category: Endpoint
sectionorder:
- Connect
- Collect
provider: Tanium
commonfields:
  id: Tanium Threat Response
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Hostname, IP address, or server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: 24 hours
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  required: false
  section: Collect
- defaultvalue: unresolved
  display: 'A comma-separated list of alert states to filter by in fetch incidents command. Possible options are: unresolved, in progress, resolved or suppressed. Empty list won''t filter the incidents by state.'
  name: filter_alerts_by_state
  options:
  - unresolved
  - inprogress
  - resolved
  - suppressed
  type: 16
  required: false
  section: Collect
description: Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version below 3.0.159. In order to use Tanium Threat Response version 3.0.159 and above, use Tanium Threat Response V2 Integration.
display: Tanium Threat Response
name: Tanium Threat Response
script:
  commands:
  - arguments:
    - description: The intel document ID.
      name: intel-doc-id
      required: true
    description: Returns an intel document object based on ID.
    name: tanium-tr-get-intel-doc-by-id
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date at which this intel was first added to the system.
      type: Date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: Date
  - arguments:
    - defaultValue: '5'
      description: The maximum number of intel documents to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing intel documents.
      name: offset
    description: Returns a list of all intel documents.
    name: tanium-tr-list-intel-docs
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date at which this intel was first added to the system.
      type: Date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: Number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: String
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: Number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: Date
  - arguments:
    - defaultValue: '5'
      description: The maximum number of alerts to return. The default value is 5.
      name: limit
    - description: The offset number to begin listing alerts.
      name: offset
    - description: Filter alerts by the specified computer IP addresses.
      name: computer-ip-address
    - description: Filter alerts by the specified computer name.
      name: computer-name
    - description: Filter alerts by the specified scan config ID.
      name: scan-config-id
    - description: Filter alerts by the specified intel document ID.
      name: intel-doc-id
    - description: Filter alerts by the specified severity.
      name: severity
    - description: Filter alerts by the specified priority.
      name: priority
    - description: Filter alerts by the specified type.
      name: type
    - auto: PREDEFINED
      description: Filter alerts by the specified state. Can be "Unresolved", "In Progress", "Ignored", or "Resolved".
      name: state
      predefined:
      - Unresolved
      - In Progress
      - Ignored
      - Resolved
    description: Returns a list of all alerts.
    name: tanium-tr-list-alerts
    outputs:
    - contextPath: Tanium.Alert.Priority
      description: The priority of the alert.
      type: String
    - contextPath: Tanium.Alert.ComputerName
      description: The hostname of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.GUID
      description: A globally unique identifier for this alert in the customer environment.
      type: String
    - contextPath: Tanium.Alert.AlertedAt
      description: The moment that the alert was generated.
      type: Date
    - contextPath: Tanium.Alert.UpdatedAt
      description: The last time the alert state was updated.
      type: Date
    - contextPath: Tanium.Alert.State
      description: The current state of the alert. For example, "unresolved", "inprogress", and so on.
      type: String
    - contextPath: Tanium.Alert.ComputerIpAddress
      description: The IP address of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.Type
      description: The name of the alert type. For example, "detect.endpoint.match".
      type: String
    - contextPath: Tanium.Alert.ID
      description: The ID of the alert. For example, "123".
      type: Number
    - contextPath: Tanium.Alert.CreatedAt
      description: The date when the alert was received by the Detect product.
      type: Date
    - contextPath: Tanium.Alert.IntelDocId
      description: The intel document revision, if intelDocId is present.
      type: Number
    - contextPath: Tanium.Alert.Severity
      description: The severity of the alert.
      type: String
  - arguments:
    - description: The alert ID.
      name: alert-id
      required: true
    description: Returns an alert object based on alert ID.
    name: tanium-tr-get-alert-by-id
    outputs:
    - contextPath: Tanium.Alert.Priority
      description: The priority of the alert.
      type: String
    - contextPath: Tanium.Alert.ComputerName
      description: The hostname of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.GUID
      description: A globally unique identifier for this alert in the customer environment.
      type: String
    - contextPath: Tanium.Alert.AlertedAt
      description: The date when the alert was generated.
      type: Date
    - contextPath: Tanium.Alert.UpdatedAt
      description: The date when the alert state was last updated.
      type: Date
    - contextPath: Tanium.Alert.State
      description: The current state of the alert. For example, "unresolved", "inprogress".
      type: String
    - contextPath: Tanium.Alert.ComputerIpAddress
      description: The IP address of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.Type
      description: The name of the alert type. For example, "detect.endpoint.match".
      type: String
    - contextPath: Tanium.Alert.ID
      description: The ID of the alert. For example, "123".
      type: Number
    - contextPath: Tanium.Alert.CreatedAt
      description: The date when the alert was received by the Detect product.
      type: Date
    - contextPath: Tanium.Alert.IntelDocId
      description: The intel document revision, if intelDocId is present.
      type: Number
    - contextPath: Tanium.Alert.Severity
      description: The severity of the alert.
      type: String
  - arguments:
    - description: The ID of the alert to update.
      name: alert-id
      required: true
    - auto: PREDEFINED
      description: The new state for the alert. Can be "Unresolved", "In Progress", "Ignored", or "Resolved".
      name: state
      predefined:
      - Unresolved
      - In Progress
      - Ignored
      - Resolved
      required: true
    description: Updates the state of a single alert.
    name: tanium-tr-alert-update-state
    outputs:
    - contextPath: Tanium.Alert.Priority
      description: The priority of the alert.
      type: String
    - contextPath: Tanium.Alert.ComputerName
      description: The hostname of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.GUID
      description: A globally unique identifier for this alert in the customer environment.
      type: String
    - contextPath: Tanium.Alert.AlertedAt
      description: The date when the alert was generated.
      type: Date
    - contextPath: Tanium.Alert.UpdatedAt
      description: The date when the alert state was last updated.
      type: Date
    - contextPath: Tanium.Alert.State
      description: The current state of the alert. For example, "unresolved", "inprogress".
      type: String
    - contextPath: Tanium.Alert.ComputerIpAddress
      description: The IP address of the computer that generated the alert.
      type: String
    - contextPath: Tanium.Alert.Type
      description: The name of the alert type. For example, "detect.endpoint.match".
      type: String
    - contextPath: Tanium.Alert.ID
      description: The ID of the alert. For example, "123".
      type: Number
    - contextPath: Tanium.Alert.CreatedAt
      description: The date when the alert was received by the Detect product.
      type: Date
    - contextPath: Tanium.Alert.IntelDocId
      description: The intel document revision, if intelDocId is present.
      type: Number
    - contextPath: Tanium.Alert.Severity
      description: The severity of the alert.
      type: String
  - arguments:
    - defaultValue: '50'
      description: The maximum number of snapshots to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing snapshots.
      name: offset
    - description: The connection name.
      name: connection-name
      required: true
    description: Returns all snapshots of a single connection.
    name: tanium-tr-list-snapshots-by-connection
    outputs:
    - contextPath: Tanium.Snapshot.ConnectionName
      description: The snapshot connection name.
      type: String
    - contextPath: Tanium.Snapshot.Error
      description: The snapshot error message.
      type: String
    - contextPath: Tanium.Snapshot.ID
      description: The snapshot id.
      type: String
    - contextPath: Tanium.Snapshot.Started
      description: The date when the snapshot was created.
      type: Date
    - contextPath: Tanium.Snapshot.State
      description: The current state of the snapshot.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    description: Captures a new snapshot by connection name.
    name: tanium-tr-create-snapshot
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The snapshot ID.
      name: snapshot-id
      required: true
    description: Deletes a snapshot by connection name and snapshot ID.
    name: tanium-tr-delete-snapshot
    outputs:
    - contextPath: Tanium.Snapshot.ID
      description: The snapshot ID.
      type: String
    - contextPath: Tanium.Snapshot.ConnectionName
      description: The connection name.
      type: String
    - contextPath: Tanium.Snapshot.Deleted
      description: Whether the snapshot has been deleted.
      type: Boolean
  - arguments:
    - defaultValue: '50'
      description: The maximum number of local snapshots to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing local snapshots.
      name: offset
    - description: The connection name.
      name: connection-name
      required: true
    description: Returns all local snapshots of a single connection.
    name: tanium-tr-list-local-snapshots-by-connection
    outputs:
    - contextPath: Tanium.LocalSnapshot.ConnectionName
      description: The snapshot connection name.
      type: String
    - contextPath: Tanium.LocalSnapshot.FileName
      description: The snapshot file name.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The file name.
      name: file-name
      required: true
    description: Deletes a local snapshot by connection name and file name.
    name: tanium-tr-delete-local-snapshot
    outputs:
    - contextPath: Tanium.LocalSnapshot.FileName
      description: The snapshot file name.
      type: String
    - contextPath: Tanium.LocalSnapshot.Deleted
      description: Whether the local snapshot has been deleted.
      type: Boolean
  - arguments:
    - defaultValue: '50'
      description: The maximum number of connections to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing connections.
      name: offset
    description: Returns all connections.
    name: tanium-tr-list-connections
    outputs:
    - contextPath: Tanium.Connection.CreateTime
      description: Time when the connection was first created.
      type: Date
    - contextPath: Tanium.Connection.Name
      description: The connection name.
      type: String
    - contextPath: Tanium.Connection.Remote
      description: Whether it is a remote connection.
      type: Boolean
    - contextPath: Tanium.Connection.State
      description: Current connection state. Can be "closed", "pending", "active", "timeout", or "migrating".
      type: String
    - contextPath: Tanium.Connection.Deleted
      description: Whether the connection has been deleted.
      type: Boolean
    - contextPath: Tanium.Connection.DestionationType
      description: The destionation type (computer_name or ip_address).
      type: String
    - contextPath: Tanium.Connection.DST
      description: The connection's DST.
      type: String
    - contextPath: Tanium.Connection.OSName
      description: The connection's operating system.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    description: Returns a connection object based on connection name.
    name: tanium-tr-get-connection-by-name
    outputs:
    - contextPath: Tanium.Connection.CreateTime
      description: Time when the connection was first created.
      type: Date
    - contextPath: Tanium.Connection.Name
      description: The connection name.
      type: String
    - contextPath: Tanium.Connection.Remote
      description: Whether it is a remote connection.
      type: Boolean
    - contextPath: Tanium.Connection.State
      description: Current connection state. Can be "closed", "pending", "active", "timeout", or "migrating".
      type: String
    - contextPath: Tanium.Connection.Deleted
      description: Whether the connection has been deleted.
      type: Boolean
    - contextPath: Tanium.Connection.DestionationType
      description: The destionation type (computer_name or ip_address).
      type: String
    - contextPath: Tanium.Connection.DST
      description: The connection's DST.
      type: String
    - contextPath: Tanium.Connection.OSName
      description: The connection's operating system.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: Whether it is a remote connection. Can be "True" or "False".
      name: remote
      predefined:
      - 'True'
      - 'False'
      required: true
    - auto: PREDEFINED
      description: Type of destination. Can be "ip_address" or "computer_name".
      name: destination-type
      predefined:
      - ip_address
      - computer_name
      required: true
    - description: Computer name or IP address.
      name: destination
      required: true
    - defaultValue: '30000'
      description: connection timeout, in milliseconds.
      name: connection-timeout
    description: Creates a local or remote connection.
    name: tanium-tr-create-connection
  - arguments:
    - description: The name of the connection.
      name: connection-name
      required: true
    description: Deletes a connection by connection name.
    name: tanium-tr-delete-connection
    outputs:
    - contextPath: Tanium.Connection.Name
      description: The connection name.
      type: String
    - contextPath: Tanium.Connection.Deleted
      description: Whether the connection has been deleted.
      type: Boolean
  - arguments:
    - defaultValue: '50'
      description: The maximum number of labels to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing labels.
      name: offset
    description: Returns all available labels in the system.
    name: tanium-tr-list-labels
    outputs:
    - contextPath: Tanium.Label.CreatedAt
      description: The date when this label was created.
      type: Date
    - contextPath: Tanium.Label.Description
      description: An extended description of the label.
      type: String
    - contextPath: Tanium.Label.ID
      description: The unique identifier for this label.
      type: Number
    - contextPath: Tanium.Label.IndicatorCount
      description: The number of indicator-based intel documents associated with this label, not including Tanium Signals.
      type: Number
    - contextPath: Tanium.Label.Name
      description: The display name of the label.
      type: String
    - contextPath: Tanium.Label.SignalCount
      description: The number of Tanium Signal documents associated with this label.
      type: Number
    - contextPath: Tanium.Label.UpdatedAt
      description: The date when this label was last updated, not including the intel and signal counts.
      type: Date
  - arguments:
    - description: The label ID.
      name: label-id
      required: true
    description: Returns a label object based on label ID.
    name: tanium-tr-get-label-by-id
    outputs:
    - contextPath: Tanium.Label.CreatedAt
      description: The date when this label was created.
      type: Date
    - contextPath: Tanium.Label.Description
      description: An extended description of the label.
      type: String
    - contextPath: Tanium.Label.ID
      description: The unique identifier for this label.
      type: Number
    - contextPath: Tanium.Label.IndicatorCount
      description: The number of indicator-based intel documents associated with this label, not including Tanium Signals.
      type: Number
    - contextPath: Tanium.Label.Name
      description: The display name of the label.
      type: String
    - contextPath: Tanium.Label.SignalCount
      description: The number of Tanium Signal documents associated with this label.
      type: Number
    - contextPath: Tanium.Label.UpdatedAt
      description: The date this label was last updated, not including the intel and signal counts.
      type: Date
  - arguments:
    - defaultValue: '50'
      description: The maximum number of files to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting file downloads. The default is 0.
      name: offset
    - description: Filter downloaded files by host.
      name: host
    description: Returns all downloaded files in the system.
    name: tanium-tr-list-file-downloads
    outputs:
    - contextPath: Tanium.FileDownload.Size
      description: The size of the file, in bytes.
      type: Number
    - contextPath: Tanium.FileDownload.Path
      description: The path of the file.
      type: String
    - contextPath: Tanium.FileDownload.Downloaded
      description: The date when this file was downloaded.
      type: Date
    - contextPath: Tanium.FileDownload.Host
      description: The hostname of the downloaded file.
      type: String
    - contextPath: Tanium.FileDownload.Created
      description: The date when the file was created.
      type: Date
    - contextPath: Tanium.FileDownload.Hash
      description: The file hash.
      type: String
    - contextPath: Tanium.FileDownload.SPath
      description: The file SPath.
      type: String
    - contextPath: Tanium.FileDownload.ID
      description: The downloaded file ID.
      type: Number
    - contextPath: Tanium.FileDownload.LastModified
      description: The date when the file was last modified.
      type: Date
    - contextPath: Tanium.FileDownload.CreatedBy
      description: The user that created this file.
      type: String
    - contextPath: Tanium.FileDownload.CreatedByProc
      description: The process path that created this file.
      type: String
    - contextPath: Tanium.FileDownload.LastModifiedBy
      description: The user that last modified this file.
      type: String
    - contextPath: Tanium.FileDownload.LastModifiedByProc
      description: The process path that modified this file.
      type: String
    - contextPath: Tanium.FileDownload.Comments
      description: Additional comments for the downloaded file.
      type: String
    - contextPath: Tanium.FileDownload.Tags
      description: The downloaded file tags.
      type: String
    - contextPath: Tanium.FileDownload.Deleted
      description: Whether the file download has been deleted.
      type: Boolean
  - arguments:
    - description: The file ID.
      name: file-id
      required: true
    description: Gets the actual content of a downloaded file by file ID.
    name: tanium-tr-get-downloaded-file
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - auto: PREDEFINED
      defaultValue: combined
      description: The type of event. Can be "File", "Network", "Registry", "Process", "Driver", "Security", "Combined", "DNS", or "Image". The default is "Combined".
      name: event-type
      predefined:
      - File
      - Network
      - Registry
      - Process
      - Driver
      - Security
      - Combined
      - DNS
      - Image
      required: true
    - defaultValue: '50'
      description: The maximum number of events to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting the result set. The default is 0.
      name: offset
    - description: 'Advanced search that filters according to event fields. For example: [[''process_id'', ''gt'', ''30''], [''username'', ''ne'', ''administrator'']]. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional operators: eq (equals), ne (does not equal); for integers/date: gt (greater than), gte (greater than or equals), ls (less than), lse (less than or equals); for strings: co (contains), nc (does not contain). '
      name: filter
    - auto: PREDEFINED
      defaultValue: all
      description: Whether the results should fit all filters or at least one filter.
      name: match
      predefined:
      - all
      - any
    - description: 'A comma-separated list of fields to sort on prefixed by +/- for ascending or descending and ordered by priority left to right. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC).'
      name: sort
    - description: 'A comma-separated list of fields on which to search. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time.'
      name: fields
    description: Queries events for a connection.
    name: tanium-tr-list-events-by-connection
    outputs:
    - contextPath: TaniumEvent.Domain
      description: The domain of the event.
      type: String
    - contextPath: TaniumEvent.File
      description: The path of the file in the event.
      type: String
    - contextPath: TaniumEvent.Operation
      description: The event operation.
      type: String
    - contextPath: TaniumEvent.ProcessID
      description: The ID of the process.
      type: Number
    - contextPath: TaniumEvent.ProcessName
      description: The name of the process.
      type: String
    - contextPath: TaniumEvent.ProcessTableID
      description: The ID of the process table.
      type: Number
    - contextPath: TaniumEvent.Timestamp
      description: The date when the event was created.
      type: Date
    - contextPath: TaniumEvent.Username
      description: The username associated with the event.
      type: String
    - contextPath: TaniumEvent.DestinationAddress
      description: The network event destination address.
      type: String
    - contextPath: TaniumEvent.DestinationPort
      description: The network event destination port.
      type: Number
    - contextPath: TaniumEvent.SourceAddress
      description: The network event source address.
      type: String
    - contextPath: TaniumEvent.SourcePort
      description: The network event source port.
      type: Number
    - contextPath: TaniumEvent.KeyPath
      description: The registry key path.
      type: String
    - contextPath: TaniumEvent.ValueName
      description: The registry value name.
      type: String
    - contextPath: TaniumEvent.ExitCode
      description: The process exit code.
      type: Number
    - contextPath: TaniumEvent.ProcessCommandLine
      description: The process command line.
      type: String
    - contextPath: TaniumEvent.ProcessHash
      description: The hash value of the process.
      type: String
    - contextPath: TaniumEvent.SID
      description: The process SID.
      type: Number
    - contextPath: TaniumEvent.Hashes
      description: The hashes of the driver.
      type: String
    - contextPath: TaniumEvent.ImageLoaded
      description: The image loaded path of the driver.
      type: String
    - contextPath: TaniumEvent.Signature
      description: The signature of the driver.
      type: String
    - contextPath: TaniumEvent.Signed
      description: Whether the driver is signed.
      type: Boolean
    - contextPath: TaniumEvent.EventID
      description: The ID of the event.
      type: Number
    - contextPath: TaniumEvent.EventOpcode
      description: The event opcode.
      type: Number
    - contextPath: TaniumEvent.EventRecordID
      description: The ID of the event record.
      type: Number
    - contextPath: TaniumEvent.EventTaskID
      description: The ID of the event task.
      type: Number
    - contextPath: TaniumEvent.Query
      description: The query of the DNS.
      type: String
    - contextPath: TaniumEvent.Response
      description: The response of the DNS.
      type: String
    - contextPath: TaniumEvent.ImagePath
      description: The image path.
      type: String
    - contextPath: TaniumEvent.CreationTime
      description: The process creation time.
      type: Date
    - contextPath: TaniumEvent.EndTime
      description: The process end time.
      type: Date
    - contextPath: TaniumEvent.EventTaskName
      description: The name of the event task.
      type: String
    - contextPath: TaniumEvent.Property.Name
      description: The name of the event's property.
      type: String
    - contextPath: TaniumEvent.Property.Value
      description: The value of the event's property.
      type: String
  - arguments:
    - description: The hostname of the downloaded file.
      name: host
      required: true
    - description: The path of the file.
      name: path
    - description: File download ID.
      name: id
    description: Gets the metadata of a file download. You must supply either the `path` or `id` argument for the command to run successfully.
    name: tanium-tr-get-file-download-info
    outputs:
    - contextPath: Tanium.FileDownload.Size
      description: The size of the file, in bytes.
      type: Number
    - contextPath: Tanium.FileDownload.Path
      description: The path of the file.
      type: String
    - contextPath: Tanium.FileDownload.Downloaded
      description: The date when this file was downloaded.
      type: Date
    - contextPath: Tanium.FileDownload.Host
      description: The hostname of the downloaded file.
      type: String
    - contextPath: Tanium.FileDownload.Created
      description: The date when the file was created.
      type: Date
    - contextPath: Tanium.FileDownload.Hash
      description: The file hash.
      type: String
    - contextPath: Tanium.FileDownload.SPath
      description: The file SPath.
      type: String
    - contextPath: Tanium.FileDownload.ID
      description: The downloaded file ID.
      type: Number
    - contextPath: Tanium.FileDownload.LastModified
      description: The date when the file was last modified.
      type: Date
    - contextPath: Tanium.FileDownload.CreatedBy
      description: The user that created this file.
      type: String
    - contextPath: Tanium.FileDownload.CreatedByProc
      description: The process path that created this file.
      type: String
    - contextPath: Tanium.FileDownload.LastModifiedBy
      description: The user that last modified this file.
      type: String
    - contextPath: Tanium.FileDownload.LastModifiedByProc
      description: The process path that modified this file.
      type: String
    - contextPath: Tanium.FileDownload.Comments
      description: The downloaded file comments.
      type: String
    - contextPath: Tanium.FileDownload.Tags
      description: The downloaded file tags.
      type: String
    - contextPath: Tanium.FileDownload.Deleted
      description: Whether the file download has been deleted.
      type: Boolean
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Get information for a process.
    name: tanium-tr-get-process-info
    outputs:
    - contextPath: Tanium.Process.CreateTime
      description: Time when the process was created.
      type: Date
    - contextPath: Tanium.Process.Domain
      description: The domain of the process.
      type: String
    - contextPath: Tanium.Process.ExitCode
      description: The process exit code.
      type: Number
    - contextPath: Tanium.Process.ProcessCommandLine
      description: The process command line.
      type: String
    - contextPath: Tanium.Process.ProcessID
      description: The ID of the process.
      type: Number
    - contextPath: Tanium.Process.ProcessName
      description: File of the process.
      type: String
    - contextPath: Tanium.Process.ProcessTableId
      description: The ID of the process table.
      type: Number
    - contextPath: Tanium.Process.SID
      description: The security ID of the process.
      type: String
    - contextPath: Tanium.Process.Username
      description: The username who created the process.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    - defaultValue: '50'
      description: The maximum number of events to return.
      name: limit
    - defaultValue: '0'
      description: The offset number to begin listing events.
      name: offset
    description: Gets the events for a process.
    name: tanium-tr-get-events-by-process
    outputs:
    - contextPath: Tanium.ProcessEvent.ID
      description: The ID of the event.
      type: Number
    - contextPath: Tanium.ProcessEvent.Detail
      description: The event details.
      type: Unknown
    - contextPath: Tanium.ProcessEvent.Operation
      description: The event operation.
      type: String
    - contextPath: Tanium.ProcessEvent.Timestamp
      description: Time when the event was created.
      type: Date
    - contextPath: Tanium.ProcessEvent.Type
      description: The event type.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Gets the children of this process instance.
    name: tanium-tr-get-process-children
    outputs:
    - contextPath: Tanium.ProcessChildren.ID
      description: The ID of the process.
      type: Number
    - contextPath: Tanium.ProcessChildren.Name
      description: File of the process.
      type: String
    - contextPath: Tanium.ProcessChildren.PID
      description: The PID of the process.
      type: Number
    - contextPath: Tanium.ProcessChildren.PTID
      description: The process instance ID.
      type: Number
    - contextPath: Tanium.ProcessChildren.Parent
      description: The parent process name.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Gets information for the parent process.
    name: tanium-tr-get-parent-process
    outputs:
    - contextPath: Tanium.Process.CreateTime
      description: Time when the process was created.
      type: Date
    - contextPath: Tanium.Process.Domain
      description: The domain of the process.
      type: String
    - contextPath: Tanium.Process.ExitCode
      description: The process exit code.
      type: Number
    - contextPath: Tanium.Process.ProcessCommandLine
      description: The process command line.
      type: String
    - contextPath: Tanium.Process.ProcessID
      description: The ID of the process.
      type: Number
    - contextPath: Tanium.Process.ProcessName
      description: File of the process.
      type: String
    - contextPath: Tanium.Process.ProcessTableId
      description: The ID of the process table.
      type: Number
    - contextPath: Tanium.Process.SID
      description: The security ID of the process.
      type: String
    - contextPath: Tanium.Process.Username
      description: The username who created the process.
      type: String
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Gets the parent process tree for the process instance.
    name: tanium-tr-get-parent-process-tree
    outputs:
    - contextPath: Tanium.ParentProcessTree.ID
      description: The parent process ID.
      type: Number
    - contextPath: Tanium.ParentProcessTree.Name
      description: File of the parent process.
      type: String
    - contextPath: Tanium.ParentProcessTree.PID
      description: The parent process PID.
      type: Number
    - contextPath: Tanium.ParentProcessTree.PTID
      description: The parent process instance ID.
      type: Number
    - contextPath: Tanium.ParentProcessTree.Parent
      description: The parent process name.
      type: String
    - contextPath: Tanium.ParentProcessTree.Children
      description: The parent process children.
      type: Unknown
  - arguments:
    - description: The connection name.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Gets the process tree for the process instance.
    name: tanium-tr-get-process-tree
    outputs:
    - contextPath: Tanium.ProcessTree.ID
      description: The process ID.
      type: Number
    - contextPath: Tanium.ProcessTree.Name
      description: File of the process.
      type: String
    - contextPath: Tanium.ProcessTree.PID
      description: The process PID.
      type: Number
    - contextPath: Tanium.ProcessTree.PTID
      description: The process instance ID.
      type: Number
    - contextPath: Tanium.ProcessTree.Parent
      description: The parent process name.
      type: String
    - contextPath: Tanium.ProcessTree.Children
      description: The process children.
      type: Unknown
  - arguments:
    - defaultValue: '50'
      description: The maximum number of evidences to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting the events result set. The default is 0.
      name: offset
    - description: A comma-separated list of fields by which to sort, using +/- prefixes for ascending/descending, in order of priority (left to right).
      name: sort
    description: Returns a list of all available evidence in the system.
    name: tanium-tr-list-evidence
    outputs:
    - contextPath: Tanium.Evidence.ID
      description: The evidence ID.
      type: Number
    - contextPath: Tanium.Evidence.CreatedAt
      description: Time when the process was created.
      type: Date
    - contextPath: Tanium.Evidence.LastModified
      description: The date that the file was last modified.
      type: Date
    - contextPath: Tanium.Evidence.User
      description: The user of the evidence.
      type: String
    - contextPath: Tanium.Evidence.ConnectionName
      description: The evidence connection name.
      type: String
    - contextPath: Tanium.Evidence.Type
      description: The evidence type.
      type: Number
    - contextPath: Tanium.Evidence.ProcessTableId
      description: The evidence process table ID.
      type: Number
    - contextPath: Tanium.Evidence.Timestamp
      description: The evidence timestamp.
      type: Date
    - contextPath: Tanium.Evidence.Summary
      description: The evidence summary.
      type: String
    - contextPath: Tanium.Evidence.Comments
      description: The evidence comments.
      type: String
    - contextPath: Tanium.Evidence.Tags
      description: The evidence tags.
      type: String
    - contextPath: Tanium.Evidence.Deleted
      description: Whether the evident has been deleted.
      type: Boolean
  - arguments:
    - description: The ID of the evidence.
      name: evidence-id
      required: true
    description: Gets evidence by evidence ID.
    name: tanium-tr-get-evidence-by-id
    outputs:
    - contextPath: Tanium.Evidence.ID
      description: The evidence ID.
      type: Number
    - contextPath: Tanium.Evidence.CreatedAt
      description: Time when the process was created.
      type: Date
    - contextPath: Tanium.Evidence.LastModified
      description: The date that the file was last modified.
      type: Date
    - contextPath: Tanium.Evidence.User
      description: The user of the evidence.
      type: String
    - contextPath: Tanium.Evidence.ConnectionName
      description: The evidence connection name.
      type: String
    - contextPath: Tanium.Evidence.Type
      description: The evidence type.
      type: Number
    - contextPath: Tanium.Evidence.ProcessTableId
      description: The evidence process table ID.
      type: Number
    - contextPath: Tanium.Evidence.Timestamp
      description: The evidence timestamp.
      type: Date
    - contextPath: Tanium.Evidence.Summary
      description: The evidence summary.
      type: String
    - contextPath: Tanium.Evidence.Comments
      description: The evidence comments.
      type: String
    - contextPath: Tanium.Evidence.Tags
      description: The evidence tags.
      type: String
    - contextPath: Tanium.Evidence.Deleted
      description: Whether the evident has been deleted.
      type: Boolean
  - arguments:
    - description: The name of the connection.
      name: connection-name
      required: true
    - description: The process instance ID.
      name: ptid
      required: true
    description: Creates an evidence.
    name: tanium-tr-create-evidence
  - arguments:
    - description: The ID of the evidence.
      name: evidence-id
      required: true
    description: Deletes an evidence.
    name: tanium-tr-delete-evidence
    outputs:
    - contextPath: Tanium.Evidence.ID
      description: The evidence ID.
      type: String
    - contextPath: Tanium.Evidence.Deleted
      description: Whether the evidence has been deleted.
      type: Boolean
  - arguments:
    - description: Path to file.
      name: path
      required: true
    - description: Connection name.
      name: connection-name
      required: true
    description: Requests a new file download.
    name: tanium-tr-request-file-download
    outputs:
    - contextPath: Tanium.FileDownload.Path
      description: The file download path.
      type: String
    - contextPath: Tanium.FileDownload.ConnectionName
      description: The file download host.
      type: String
    - contextPath: Tanium.FileDownload.Downloaded
      description: Date of the download request.
      type: Date
    - contextPath: Tanium.FileDownload.Status
      description: Status of the file download request.
      type: String
    - contextPath: Tanium.FileDownload.ID
      description: ID of the file download.
      type: Number
  - arguments:
    - description: File download ID.
      name: file-id
      required: true
    description: Deletes a file download.
    name: tanium-tr-delete-file-download
    outputs:
    - contextPath: Tanium.FileDownload.ID
      description: The file download ID.
      type: String
    - contextPath: Tanium.FileDownload.Deleted
      description: Whether the file download has been deleted.
      type: Boolean
  - arguments:
    - description: Path to the directory.
      name: path
      required: true
    - description: Connection name.
      name: connection-name
      required: true
    - defaultValue: '50'
      description: The maximum number of files to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting files. The default is 0.
      name: offset
    description: Gets a list of files in the given directory.
    name: tanium-tr-list-files-in-directory
    outputs:
    - contextPath: Tanium.File.Created
      description: Time the file was created.
      type: Date
    - contextPath: Tanium.File.Size
      description: The file size.
      type: Number
    - contextPath: Tanium.File.IsDirectory
      description: Whether or not the file is a directory.
      type: Boolean
    - contextPath: Tanium.File.LastModified
      description: The date that the file was last modified.
      type: Date
    - contextPath: Tanium.File.Path
      description: The file path.
      type: Boolean
    - contextPath: Tanium.File.Permissions
      description: The file permissions.
      type: Date
    - contextPath: Tanium.File.ConnectionName
      description: The host of the file.
      type: String
    - contextPath: Tanium.File.Deleted
      description: Whether the file has been deleted.
      type: Boolean
  - arguments:
    - defaultValue: Connection name.
      description: The name of the connection.
      name: connection-name
      required: true
    - defaultValue: Path to file.
      description: The path to the file.
      name: path
      required: true
    description: Gets information about a file from a remote connection.
    name: tanium-tr-get-file-info
    outputs:
    - contextPath: Tanium.File.Created
      description: The file creation timestamp.
      type: Date
    - contextPath: Tanium.File.Size
      description: The file size.
      type: Number
    - contextPath: Tanium.File.IsDirectory
      description: Whether or not the file is a directory.
      type: Boolean
    - contextPath: Tanium.File.LastModified
      description: The date that the file was last modified.
      type: Date
    - contextPath: Tanium.File.Path
      description: The file path.
      type: String
    - contextPath: Tanium.File.ConnectionName
      description: The host of the file.
      type: String
    - contextPath: Tanium.File.Deleted
      description: Whether the file has been deleted.
      type: Boolean
  - arguments:
    - description: Connection name.
      name: connection-name
      required: true
    - description: Path to file.
      name: path
      required: true
    description: Deletes a file from the given endpoint.
    name: tanium-tr-delete-file-from-endpoint
    outputs:
    - contextPath: Tanium.File.Path
      description: The file path.
      type: String
    - contextPath: Tanium.File.ConnectionName
      description: The host of the file.
      type: String
    - contextPath: Tanium.File.Deleted
      description: Whether the file has been deleted.
      type: Boolean
  - arguments:
    - description: Connection name.
      name: connection-name
      required: true
    - description: Process table ID.
      name: ptid
      required: true
    - auto: PREDEFINED
      description: The event categories to retrieve. Can be "File", "DNS", "Registry", "Network", "Image", or "Process".
      name: category
      predefined:
      - File
      - DNS
      - Registry
      - Network
      - Image
      - Process
      required: true
    - defaultValue: '50'
      description: The maximum number of events to return. The default value is 50.
      name: limit
    - defaultValue: '0'
      description: Offset to start getting the events. The default is 0.
      name: offset
    description: Gets the process timeline.
    name: tanium-tr-get-process-timeline
    outputs:
    - contextPath: Tanium.ProcessTimeline.ProcessTableID
      description: The process instance ID.
      type: Number
    - contextPath: Tanium.ProcessTimeline.ConnectionName
      description: The connection name of the process.
      type: String
    - contextPath: Tanium.ProcessTimeline.Date
      description: Events date of the process.
      type: Date
    - contextPath: Tanium.ProcessTimeline.Event
      description: Event of the process.
      type: String
    - contextPath: Tanium.ProcessTimeline.Category
      description: The event category of the process.
      type: String
  - arguments:
    - description: 'Date of the download file request, or example: 2019-09-23T12:55:08.622.'
      name: request-date
      required: true
    - description: The connection to which the request was made.
      name: connection-name
    - description: The file path.
      name: path
    description: Gets the status of the download file request.
    name: tanium-tr-get-download-file-request-status
    outputs:
    - contextPath: Tanium.DownloadFile.ID
      description: ID of the file download.
      type: Number
    - contextPath: Tanium.DownloadFile.ConnectionName
      description: Host of the file.
      type: String
    - contextPath: Tanium.DownloadFile.Path
      description: Path of the file.
      type: String
    - contextPath: Tanium.DownloadFile.Status
      description: Status of the file download request.
      type: String
    - contextPath: Tanium.DownloadFile.Downloaded
      description: The date of the download request.
      type: Date
  - arguments:
    - description: The file entry ID.
      name: entry_id
      required: true
    - auto: PREDEFINED
      description: The suffix at the end of a filename. (Available file types - yara, stix, ioc).
      name: file_extension
      predefined:
      - ioc
      - yara
      - stix
      required: true
    description: Add a new intel document to the system by providing its document contents.
    name: tanium-tr-intel-doc-create
    outputs:
    - contextPath: Tanium.IntelDoc.AlertCount
      description: The number of alerts that currently exist for this intel.
      type: number
    - contextPath: Tanium.IntelDoc.CreatedAt
      description: The date at which this intel was first added to the system.
      type: date
    - contextPath: Tanium.IntelDoc.Description
      description: The description of the intel, as declared in the document or as updated by a user.
      type: string
    - contextPath: Tanium.IntelDoc.ID
      description: The unique identifier for this intel in this instance of the system.
      type: number
    - contextPath: Tanium.IntelDoc.LabelIds
      description: The IDs of all labels applied to this intel.
      type: number
    - contextPath: Tanium.IntelDoc.Name
      description: The name of the intel, as declared in the document or as updated by a user.
      type: string
    - contextPath: Tanium.IntelDoc.UnresolvedAlertCount
      description: The number of unresolved alerts that currently exist for this intel.
      type: number
    - contextPath: Tanium.IntelDoc.UpdatedAt
      description: The date when this intel was last updated.
      type: date
    - contextPath: Tanium.IntelDoc.Type
      description: The shortened type name of the intel. For example, "openioc", "stix", "yara".
      type: String
  - arguments:
    - description: The intel document ID.
      name: intel_doc_id
      required: true
    - description: The name of a Tanium computer group. See command description for possible ways to retrieve this value.
      name: computer_group_name
      required: true
    description: Scan a computer group for hashes in intel document. Computer groups can be viewed by navigating to `Administration -> Computer Groups` in the Threat-Response product console. Computer group names and IDs can also be retrieved by using the `tn-list-groups` command in the `Tanium` integration.
    name: tanium-tr-start-quick-scan
    outputs:
    - contextPath: Tanium.QuickScan.IntelDocId
      description: The unique identifier for this intel in this instance of the system.
      type: number
    - contextPath: Tanium.QuickScan.ComputerGroupId
      description: The ID of a Tanium computer group.
      type: number
    - contextPath: Tanium.QuickScan.ID
      description: The ID of the quick scan.
      type: number
    - contextPath: Tanium.QuickScan.AlertCount
      description: The number of alerts returned from the quick scan.
      type: number
    - contextPath: Tanium.QuickScan.CreatedAt
      description: The date the quick scan was created.
      type: date
    - contextPath: Tanium.QuickScan.UserID
      description: The user ID which initiated the quick scan.
      type: number
    - contextPath: Tanium.QuickScan.QuestionID
      description: The ID of the quick scan question.
      type: number
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Tanium Threat Response Test
fromversion: 5.0.0