Tanium Threat Response

Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version below 3.0.159. In order to use Tanium Threat Response version 3.0.159 and above, use Tanium Threat Response V2 Integration.

Category

Endpoint

Pack

TaniumThreatResponse

Configuration parameters

• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• url — Hostname, IP address, or server URL (required)
• credentials — Username (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• filter_alerts_by_state — A comma-separated list of alert states to filter by in fetch incidents command. Possible options are: unresolved, in progress, resolved or suppressed. Empty list won't filter the incidents by state.

Commands (39)

• tanium-tr-alert-update-state — Updates the state of a single alert.
• tanium-tr-create-connection — Creates a local or remote connection.
• tanium-tr-create-evidence — Creates an evidence.
• tanium-tr-create-snapshot — Captures a new snapshot by connection name.
• tanium-tr-delete-connection — Deletes a connection by connection name.
• tanium-tr-delete-evidence — Deletes an evidence.
• tanium-tr-delete-file-download — Deletes a file download.
• tanium-tr-delete-file-from-endpoint — Deletes a file from the given endpoint.
• tanium-tr-delete-local-snapshot — Deletes a local snapshot by connection name and file name.
• tanium-tr-delete-snapshot — Deletes a snapshot by connection name and snapshot ID.
• tanium-tr-get-alert-by-id — Returns an alert object based on alert ID.
• tanium-tr-get-connection-by-name — Returns a connection object based on connection name.
• tanium-tr-get-download-file-request-status — Gets the status of the download file request.
• tanium-tr-get-downloaded-file — Gets the actual content of a downloaded file by file ID.
• tanium-tr-get-events-by-process — Gets the events for a process.
• tanium-tr-get-evidence-by-id — Gets evidence by evidence ID.
• tanium-tr-get-file-download-info — Gets the metadata of a file download. You must supply either the `path` or `id` argument for the command to run successfully.
• tanium-tr-get-file-info — Gets information about a file from a remote connection.
• tanium-tr-get-intel-doc-by-id — Returns an intel document object based on ID.
• tanium-tr-get-label-by-id — Returns a label object based on label ID.
• tanium-tr-get-parent-process — Gets information for the parent process.
• tanium-tr-get-parent-process-tree — Gets the parent process tree for the process instance.
• tanium-tr-get-process-children — Gets the children of this process instance.
• tanium-tr-get-process-info — Get information for a process.
• tanium-tr-get-process-timeline — Gets the process timeline.
• tanium-tr-get-process-tree — Gets the process tree for the process instance.
• tanium-tr-intel-doc-create — Add a new intel document to the system by providing its document contents.
• tanium-tr-list-alerts — Returns a list of all alerts.
• tanium-tr-list-connections — Returns all connections.
• tanium-tr-list-events-by-connection — Queries events for a connection.
• tanium-tr-list-evidence — Returns a list of all available evidence in the system.
• tanium-tr-list-file-downloads — Returns all downloaded files in the system.
• tanium-tr-list-files-in-directory — Gets a list of files in the given directory.
• tanium-tr-list-intel-docs — Returns a list of all intel documents.
• tanium-tr-list-labels — Returns all available labels in the system.
• tanium-tr-list-local-snapshots-by-connection — Returns all local snapshots of a single connection.
• tanium-tr-list-snapshots-by-connection — Returns all snapshots of a single connection.
• tanium-tr-request-file-download — Requests a new file download.
• tanium-tr-start-quick-scan — Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.