Tanium
This Connector integrates Tanium with Swimlane Turbine.
Asset Setup
The asset for this Connector requires the following inputs:
- Session Token
Capabilities
This Connector provides the following capabilities:
- Get alerts from an endpoint
- Get Connection ID
- Get process from an endpoint
- Resolve an alert
- Get Endpoints
Notes
For more information on Tanium is found at: Tanium Main Site
API Documentation Link
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
session | API token or Session ID in the authorization header of all requests that are sent to API Gateway. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Alerts from Endpoint
Get Alerts from an Endpoint
Endpoint
- URL: /plugin/products/gateway/graphql
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
variables | object | Optional | Parameter for Get Alerts from Endpoint |
variables.id | string | Required | Unique identifier |
Input Example
{"json_body":{"variables":{"id":"12345678-90ab-cdef-1234-567890abcdef"}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | object | Response data |
data.directConnectEndpoint | object | Response data |
data.directConnectEndpoint.alerts | object | Response data |
data.directConnectEndpoint.alerts.all | array | Response data |
data.directConnectEndpoint.alerts.all.schema | number | Response data |
data.directConnectEndpoint.alerts.all.key | string | Response data |
data.directConnectEndpoint.alerts.all.type | string | Response data |
data.directConnectEndpoint.alerts.all.ref | object | Response data |
data.directConnectEndpoint.alerts.all.topProcessesExpr | object | Response data |
data.directConnectEndpoint.alerts.all.labels | object | Response data |
data.directConnectEndpoint.alerts.all.pendingAt | string | Response data |
data.directConnectEndpoint.alerts.all.start | string | Response data |
data.directConnectEndpoint.alerts.all.resolvedAt | object | Response data |
data.directConnectEndpoint.alerts.all.leadup | number | Response data |
data.directConnectEndpoint.alerts.all.value | number | Response data |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"directConnectEndpoint":{}}}}
Get Connection ID
Get Connection ID
Endpoint
- URL: /plugin/products/gateway/graphql
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
variables | object | Optional | Parameter for Get Connection ID |
variables.id | string | Required | Unique identifier |
Input Example
{"json_body":{"variables":{"id":"12323"}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | object | Response data |
data.openDirectConnection | object | Response data |
data.openDirectConnection.connectionID | string | Response data |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"openDirectConnection":{}}}}
Get Endpoints
The following query retrieves known endpoints from Tanium.
Endpoint
- URL: /plugin/products/gateway/graphql
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
variables | object | Optional | Parameter for Get Endpoints |
variables.count | number | Optional | Count value |
variables.time | number | Optional | Time value |
Input Example
{"variables":{"count":123,"time":123}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | object | Response data |
data.endpoints | object | Response data |
data.endpoints.edges | array | Response data |
data.endpoints.edges.node | object | Response data |
data.endpoints.edges.node.computerID | string | Response data |
data.endpoints.edges.node.name | string | Response data |
data.endpoints.edges.node.serialNumber | string | Response data |
data.endpoints.edges.node.ipAddress | string | Response data |
Output Example
{"status_code":200,"response_headers":{"X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1","Referrer-Policy":"no-referrer","Server":"restify","x-request-id":"31dd35f5-42a5-4d04-845a-6a3ea7c4304f","tanium-gateway-version":"1.9.72.0000","Content-Encoding":"gzip","cache-control":"no-store","Pragma":"no-cache","Expires":"0","content-type":"application/json; charset=utf-8","Date":"Thu, 16 Nov 2023 16:02:59 GMT","Transfer-Encoding":"chunked"},"reason":"OK","json_bo...
Get Process from Endpoint
Get Process from an Endpoint
Endpoint
- URL: /plugin/products/gateway/graphql
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
variables | object | Optional | Parameter for Get Process from Endpoint |
variables.id | string | Required | Unique identifier |
Input Example
{"json_body":{"variables":{"id":"12323"}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | object | Response data |
data.directConnectEndpoint | object | Response data |
data.directConnectEndpoint.processes | object | Response data |
data.directConnectEndpoint.processes.all | array | Response data |
data.directConnectEndpoint.processes.all.pid | number | Response data |
data.directConnectEndpoint.processes.all.ppid | number | Response data |
data.directConnectEndpoint.processes.all.name | string | Response data |
data.directConnectEndpoint.processes.all.commandLine | string | Response data |
data.directConnectEndpoint.processes.all.userName | string | Response data |
data.directConnectEndpoint.processes.all.groupName | string | Response data |
data.directConnectEndpoint.processes.all.memoryResidentBytes | number | Response data |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"directConnectEndpoint":{}}}}
resolve an alert
Assign Resolved Status to Alert
Endpoint
- URL: /plugin/products/gateway/graphql
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
variables | object | Optional | Parameter for resolve an alert |
variables.guid | string | Required | Unique identifier |
Input Example
{"json_body":{"variables":{"guid":"12345678-90ab-cdef-1234-567890abcdef"}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | object | Response data |
data.threatResponseAlertResolve | object | Response data |
data.threatResponseAlertResolve.resolved | boolean | Response data |
data.threatResponseAlertResolve.guid | string | Response data |
data.threatResponseAlertResolve.error | object | Response data |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"threatResponseAlertResolve":{}}}}
Response Headers
Header | Description | Example |
|---|---|---|
cache-control | Directives for caching mechanisms | no-store |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
content-type | The media type of the resource | application/json; charset=utf-8 |
Date | The date and time at which the message was originated | Thu, 16 Nov 2023 16:02:59 GMT |
Expires | The date/time after which the response is considered stale | 0 |
Pragma | HTTP response header: Pragma | no-cache |
Referrer-Policy | HTTP response header: Referrer-Policy | no-referrer |
Server | Information about the software used by the origin server | restify |
tanium-gateway-version | HTTP response header: tanium-gateway-version | 1.9.72.0000 |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN |
x-request-id | A unique identifier for the request | 31dd35f5-42a5-4d04-845a-6a3ea7c4304f |
X-XSS-Protection | HTTP response header: X-XSS-Protection | 1 |