Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownload.path.
  • Tanium.FileDownload.Downloaded - this output was replaced by Tanium.FileDownload.downloaded.
  • Tanium.FileDownload.Host - this output was replaced by Tanium.FileDownload.hostname.
  • Tanium.FileDownload.Created - this output was replaced by Tanium.FileDownload.processCreationTime.
  • Tanium.FileDownload.Hash - this output was replaced by Tanium.FileDownload.hash.
  • Tanium.FileDownload.SPath - this output was removed.
  • Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownload.uuid.
  • Tanium.FileDownload.LastModified - this output was replaced by Tanium.FileDownload.lastModified.
  • Tanium.FileDownload.CreatedBy - this output was replaced by Tanium.FileDownload.createdBy.
  • Tanium.FileDownload.CreatedByProc - this output was replaced by Tanium.FileDownload.createdByProc.
  • Tanium.FileDownload.LastModifiedBy - this output was replaced by Tanium.FileDownload.lastModifiedBy.
  • Tanium.FileDownload.LastModifiedByProc - this output was replaced by Tanium.FileDownload.lastModifiedByProc.
  • Tanium.FileDownload.Comments - this output was removed.
  • Tanium.FileDownload.Tags - this output was removed.
  • Tanium.FileDownload.Deleted - this output was removed.

In the tanium-tr-list-events-by-connection command:

  • TaniumEvent.Domain - this output was removed.
  • TaniumEvent.File - this output was replaced by TaniumEvent.file.
  • TaniumEvent.Operation - this output was replaced by TaniumEvent.operation.
  • TaniumEvent.ProcessID - this output was replaced by TaniumEvent.pid.
  • TaniumEvent.ProcessName - this output was removed.
  • TaniumEvent.ProcessTableID - this output was replaced by TaniumEvent.processTableId.
  • TaniumEvent.Timestamp - this output was removed.
  • TaniumEvent.Username - this output was replaced by TaniumEvent.userName.
  • TaniumEvent.DestinationAddress - this output was replaced by TaniumEvent.remoteAddress.
  • TaniumEvent.DestinationPort - this output was replaced by TaniumEvent.remoteAddressPort.
  • TaniumEvent.SourceAddress - this output was replaced by TaniumEvent.localAddress.
  • TaniumEvent.SourcePort - this output was replaced by TaniumEvent.localAddressPort.
  • TaniumEvent.KeyPath - this output was replaced by TaniumEvent.keyPath.
  • TaniumEvent.ValueName - this output was replaced by TaniumEvent.valueName.
  • TaniumEvent.ExitCode - this output was replaced by TaniumEvent.exitCode.
  • TaniumEvent.ProcessCommandLine - this output was replaced by TaniumEvent.processCommandLine.
  • TaniumEvent.ProcessHash - this output was removed.
  • TaniumEvent.SID - this output was removed.
  • TaniumEvent.Hashes - this output was replaced by TaniumEvent.hashes.
  • TaniumEvent.ImageLoaded - this output was replaced by TaniumEvent.imageLoaded.
  • TaniumEvent.Signature - this output was replaced by TaniumEvent.signature.
  • TaniumEvent.Signed - this output was replaced by TaniumEvent.signed.
  • TaniumEvent.EventID - this output was replaced by TaniumEvent.eventId.
  • TaniumEvent.EventOpcode - this output was replaced by TaniumEvent.eventOpcode.
  • TaniumEvent.EventRecordID - this output was replaced by TaniumEvent.eventRecordId.
  • TaniumEvent.EventTaskID - this output was replaced by TaniumEvent.eventTaskId.
  • TaniumEvent.Query - this output was replaced by TaniumEvent.query.
  • TaniumEvent.Response - this output was replaced by TaniumEvent.response.
  • TaniumEvent.ImagePath - this output was replaced by TaniumEvent.imagePath.
  • TaniumEvent.CreationTime - this output was replaced by TaniumEvent.createTime.
  • TaniumEvent.EndTime - this output was replaced by TaniumEvent.endTime.
  • TaniumEvent.EventTaskName - this output was replaced by TaniumEvent.eventTaskName.
  • TaniumEvent.Property.Name - this output was removed.
  • TaniumEvent.Property.Value - this output was removed.

In the tanium-tr-get-file-download-info command:

  • Tanium.FileDownload.Size - this output was replaced by Tanium.FileDownload.size.
  • Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownload.path.
  • Tanium.FileDownload.Downloaded - this output was replaced by Tanium.FileDownload.downloaded.
  • Tanium.FileDownload.Host - this output was replaced by Tanium.FileDownload.hostname.
  • Tanium.FileDownload.Created - this output was replaced by Tanium.FileDownload.processCreationTime.
  • Tanium.FileDownload.Hash - this output was replaced by Tanium.FileDownload.hash.
  • Tanium.FileDownload.SPath - this output was removed.
  • Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownload.uuid.
  • Tanium.FileDownload.LastModified - this output was replaced by Tanium.FileDownload.lastModified.
  • Tanium.FileDownload.CreatedBy - this output was replaced by Tanium.FileDownload.createdBy.
  • Tanium.FileDownload.CreatedByProc - this output was replaced by Tanium.FileDownload.createdByProc.
  • Tanium.FileDownload.LastModifiedBy - this output was replaced by Tanium.FileDownload.lastModifiedBy.
  • Tanium.FileDownload.LastModifiedByProc - this output was replaced by Tanium.FileDownload.lastModifiedByProc.
  • Tanium.FileDownload.Comments - this output was removed.
  • Tanium.FileDownload.Tags - this output was removed.
  • Tanium.FileDownload.Deleted - this output was removed.

In the tanium-tr-get-process-info command:

  • Tanium.Process.CreateTime - this output was replaced by Tanium.ProcessInfo.createTime.
  • Tanium.Process.Domain - this output was removed.
  • Tanium.Process.ExitCode - this output was replaced by Tanium.ProcessInfo.exitCode.
  • Tanium.Process.ProcessCommandLine - this output was removed.
  • Tanium.Process.ProcessID - this output was replaced by Tanium.ProcessInfo.pid.
  • Tanium.Process.ProcessName - this output was removed.
  • Tanium.Process.ProcessTableId - this output was replaced by Tanium.ProcessInfo.processTableId.
  • Tanium.Process.SID - this output was removed
  • Tanium.Process.Username - this output was replaced by Tanium.ProcessInfo.userName.

In the tanium-tr-get-events-by-process command:

  • Tanium.ProcessEvent.ID - this output was replaced by Tanium.ProcessEvent.id.
  • Tanium.ProcessEvent.Detail - this output was replaced by Tanium.ProcessEvent.detail.
  • Tanium.ProcessEvent.Operation - this output was replaced by Tanium.ProcessEvent.operation.
  • Tanium.ProcessEvent.Timestamp - this output was replaced by Tanium.ProcessEvent.timestamp.
  • Tanium.ProcessEvent.Type - this output was replaced by Tanium.ProcessEvent.type.

In the tanium-tr-get-process-children command:

  • Tanium.ProcessChildren.ID - this output was replaced by Tanium.ProcessChildren.id.
  • Tanium.ProcessChildren.Name - this output was removed.
  • Tanium.ProcessChildren.PID - this output was replaced by Tanium.ProcessChildren.pid.
  • Tanium.ProcessChildren.PTID - this output was replaced by Tanium.ProcessChildren.parentProcessTableId.
  • Tanium.ProcessChildren.Parent - this output was removed.

In the tanium-tr-get-parent-process command:

  • Tanium.Process.CreateTime - this output was replaced by Tanium.ProcessParent.createTime.
  • Tanium.Process.Domain - this output was removed.
  • Tanium.Process.ExitCode - this output was replaced by Tanium.ProcessParent.exitCode.
  • Tanium.Process.ProcessCommandLine - this output was removed.
  • Tanium.Process.ProcessID - this output was replaced by Tanium.ProcessParent.pid.
  • Tanium.Process.ProcessName - this output was removed.
  • Tanium.Process.ProcessTableId - this output was replaced by Tanium.ProcessParent.processTableId.
  • Tanium.Process.SID - this output was removed.
  • Tanium.Process.Username - this output was replaced by Tanium.ProcessParent.userName.

In the tanium-tr-get-process-tree command:

  • Tanium.ProcessTree.ID - this output was replaced by Tanium.ProcessTree.id.
  • Tanium.ProcessTree.Name - this output was removed.
  • Tanium.ProcessTree.PID - this output was replaced by Tanium.ProcessTree.pid.
  • Tanium.ProcessTree.PTID - this output was replaced by Tanium.ProcessTree.parentProcessTableId.
  • Tanium.ProcessTree.Parent - this output was removed.
  • Tanium.ProcessTree.Children - this output was replaced by Tanium.ProcessTree.childrenCount.

In the tanium-tr-get-evidence-by-id command:

  • Tanium.Evidence.ID - this output was replaced by Tanium.Evidence.uuid.
  • Tanium.Evidence.CreatedAt - this output was replaced by Tanium.Evidence.createTime.
  • Tanium.Evidence.LastModified - this output was removed.
  • Tanium.Evidence.User - this output was replaced by Tanium.Evidence.username.
  • Tanium.Evidence.ConnectionName - this output was replaced by Tanium.Evidence.hostname.
  • Tanium.Evidence.Type - this output was replaced by Tanium.Evidence.type.
  • Tanium.Evidence.ProcessTableId - this output was removed.
  • Tanium.Evidence.Timestamp - this output was replaced by Tanium.Evidence.timestamp.
  • Tanium.Evidence.Summary - this output was replaced by Tanium.Evidence.summary.
  • Tanium.Evidence.Comments - this output was removed.
  • Tanium.Evidence.Tags - this output was removed.
  • Tanium.Evidence.Deleted - this output was removed.

In the tanium-tr-request-file-download command:

  • Tanium.FileDownload.Path - this output was replaced by Tanium.FileDownloadTask.paths.
  • Tanium.FileDownload.ConnectionName - this output was replaced by Tanium.FileDownloadTask.connection.
  • Tanium.FileDownload.Downloaded - this output was removed.
  • Tanium.FileDownload.Status - this output was replaced by Tanium.FileDownloadTask.status.
  • Tanium.FileDownload.ID - this output was replaced by Tanium.FileDownloadTask.taskId.

In the tanium-tr-list-files-in-directory command:

  • Tanium.File.Created - this output was replaced by Tanium.File.createdDate.
  • Tanium.File.Size - this output was replaced by Tanium.File.size.
  • Tanium.File.IsDirectory - this output was replaced by Tanium.File.type.
  • Tanium.File.LastModified - this output was replaced by Tanium.File.modifiedDate.
  • Tanium.File.Path - this output was replaced by Tanium.File.path.
  • Tanium.File.Permissions - this output was replaced by Tanium.File.permissions.
  • Tanium.File.ConnectionName - this output was replaced by Tanium.File.connectionId.
  • Tanium.File.Deleted - this output was removed.

In the tanium-tr-get-file-info command:

  • Tanium.File.Created - this output was replaced by Tanium.File.createdDate.
  • Tanium.File.Size - this output was replaced by Tanium.File.size.
  • Tanium.File.IsDirectory - this output was replaced by Tanium.File.type.
  • Tanium.File.LastModified - this output was replaced by Tanium.File.modifiedDate.
  • Tanium.File.Path - this output was replaced by Tanium.File.path.
  • Tanium.File.ConnectionName - this output was replaced by Tanium.File.connectionId.
  • Tanium.File.Deleted - this output was removed.

Configuration parameters

  • url — Hostname, IP address, or server URL (required)
  • credentials — Username
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Maximum number of incidents to fetch each time
  • filter_alerts_by_state — Alert states to filter by in fetch incidents command. Empty list won't filter the incidents by state.
  • filter_by_label_name — Label name to filter by in fetch incidents command. Leave empty to not filter the incidents by label name.
  • api_version — API Version
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval

Commands (47)

  • tanium-tr-alert-update-state

    Updates the state of the specified alerts.

  • tanium-tr-close-connection

    Closes a connection by connection ID.

  • tanium-tr-create-connection

    Creates a local or remote connection.

  • tanium-tr-create-evidence

    Creates event evidence from process.

  • tanium-tr-create-snapshot

    Captures a new snapshot by connection ID.

  • tanium-tr-delete-connection

    Deletes a connection by connection ID.

  • tanium-tr-delete-evidence

    Deletes event evidences from Tanium.

  • tanium-tr-delete-file-download

    Deletes a file download.

  • tanium-tr-delete-file-from-endpoint

    Deletes a file from the given endpoint.

  • tanium-tr-delete-local-snapshot

    Deletes a local snapshot by connection ID.

  • tanium-tr-delete-snapshot

    Deletes a snapshot by connection name and snapshot ID.

  • tanium-tr-event-evidence-get-properties

    Returns event evidence properties for IOC generation.

  • tanium-tr-event-evidence-list

    Returns a list of all available event evidences in the system.

  • tanium-tr-get-alert-by-id

    Returns an alert object based on alert ID.

  • tanium-tr-get-downloaded-file

    Gets the actual content of a downloaded file by file ID. Downloaded file password: `infected`.

  • tanium-tr-get-events-by-process

    Gets the events for a process.

  • tanium-tr-get-evidence-by-id

    Gets event evidence by evidence ID.

  • tanium-tr-get-file-download-info

    Gets the metadata of a file download.

  • tanium-tr-get-file-info

    Gets information about a file from a remote connection.

  • tanium-tr-get-intel-doc-by-id

    Returns an intel document object based on ID.

  • tanium-tr-get-label-by-id

    Returns a label object based on label ID.

  • tanium-tr-get-parent-process

    Gets information for the parent process.

  • tanium-tr-get-process-children

    Gets the children of this process instance.

  • tanium-tr-get-process-info

    Get information for a process.

  • tanium-tr-get-process-tree

    Gets the process tree for the process instance.

  • tanium-tr-get-response-actions

    Returns the Response Actions matching the specified filters.

  • tanium-tr-get-system-status

    Gets system status, including connections, client IDs, hostnames, and IPs.

  • tanium-tr-get-task-by-id

    Get task by ID.

  • tanium-tr-intel-deploy

    Deploys intel using the service account context.

  • tanium-tr-intel-deploy-status

    Displays status of last intel deployment.

  • tanium-tr-intel-doc-create

    Add a new intel document to the system by providing its document contents.

  • tanium-tr-intel-doc-delete

    Remove an intel document from the system by providing its ID.

  • tanium-tr-intel-doc-update

    Update the contents of an existing intel document by providing the document contents.

  • tanium-tr-intel-docs-add-label

    Create a new label association for the identified intel document.

  • tanium-tr-intel-docs-labels-list

    List all labels for the identified intel document.

  • tanium-tr-intel-docs-remove-label

    Delete a label association for the identified intel document.

  • tanium-tr-list-alerts

    Returns a comma-separated list of all alerts.

  • tanium-tr-list-connections

    Returns a list of all connections.

  • tanium-tr-list-events-by-connection

    Queries events for a connection.

  • tanium-tr-list-file-downloads

    Returns all downloaded files in the system.

  • tanium-tr-list-files-in-directory

    Gets a list of files in the given directory.

  • tanium-tr-list-intel-docs

    Returns a comma-separated list of all intel documents.

  • tanium-tr-list-labels

    Returns all available labels in the system.

  • tanium-tr-list-snapshots

    Returns all local snapshots of a single connection.

  • tanium-tr-request-file-download

    Requests a new file download.

  • tanium-tr-response-action-gather-snapshot

    Creates a "gatherSnapshot" Response Action for the specified host.

  • tanium-tr-start-quick-scan

    Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.

Source

TaniumThreatResponseV2.py TaniumThreatResponseV2_test.py TaniumThreatResponseV2.yml TaniumThreatResponseV2_description.md command_examples.txt
Download History Raw 
import json
from datetime import datetime

import pytest
from dateparser import parse

import TaniumThreatResponseV2


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def mock_client():
    client = TaniumThreatResponseV2.Client(base_url=BASE_URL, password="TEST", username="TEST", api_version="4.x")
    return client


BASE_URL = "https://test.com"
MOCK_CLIENT = mock_client()

FILTER_FILE_DOWNLOADS_ARGS = [
    ({"offset": "0", "limit": "50", "hostname": "host1"}, 3),
    ({"offset": "0", "limit": "50", "hostname": "host2"}, 2),
    ({"offset": "0", "limit": "50", "hostname": "host3"}, 2),
    ({"offset": "0", "limit": "50", "hostname": "host2,host3"}, 4),
    (
        {
            "offset": "0",
            "limit": "50",
            "hash": "123",
        },
        2,
    ),
    (
        {
            "offset": "0",
            "limit": "50",
            "hash": "123,1234",
        },
        3,
    ),
]

FILTER_CONNECTIONS_LIST_ARGS = [
    ({"offset": "0", "limit": "50", "hostname": "host1"}, 3),
    ({"offset": "0", "limit": "50", "hostname": "host2"}, 2),
    ({"offset": "0", "limit": "50", "hostname": "host3"}, 2),
    ({"offset": "0", "limit": "50", "hostname": "host1,host2"}, 5),
    ({"offset": "0", "limit": "50", "platform": "Linux"}, 3),
    ({"offset": "0", "limit": "50", "platform": "Windows"}, 4),
    ({"offset": "0", "limit": "50", "status": "connected"}, 2),
    ({"offset": "0", "limit": "50", "status": "disconnected"}, 5),
    ({"offset": "0", "limit": "50", "ip": "3.3.3.3"}, 4),
    (
        {
            "offset": "0",
            "limit": "50",
            "ip": "3.3.3.3",
            "hostname": "host2",
        },
        6,
    ),
]

FILTER_EVIDENCE_LIST_ARGS = [
    ({"offset": "0", "limit": "50", "hostname": "host1,host2"}, 6),
    ({"offset": "0", "limit": "50", "hostname": "host1"}, 3),
    ({"offset": "0", "limit": "50", "hostname": "host2"}, 3),
    ({"offset": "0", "limit": "50", "hostname": "host3"}, 2),
    (
        {
            "offset": "0",
            "limit": "50",
            "hostname": "host1,host3",
            "type": "event",
        },
        5,
    ),
]

FILTER_GET_SYSTEM_STATUS_ARGS = [
    ({"offset": "0", "limit": "50", "status": "Leader"}, 2),
    ({"offset": "0", "limit": "50", "status": "Normal"}, 1),
    (
        {
            "offset": "0",
            "limit": "50",
            "status": "Normal",
            "hostname": "host1",
        },
        3,
    ),
    (
        {
            "offset": "0",
            "limit": "50",
            "hostname": "host1",
            "ip_client": "3.3.3.3",
        },
        4,
    ),
    (
        {
            "offset": "0",
            "limit": "50",
            "hostname": "host3",
            "ip_server": "1.1.1.1",
        },
        2,
    ),
    ({"offset": "0", "limit": "50", "hostname": "host1,host2,host4"}, 4),
    ({"offset": "0", "limit": "50", "port": "8080"}, 2),
]

""" GENERAL HELPER FUNCTIONS TESTS"""


@pytest.mark.parametrize("test_input, expected_output", [("2", 2), (None, None), (2, 2), ("", None)])
def test_convert_to_int(test_input, expected_output):
    """
    Given -
        An object to convert to int.

    When -
        Running convert_to_int function.

    Then -
        If the object can be converted to int, the function returns the int, otherwise returns None.
    """

    res = TaniumThreatResponseV2.convert_to_int(test_input)
    assert res == expected_output


@pytest.mark.parametrize(
    "test_input, expected_output",
    [
        ({"testingFunctionFirst": 1, "testingFunctionSecond": 2}, {"TestingFunctionFirst": 1, "TestingFunctionSecond": 2}),
        (
            [{"testingFunctionFirst": 1}, {"testingFunctionSecond": 2}],
            [{"TestingFunctionFirst": 1}, {"TestingFunctionSecond": 2}],
        ),
    ],
)
def test_format_context_data(test_input, expected_output):
    """
    Given -
        A dict or a list of dicts to format to standard context.

    When -
        Running format_context_data function.
        Running format_context_data function.

    Then -
        A formatted dict should be returned.
    """

    assert TaniumThreatResponseV2.format_context_data(test_input) == expected_output


""" INTEL DOCS FUNCTIONS TESTS"""


def test_get_intel_doc(requests_mock):
    """
    Given -
        A specific intel doc id.

    When -
        Running get_intel_doc function.

    Then -
        The intel doc details should be returned.
    """

    api_expected_response = util_load_json("test_data/get_intel_doc_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/423", json=api_expected_response)
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intels/423", json={"data": api_expected_response})
    human_readable, outputs, raw_response = TaniumThreatResponseV2.get_intel_doc(MOCK_CLIENT, {"intel_doc_id": "423"})
    assert "| 423 | get_doc_test |" in human_readable
    assert outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", {}).get("Name") == "get_doc_test"
    assert outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", {}).get("ID") == 423


def test_get_intel_docs_single(requests_mock):
    """
    Given -
        A specific intel name to obtain.

    When -
        Running get_intel_docs function.

    Then -
        This intel doc details should be returned.
    """

    api_expected_response = util_load_json("test_data/get_intel_docs_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/?name=test2", json=api_expected_response[1])
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/intels/?name=test2", json={"data": api_expected_response[1]}
    )

    human_readable, outputs, raw_response = TaniumThreatResponseV2.get_intel_docs(MOCK_CLIENT, {"name": "test2"})
    assert "| 430 | test2 |" in human_readable
    intel_docs = outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", [])
    assert intel_docs.get("Name") == "test2"
    assert intel_docs.get("ID") == 430


def test_get_intel_docs_multiple(requests_mock):
    """
    Given -
        Some data args to filter.

    When -
        Running get_intel_docs function.

    Then -
        A list of all intel docs with their details should be returned.
    """

    api_expected_response = util_load_json("test_data/get_intel_docs_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/", json=api_expected_response)
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intels/", json={"data": api_expected_response})

    human_readable, outputs, raw_response = TaniumThreatResponseV2.get_intel_docs(MOCK_CLIENT, {})
    intel_docs = outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", [])
    assert len(intel_docs) == 3


def test_get_intel_docs_labels_list(requests_mock):
    """
    Given -
        A specific intel-doc ID.

    When -
        Running get_intel_docs_labels_list function.

    Then -
        A list of label IDs of this specific intel-doc.
    """

    intel_doc_id = 423
    api_expected_response = util_load_json("test_data/get_intel_docs_labels_list_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + f"/plugin/products/detect3/api/v1/intels/{intel_doc_id}/labels", json=api_expected_response)
    requests_mock.get(
        BASE_URL + f"/plugin/products/threat-response/api/v1/intels/{intel_doc_id}/labels", json={"data": api_expected_response}
    )

    human_readable, outputs, raw_response = TaniumThreatResponseV2.get_intel_docs_labels_list(
        MOCK_CLIENT, {"intel_doc_id": intel_doc_id}
    )
    assert "| 8 | test3 |" in human_readable
    assert "| 9 | test4 |" in human_readable
    intel_docs = outputs.get("Tanium.IntelDocLabel(val.IntelDocID && val.IntelDocID === obj.IntelDocID)", {})
    assert intel_docs.get("IntelDocID") == 423
    labels = intel_docs.get("LabelsList")
    assert len(labels) == 5
    assert labels[1].get("Name") == "test2"
    assert labels[3].get("ID") == 9


def test_add_intel_docs_label(requests_mock):
    """
    Given -
        A specific intel-doc ID.
        A specific label ID.

    When -
        Running add_intel_docs_label function.

    Then -
        A list of label IDs of this specific intel-doc with the label ID added.
    """

    intel_doc_id = 423
    label_id = 3
    api_expected_response = util_load_json("test_data/add_intel_docs_labels_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    req = requests_mock.put(
        BASE_URL + f"/plugin/products/detect3/api/v1/intels/{intel_doc_id}/labels", json=api_expected_response
    )
    req_4 = requests_mock.put(
        BASE_URL + f"/plugin/products/threat-response/api/v1/intels/{intel_doc_id}/labels", json={"data": api_expected_response}
    )

    human_readable, outputs, raw_response = TaniumThreatResponseV2.add_intel_docs_label(
        MOCK_CLIENT, {"intel_doc_id": intel_doc_id, "label_id": label_id}
    )
    assert "Successfully created a new label (3) association for the identified intel document (423)." in human_readable
    assert "| 3 | test6 |" in human_readable
    test_req = req if MOCK_CLIENT.api_version == "3.x" else req_4
    assert json.loads(test_req.last_request.text) == {"id": label_id}
    intel_docs = outputs.get("Tanium.IntelDocLabel(val.IntelDocID && val.IntelDocID === obj.IntelDocID)", {})
    assert intel_docs.get("IntelDocID") == 423
    labels = intel_docs.get("LabelsList")
    assert len(labels) == 6
    assert labels[1].get("Name") == "test2"
    assert labels[3].get("ID") == 9


def test_remove_intel_docs_label(requests_mock):
    """
    Given -
        A specific intel-doc ID.
        A specific label ID.

    When -
        Running remove_intel_docs_label function.

    Then -
        A list of label IDs of this specific intel-doc with the label ID removed.
    """

    intel_doc_id = 423
    label_id = 3
    api_expected_response = util_load_json("test_data/get_intel_docs_labels_list_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(
        BASE_URL + f"/plugin/products/detect3/api/v1/intels/{intel_doc_id}/labels/{label_id}", json=api_expected_response
    )

    requests_mock.delete(
        BASE_URL + f"/plugin/products/threat-response/api/v1/intels/{intel_doc_id}/labels/{label_id}",
        json={"data": api_expected_response},
    )

    human_readable, outputs, raw_response = TaniumThreatResponseV2.remove_intel_docs_label(
        MOCK_CLIENT, {"intel_doc_id": intel_doc_id, "label_id": label_id}
    )
    assert "Successfully removed the label (3)" in human_readable
    intel_docs = outputs.get("Tanium.IntelDocLabel(val.IntelDocID && val.IntelDocID === obj.IntelDocID)", {})
    labels = intel_docs.get("LabelsList")
    for item in labels:
        assert item.get("ID") != 3


def test_create_intel_doc(mocker, requests_mock):
    """
    Given -
        An ioc file content.

    When -
        Running create_intel_doc function.

    Then -
        A new intel-doc should be created with that specific file content.
    """

    with open("test_data/test.ioc") as f:
        file_content = f.read()
    entry_id = "Test"
    file_extension = "ioc"
    api_expected_response = util_load_json("test_data/create_intel_docs_raw_response.json")
    mocker.patch("TaniumThreatResponseV2.get_file_data", return_value=("test_name", "test_data/test.ioc", file_content))
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.post(BASE_URL + "/plugin/products/detect3/api/v1/intels", json=api_expected_response)
    requests_mock.post(BASE_URL + "/plugin/products/threat-response/api/v1/intels", json={"data": api_expected_response})

    human_readable, outputs, raw_response = TaniumThreatResponseV2.create_intel_doc(
        MOCK_CLIENT, {"entry_id": entry_id, "file_extension": file_extension}
    )
    assert "Intel Doc information" in human_readable
    assert outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", {}).get("Name") == "VIRUS TEST"


def test_update_intel_doc_ioc(mocker, requests_mock):
    intel_doc_id = 423
    with open("test_data/test.ioc") as f:
        file_content = f.read()
    entry_id = "Test"
    file_extension = "ioc"
    api_update_expected_response = util_load_json("test_data/update_intel_docs_raw_response.json")
    api_get_expected_response = util_load_json("test_data/get_intel_doc_raw_response.json")
    mocker.patch("TaniumThreatResponseV2.get_file_data", return_value=("test_name", "test_data/test.ioc", file_content))
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/423", json=api_get_expected_response)
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intels/423", json={"data": api_get_expected_response})
    requests_mock.put(
        BASE_URL + f"/plugin/products/detect3/api/v1/intels/{str(intel_doc_id)}",
        json=api_update_expected_response,
        request_headers={"Content-Disposition": "attachment; filename=file.ioc", "Content-Type": "application/xml"},
    )
    requests_mock.put(
        BASE_URL + f"/plugin/products/threat-response/api/v1/intels/{str(intel_doc_id)}",
        json={"data": api_update_expected_response},
        request_headers={"Content-Disposition": "attachment; filename=file.ioc", "Content-Type": "application/xml"},
    )

    human_readable, outputs, raw_response = TaniumThreatResponseV2.update_intel_doc(
        MOCK_CLIENT, {"intel_doc_id": intel_doc_id, "entry_id": entry_id, "file_extension": file_extension}
    )
    assert outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", {}).get("IntrinsicId") == "test123456"
    assert outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", {}).get("RevisionId") == 2


def test_update_intel_doc_yara(mocker, requests_mock):
    intel_doc_id = 423
    with open("test_data/test.yara") as f:
        file_content = f.read()
    entry_id = "Test"
    file_extension = "yara"
    api_update_expected_response = util_load_json("test_data/update_intel_docs_raw_response.json")
    api_get_expected_response = util_load_json("test_data/get_intel_doc_raw_response.json")
    mocker.patch("TaniumThreatResponseV2.get_file_data", return_value=("test_name", "test_data/test.yara", file_content))
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/423", json=api_get_expected_response)
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intels/423", json={"data": api_get_expected_response})
    requests_mock.put(
        BASE_URL + f"/plugin/products/detect3/api/v1/intels/{str(intel_doc_id)}",
        request_headers={"Content-Disposition": "filename=test123456", "Content-Type": "application/xml"},
        json=api_update_expected_response,
    )
    requests_mock.put(
        BASE_URL + f"/plugin/products/threat-response/api/v1/intels/{str(intel_doc_id)}",
        request_headers={"Content-Disposition": "attachment; filename=test123456", "Content-Type": "application/xml"},
        json={"data": api_update_expected_response},
    )

    human_readable, outputs, raw_response = TaniumThreatResponseV2.update_intel_doc(
        MOCK_CLIENT, {"intel_doc_id": intel_doc_id, "entry_id": entry_id, "file_extension": file_extension}
    )
    assert outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", {}).get("IntrinsicId") == "test123456"
    assert outputs.get("Tanium.IntelDoc(val.ID && val.ID === obj.ID)", {}).get("RevisionId") == 2


def test_delete_intel_doc(mocker, requests_mock):
    """
    Given -
        A specific intel-doc ID.

    When -
        Running delete_intel_doc function.

    Then -
        Specified intel-doc is deleted.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(BASE_URL + "/plugin/products/detect3/api/v1/intels/?id=431", json={})
    requests_mock.delete(BASE_URL + "/plugin/products/threat-response/api/v1/intels/?id=431", json={})

    human_readable, outputs, raw_response = TaniumThreatResponseV2.delete_intel_doc(MOCK_CLIENT, {"intel_doc_id": 431})
    assert "Intel doc deleted" in human_readable
    assert isinstance(raw_response, str)


def test_start_quick_scan(mocker, requests_mock):
    """
    Given -
        A specific intel-doc ID.
        A Tanium Computer Group Name

    When -
        Running start_quick_scan function.

    Then -
        A quick scan is started.
    """

    api_get_expected_response = util_load_json("test_data/get_computer_group_name_raw_response.json")
    api_post_expected_response = util_load_json("test_data/start_quick_scan_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/api/v2/groups/by-name/All%20Computers", json=api_get_expected_response)
    requests_mock.post(BASE_URL + "/plugin/products/detect3/api/v1/quick-scans/", json=api_post_expected_response)
    requests_mock.post(
        BASE_URL + "/plugin/products/threat-response/api/v1/on-demand-scans/", json={"data": api_post_expected_response}
    )

    human_readable, outputs, raw_response = TaniumThreatResponseV2.start_quick_scan(
        MOCK_CLIENT, {"intel_doc_id": 431, "computer_group_name": "All Computers"}
    )
    assert "Quick Scan started" in human_readable
    assert outputs.get("Tanium.QuickScan(val.ID && val.ID === obj.ID)", {}).get("IntelDocId") == 431
    assert outputs.get("Tanium.QuickScan(val.ID && val.ID === obj.ID)", {}).get("ComputerGroupId") == 1
    assert outputs.get("Tanium.QuickScan(val.ID && val.ID === obj.ID)", {}).get("ID") == 1000239
    assert outputs.get("Tanium.QuickScan(val.ID && val.ID === obj.ID)", {}).get("AlertCount") == 0
    assert outputs.get("Tanium.QuickScan(val.ID && val.ID === obj.ID)", {}).get("CreatedAt") == "2022-01-05T19:53:43.049Z"
    assert outputs.get("Tanium.QuickScan(val.ID && val.ID === obj.ID)", {}).get("UserId") == 64
    assert outputs.get("Tanium.QuickScan(val.ID && val.ID === obj.ID)", {}).get("QuestionId") == 2025697


def test_deploy_intel(requests_mock):
    """
    Given -
        We want to deploy the intels.

    When -
        Running deploy_intel function.

    Then -
        The deploy process should begin.
    """

    api_raw_response = {"data": {"taskId": 750}}
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.post(BASE_URL + "/plugin/products/threat-response/api/v1/intel/deploy", json=api_raw_response)

    human_readable, outputs, raw_response = TaniumThreatResponseV2.deploy_intel(MOCK_CLIENT, {})
    assert human_readable == "Successfully deployed intel."
    assert api_raw_response == raw_response


def test_get_deploy_status(requests_mock):
    """
    Given -
        We want to get the last deploy status.

    When -
        Running get_deploy_status function.

    Then -
        The deploy status details should be returned.
    """

    api_raw_response = {
        "data": {
            "createdAt": "2021-05-02T19:18:00.685Z",
            "modifiedAt": "2021-07-14T10:17:13.050Z",
            "currentRevision": 10,
            "currentSize": 2000,
            "pendingRevision": None,
            "pendingSize": None,
        }
    }
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intel/status", json=api_raw_response)

    human_readable, outputs, raw_response = TaniumThreatResponseV2.get_deploy_status(MOCK_CLIENT, {})
    assert "Intel deploy status" in human_readable
    assert outputs.get("Tanium.IntelDeployStatus", {}).get("CurrentRevision") == 10


def test_get_alerts(requests_mock):
    """
    Given -
        We want to get alerts list.

    When -
        Running get_alerts function.

    Then -
        The alerts list should be returned.
    """

    api_raw_response = util_load_json("test_data/get_alerts_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/alerts/", json=api_raw_response)
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/alerts/", json={"data": api_raw_response})

    human_readable, outputs, raw_response = TaniumThreatResponseV2.get_alerts(MOCK_CLIENT, {})
    assert "Alerts" in human_readable
    assert len(outputs.get("Tanium.Alert(val.ID && val.ID === obj.ID)", [])) == 2


def test_get_alert(requests_mock):
    """
    Given -
        We want to get alerts by id.

    When -
        Running get_alert function.

    Then -
        The alert should be returned.
    """

    api_raw_response = util_load_json("test_data/get_alert_raw_response.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/alerts/1", json=api_raw_response)
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/alerts/1", json={"data": api_raw_response})

    human_readable, outputs, raw_response = TaniumThreatResponseV2.get_alert(MOCK_CLIENT, {"alert_id": 1})
    assert "Alert information" in human_readable
    assert outputs.get("Tanium.Alert(val.ID && val.ID === obj.ID)", {}).get("ID") == 1


def test_alert_update_state(requests_mock):
    """
    Given -
        We want to update alert status.

    When -
        Running get_alert function.

    Then -
        The alert should be returned.
    """
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.put(BASE_URL + "/plugin/products/detect3/api/v1/alerts/", json={})
    requests_mock.put(BASE_URL + "/plugin/products/threat-response/api/v1/alerts/", json={})

    args = {"alert_ids": "1,2,test", "state": "unresolved"}
    human_readable, outputs, _ = TaniumThreatResponseV2.alert_update_state(MOCK_CLIENT, args)
    assert "Alert state updated to unresolved" in human_readable
    assert outputs == {}


def test_create_snapshot(requests_mock):
    """
    Given - connection to snapshot.


    When -
        Running create_snapshot function.

    Then -
        The Task_id should be returned.
    """

    api_raw_response = util_load_json("test_data/create_snapshot.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.post(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/snapshot", json=api_raw_response
    )

    args = {"connection_id": "remote:host:123:"}
    human_readable, outputs, _ = TaniumThreatResponseV2.create_snapshot(MOCK_CLIENT, args)
    assert "Initiated snapshot creation request for" in human_readable
    assert "Task id: 1" in human_readable
    assert (
        outputs.get("Tanium.SnapshotTask(val.taskId === obj.taskId && val.connection === obj.connection)", {}).get("taskId") == 1
    )
    assert (
        outputs.get("Tanium.SnapshotTask(val.taskId === obj.taskId && val.connection === obj.connection)", {}).get("connection")
        == "remote:host:123:"
    )


def test_delete_snapshot(requests_mock):
    """
    Given - snapshot ids to delete

    When -
        Running delete_snapshot function.

    Then -
        The human_readable should be returned.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(BASE_URL + "/plugin/products/threat-response/api/v1/snapshot", json={})

    args = {"snapshot_ids": "1,2,3"}
    human_readable, outputs, _ = TaniumThreatResponseV2.delete_snapshot(MOCK_CLIENT, args)
    assert "deleted successfully." in human_readable
    assert outputs == {}


def test_list_snapshots(requests_mock):
    """
    Given - list_snapshots command, with limit 2.

    When -
        Running list_snapshots function.

    Then -
        The 2 snapshots should be returned.
    """

    api_raw_response = util_load_json("test_data/list_snapshots.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/snapshot", json=api_raw_response)

    args = {"limit": 2, "offset": 0}
    human_readable, outputs, _ = TaniumThreatResponseV2.list_snapshots(MOCK_CLIENT, args)
    assert "Snapshots:" in human_readable
    assert outputs.get("Tanium.Snapshot(val.uuid === obj.uuid)", [{}])[0].get("uuid") == "1234567890"


def test_delete_local_snapshot(requests_mock):
    """
    Given - connection id to delete its local snapshot

    When -
        Running delete_local_snapshot function.

    Then -
        The human_readable should be returned.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:", json={})

    args = {"connection_id": "remote:host:123:"}
    human_readable, outputs, _ = TaniumThreatResponseV2.delete_local_snapshot(MOCK_CLIENT, args)
    assert " was deleted successfully." in human_readable
    assert outputs == {}


def test_get_connections(requests_mock):
    """
    Given - get_connections command and limit=2.

    When -
        Running get_connections function.

    Then -
        2 connections should be returned.
    """

    api_raw_response = util_load_json("test_data/get_connections.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/conns", json=api_raw_response)

    args = {"limit": "2", "offset": "0"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_connections(MOCK_CLIENT, args)
    assert "Connections" in human_readable
    assert outputs.get("Tanium.Connection(val.id === obj.id)", [{}])[0].get("hostname") == "hostname"
    assert len(outputs.get("Tanium.Connection(val.id === obj.id)")) == 2


@pytest.mark.parametrize("command_args, expected_output_len", FILTER_CONNECTIONS_LIST_ARGS)
def test_filter_get_connections(requests_mock, command_args, expected_output_len):
    """
    Given -
        offset, limit, hostname/platform/status/ip as filter parameters to 'get_connections' function

    When -
        Running 'get_connections' function

    Then -
        'get_connections' function will filter and return response output length the same as expected_output_len
    """
    api_raw_response = util_load_json("test_data/filter_get_connections.json")
    requests_mock.get(
        BASE_URL + "/api/v2/session/login",
        json={"data": {"session": "session-id"}},
    )
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns",
        json=api_raw_response,
    )

    _, outputs, _ = TaniumThreatResponseV2.get_connections(client=MOCK_CLIENT, command_args=command_args)
    response = outputs.get("Tanium.Connection(val.id === obj.id)", {})
    full_response_len = len(response)
    assert full_response_len == expected_output_len, f"Actual: {full_response_len}, Expected: {expected_output_len}"


def test_create_connection(requests_mock):
    """
    Given - ip, client_id, hostname to create new connection.

    When -
        Running create_connection function.

    Then -
        The connection_id should be returned.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.post(BASE_URL + "/plugin/products/threat-response/api/v1/conns/connect", content=b"remote:hostname:123:")

    args = {"ip": "1.1.1.1", "client_id": "123", "hostname": "hostname"}
    human_readable, outputs, _ = TaniumThreatResponseV2.create_connection(MOCK_CLIENT, args)
    assert "Initiated connection request to " in human_readable
    assert outputs.get("Tanium.Connection(val.id === obj.id)", {}).get("id") == "remote:hostname:123:"


def test_delete_connection(requests_mock):
    """
    Given - connection_id to delete

    When -
        Running delete_connection function.

    Then -
        The connection should be deleted without errors.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(BASE_URL + "/plugin/products/threat-response/api/v1/conns/delete/remote:host:123:", json={})

    args = {"connection_id": "remote:host:123:"}
    human_readable, outputs, _ = TaniumThreatResponseV2.delete_connection(MOCK_CLIENT, args)
    assert "Connection `remote:host:123:` deleted successfully." in human_readable
    assert outputs == {}


def test_close_connection(requests_mock):
    """
    Given - connection_id to close

    When -
        Running close_connection function.

    Then -
        The connection should be closed without errors.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(BASE_URL + "/plugin/products/threat-response/api/v1/conns/close/remote:host:123:", json={})

    args = {"connection_id": "remote:host:123:"}
    human_readable, outputs, _ = TaniumThreatResponseV2.close_connection(MOCK_CLIENT, args)
    assert "Connection `remote:host:123:` closed successfully." in human_readable
    assert outputs == {}


def test_get_events_by_connection(requests_mock):
    """
    Given -connection_id and type of events to return in this connection.

    When -
        Running get_events_by_connection function.

    Then -
        The list of events in connection should be returned.
    """

    api_raw_response = util_load_json("test_data/get_events_by_connection.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:hostname:123:/views/process/events",
        json=api_raw_response,
    )

    args = {"limit": "2", "offset": "0", "connection_id": "remote:hostname:123:", "type": "process"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_events_by_connection(MOCK_CLIENT, args)
    assert "Events for remote:hostname:123:" in human_readable
    assert outputs.get("TaniumEvent(val.id === obj.id)", [{}])[0].get("pid") == 1


def test_get_labels(requests_mock):
    """
    Given - limit 2 labels.

    When -
        Running get_labels function.

    Then -
        two labels should be returned.
    """

    api_raw_response = util_load_json("test_data/get_labels.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/labels/", json=api_raw_response)
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/labels/", json={"data": api_raw_response})

    args = {"limit": "2", "offset": "0"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_labels(MOCK_CLIENT, args)
    assert "Labels" in human_readable
    assert outputs.get("Tanium.Label(val.id === obj.id)", [{}])[0].get("id") == 1
    assert len(outputs.get("Tanium.Label(val.id === obj.id)")) == 2


def test_get_label(requests_mock):
    """
    Given - label id to get.

    When -
        Running get_label function.

    Then -
        The label info should be returned.
    """

    api_raw_response = util_load_json("test_data/get_label.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/labels/1", json=api_raw_response)
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/labels/1", json={"data": api_raw_response})

    args = {"label_id": 1}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_label(MOCK_CLIENT, args)
    assert "Label information" in human_readable
    assert outputs.get("Tanium.Label(val.id && val.id === obj.id)", {}).get("id") == 1


def test_get_events_by_process(requests_mock):
    """
    Given - connection id, process id anf type of events to get.

    When -
        Running get_events_by_process function.

    Then -
        Two pocess events related to connection id and ptid 1 should be returned.
    """

    api_raw_response = util_load_json("test_data/get_events_by_process.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/processevents/1/process?limit=2&offset=0",
        json=api_raw_response,
    )

    args = {"connection_id": "remote:host:123:", "limit": "2", "offset": "0", "ptid": "1", "type": "Process"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_events_by_process(MOCK_CLIENT, args)
    assert "Events for process 1" in human_readable
    assert outputs.get("Tanium.ProcessEvent(val.id && val.id === obj.id)", [{}])[0].get("id") == "1"


def test_get_process_info(requests_mock):
    """
    Given - connection id and ptid to get its info.

    When -
        Running get_process_info function.

    Then -
        The process info should be returned.
    """

    api_raw_response = util_load_json("test_data/get_process_info.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/processtrees/1", json=api_raw_response
    )

    args = {"connection_id": "remote:host:123:", "ptid": "1"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_process_info(MOCK_CLIENT, args)
    assert "Process information for process with PTID 1" in human_readable
    assert outputs.get("Tanium.ProcessInfo(val.id === obj.id)", [{}])[0].get("id") == "1"


def test_get_process_children(requests_mock):
    """
    Given - connection id and ptid to get its children.

    When -
        Running get_process_children function.

    Then -
        The process children should be returned.
    """

    api_raw_response = util_load_json("test_data/get_process_children.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/processtrees/1", json=api_raw_response
    )

    args = {"connection_id": "remote:host:123:", "ptid": "1"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_process_children(MOCK_CLIENT, args)
    assert "Children for process with PTID 1" in human_readable
    assert outputs.get("Tanium.ProcessChildren(val.id === obj.id)", [{}])[0].get("id") == "2"


def test_get_parent_process(requests_mock):
    """
    Given - connection id and ptid to get its parent.

    When -
        Running get_parent_process function.

    Then -
        The process parent should be returned.
    """

    api_raw_response = util_load_json("test_data/get_parent_process.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/processtrees/2", json=api_raw_response
    )

    args = {"connection_id": "remote:host:123:", "ptid": "2"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_parent_process(MOCK_CLIENT, args)
    assert "Parent process for process with PTID 2" in human_readable
    assert outputs.get("Tanium.ProcessParent(val.id === obj.id)", [{}])[0].get("id") == "1"


def test_get_process_tree(requests_mock):
    """
    Given - connection id and ptid to get its process tree.

    When -
        Running get_process_tree function.

    Then -
        The process tree should be returned.
    """

    api_raw_response = util_load_json("test_data/get_process_tree.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/processtrees/2", json=api_raw_response
    )

    args = {"connection_id": "remote:host:123:", "ptid": "2"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_process_tree(MOCK_CLIENT, args)
    assert "Process information for process with PTID 2" in human_readable
    assert outputs.get("Tanium.ProcessTree(val.id && val.id === obj.id)", [{}])[0].get("id") == "1"


def test_list_evidence(requests_mock):
    """
    Given - limit and offset for evidenced to get

    When -
        Running list_evidence function.

    Then -
        Two evidences should be returned.
    """

    api_raw_response = util_load_json("test_data/list_evidence.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/evidence", json=api_raw_response)

    args = {"limit": "2", "offset": "0"}
    human_readable, outputs, _ = TaniumThreatResponseV2.list_evidence(MOCK_CLIENT, args)
    assert "Evidence list" in human_readable
    assert outputs.get("Tanium.Evidence(val.uuid && val.uuid === obj.uuid)", [{}])[0].get("uuid") == "123abc"
    assert len(outputs.get("Tanium.Evidence(val.uuid && val.uuid === obj.uuid)")) == 2


@pytest.mark.parametrize("command_args, expected_output_len", FILTER_EVIDENCE_LIST_ARGS)
def test_filter_list_evidence(requests_mock, command_args, expected_output_len):
    """
    Given -
        offset, limit, hash/hostname as filter arguments for 'get_file_downloads_function'

    When -
        Running 'get_file_downloads' function

    Then -
        'get_file_downloads' function will filter and return response in the same length as expected_output_len.
    """
    api_raw_response = util_load_json("test_data/filter_list_evidence.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/evidence", json=api_raw_response)

    _, outputs, _ = TaniumThreatResponseV2.list_evidence(MOCK_CLIENT, command_args)
    response = outputs.get("Tanium.Evidence(val.uuid && val.uuid === obj.uuid)", {})
    assert len(response) == expected_output_len, f"Actual length: {len(response)}, Expected length: {expected_output_len}"


def test_event_evidence_get_properties(requests_mock):
    """
    Given - event_evidence_get_properties command.

    When -
        Running event_evidence_get_properties function.

    Then -
        The properties list should be returned should be returned.
    """

    api_raw_response = util_load_json("test_data/event_evidence_get_properties.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/event-evidence/properties", json=api_raw_response)

    args = {}
    human_readable, outputs, _ = TaniumThreatResponseV2.event_evidence_get_properties(MOCK_CLIENT, args)
    assert "Evidence Properties" in human_readable
    assert outputs.get("Tanium.EvidenceProperties(val.value === obj.value)", [{}])[0].get("type") == "ProcessId"


def test_get_evidence_by_id(requests_mock):
    """
    Given - evidence id to get its info.

    When -
        Running get_evidence_by_id function.

    Then -
        The evidence with given id should be returned.
    """

    api_raw_response = util_load_json("test_data/get_evidence_by_id.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/event-evidence/1", json=api_raw_response)

    args = {"evidence_id": "1"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_evidence_by_id(MOCK_CLIENT, args)
    assert "Evidence information" in human_readable
    assert outputs.get("Tanium.Evidence(val.uuid && val.uuid === obj.uuid)", {}).get("uuid") == "1"


def test_create_evidence(requests_mock):
    """
    Given - hostname, connection_id and ptid to create event evidence with this data.

    When -
        Running create_evidence function.

    Then -
        Human readable should be returned.
    """
    api_raw_response = util_load_json("test_data/create_evidence.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/views/process/events", json=api_raw_response
    )
    requests_mock.post(BASE_URL + "/plugin/products/threat-response/api/v1/event-evidence", json={})

    args = {"connection_id": "remote:host:123:", "hostname": "host", "ptid": "1"}
    human_readable, _, _ = TaniumThreatResponseV2.create_evidence(MOCK_CLIENT, args)
    assert "Evidence have been created." in human_readable


def test_delete_evidence(requests_mock):
    """
    Given - evidence_ids to delete

    When -
        Running delete_evidence? function.

    Then -
        The evidence ids should be deleted.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(BASE_URL + "/plugin/products/threat-response/api/v1/event-evidence", json={})

    args = {"evidence_ids": "1,2,3"}
    human_readable, _, _ = TaniumThreatResponseV2.delete_evidence(MOCK_CLIENT, args)
    assert "Evidence 1,2,3 has been deleted successfully." in human_readable


def test_get_file_downloads(requests_mock):
    """
    Given - get_file_downloads command

    When -
        Running get_file_downloads function.

    Then -
        The file dowloads list should be returned.
    """

    api_raw_response = util_load_json("test_data/get_file_downloads.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/filedownload", json=api_raw_response)

    args = {"limit": "2"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_file_downloads(MOCK_CLIENT, args)
    assert "File downloads" in human_readable
    assert outputs.get("Tanium.FileDownload(val.uuid === obj.uuid)", [{}])[0].get("uuid") == "1"
    assert outputs.get("Tanium.FileDownload(val.uuid === obj.uuid)", [{}])[0].get("evidenceType") == "file"


@pytest.mark.parametrize("command_args, expected_output_len", FILTER_FILE_DOWNLOADS_ARGS)
def test_filter_get_file_downloads(requests_mock, command_args, expected_output_len):
    """
    Given -
        offset, limit, hash/hostname as filter arguments for 'get_file_downloads_function'

    When -
        Running 'get_file_downloads' function

    Then -
        'get_file_downloads' function will filter and return response in the same length as expected_output_len.
    """
    api_raw_response = util_load_json("test_data/filter_get_file_downloads.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/filedownload", json=api_raw_response)

    _, outputs, _ = TaniumThreatResponseV2.get_file_downloads(MOCK_CLIENT, command_args)
    response = outputs.get("Tanium.FileDownload(val.uuid === obj.uuid)", {})
    assert len(response) == expected_output_len, f"Expected length: {expected_output_len}, actual: {len(response)}"


def test_get_file_download_info(requests_mock):
    """
    Given - file id to get its info

    When -
        Running get_file_download_info function.

    Then -
        The file download info should be returned.
    """

    api_raw_response = util_load_json("test_data/get_file_download_info.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/filedownload/1", json=api_raw_response)

    args = {"file_id": "1"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_file_download_info(MOCK_CLIENT, args)
    assert "File download" in human_readable
    assert outputs.get("Tanium.FileDownload(val.uuid === obj.uuid)", {}).get("uuid") == "1"


def test_request_file_download(requests_mock):
    """
    Given - path, connection id to request file download from there.

    When -
        Running request_file_download function.

    Then -
        The Task info should be returned.
    """

    api_raw_response = util_load_json("test_data/request_file_download.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.post(BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/file", json=api_raw_response)

    args = {"connection_id": "remote:host:123:", "path": "C:\\file.txt"}
    human_readable, outputs, _ = TaniumThreatResponseV2.request_file_download(MOCK_CLIENT, args)
    assert "Task id: 1" in human_readable
    assert (
        outputs.get("Tanium.FileDownloadTask(val.taskId === obj.taskId && val.connection === obj.connection)", {}).get("taskId")
        == 1
    )
    assert (
        outputs.get("Tanium.FileDownloadTask(val.taskId === obj.taskId && val.connection === obj.connection)", {}).get(
            "connection"
        )
        == "remote:host:123:"
    )


def test_delete_file_download(requests_mock):
    """
    Given - file id to delete

    When -
        Running delete_file_download function.

    Then -
        The file download should be deleted.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(BASE_URL + "/plugin/products/threat-response/api/v1/filedownload/1", json={})

    args = {"file_id": "1"}
    human_readable, outputs, _ = TaniumThreatResponseV2.delete_file_download(MOCK_CLIENT, args)
    assert "Delete request of file with ID 1 has been sent successfully" in human_readable


def test_list_files_in_dir(requests_mock):
    """
    Given - path in connection to get its files.

    When -
        Running list_files_in_dir function.

    Then -
        The list of files in path should be returned.
    """

    api_raw_response = util_load_json("test_data/list_files_in_dir.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/file/list/C%3A%5CDir%5C", json=api_raw_response
    )

    args = {"connection_id": "remote:host:123:", "path": "C:\\Dir\\", "limit": "2", "offset": "0"}
    human_readable, outputs, _ = TaniumThreatResponseV2.list_files_in_dir(MOCK_CLIENT, args)
    assert "Files in directory" in human_readable
    assert (
        outputs.get("Tanium.File(val.name === obj.name && val.connectionId === obj.connectionId)", [{}])[0].get("name")
        == "file1.exe"
    )
    assert (
        outputs.get("Tanium.File(val.name === obj.name && val.connectionId === obj.connectionId)", [{}])[0].get("connectionId")
        == "remote:host:123:"
    )


def test_get_file_info(requests_mock):
    """
    Given -

    When -
        Running get_file_info function.

    Then -
        The file info should be returned.
    """

    api_raw_response = util_load_json("test_data/get_file_info.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/file/info/C%3A%5Cfile1.txt",
        json=api_raw_response,
    )

    args = {"path": "C:\\file1.txt", "connection_id": "remote:host:123:"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_file_info(MOCK_CLIENT, args)
    assert "Information for file" in human_readable
    assert (
        outputs.get("Tanium.File(val.path === obj.path && val.connectionId === obj.connectionId)", {}).get("connectionId")
        == "remote:host:123:"
    )
    assert (
        outputs.get("Tanium.File(val.path === obj.path && val.connectionId === obj.connectionId)", {}).get("path")
        == "C:\\file1.txt"
    )


def test_delete_file_from_endpoint(requests_mock):
    """
    Given - connection id and path of file to delete.

    When -
        Running delete_file_from_endpoint function.

    Then -
        The file should be deleted.
    """

    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.delete(
        BASE_URL + "/plugin/products/threat-response/api/v1/conns/remote:host:123:/file/delete/C%3A%5Cfile1.txt", json={}
    )

    args = {"path": "C:\\file1.txt", "connection_id": "remote:host:123:"}
    human_readable, outputs, _ = TaniumThreatResponseV2.delete_file_from_endpoint(MOCK_CLIENT, args)
    assert "Delete request of file C:\\file1.txt" in human_readable


def test_get_task_by_id(requests_mock):
    """
    Given - task id to get its status and info

    When -
        Running get_task_by_id function.

    Then -
        The task info should be returned.
    """

    api_raw_response = util_load_json("test_data/get_task_by_id.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/tasks/1", json=api_raw_response)

    args = {"task_id": "1"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_task_by_id(MOCK_CLIENT, args)
    assert "Task information" in human_readable
    assert outputs.get("Tanium.Task(val.id === obj.id)", {}).get("id") == 1


def test_get_system_status(requests_mock):
    """
    Given - tanium system

    When -
        Running get_system_status function.

    Then -
        The connected computers should be returned.
    """

    api_raw_response = util_load_json("test_data/get_system_status.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/api/v2/system_status", json=api_raw_response)

    args = {"limit": 2, "offset": 0}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_system_status(MOCK_CLIENT, args)
    assert "Reporting clients" in human_readable
    assert outputs.get("Tanium.SystemStatus(val.clientId === obj.clientId)", {})[0].get("clientId") == 1


@pytest.mark.parametrize("command_args, expected_output_len", FILTER_GET_SYSTEM_STATUS_ARGS)
def test_filter_get_system_status(requests_mock, command_args, expected_output_len):
    """
    Given -
        offset, limit, status/hostname/ip_server/ip_client/port as filter arguments for 'get_system_status' function

    When -
        Running 'get_system_status' function

    Then -
        'get_system_status' function will filter and return response in the same length as expected_output_len.
    """
    api_raw_response = util_load_json("test_data/filter_get_system_status.json")

    requests_mock.get(
        BASE_URL + "/api/v2/session/login",
        json={"data": {"session": "session-id"}},
    )
    requests_mock.get(BASE_URL + "/api/v2/system_status", json=api_raw_response)

    _, outputs, _ = TaniumThreatResponseV2.get_system_status(MOCK_CLIENT, command_args)
    response = outputs.get("Tanium.SystemStatus(val.clientId === obj.clientId)", {})
    assert len(response) == expected_output_len, f"Actual length: {len(response)}, Expected length: {expected_output_len}"


def test_fetch_all_incidents(requests_mock):
    """
    Given
        fetch incidents command running for the first time.
    When
        mock the Client's http_request.
    Then
        validate fetch incidents command using the Client gets all 2 relevant incidents
    """

    test_incidents = util_load_json("test_data/fetch_incidents.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/detect3/api/v1/alerts?"
        "&state=unresolved&sort=-createdAt&limit=500&offset=0&labelName=some_label",
        json=test_incidents,
    )
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/alerts?"
        "&state=unresolved&sort=-createdAt&limit=500&offset=0&labelName=some_label",
        json={"data": test_incidents},
    )
    requests_mock.get(
        BASE_URL + "/plugin/products/detect3/api/v1/alerts?&state=unresolved&sort=-createdAt&limit=500&offset=500", json=[]
    )
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/alerts?state=unresolved&sort=-createdAt&limit=500&offset=500",
        json=[],
    )
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/11", json={"name": "test"})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intels/11", json={"data": {"name": "test"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/11/labels", json=[{"name": "test"}])
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intels/11/labels", json={"data": [{"name": "test"}]})

    alerts_states_to_retrieve = "unresolved"
    last_run = {}
    fetch_time = "10 years"
    max_fetch = 2
    filter_label_name = "some_label"

    incidents, next_run = TaniumThreatResponseV2.fetch_incidents(
        MOCK_CLIENT, alerts_states_to_retrieve, filter_label_name, last_run, fetch_time, max_fetch
    )

    assert len(incidents) == 2
    assert incidents[0].get("name") == "hostname found test"
    assert incidents[0].get("occurred") == "2021-09-26T14:01:31.000Z"
    assert next_run.get("id") == "2"
    assert next_run.get("time") == datetime.strftime(parse("2021-09-26T14:02:59.000Z"), TaniumThreatResponseV2.DATE_FORMAT)


def test_fetch_new_incidents(requests_mock):
    """
    Given
        fetch incidents command running for the first time.
    When
        mock the Client's http_request.
    Then
        validate fetch incidents command using the Client gets new 2 relevant incidents
    """

    test_incidents = util_load_json("test_data/fetch_incidents_new.json")
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(
        BASE_URL + "/plugin/products/detect3/api/v1/alerts?&state=unresolved&sort=-createdAt&limit=500&offset=0",
        json=test_incidents,
    )
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/alerts?state=unresolved&sort=-createdAt&limit=500&offset=0",
        json={"data": test_incidents},
    )
    requests_mock.get(
        BASE_URL + "/plugin/products/detect3/api/v1/alerts?&state=unresolved&sort=-createdAt&limit=500&offset=500", json=[]
    )
    requests_mock.get(
        BASE_URL + "/plugin/products/threat-response/api/v1/alerts?state=unresolved&sort=-createdAt&limit=500&offset=500",
        json=[],
    )
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/11", json={"name": "test"})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intels/11", json={"data": {"name": "test"}})
    requests_mock.get(BASE_URL + "/plugin/products/detect3/api/v1/intels/11/labels", json=[{"name": "test"}])
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/intels/11/labels", json={"data": [{"name": "test"}]})

    alerts_states_to_retrieve = "unresolved"
    last_run = {"time": "2021-09-26T14:02:59.000000Z", "id": "2"}
    fetch_time = "3 days"
    max_fetch = 2
    filter_label_name = ""

    incidents, next_run = TaniumThreatResponseV2.fetch_incidents(
        MOCK_CLIENT, alerts_states_to_retrieve, filter_label_name, last_run, fetch_time, max_fetch
    )

    assert len(incidents) == 2
    assert incidents[0].get("name") == "hostname found test"
    assert incidents[0].get("occurred") == "2021-09-26T14:01:31.000Z"
    assert next_run.get("id") == "4"
    assert next_run.get("time") == datetime.strftime(parse("2021-09-26T14:04:59.000Z"), TaniumThreatResponseV2.DATE_FORMAT)


def test_get_response_actions(requests_mock):
    """
    Given - Nothing

    When -
        Running get_response_actions function.

    Then -
        The response actions should be returned.
    """

    api_raw_response = {
        "data": [
            {
                "id": 10,
                "type": "downloadFile",
                "status": "COMPLETED",
                "computerName": "id1",
                "userId": 1,
                "userName": "test",
                "options": {"filePath": "C:\\Program Files (x86)\\log1.txt"},
                "results": {"taskIds": [34], "actionIds": [], "fileName": "test.zip"},
                "expirationTime": "2021-11-17T14:05:12.003Z",
                "createdAt": "2021-11-10T14:06:19.571Z",
                "updatedAt": "2021-11-10T14:06:26.249Z",
            }
        ]
    }
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.get(BASE_URL + "/plugin/products/threat-response/api/v1/response-actions", json=api_raw_response)

    args = {"limit": 2, "offset": 0, "partial_computer_name": "1", "status": "test"}
    human_readable, outputs, _ = TaniumThreatResponseV2.get_response_actions(MOCK_CLIENT, args)
    assert "Response Actions" in human_readable
    assert outputs.get("Tanium.ResponseActions(val.id === obj.id)", {})["data"][0].get("id") == 10


def test_response_action_gather_snapshot(requests_mock):
    """
    Given - Nothing

    When -
        Running get_response_actions function.

    Then -
        The response actions should be returned.
    """

    api_raw_response = {
        "data": {
            "type": "gatherSnapshot",
            "computerName": "1",
            "options": {},
            "status": "QUEUED",
            "userId": 1,
            "userName": "administrator",
            "results": {},
            "expirationTime": "2023-05-18T16:56:16.502Z",
            "createdAt": "2023-05-11T16:56:16.503Z",
            "updatedAt": "2023-05-11T16:56:16.503Z",
            "id": 11,
        }
    }
    requests_mock.post(BASE_URL + "/api/v2/session/login", json={"data": {"session": "session-id"}})
    requests_mock.post(BASE_URL + "/plugin/products/threat-response/api/v1/response-actions", json=api_raw_response)

    args = {"computer_name": 1}
    human_readable, outputs, _ = TaniumThreatResponseV2.response_action_gather_snapshot(MOCK_CLIENT, args)
    assert "Response Actions" in human_readable
    assert outputs.get("Tanium.ResponseActions(val.id === obj.id)", {})["data"].get("id") == 11
    assert outputs.get("Tanium.ResponseActions(val.id === obj.id)", {})["data"].get("type") == "gatherSnapshot"