Tanium Threat Response v2

Use the Tanium Threat Response integration to manage endpoint processes, evidence, alerts, files, snapshots, and connections. This integration works with Tanium Threat Response version 3.0.159 and above.

Category

Endpoint

Pack

TaniumThreatResponse

Configuration parameters

• url — Hostname, IP address, or server URL (required)
• credentials — Username
• isFetch — Fetch incidents
• incidentType — Incident type
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• max_fetch — Maximum number of incidents to fetch each time
• filter_alerts_by_state — Alert states to filter by in fetch incidents command. Empty list won't filter the incidents by state.
• filter_by_label_name — Label name to filter by in fetch incidents command. Leave empty to not filter the incidents by label name.
• api_version — API Version
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• incidentFetchInterval — Incidents Fetch Interval

Commands (47)

• tanium-tr-alert-update-state — Updates the state of the specified alerts.
• tanium-tr-close-connection — Closes a connection by connection ID.
• tanium-tr-create-connection — Creates a local or remote connection.
• tanium-tr-create-evidence — Creates event evidence from process.
• tanium-tr-create-snapshot — Captures a new snapshot by connection ID.
• tanium-tr-delete-connection — Deletes a connection by connection ID.
• tanium-tr-delete-evidence — Deletes event evidences from Tanium.
• tanium-tr-delete-file-download — Deletes a file download.
• tanium-tr-delete-file-from-endpoint — Deletes a file from the given endpoint.
• tanium-tr-delete-local-snapshot — Deletes a local snapshot by connection ID.
• tanium-tr-delete-snapshot — Deletes a snapshot by connection name and snapshot ID.
• tanium-tr-event-evidence-get-properties — Returns event evidence properties for IOC generation.
• tanium-tr-event-evidence-list — Returns a list of all available event evidences in the system.
• tanium-tr-get-alert-by-id — Returns an alert object based on alert ID.
• tanium-tr-get-downloaded-file — Gets the actual content of a downloaded file by file ID. Downloaded file password: `infected`.
• tanium-tr-get-events-by-process — Gets the events for a process.
• tanium-tr-get-evidence-by-id — Gets event evidence by evidence ID.
• tanium-tr-get-file-download-info — Gets the metadata of a file download.
• tanium-tr-get-file-info — Gets information about a file from a remote connection.
• tanium-tr-get-intel-doc-by-id — Returns an intel document object based on ID.
• tanium-tr-get-label-by-id — Returns a label object based on label ID.
• tanium-tr-get-parent-process — Gets information for the parent process.
• tanium-tr-get-process-children — Gets the children of this process instance.
• tanium-tr-get-process-info — Get information for a process.
• tanium-tr-get-process-tree — Gets the process tree for the process instance.
• tanium-tr-get-response-actions — Returns the Response Actions matching the specified filters.
• tanium-tr-get-system-status — Gets system status, including connections, client IDs, hostnames, and IPs.
• tanium-tr-get-task-by-id — Get task by ID.
• tanium-tr-intel-deploy — Deploys intel using the service account context.
• tanium-tr-intel-deploy-status — Displays status of last intel deployment.
• tanium-tr-intel-doc-create — Add a new intel document to the system by providing its document contents.
• tanium-tr-intel-doc-delete — Remove an intel document from the system by providing its ID.
• tanium-tr-intel-doc-update — Update the contents of an existing intel document by providing the document contents.
• tanium-tr-intel-docs-add-label — Create a new label association for the identified intel document.
• tanium-tr-intel-docs-labels-list — List all labels for the identified intel document.
• tanium-tr-intel-docs-remove-label — Delete a label association for the identified intel document.
• tanium-tr-list-alerts — Returns a comma-separated list of all alerts.
• tanium-tr-list-connections — Returns a list of all connections.
• tanium-tr-list-events-by-connection — Queries events for a connection.
• tanium-tr-list-file-downloads — Returns all downloaded files in the system.
• tanium-tr-list-files-in-directory — Gets a list of files in the given directory.
• tanium-tr-list-intel-docs — Returns a comma-separated list of all intel documents.
• tanium-tr-list-labels — Returns all available labels in the system.
• tanium-tr-list-snapshots — Returns all local snapshots of a single connection.
• tanium-tr-request-file-download — Requests a new file download.
• tanium-tr-response-action-gather-snapshot — Creates a "gatherSnapshot" Response Action for the specified host.
• tanium-tr-start-quick-scan — Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.