Skip to main content

Tanium Threat Response

Tanium Threat Response

Configure Tanium Threat Response on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Tanium Threat Response.
  3. Click Add instance to create and configure a new integration instance.
ParameterDescriptionRequired
isFetchFetch incidentsFalse
incidentTypeIncident typeFalse
urlHostname, IP address, or server URLTrue
credentialsUsernameTrue
insecureTrust any certificate (not secure)False
proxyUse system proxy settingsFalse
fetch_timeFirst fetch timestamp ({number} {time unit}, e.g., 12 hours, 7 days)False
filter_alerts_by_stateA comma-separated list of alert states to filter by in fetch incidents command. Possible options are: unresolved, in progress, resolved or suppressed. Empty list won't filter the incidents by state.False
  1. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

tanium-tr-get-intel-doc-by-id#


Returns an intel document object based on ID.

Base Command#

tanium-tr-get-intel-doc-by-id

Input#
Argument NameDescriptionRequired
intel-doc-idThe intel document ID.Required
Context Output#
PathTypeDescription
Tanium.IntelDoc.AlertCountNumberThe number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAtDateThe date at which this intel was first added to the system.
Tanium.IntelDoc.DescriptionStringThe description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.IDNumberThe unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIdsNumberThe IDs of all labels applied to this intel.
Tanium.IntelDoc.NameStringThe name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCountNumberThe number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAtDateThe date when this intel was last updated.
Command Example#

!tanium-tr-get-intel-doc-by-id intel-doc-id=2

Context Example#
{
"Tanium": {
"IntelDoc": {
"AlertCount": 0,
"CreatedAt": "2019-07-31T18:46:28.814Z",
"Description": "Detects usage of the NET.EXE utility to enumerate members of the local Administrators or Domain Administrators groups. Often used during post-compromise reconnaissance.",
"ID": 2,
"LabelIds": [
2,
3,
9,
16
],
"Name": "Administrator Account Enumeration",
"UnresolvedAlertCount": 0,
"UpdatedAt": "2020-01-14T21:37:30.934Z"
}
}
}
Human Readable Output#

Intel Doc information#

IDNameDescriptionTypeAlert CountUnresolved Alert CountCreated AtUpdated AtLabel Ids
2Administrator Account EnumerationDetects usage of the NET.EXE utility to enumerate members of the local Administrators or Domain Administrators groups. Often used during post-compromise reconnaissance.002019-07-31T18:46:28.814Z2020-01-14T21:37:30.934Z2, 3, 9, 16

tanium-tr-list-intel-docs#


Returns a list of all intel documents.

Base Command#

tanium-tr-list-intel-docs

Input#
Argument NameDescriptionRequired
limitThe maximum number of intel documents to return.Optional
offsetThe offset number to begin listing intel documents.Optional
Context Output#
PathTypeDescription
Tanium.IntelDoc.AlertCountNumberThe number of alerts that currently exist for this intel.
Tanium.IntelDoc.CreatedAtDateThe date at which this intel was first added to the system.
Tanium.IntelDoc.DescriptionStringThe description of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.IDNumberThe unique identifier for this intel in this instance of the system.
Tanium.IntelDoc.LabelIdsNumberThe IDs of all labels applied to this intel.
Tanium.IntelDoc.NameStringThe name of the intel, as declared in the document or as updated by a user.
Tanium.IntelDoc.UnresolvedAlertCountNumberThe number of unresolved alerts that currently exist for this intel.
Tanium.IntelDoc.UpdatedAtDateThe date when this intel was last updated.
Command Example#

!tanium-tr-list-intel-docs limit=2

Context Example#
{
"Tanium": {
"IntelDoc": [
{
"AlertCount": 0,
"CreatedAt": "2020-01-14T21:37:32.263Z",
"ID": 99,
"LabelIds": [
2,
7,
11,
16
],
"Name": "Spooler Service Creating or Spawning Executables",
"UnresolvedAlertCount": 0,
"UpdatedAt": "2020-01-14T21:37:32.263Z"
},
{
"AlertCount": 0,
"CreatedAt": "2020-01-14T21:37:32.075Z",
"ID": 98,
"LabelIds": [
2,
8,
16
],
"Name": "RunDll Creating MiniDump",
"UnresolvedAlertCount": 0,
"UpdatedAt": "2020-01-14T21:37:32.075Z"
}
]
}
}
Human Readable Output#

Intel docs#

IDNameAlert CountUnresolved Alert CountCreated AtUpdated AtLabel Ids
99Spooler Service Creating or Spawning Executables002020-01-14T21:37:32.263Z2020-01-14T21:37:32.263Z2, 7, 11, 16
98RunDll Creating MiniDump002020-01-14T21:37:32.075Z2020-01-14T21:37:32.075Z2, 8, 16

tanium-tr-list-alerts#


Returns a list of all alerts.

Base Command#

tanium-tr-list-alerts

Input#
Argument NameDescriptionRequired
limitThe maximum number of alerts to return. The default value is 5.Optional
offsetThe offset number to begin listing alerts.Optional
computer-ip-addressFilter alerts by the specified computer IP addresses.Optional
computer-nameFilter alerts by the specified computer name.Optional
scan-config-idFilter alerts by the specified scan config ID.Optional
intel-doc-idFilter alerts by the specified intel document ID.Optional
severityFilter alerts by the specified severity.Optional
priorityFilter alerts by the specified priority.Optional
typeFilter alerts by the specified type.Optional
stateFilter alerts by the specified state. Can be "Unresolved", "In Progress", "Ignored", or "Resolved".Optional
Context Output#
PathTypeDescription
Tanium.Alert.PriorityStringThe priority of the alert.
Tanium.Alert.ComputerNameStringThe hostname of the computer that generated the alert.
Tanium.Alert.GUIDStringA globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAtDateThe moment that the alert was generated.
Tanium.Alert.UpdatedAtDateThe last time the alert state was updated.
Tanium.Alert.StateStringThe current state of the alert. For example, "unresolved", "inprogress", and so on.
Tanium.Alert.ComputerIpAddressStringThe IP address of the computer that generated the alert.
Tanium.Alert.TypeStringThe name of the alert type. For example, "detect.endpoint.match".
Tanium.Alert.IDNumberThe ID of the alert. For example, "123".
Tanium.Alert.CreatedAtDateThe date when the alert was received by the Detect product.
Tanium.Alert.IntelDocIdNumberThe intel document revision, if intelDocId is present.
Tanium.Alert.SeverityStringThe severity of the alert.
Command Example#

!tanium-tr-list-alerts limit=1

Context Example#
{
"Tanium": {
"Alert": {
"AlertedAt": "2019-09-22T14:01:31.000Z",
"ComputerIpAddress": "172.0.0.0",
"ComputerName": "HOST_NAME",
"CreatedAt": "2019-09-22T14:01:59.768Z",
"GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
"ID": 1,
"IntelDocId": 64,
"Priority": "high",
"Severity": "info",
"State": "Unresolved",
"Type": "detect.match",
"UpdatedAt": "2020-02-05T14:55:41.440Z"
}
}
}
Human Readable Output#

Alerts#

IDTypeSeverityPriorityAlerted AtCreated AtUpdated AtComputer Ip AddressComputer NameGUIDStateIntel Doc Id
1detect.matchinfohigh2019-09-22T14:01:31.000Z2019-09-22T14:01:59.768Z2020-02-05T14:55:41.440Z172.0.0.0HOST_NAMEa33e3482-556e-4e9d-bbbd-2fdbe330d492Unresolved64

tanium-tr-get-alert-by-id#


Returns an alert object based on alert ID.

Base Command#

tanium-tr-get-alert-by-id

Input#
Argument NameDescriptionRequired
alert-idThe alert ID.Required
Context Output#
PathTypeDescription
Tanium.Alert.PriorityStringThe priority of the alert.
Tanium.Alert.ComputerNameStringThe hostname of the computer that generated the alert.
Tanium.Alert.GUIDStringA globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAtDateThe date when the alert was generated.
Tanium.Alert.UpdatedAtDateThe date when the alert state was last updated.
Tanium.Alert.StateStringThe current state of the alert. For example, "unresolved", "inprogress".
Tanium.Alert.ComputerIpAddressStringThe IP address of the computer that generated the alert.
Tanium.Alert.TypeStringThe name of the alert type. For example, "detect.endpoint.match".
Tanium.Alert.IDNumberThe ID of the alert. For example, "123".
Tanium.Alert.CreatedAtDateThe date when the alert was received by the Detect product.
Tanium.Alert.IntelDocIdNumberThe intel document revision, if intelDocId is present.
Tanium.Alert.SeverityStringThe severity of the alert.
Command Example#

!tanium-tr-get-alert-by-id alert-id=1

Context Example#
{
"Tanium": {
"Alert": {
"AlertedAt": "2019-09-22T14:01:31.000Z",
"ComputerIpAddress": "172.0.0.0",
"ComputerName": "HOST_NAME",
"CreatedAt": "2019-09-22T14:01:59.768Z",
"GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
"ID": 1,
"IntelDocId": 64,
"Priority": "high",
"Severity": "info",
"State": "Unresolved",
"Type": "detect.match",
"UpdatedAt": "2020-02-05T14:55:41.440Z"
}
}
}
Human Readable Output#

Alert information#

IDTypeSeverityPriorityAlerted AtCreated AtUpdated AtComputer Ip AddressComputer NameGUIDStateIntel Doc Id
1detect.matchinfohigh2019-09-22T14:01:31.000Z2019-09-22T14:01:59.768Z2020-02-05T14:55:41.440Z172.0.0.0HOST_NAMEa33e3482-556e-4e9d-bbbd-2fdbe330d492Unresolved64

tanium-tr-alert-update-state#


Updates the state of a single alert.

Base Command#

tanium-tr-alert-update-state

Input#
Argument NameDescriptionRequired
alert-idThe ID of the alert to update.Required
stateThe new state for the alert. Can be "Unresolved", "In Progress", "Ignored", or "Resolved".Required
Context Output#
PathTypeDescription
Tanium.Alert.PriorityStringThe priority of the alert.
Tanium.Alert.ComputerNameStringThe hostname of the computer that generated the alert.
Tanium.Alert.GUIDStringA globally unique identifier for this alert in the customer environment.
Tanium.Alert.AlertedAtDateThe date when the alert was generated.
Tanium.Alert.UpdatedAtDateThe date when the alert state was last updated.
Tanium.Alert.StateStringThe current state of the alert. For example, "unresolved", "inprogress".
Tanium.Alert.ComputerIpAddressStringThe IP address of the computer that generated the alert.
Tanium.Alert.TypeStringThe name of the alert type. For example, "detect.endpoint.match".
Tanium.Alert.IDNumberThe ID of the alert. For example, "123".
Tanium.Alert.CreatedAtDateThe date when the alert was received by the Detect product.
Tanium.Alert.IntelDocIdNumberThe intel document revision, if intelDocId is present.
Tanium.Alert.SeverityStringThe severity of the alert.
Command Example#

!tanium-tr-alert-update-state alert-id=1 state=Unresolved

Context Example#
{
"Tanium": {
"Alert": {
"AlertedAt": "2019-09-22T14:01:31.000Z",
"ComputerIpAddress": "172.0.0.0",
"ComputerName": "HOST_NAME",
"CreatedAt": "2019-09-22T14:01:59.768Z",
"GUID": "a33e3482-556e-4e9d-bbbd-2fdbe330d492",
"ID": 1,
"IntelDocId": 64,
"Priority": "high",
"Severity": "info",
"State": "Unresolved",
"Type": "detect.match",
"UpdatedAt": "2020-02-05T14:55:41.440Z"
}
}
}
Human Readable Output#

Alert state updated to Unresolved#

IDTypeSeverityPriorityAlerted AtCreated AtUpdated AtComputer Ip AddressComputer NameGUIDStateIntel Doc Id
1detect.matchinfohigh2019-09-22T14:01:31.000Z2019-09-22T14:01:59.768Z2020-02-05T14:55:41.440Z172.0.0.0HOST_NAMEa33e3482-556e-4e9d-bbbd-2fdbe330d492Unresolved64

tanium-tr-list-snapshots-by-connection#


Returns all snapshots of a single connection.

Base Command#

tanium-tr-list-snapshots-by-connection

Input#
Argument NameDescriptionRequired
limitThe maximum number of snapshots to return.Optional
offsetThe offset number to begin listing snapshots.Optional
connection-nameThe connection name.Required
Context Output#
PathTypeDescription
Tanium.Snapshot.ConnectionNameStringThe snapshot connection name.
Tanium.Snapshot.ErrorStringThe snapshot error message.
Tanium.Snapshot.IDStringThe snapshot id.
Tanium.Snapshot.StartedDateThe date when the snapshot was created.
Tanium.Snapshot.StateStringThe current state of the snapshot.
Command Example#

!tanium-tr-list-snapshots-by-connection connection-name=HOST_NAME limit=2

Context Example#
{
"Tanium": {
"Snapshot": [
{
"ConnectionName": "HOST_NAME",
"FileName": "2020_02_06T15.54.43.600Z.db",
"Started": "2020-02-06T15:54:43.600Z",
"State": "complete"
},
{
"ConnectionName": "HOST_NAME",
"Error": "Error checkpointing remote database",
"FileName": "2020_02_06T15.54.46.795Z.db",
"Started": "2020-02-06T15:54:46.795Z",
"State": "error"
}
]
}
}
Human Readable Output#

Snapshots#

File NameConnection NameStateStartedError
2020_02_06T15.54.43.600Z.dbHOST_NAMEcomplete2020-02-06T15:54:43.600Z
2020_02_06T15.54.46.795Z.dbHOST_NAMEerror2020-02-06T15:54:46.795ZError checkpointing remote database

tanium-tr-create-snapshot#


Captures a new snapshot by connection name.

Base Command#

tanium-tr-create-snapshot

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
Context Output#

There is no context output for this command.

Command Example#

!tanium-tr-create-snapshot connection-name=HOST_NAME

Human Readable Output#

Initiated snapshot creation request for HOST_NAME.

tanium-tr-delete-snapshot#


Deletes a snapshot by connection name and snapshot ID.

Base Command#

tanium-tr-delete-snapshot

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
snapshot-idThe snapshot ID.Required
Context Output#
PathTypeDescription
Tanium.Snapshot.IDStringThe snapshot ID.
Tanium.Snapshot.ConnectionNameStringThe connection name.
Tanium.Snapshot.DeletedBooleanWhether the snapshot has been deleted.
Command Example#

!tanium-tr-delete-snapshot connection-name=HOST_NAME snapshot-id=2020_02_06T15.54.43.600Z.db

Context Example#
{
"Tanium": {
"LocalSnapshot": {
"ConnectionName": "HOST_NAME",
"Deleted": True,
"FileName": "2020_02_06T15.54.43.600Z.db"
}
}
}
Human Readable Output#

Snapshot 2020_02_06T15.54.43.600Z.db deleted successfully.

tanium-tr-list-local-snapshots-by-connection#


Returns all local snapshots of a single connection.

Base Command#

tanium-tr-list-local-snapshots-by-connection

Input#
Argument NameDescriptionRequired
limitThe maximum number of local snapshots to return. The default value is 50.Optional
offsetThe offset number to begin listing local snapshots.Optional
connection-nameThe connection name.Required
Context Output#
PathTypeDescription
Tanium.LocalSnapshot.ConnectionNameStringThe snapshot connection name.
Tanium.LocalSnapshot.DeletedBooleanWhether the snapshot has been deleted.
Tanium.LocalSnapshot.FileNameStringThe snapshot file name.
Command Example#

!tanium-tr-list-local-snapshots-by-connection connection-name=HOST_NAME limit=2

Context Example#
{
"Tanium": {
"LocalSnapshot": [
{
"ConnectionName": "HOST_NAME",
"Deleted": false,
"FileName": "2020_02_06T15.54.43.600Z.db"
},
{
"ConnectionName": "HOST_NAME",
"Deleted": false,
"FileName": "2020_01_09T15.25.13.535Z.db"
}
]
}
}
Human Readable Output#

Local snapshots#

File NameConnection Name
2020_02_06T15.54.43.600Z.dbHOST_NAME
2020_01_09T15.25.13.535Z.dbHOST_NAME

tanium-tr-delete-local-snapshot#


Deletes a local snapshot by directory name and file name.

Base Command#

tanium-tr-delete-local-snapshot

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
file-nameThe file name.Required
Context Output#
PathTypeDescription
Tanium.LocalSnapshot.FileNameStringThe snapshot file name.
Tanium.LocalSnapshot.DeletedBooleanWhether the local snapshot has been deleted.
Command Example#

!tanium-tr-delete-local-snapshot connection-name=HOST_NAME file-name=2020_02_06T15.54.43.600Z.db

Context Example#
{
"Tanium": {
"LocalSnapshot": {
"ConnectionName": "HOST_NAME",
"Deleted": true,
"FileName": "2020_02_06T15.54.43.600Z.db"
}
}
}
Human Readable Output#

Local snapshot from Directory HOST_NAME and File 2020_02_06T15.54.43.600Z.db is deleted successfully.

tanium-tr-list-connections#


Returns all connections.

Base Command#

tanium-tr-list-connections

Input#
Argument NameDescriptionRequired
limitThe maximum number of connections to return.Optional
offsetThe offset number to begin listing connections.Optional
Context Output#
PathTypeDescription
Tanium.Connection.CreateTimeDateTime when the connection was first created.
Tanium.Connection.NameStringThe connection name.
Tanium.Connection.RemoteBooleanWhether it is a remote connection.
Tanium.Connection.StateStringCurrent connection state. Can be "closed", "pending", "active", "timeout", or "migrating".
Tanium.Connection.DeletedBooleanWhether the connection has been deleted.
Tanium.Connection.DestionationTypeStringThe destionation type (computer_name or ip_address).
Tanium.Connection.DSTStringThe connection's DST.
Tanium.Connection.OSNameStringThe connection's operating system.
Command Example#

!tanium-tr-list-connections limit=2

Context Example#
{
"Tanium": {
"Connection": [
{
"DST": "HOST_NAME",
"Name": "HOST_NAME",
"State": "timeout",
"Deleted": false,
"DestionationType": "computer-name",
"OSName": "Linux"
},
{
"DST": "HOST_NAME-2020_01_09T15.25.13.535Z.db",
"Name": "HOST_NAME-2020_01_09T15.25.13.535Z.db",
"State": "timeout",
"Deleted": false,
"DestionationType": "computer-name"
"OSName": "Linux"
}
]
}
}
Human Readable Output#

Connections#

NameStateDSTOS Name
HOST_NAMEtimeoutHOST_NAMELinux
HOST_NAME-2020_01_09T15.25.13.535Z.dbtimeoutHOST_NAME-2020_01_09T15.25.13.535Z.dbLinux

tanium-tr-get-connection-by-name#


Returns a connection object based on connection name.

Base Command#

tanium-tr-get-connection-by-name

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
Context Output#
PathTypeDescription
Tanium.Connection.CreateTimeDateTime when the connection was first created.
Tanium.Connection.NameStringThe connection name.
Tanium.Connection.RemoteBooleanWhether it is a remote connection.
Tanium.Connection.StateStringCurrent connection state. Can be "closed", "pending", "active", "timeout", or "migrating".
Tanium.Connection.DeletedBooleanWhether the connection has been deleted.
Tanium.Connection.DestionationTypeStringThe destionation type (computer_name or ip_address).
Tanium.Connection.DSTStringThe connection's DST.
Tanium.Connection.OSNameStringThe connection's operating system.
Command Example#

!tanium-tr-get-connection-by-name connection-name=HOST_NAME

Context Example#
{
"Tanium": {
"Connection": {
"CreateTime": "2020-02-06T15:54:40.830Z",
"Name": "HOST_NAME",
"Deleted": false,
"OSName": "Windows",
"Remote": true,
"State": "active"
}
}
}
Human Readable Output#

Connection information#

NameStateRemoteCreate TimeOS Name
HOST_NAMEactivetrue2020-02-06T15:54:40.830ZWindows

tanium-tr-create-connection#


Creates a local or remote connection.

Base Command#

tanium-tr-create-connection

Input#
Argument NameDescriptionRequired
remoteWhether it is a remote connection. Can be "True" or "False".Required
destination-typeType of destination. Can be "ip_address" or "computer_name".Required
destinationComputer name or IP address.Required
connection-timeoutconnection timeout, in milliseconds.Optional
Context Output#

There is no context output for this command.

Command Example#

!tanium-tr-create-connection destination=HOST_NAME destination-type=computer_name remote=False

Human Readable Output#

Initiated connection request to HOST_NAME.

tanium-tr-delete-connection#


Deletes a connection by connection name.

Base Command#

tanium-tr-delete-connection

Input#
Argument NameDescriptionRequired
connection-nameThe name of the connection.Required
Context Output#
PathTypeDescription
Tanium.Connection.NameStringThe connection name.
Tanium.Connection.DeletedBooleanWhether the connection has been deleted.
Command Example#

!tanium-tr-delete-connection connection-name=HOST_NAME

Context Example#
{
"Tanium": {
"Connection": {
"Name": "HOST_NAME",
"Deleted": true
}
}
}
Human Readable Output#

Connection HOST_NAME deleted successfully.

tanium-tr-list-labels#


Returns all available labels in the system.

Base Command#

tanium-tr-list-labels

Input#
Argument NameDescriptionRequired
limitThe maximum number of labels to return.Optional
offsetThe offset number to begin listing labels.Optional
Context Output#
PathTypeDescription
Tanium.Label.CreatedAtDateThe date when this label was created.
Tanium.Label.DescriptionStringAn extended description of the label.
Tanium.Label.IDNumberThe unique identifier for this label.
Tanium.Label.IndicatorCountNumberThe number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.NameStringThe display name of the label.
Tanium.Label.SignalCountNumberThe number of Tanium Signal documents associated with this label.
Tanium.Label.UpdatedAtDateThe date when this label was last updated, not including the intel and signal counts.
Command Example#

!tanium-tr-list-labels limit=2

Context Example#
{
"Tanium": {
"Label": [
{
"CreatedAt": "2019-07-31T18:46:28.629Z",
"Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
"ID": 1,
"IndicatorCount": 0,
"Name": "Alpha",
"SignalCount": 0,
"UpdatedAt": "2019-07-31T18:46:28.629Z"
},
{
"CreatedAt": "2019-07-31T18:46:28.629Z",
"Description": "These signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.",
"ID": 2,
"IndicatorCount": 0,
"Name": "Beta",
"SignalCount": 97,
"UpdatedAt": "2019-07-31T18:46:28.629Z"
}
]
}
}
Human Readable Output#

Labels#

NameDescriptionIDIndicator CountSignal CountCreated AtUpdated At
AlphaThese signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.1002019-07-31T18:46:28.629Z2019-07-31T18:46:28.629Z
BetaThese signals have been tested and reviewed internally for syntax. Internal testing of expected alert generation has been verified. Testing on internal systems for false positives has been conducted and tuned if necessary. These signals are included on the external feed.20972019-07-31T18:46:28.629Z2019-07-31T18:46:28.629Z

tanium-tr-get-label-by-id#


Returns a label object based on label ID.

Base Command#

tanium-tr-get-label-by-id

Input#
Argument NameDescriptionRequired
label-idThe label ID.Required
Context Output#
PathTypeDescription
Tanium.Label.CreatedAtDateThe date when this label was created.
Tanium.Label.DescriptionStringAn extended description of the label.
Tanium.Label.IDNumberThe unique identifier for this label.
Tanium.Label.IndicatorCountNumberThe number of indicator-based intel documents associated with this label, not including Tanium Signals.
Tanium.Label.NameStringThe display name of the label.
Tanium.Label.SignalCountNumberThe number of Tanium Signal documents associated with this label.
Tanium.Label.UpdatedAtDateThe date this label was last updated, not including the intel and signal counts.
Command Example#

!tanium-tr-get-label-by-id label-id=1

Context Example#
{
"Tanium": {
"Label": {
"CreatedAt": "2019-07-31T18:46:28.629Z",
"Description": "These signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.",
"ID": 1,
"IndicatorCount": 0,
"Name": "Alpha",
"SignalCount": 0,
"UpdatedAt": "2019-07-31T18:46:28.629Z"
}
}
}
Human Readable Output#

Label information#

NameDescriptionIDIndicator CountSignal CountCreated AtUpdated At
AlphaThese signals have been tested and reviewed internally for syntax. Little or no testing of expected alert generation has been conducted. These signals are not included on the external feed.1002019-07-31T18:46:28.629Z2019-07-31T18:46:28.629Z

tanium-tr-list-file-downloads#


Returns all downloaded files in the system.

Base Command#

tanium-tr-list-file-downloads

Input#
Argument NameDescriptionRequired
limitThe maximum number of files to return. The default value is 50.Optional
offsetOffset to start getting file downloads. The default is 0.Optional
hostFilter downloaded files by host.Optional
Context Output#
PathTypeDescription
Tanium.FileDownload.SizeNumberThe size of the file, in bytes.
Tanium.FileDownload.PathStringThe path of the file.
Tanium.FileDownload.DownloadedDateThe date when this file was downloaded.
Tanium.FileDownload.HostStringThe hostname of the downloaded file.
Tanium.FileDownload.CreatedDateThe date when the file was created.
Tanium.FileDownload.HashStringThe file hash.
Tanium.FileDownload.SPathStringThe file SPath.
Tanium.FileDownload.IDNumberThe downloaded file ID.
Tanium.FileDownload.LastModifiedDateThe date when the file was last modified.
Tanium.FileDownload.CreatedByStringThe user that created this file.
Tanium.FileDownload.CreatedByProcStringThe process path that created this file.
Tanium.FileDownload.LastModifiedByStringThe user that last modified this file.
Tanium.FileDownload.LastModifiedByProcStringThe process path that modified this file.
Tanium.FileDownload.CommentsStringAdditional comments for the downloaded file.
Tanium.FileDownload.TagsStringThe downloaded file tags.
Tanium.FileDownload.DeletedBooleanWhether the file download has been deleted.
Command Example#

!tanium-tr-list-file-downloads host=HOST_NAME limit=2 offset=1

Context Example#
{
"Tanium": {
"FileDownload": [
{
"Created": "2020-01-02 15:39:57.289",
"CreatedBy": "NT AUTHORITY\\LOCAL SERVICE",
"CreatedByProc": "C:\\Windows\\System32\\svchost.exe",
"Downloaded": "2020-01-02 15:40:29.003",
"Hash": "2ae2da9237309b13b9a9d52d1358c826",
"Host": "HOST_NAME",
"ID": 4,
"LastModified": "2020-01-02 15:39:57.289",
"LastModifiedBy": "NT AUTHORITY\\LOCAL SERVICE",
"LastModifiedByProc": "C:\\Windows\\System32\\svchost.exe",
"Path": "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive1.dat",
"SPath": "6ae86937-611f-45e9-900c-3ba57298f264.zip",
"Size": 2048,
"Deleted": false
},
{
"Created": "Tue, 03 Sep 2019 17:51:40 GMT",
"Downloaded": "2020-01-15 13:04:02.827",
"Hash": "99297a0e626ca092ff1884ad28f54453",
"Host": "HOST_NAME",
"ID": 6,
"LastModified": "Wed, 15 Jan 2020 08:57:19 GMT",
"Path": "C:\\Program Files (x86)\\Tanium\\Tanium Client\\Logs\\log1.txt",
"SPath": "c0531415-87a6-4d28-a226-b485784b1881.zip",
"Size": 10485904,
"Deleted": true
}
]
}
}
Human Readable Output#

File downloads#

IDHostPathHashDownloadedSizeCreatedCreated ByCreated By ProcLast ModifiedLast Modified ByLast Modified By ProcS Path
4HOST_NAMEC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat2ae2da9237309b13b9a9d52d1358c8262020-01-02 15:40:29.00320482020-01-02 15:39:57.289NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exe2020-01-02 15:39:57.289NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exe6ae86937-611f-45e9-900c-3ba57298f264.zip
6HOST_NAMEC:\Program Files (x86)\Tanium\Tanium Client\Logs\log1.txt99297a0e626ca092ff1884ad28f544532020-01-15 13:04:02.82710485904Tue, 03 Sep 2019 17:51:40 GMTWed, 15 Jan 2020 08:57:19 GMTc0531415-87a6-4d28-a226-b485784b1881.zip

tanium-tr-get-downloaded-file#


Gets the actual content of a downloaded file by file ID.

Base Command#

tanium-tr-get-downloaded-file

Input#
Argument NameDescriptionRequired
file-idThe file ID.Required
Context Output#

There is no context output for this command.

Command Example#

!tanium-tr-get-downloaded-file file-id=4

Context Example#
{
"File": {
"EntryID": "8389@b32fdf18-1c65-43af-8918-7f85a1fab951",
"Extension": "zip",
"Info": "application/zip",
"MD5": "216923cc567afe1009e7c90c105450f5",
"Name": "lastalive1.dat.zip",
"SHA1": "f7d257dc94ea0b650f62cc87264861b593a341c8",
"SHA256": "5d0051b4c596e06217bdb3e48196b0515a7983f18a8ea7477bc33c837e0202e5",
"SHA512": "269669cda90658e1bfea8ff85f27f8f68320ccd3b54c64a00037204fa3b5422634d9107806ddad585fa0d5c7fe7aa7fa240afb4142c6ff02537b039d176bd482",
"SSDeep": "6:5jPRX/CSkILyratwQte+zetPYwCRXgLrCDh/+loUn:5jtCCPtTzep33vCDJaoUn",
"Size": 253,
"Type": "Zip archive data, at least v2.0 to extract"
}
}
Human Readable Output#

tanium-tr-list-events-by-connection#


Queries events for a connection.

Base Command#

tanium-tr-list-events-by-connection

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
event-typeThe type of event. Can be "File", "Network", "Registry", "Process", "Driver", "Security", "Combined", "DNS", or "Image". The default is "Combined".Required
limitThe maximum number of events to return. The default value is 50.Optional
offsetOffset to start getting the result set. The default is 0.Optional
filterAdvanced search that filters according to event fields. For example: [['process_id', 'gt', '30'], ['username', 'ne', 'administrator']]. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC). Optional operators: eq (equals), ne (does not equal); for integers/date: gt (greater than), gte (greater than or equals), ls (less than), lse (less than or equals); for strings: co (contains), nc (does not contain).Optional
matchWhether the results should fit all filters or at least one filter.Optional
sortA comma-separated list of fields to sort on prefixed by +/- for ascending or descending and ordered by priority left to right. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time (UTC).Optional
fieldsA comma-separated list of fields on which to search. Optional fields: process_id, process_name, process_hash, process_command_line, username, process_name, create_time.Optional
Context Output#
PathTypeDescription
TaniumEvent.DomainStringThe domain of the event.
TaniumEvent.FileStringThe path of the file in the event.
TaniumEvent.OperationStringThe event operation.
TaniumEvent.ProcessIDNumberThe ID of the process.
TaniumEvent.ProcessNameStringThe name of the process.
TaniumEvent.ProcessTableIDNumberThe ID of the process table.
TaniumEvent.TimestampDateThe date when the event was created.
TaniumEvent.UsernameStringThe username associated with the event.
TaniumEvent.DestinationAddressStringThe network event destination address.
TaniumEvent.DestinationPortNumberThe network event destination port.
TaniumEvent.SourceAddressStringThe network event source address.
TaniumEvent.SourcePortNumberThe network event source port.
TaniumEvent.KeyPathStringThe registry key path.
TaniumEvent.ValueNameStringThe registry value name.
TaniumEvent.ExitCodeNumberThe process exit code.
TaniumEvent.ProcessCommandLineStringThe process command line.
TaniumEvent.ProcessHashStringThe hash value of the process.
TaniumEvent.SIDNumberThe process SID.
TaniumEvent.HashesStringThe hashes of the driver.
TaniumEvent.ImageLoadedStringThe image loaded path of the driver.
TaniumEvent.SignatureStringThe signature of the driver.
TaniumEvent.SignedBooleanWhether the driver is signed.
TaniumEvent.EventIDNumberThe ID of the event.
TaniumEvent.EventOpcodeNumberThe event opcode.
TaniumEvent.EventRecordIDNumberThe ID of the event record.
TaniumEvent.EventTaskIDNumberThe ID of the event task.
TaniumEvent.QueryStringThe query of the DNS.
TaniumEvent.ResponseStringThe response of the DNS.
TaniumEvent.ImagePathStringThe image path.
TaniumEvent.CreationTimeDateThe process creation time
TaniumEvent.EndTimeDateThe process end time.
TaniumEvent.EventTaskNameStringThe name of the event task.
TaniumEvent.Property.NameStringThe name of the event's property
TaniumEvent.Property.ValueStringThe value of the event's property
Command Example#

!tanium-tr-list-events-by-connection connection-name=HOST_NAME event-type=Process limit=2

Context Example#
{
"Tanium": {
"Event": [
{
"Domain": "root",
"Type": "Process",
"CreationTime": "2020-03-02 16:05:37.574",
"EndTime": "2020-03-03 11:28:28.413",
"ExitCode": 0,
"ProcessCommandLine": "sleep 0.1",
"ProcessID": 13136,
"ProcessName": "/usr/bin/sleep",
"ProcessTableID": 17191168,
"SID": 5,
"Username": "root"
},
{
"Domain": "root",
"Type": "Process",
"CreationTime": "2020-03-02 23:09:33.153",
"EndTime": "2020-03-03 08:48:05.624",
"ExitCode": 0,
"ProcessCommandLine": "sleep 0.1",
"ProcessHash": "BEA3A5351BBE28622A560FF5F18C805E",
"ProcessID": 4229,
"ProcessName": "/usr/bin/sleep",
"ProcessTableID": 17232881,
"SID": 5,
"Username": "root"
}
]
}
}
Human Readable Output#

Events for HOST_NAME#

DomainTypeProcess Table IDProcess Command LineProcess IDProcess NameExit CodeSIDUsernameCreation TimeEnd Time
rootProcess17191168sleep 0.113136/usr/bin/sleep05root2020-03-02 16:05:37.5742020-03-03 11:28:28.413
rootProcess17232881sleep 0.14229/usr/bin/sleep05root2020-03-02 23:09:33.1532020-03-03 08:48:05.624

tanium-tr-get-file-download-info#


Gets the metadata of a file download. You must supply either the path or id agument for the command to run successfully.

Base Command#

tanium-tr-get-file-download-info

Input#
Argument NameDescriptionRequired
hostThe hostname of the downloaded file.Required
pathThe path of the file.Optional
idFile download ID.Optional
Context Output#
PathTypeDescription
Tanium.FileDownload.SizeNumberThe size of the file, in bytes.
Tanium.FileDownload.PathStringThe path of the file.
Tanium.FileDownload.DownloadedDateThe date when this file was downloaded.
Tanium.FileDownload.HostStringThe hostname of the downloaded file.
Tanium.FileDownload.CreatedDateThe date when the file was created.
Tanium.FileDownload.HashStringThe file hash.
Tanium.FileDownload.SPathStringThe file SPath.
Tanium.FileDownload.IDNumberThe downloaded file ID.
Tanium.FileDownload.LastModifiedDateThe date when the file was last modified.
Tanium.FileDownload.CreatedByStringThe user that created this file.
Tanium.FileDownload.CreatedByProcStringThe process path that created this file.
Tanium.FileDownload.LastModifiedByStringThe user that last modified this file.
Tanium.FileDownload.LastModifiedByProcStringThe process path that modified this file.
Tanium.FileDownload.CommentsStringThe downloaded file comments.
Tanium.FileDownload.TagsStringThe downloaded file tags.
Tanium.FileDownload.DeletedBooleanWhether the file download has been deleted.
Command Example#

!tanium-tr-get-file-download-info host=HOST_NAME id=4

Context Example#
{
"Tanium": {
"FileDownload": {
"Created": "2020-01-02 15:39:57.289",
"CreatedBy": "NT AUTHORITY\\LOCAL SERVICE",
"CreatedByProc": "C:\\Windows\\System32\\svchost.exe",
"Downloaded": "2020-01-02 15:40:29.003",
"Hash": "2ae2da9237309b13b9a9d52d1358c826",
"Host": "HOST_NAME",
"ID": 4,
"LastModified": "2020-01-02 15:39:57.289",
"LastModifiedBy": "NT AUTHORITY\\LOCAL SERVICE",
"LastModifiedByProc": "C:\\Windows\\System32\\svchost.exe",
"Path": "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive1.dat",
"SPath": "6ae86937-611f-45e9-900c-3ba57298f264.zip",
"Size": 2048,
"Deleted": false
}
}
}
Human Readable Output#

File download metadata for file C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat#

IDHostPathHashDownloadedSizeCreatedCreated ByCreated By ProcLast ModifiedLast Modified ByLast Modified By ProcS Path
4HOST_NAMEC:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat2ae2da9237309b13b9a9d52d1358c8262020-01-02 15:40:29.00320482020-01-02 15:39:57.289NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exe2020-01-02 15:39:57.289NT AUTHORITY\LOCAL SERVICEC:\Windows\System32\svchost.exe6ae86937-611f-45e9-900c-3ba57298f264.zip

tanium-tr-get-process-info#


Get information for a process.

Base Command#

tanium-tr-get-process-info

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
ptidThe process instance ID.Required
Context Output#
PathTypeDescription
Tanium.Process.CreateTimeDateTime when the process was created.
Tanium.Process.DomainStringThe domain of the process.
Tanium.Process.ExitCodeNumberThe process exit code.
Tanium.Process.ProcessCommandLineStringThe process command line.
Tanium.Process.ProcessIDNumberThe ID of the process.
Tanium.Process.ProcessNameStringFile of the process.
Tanium.Process.ProcessTableIdNumberThe ID of the process table.
Tanium.Process.SIDStringThe security ID of the process.
Tanium.Process.UsernameStringThe username who created the process.
Command Example#

!tanium-tr-get-process-info ptid=667680 connection-name=HOST_NAME limit=5

Context Example#
{
"Tanium": {
"Process": {
"CreateTime": "2020-01-22 16:16:07.553",
"Domain": "NT AUTHORITY",
"ExitCode": 0,
"ProcessCommandLine": "System",
"ProcessID": 4,
"ProcessName": "System",
"ProcessTableId": 667680,
"SID": "S-1-5-18",
"Username": "SYSTEM"
}
}
}
Human Readable Output#

Process information for process with PTID 667680#

Process IDProcess NameProcess Command LineProcess Table IdSIDUsernameDomainExit CodeCreate Time
4SystemSystem667680S-1-5-18SYSTEMNT AUTHORITY02020-01-22 16:16:07.553

tanium-tr-get-events-by-process#


Gets the events for a process.

Base Command#

tanium-tr-get-events-by-process

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
ptidThe process instance ID.Required
limitThe maximum number of events to return.Optional
offsetThe offset number to begin listing events.Optional
Context Output#
PathTypeDescription
Tanium.ProcessEvent.IDNumberThe ID of the event.
Tanium.ProcessEvent.DetailUnknownThe event details.
Tanium.ProcessEvent.OperationStringThe event operation.
Tanium.ProcessEvent.TimestampDateTime when the event was created.
Tanium.ProcessEvent.TypeStringThe event type.
Command Example#

!tanium-tr-get-events-by-process ptid=667680 connection-name=HOST_NAME limit=1

Context Example#
{
"Tanium": {
"ProcessEvent": {
"Detail": "4: System",
"ID": 667680,
"Operation": "CreateProcess",
"Timestamp": "2020-01-22 16:16:07.553",
"Type": "Process"
}
}
}
Human Readable Output#

Events for process 667680#

IDDetailTypeTimestampOperation
6676804: SystemProcess2020-01-22 16:16:07.553CreateProcess

tanium-tr-get-process-children#


Gets the children of this process instance.

Base Command#

tanium-tr-get-process-children

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
ptidThe process instance ID.Required
Context Output#
PathTypeDescription
Tanium.ProcessChildren.IDNumberThe ID of the process.
Tanium.ProcessChildren.NameStringFile of the process.
Tanium.ProcessChildren.PIDNumberThe PID of the process.
Tanium.ProcessChildren.PTIDNumberThe process instance ID.
Tanium.ProcessChildren.ParentStringThe parent process name.
Command Example#

!tanium-tr-get-process-children ptid=667680 connection-name=HOST_NAME

Context Example#
{
"Tanium": {
"ProcessChildren": [
{
"ID": 667681,
"Name": "0: Unknown Process",
"PID": 0,
"PTID": 667681,
"Parent": "4: System"
},
{
"ID": 667682,
"Name": "1: Pruned Process",
"PID": 1,
"PTID": 667682,
"Parent": "4: System"
},
{
"ID": 667683,
"Name": "392: smss.exe",
"PID": 392,
"PTID": 667683,
"Parent": "4: System"
}
]
}
}
Human Readable Output#

Children for process with PTID 667680#

IDNamePIDPTIDParentChildren Count
6676810: Unknown Process06676814: System0
6676821: Pruned Process16676824: System0
667683392: smss.exe3926676834: System0

tanium-tr-get-parent-process#


Gets information for the parent process.

Base Command#

tanium-tr-get-parent-process

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
ptidThe process instance ID.Required
Context Output#
PathTypeDescription
Tanium.Process.CreateTimeDateTime when the process was created.
Tanium.Process.DomainStringThe domain of the process.
Tanium.Process.ExitCodeNumberThe process exit code.
Tanium.Process.ProcessCommandLineStringThe process command line.
Tanium.Process.ProcessIDNumberThe ID of the process.
Tanium.Process.ProcessNameStringFile of the process.
Tanium.Process.ProcessTableIdNumberThe ID of the process table.
Tanium.Process.SIDStringThe security ID of the process.
Tanium.Process.UsernameStringThe username who created the process.
Command Example#

!tanium-tr-get-parent-process ptid=667681 connection-name=HOST_NAME

Context Example#
{
"Tanium": {
"ParentProcess": {
"CreateTime": "2020-01-22 16:16:07.553",
"Domain": "NT AUTHORITY",
"ExitCode": 0,
"ProcessCommandLine": "System",
"ProcessID": 4,
"ProcessName": "System",
"ProcessTableId": 667680,
"SID": "S-1-5-18",
"Username": "SYSTEM"
}
}
}
Human Readable Output#

Process information for process with PTID 667681#

Process IDProcess NameProcess Command LineProcess Table IdSIDUsernameDomainExit CodeCreate Time
4SystemSystem667680S-1-5-18SYSTEMNT AUTHORITY02020-01-22 16:16:07.553

tanium-tr-get-parent-process-tree#


Gets the parent process tree for the process instance.

Base Command#

tanium-tr-get-parent-process-tree

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
ptidThe process instance ID.Required
Context Output#
PathTypeDescription
Tanium.ParentProcessTree.IDNumberThe parent process ID.
Tanium.ParentProcessTree.NameStringFile of the parent process.
Tanium.ParentProcessTree.PIDNumberThe parent process PID.
Tanium.ParentProcessTree.PTIDNumberThe parent process instance ID.
Tanium.ParentProcessTree.ParentStringThe parent process name.
Tanium.ParentProcessTree.ChildrenUnknownThe parent process children.
Command Example#

!tanium-tr-get-parent-process-tree ptid=667681 connection-name=HOST_NAME

Context Example#
{
"Tanium": {
"ParentProcessTree": {
"Children": [
{
"Children": [],
"ID": 667681,
"Name": "0: Unknown Process",
"PID": 0,
"PTID": 667681,
"Parent": "4: System"
},
{
"Children": [],
"ID": 667682,
"Name": "1: Pruned Process",
"PID": 1,
"PTID": 667682,
"Parent": "4: System"
},
{
"Children": [],
"ID": 667683,
"Name": "392: smss.exe",
"PID": 392,
"PTID": 667683,
"Parent": "4: System"
}
],
"ID": 667680,
"Name": "4: System",
"PID": 4,
"PTID": 667680
}
}
}
Human Readable Output#

Parent process for process with PTID 667681#

IDNamePIDPTID
6676804: System4667680

Processes with the same parent#

IDNamePIDPTIDParentChildren Count
6676810: Unknown Process06676814: System0
6676821: Pruned Process16676824: System0
667683392: smss.exe3926676834: System0

tanium-tr-get-process-tree#


Gets the process tree for the process instance.

Base Command#

tanium-tr-get-process-tree

Input#
Argument NameDescriptionRequired
connection-nameThe connection name.Required
ptidThe process instance ID.Required
Context Output#
PathTypeDescription
Tanium.ProcessTree.IDNumberThe process ID.
Tanium.ProcessTree.NameStringFile of the process.
Tanium.ProcessTree.PIDNumberThe process PID.
Tanium.ProcessTree.PTIDNumberThe process instance ID.
Tanium.ProcessTree.ParentStringThe parent process name.
Tanium.ProcessTree.ChildrenUnknownThe process children.
Command Example#

!tanium-tr-get-process-tree ptid=667680 connection-name=HOST_NAME

Context Example#
{
"Tanium": {
"ProcessTree": {
"Children": [
{
"Children": [],
"ID": 667681,
"Name": "0: Unknown Process",
"PID": 0,
"PTID": 667681,
"Parent": "4: System"
},
{
"Children": [],
"ID": 667682,
"Name": "1: Pruned Process",
"PID": 1,
"PTID": 667682,
"Parent": "4: System"
},
{
"Children": [],
"ID": 667683,
"Name": "392: smss.exe",
"PID": 392,
"PTID": 667683,
"Parent": "4: System"
}
],
"ID": 667680,
"Name": "4: System",
"PID": 4,
"PTID": 667680
}
}
}
Human Readable Output#

Process information for process with PTID 667680#

IDNamePIDPTID
6676804: System4667680

Children for process with PTID 667680#

IDNamePIDPTIDParentChildren Count
6676810: Unknown Process06676814: System0
6676821: Pruned Process16676824: System0
667683392: smss.exe3926676834: System0

tanium-tr-list-evidence#


Returns a list of all available evidence in the system.

Base Command#

tanium-tr-list-evidence

Input#
Argument NameDescriptionRequired
limitThe maximum number of evidences to return. The default value is 50.Optional
offsetOffset to start getting the events result set. The default is 0.Optional
sortA comma-separated list of fields by which to sort, using +/- prefixes for ascending/descending, in order of priority (left to right).Optional
Context Output#
PathTypeDescription
Tanium.Evidence.IDNumberThe evidence ID.
Tanium.Evidence.CreatedAtDateTime when the process was created.
Tanium.Evidence.LastModifiedDateThe date that the file was last modified.
Tanium.Evidence.UserStringThe user of the evidence.
Tanium.Evidence.ConnectionNameStringThe evidence connection name.
Tanium.Evidence.TypeNumberThe evidence type.
Tanium.Evidence.ProcessTableIdNumberThe evidence process table ID.
Tanium.Evidence.TimestampDateThe evidence timestamp.
Tanium.Evidence.SummaryStringThe evidence summary.
Tanium.Evidence.CommentsStringThe evidence comments.
Tanium.Evidence.TagsStringThe evidence tags.
Tanium.Evidence.DeletedBooleanWhether the evident has been deleted.
Command Example#

!tanium-tr-list-evidence limit=2 offset=1 sort=+id

Context Example#
{
"Tanium": {
"Evidence": [
{
"ConnectionName": "HOST_NAME",
"CreatedAt": "2020-01-02 15:40:03",
"ID": 2,
"ProcessTableId": 45632561,
"Summary": "CreateProcess: C:\\Windows\\SysWOW64\\cmd.exe",
"Timestamp": "2020-01-02 15:39:28.809",
"Type": 2,
"UpdatedAt": "2020-01-02 15:40:03",
"User": "actionapprover",
"Deleted": false
},
{
"ConnectionName": "HOST_NAME",
"CreatedAt": "2020-01-13 18:02:01",
"ID": 13,
"ProcessTableId": 4563722,
"Summary": "CreateProcess: C:\\Windows\\System32\\wsqmcons.exe",
"Timestamp": "2020-01-13 18:00:01.010",
"Type": 2,
"UpdatedAt": "2020-01-13 18:02:01",
"User": "HOST_NAME\\administrator",
"Deleted": false
}
]
}
}
Human Readable Output#

Evidence List#

IDTimestampConntection NameUserSummaryTypeCreated AtUpdated AtProcess Table Id
22020-01-02 15:39:28.809HOST_NAMEactionapproverCreateProcess: C:\Windows\SysWOW64\cmd.exe22020-01-02 15:40:032020-01-02 15:40:0345632561
132020-01-13 18:00:01.010HOST_NAMEHOST_NAME\administratorCreateProcess: C:\Windows\System32\wsqmcons.exe22020-01-13 18:02:012020-01-13 18:02:014563722

tanium-tr-get-evidence-by-id#


Gets evidence by evidence ID.

Base Command#

tanium-tr-get-evidence-by-id

Input#
Argument NameDescriptionRequired
evidence-idThe ID of the evidence.Required
Context Output#
PathTypeDescription
Tanium.Evidence.IDNumberThe evidence ID.
Tanium.Evidence.CreatedAtDateTime when the process was created.
Tanium.Evidence.LastModifiedDateThe date that the file was last modified.
Tanium.Evidence.UserStringThe user of the evidence.
Tanium.Evidence.ConnectionNameStringThe evidence connection name.
Tanium.Evidence.TypeNumberThe evidence type.
Tanium.Evidence.ProcessTableIdNumberThe evidence process table ID.
Tanium.Evidence.TimestampDateThe evidence timestamp.
Tanium.Evidence.SummaryStringThe evidence summary.
Tanium.Evidence.CommentsStringThe evidence comments.
Tanium.Evidence.TagsStringThe evidence tags.
Tanium.Evidence.DeletedBooleanWhether the evident has been deleted.
Command Example#

!tanium-tr-get-evidence-by-id evidence-id=2

Context Example#
{
"Tanium": {
"Evidence": {
"CreatedAt": "2020-01-02 15:40:03",
"ConnectionName": "HOST_NAME",
"ProcessTableId": 45632561,
"ID": 2,
"Summary": "CreateProcess: C:\\Windows\\SysWOW64\\cmd.exe",
"Timestamp": "2020-01-02 15:39:28.809",
"Type": 2,
"UpdatedAt": "2020-01-02 15:40:03",
"User": "actionapprover",
"Deleted": false
}
}
}
Human Readable Output#

Label information#

IDTimestampConnection NameUserSummaryTypeCreated AtUpdated AtProcess Table Id
22020-01-02 15:39:28.809HOST_NAMEactionapproverCreateProcess: C:\Windows\SysWOW64\cmd.exe22020-01-02 15:40:032020-01-02 15:40:0345632561

tanium-tr-create-evidence#


Creates an evidence.

Base Command#

tanium-tr-create-evidence

Input#
Argument NameDescriptionRequired
connection-nameThe name of the connection.Required
ptidThe process instance ID.Required
Context Output#

There is no context output for this command.

Command Example#

!tanium-tr-create-evidence connection-name=HOST_NAME connection-name=HOST_NAME ptid=13538572

Human Readable Output#

Evidence have been created.

tanium-tr-delete-evidence#


Deletes an evidence.

Base Command#

tanium-tr-delete-evidence

Input#
Argument NameDescriptionRequired
evidence-idThe ID of the evidence.Required
Context Output#
PathTypeDescription
Tanium.Evidence.IDStringThe evidence ID.
Tanium.Evidence.DeletedBooleanWhether the evidence has been deleted.
Command Example#

!tanium-tr-delete-evidence evidence-id=1

Context Example#
{
"Tanium": {
"Evidence": {
"ID": 2,
"Deleted": true
}
}
}
Human Readable Output#

Evidence 1 has been deleted successfully.

tanium-tr-request-file-download#


Requests a new file download.

Base Command#

tanium-tr-request-file-download

Input#
Argument NameDescriptionRequired
pathPath to file.Required
connection-nameConnection name.Required
Context Output#
PathTypeDescription
Tanium.FileDownload.PathStringThe file download path.
Tanium.FileDownload.ConnectionNameStringThe file download connection name.
Tanium.FileDownload.DownloadedDateDate of the download request.
Tanium.FileDownload.StatusStringStatus of the file download request.
Tanium.FileDownload.IDNumberID of the file download.
Command Example#

!tanium-tr-request-file-download connection-name=HOST_NAME path=dev/autofs

Context Example#
{
"Tanium": {
"FileDownload": {
"Downloaded": "2020-02-06 16:05:40.227674",
"ConnectionName": "HOST_NAME",
"Path": "dev/autofs"
}
}
}
Human Readable Output#

Download request of file autofs has been sent successfully.

tanium-tr-delete-file-download#


Deletes a file download.

Base Command#

tanium-tr-delete-file-download

Input#
Argument NameDescriptionRequired
file-idFile download ID.Required
Context Output#
PathTypeDescription
Tanium.FileDownload.IDStringThe file download ID.
Tanium.FileDownload.DeletedBooleanWhether the file download has been deleted.
Command Example#

!tanium-tr-delete-file-download file-id=3

Context Example#
{
"Tanium": {
"FileDownload": {
"ID": 3,
"Deleted": true
}
}
}
Human Readable Output#

Delete request of file with ID 3 has been sent successfully.

tanium-tr-list-files-in-directory#


Gets a list of files in the given directory.

Base Command#

tanium-tr-list-files-in-directory

Input#
Argument NameDescriptionRequired
pathPath to the directory.Required
connection-nameConnection name.Required
limitThe maximum number of files to return. The default value is 50.Optional
offsetOffset to start getting files. The default is 0.Optional
Context Output#
PathTypeDescription
Tanium.File.CreatedDateTime the file was created.
Tanium.File.SizeNumberThe file size.
Tanium.File.IsDirectoryBooleanWhether or not the file is a directory.
Tanium.File.LastModifiedDateThe date that the file was last modified.
Tanium.File.PathBooleanThe file path.
Tanium.File.PermissionsDateThe file permissions.
Tanium.File.ConnectionNameStringThe host of the file.
Tanium.File.DeletedBooleanWhether the file has been deleted.
Command Example#

!tanium-tr-list-files-in-directory path=`C:\Program Files (x86)\Tanium\Tanium Client\` connection-name=HOST_NAME limit=2

Context Example#
{
"Tanium": {
"File": [
{
"Created": "1970-01-19 03:25:44",
"IsDirectory": false,
"LastModified": "1970-01-19 03:25:44",
"Path": ".detect-engine.lock",
"Permissions": "rw-rw-rw-",
"Size": 0,
"Deleted": false
},
{
"Created": "1970-01-18 21:02:12",
"IsDirectory": true,
"LastModified": "1970-01-19 07:10:05",
"Path": "Downloads",
"Permissions": "rw-rw-rw-",
"Size": 393216,
"Deleted": false
}
]
}
}
Human Readable Output#

Files in directory C:\Program Files (x86)\Tanium\Tanium Client\#

PathSizeCreatedLast ModifiedPermissionsIs Directory
.detect-engine.lock01970-01-19 03:25:441970-01-19 03:25:44rw-rw-rw-false
Downloads3932161970-01-18 21:02:121970-01-19 07:10:05rw-rw-rw-true

tanium-tr-get-file-info#


Gets information about a file from a remote connection.

Base Command#

tanium-tr-get-file-info

Input#
Argument NameDescriptionRequired
connection-nameThe name of the connection.Required
pathThe path to the file.Required
Context Output#
PathTypeDescription
Tanium.File.CreatedDateThe file creation timestamp.
Tanium.File.SizeNumberThe file size.
Tanium.File.IsDirectoryBooleanWhether or not the file is a directory.
Tanium.File.LastModifiedDateThe date that the file was last modified.
Tanium.File.PathStringThe file path.
Tanium.File.ConnectionNameStringThe host of the file.
Tanium.File.DeletedBooleanWhether the file has been deleted.
Command Example#

!tanium-tr-get-file-info connection-name=HOST_NAME path=`C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe`

Context Example#
{
"Tanium": {
"File": {
"Created": "1970-01-18 20:01:58",
"IsDirectory": false,
"LastModified": "1970-01-18 20:01:58",
"Size": 4938736
"Path": "C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe",
"ConnectionName": "HOST_NAME",
"Deleted": false
}
}
}
Human Readable Output#

Information for file C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe#

PathSizeCreatedLast ModifiedIs DirectoryConnection Name
C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe49387361970-01-18 20:01:581970-01-18 20:01:58falseHOST_NAME

tanium-tr-delete-file-from-endpoint#


Deletes a file from the given endpoint.

Base Command#

tanium-tr-delete-file-from-endpoint

Input#
Argument NameDescriptionRequired
connection-nameConnection name.Required
pathPath to file.Required
Context Output#
PathTypeDescription
Tanium.File.PathStringThe file path.
Tanium.File.ConnectionNameStringThe host of the file.
Tanium.File.DeletedBooleanWhether the file has been deleted.
Command Example#

!tanium-tr-delete-file-from-endpoint path=`C:\Program Files (x86)\Tanium\Tanium Client\Logs\log0.txt` connection-name=HOST_NAME

Context Example#
{
"Tanium": {
"File": {
"Path": "C:\Program Files (x86)\Tanium\Tanium Client\Logs\log0.txt",
"ConnectionName": "HOST_NAME",
"Deleted": true
}
}
}
Human Readable Output#

Delete request of file C:\Program Files (x86)\Tanium\Tanium Client\Logs\log0.txt from endpoint HOST_NAME has been sent successfully.

tanium-tr-get-process-timeline#


Gets the process timeline.

Base Command#

tanium-tr-get-process-timeline

Input#
Argument NameDescriptionRequired
connection-nameConnection name.Required
ptidProcess table ID.Required
categoryThe event categories to retrieve. Can be "File", "DNS", "Registry", "Network", "Image", or "Process".Required
limitThe maximum number of events to return. The default value is 50.Optional
offsetOffset to start getting the events. The default is 0.Optional
Context Output#
PathTypeDescription
Tanium.ProcessTimeline.ProcessTableIDNumberThe process instance ID.
Tanium.ProcessTimeline.ConnectionNameStringThe connection name of the process.
Tanium.ProcessTimeline.DateDateEvents date of the process.
Tanium.ProcessTimeline.EventStringEvent of the process.
Tanium.ProcessTimeline.CategoryStringThe event category of the process.
Command Example#

!tanium-tr-get-process-timeline ptid=13530396 connection-name=HOST_NAME category=Process limit=2

Context Example#
{
"Tanium": {
"ProcessTimeline": [
{
"Category": "Process",
"Date": "2020-02-05 10:16:02.319000",
"Event": [
"Process started by root\\root"
]
},
{
"Category": "Process",
"Date": "2020-02-05 10:17:00.000000",
"Event": [
"Process ended"
]
}
]
}
}
Human Readable Output#

Timeline data for process with PTID 13530396#

DateEventCategory
2020-02-05 10:16:02.319000Process started by root\rootProcess
2020-02-05 10:17:00.000000Process endedProcess

tanium-tr-get-download-file-request-status#


Gets the status of the download file request.

Base Command#

tanium-tr-get-download-file-request-status

Input#
Argument NameDescriptionRequired
request-dateDate of the download file request, or example: 2019-09-23T12:55:08.622Required
connection-nameThe connection to which the request was made.Optional
pathThe file path.Optional
Context Output#
PathTypeDescription
Tanium.DownloadFile.IDNumberID of the file download.
Tanium.DownloadFile.ConnectionNameStringHost of the file.
Tanium.DownloadFile.PathStringPath of the file.
Tanium.DownloadFile.StatusStringStatus of the file download request.
Tanium.DownloadFile.DownloadedDateThe date of the download request.
Command Example#

!tanium-tr-get-download-file-request-status request-date=2019-09-23T12:55:08.622

Context Example#
{
"Tanium": {
"FileDownload": {
"Downloaded": "2020-01-02 15:40:18.052",
"ID": 3,
"Status": "Completed",
"Path": "C:\Program Files (x86)\Tanium\Tanium Client\Logs\log1.txt",
"ConnectionName": "HOST_NAME"
}
}
}
Human Readable Output#

File download request status#

IDConnection NameStatusPathDownloaded
3HOST_NAMECompletedC:\Program Files (x86)\Tanium\Tanium Client\Logs\log1.txt2020-01-02 15:40:18.052