Tanium Platform

The Tanium Platform connector enables automated interaction with the Tanium server for real-time endpoint data collection and action execution.

Tanium provides comprehensive endpoint management and security, enabling real-time visibility and control over IT environments. The Tanium Platform connector for Swimlane Turbine allows users to initiate deployments, actions, and queries on endpoints, enhancing incident response and operational efficiency. By leveraging this integration, security teams can automate critical tasks, rapidly respond to incidents, and access real-time endpoint data, all within the Swimlane Turbine's low-code automation platform. This connector empowers users to extend their security capabilities and streamline endpoint management workflows, ensuring a proactive and informed security posture.

Prerequisites

To effectively utilize the Tanium Platform connector with Swimlane Turbine, ensure you have the following prerequisites:

API Key Authentication with the following parameters:

URL: The endpoint URL for the Tanium server.

API Token: A valid API token generated from the Tanium console for authentication.

Capabilities

This connector provides the following capabilities:

Create Action

Create Action by Host

Create Question

Get Question Results by ID

Get System Status

Asset Setup

To generate an API Token, please follow the instructions below:

From the homepage after logging into your Tanium instance, Navigate to Administration -> API Tokens

Click on New API Token at the right side of the page.

Set the Expiration, Persona and Trusted IP Addresses details and click on Create.

Note: Only IP addresses mentioned in Trusted IP Addresses, will be able to make successful connections to the API. If you want to allow any IP, use 0.0.0.0/0 as the Trusted IP address.

Action Setup

Create Action

The Action Object input to this action can be given in one of two ways:

Using the predefined parameters in the JSON Body parameters.

Using the Custom Action Object parameter. This will override all other parameters.

Create Question

This action takes a question object in string format as input.

The following are some examples of the Question Object:

## Example object


{
    "query_text" : "Get Sample Sensor from all machines",
    "selects" : [
        {
            "group" : {
                "and_flag" : false,
                "deleted_flag" : false,
                "filters" : [],
                "not_flag" : false,
                "sub_groups" : []
            },
            "sensor" : {
                "hash" : 393862523,
                "name" : "Sample Sensor"
            }
        }
    ],
    "sensor_references" : [
        {
            "name" : "Sample Sensor",
            "start_char" : "4"
        }
    ]
}

## Example object (canonical text for parameterized sensor)

{
    "query_text" : "Get Folder Exists[/opt/Tanium/TaniumClient from all machines with Operating System contains Linux"
}

## Example object (canonical text)

{
    "query_text" : "Get Operating System from all machines"
}

Notes

Create Action

Create Question

Configurations

Tanium Platform API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
session	API token or Session ID in the authorization header of all requests that are sent to API Gateway.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create Action

Initiates a deployment of a specified package to targeted machines on a set schedule within the Tanium Platform.

Endpoint

URL: /api/v2/actions

Method: POST

Input

Argument Name	Type	Required	Description
data_body	string	Optional	Custom action object in string format. This will override all other parameters.
action_group	object	Optional	Parameter for Create Action
action_group.id	number	Optional	Unique identifier
package_spec	object	Optional	Parameter for Create Action
package_spec.id	number	Optional	Unique identifier
package_spec.source_id	number	Optional	Unique identifier
package_spec.parameters	array	Optional	Parameters for the Create Action action
package_spec.parameters.key	string	Optional	Parameters for the Create Action action
package_spec.parameters.value	string	Optional	Parameters for the Create Action action
name	string	Optional	Name of the resource
comment	string	Optional	Parameter for Create Action
expiration_time	string	Optional	Time value
priority	number	Optional	Parameter for Create Action
expire_seconds	number	Optional	Parameter for Create Action
target_group	object	Optional	Parameter for Create Action
target_group.id	number	Optional	Unique identifier

Input Example

{"json_body":{"action_group":{"id":3},"package_spec":{"id":73,"source_id":73,"parameters":[{"key":"$1","value":"TestTagForWindowsEndpoints"},{"key":"$2","value":"TestTagForLinuxEndpoints"}]},"name":"Sample Action","comment":"Some Comment","expiration_time":"string","priority":1,"expire_seconds":3600,"target_group":{"id":1}},"data_body":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data
data.name	string	Response data
data.comment	string	Response data
data.target_group	object	Response data
data.target_group.id	number	Response data
data.target_group.name	string	Response data
data.action_group	object	Response data
data.action_group.id	number	Response data
data.action_group.name	string	Response data
data.package_spec	object	Response data
data.package_spec.id	number	Response data
data.package_spec.content_set	object	Response data
data.package_spec.content_set.id	number	Response data
data.package_spec.content_set.name	string	Response data
data.package_spec.name	string	Response data
data.package_spec.display_name	string	Response data
data.package_spec.creation_time	string	Response data
data.package_spec.modification_time	string	Response data
data.package_spec.last_modified_by	string	Response data
data.package_spec.mod_user	object	Response data
data.package_spec.mod_user.id	number	Response data
data.package_spec.mod_user.name	string	Response data

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","date":"Fri, 01 Mar 2024 06:45:08 GMT","cache-control":"private,max-age=0,no-cache,no-store,must-revalidate","pragma":"no-cache","content-type":"application/json...

Create Action by Host

Initiates a new action on specified hosts in Tanium Platform using package specifications and action group details.

Endpoint

URL: /api/v2/actions

Method: POST

Input

Argument Name	Type	Required	Description
host_name	string	Optional	Host Name. Please provide the value for either the Host Name or IP Address.
ip_address	string	Optional	Host Name. Please provide the value for either the Host Name or IP Address.
name	string	Optional	The action name.
expire_seconds	number	Optional	How long from the start time of the action being issued before the action expires.
package_spec	object	Optional	Parameter for Create Action by Host
package_spec.source_id	string	Required	The unique ID of the Package Spec object.
package_spec.parameters	array	Optional	Parameters for the Create Action by Host action
package_spec.parameters.key	string	Optional	Parameters for the Create Action by Host action
package_spec.parameters.value	string	Optional	Parameters for the Create Action by Host action
action_group	object	Optional	Parameter for Create Action by Host
action_group.id	string	Optional	The unique ID of the group object.
action_group.name	string	Optional	A group name. Name must be unique.

Input Example

{"json_body":{"name":"Testing","expire_seconds":"3600","package_spec":{"source_id":"4036","parameters":[{"key":"$1","value":"TestTagForWindowsEndpoints"}]},"action_group":{"id":"4","name":"Test action group 1"}},"host_name":"google","ip_address":"127.4.1.1/24"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data
data.name	string	Response data
data.comment	string	Response data
data.target_group	object	Response data
data.target_group.id	number	Response data
data.target_group.name	string	Response data
data.action_group	object	Response data
data.action_group.id	number	Response data
data.action_group.name	string	Response data
data.package_spec	object	Response data
data.package_spec.id	number	Response data
data.package_spec.content_set	object	Response data
data.package_spec.content_set.id	number	Response data
data.package_spec.content_set.name	string	Response data
data.package_spec.name	string	Response data
data.package_spec.display_name	string	Response data
data.package_spec.creation_time	string	Response data
data.package_spec.modification_time	string	Response data
data.package_spec.last_modified_by	string	Response data
data.package_spec.mod_user	object	Response data
data.package_spec.mod_user.id	number	Response data
data.package_spec.mod_user.name	string	Response data

Output Example

{"data":{"id":123,"name":"Example Name","comment":"string","target_group":{"id":123,"name":"Example Name"},"action_group":{"id":123,"name":"Example Name"},"package_spec":{"id":123,"content_set":{},"name":"Example Name","display_name":"Example Name","creation_time":"string","modification_time":"string","last_modified_by":"string","mod_user":{},"mod_persona":{},"command":"string","command_timeout":123,"expire_seconds":123,"verify_expire_seconds":123,"skip_lock_flag":true,"hidden_flag":true},"skip_...

Create Question

Initiates a new question on the Tanium Server, which is immediately executed to gather information.

Endpoint

URL: /api/v2/questions

Method: POST

Input

Argument Name	Type	Required	Description
data_body	string	Optional	The question object to create in string format.

Input Example

{"data_body":"question_object"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","date":"Fri, 01 Mar 2024 06:21:11 GMT","cache-control":"private,max-age=0,no-cache,no-store,must-revalidate","pragma":"no-cache","content-type":"application/json...

Get Question Results by ID

Retrieve results for a specific question ID from the Tanium Platform, requiring the 'id' as a path parameter.

Endpoint

URL: /api/v2/result_data/question/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Parameters for the Get Question Results by ID action
parameters.most_recent_flag	number	Optional	Parameters for the Get Question Results by ID action
parameters.row_count	number	Optional	Parameters for the Get Question Results by ID action
parameters.row_start	number	Optional	Parameters for the Get Question Results by ID action

Input Example

{"parameters":{"most_recent_flag":0,"row_count":10,"row_start":0},"path_parameters":{"id":15165}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.now	string	Response data
data.result_sets	array	Response data
data.result_sets.id	number	Response data
data.result_sets.report_count	number	Response data
data.result_sets.saved_question_id	number	Response data
data.result_sets.question_id	number	Response data
data.result_sets.seconds_since_issued	number	Response data
data.result_sets.issue_seconds	number	Response data
data.result_sets.expire_seconds	number	Response data
data.result_sets.tested	number	Response data
data.result_sets.passed	number	Response data
data.result_sets.mr_tested	number	Response data
data.result_sets.mr_passed	number	Response data
data.result_sets.estimated_total	number	Response data
data.result_sets.select_count	number	Response data
data.result_sets.error_count	number	Response data
data.result_sets.no_results_count	number	Response data
data.result_sets.row_count	number	Response data
data.result_sets.row_count_machines	number	Response data
data.result_sets.item_count	number	Response data
data.result_sets.filtered_row_count	number	Response data
data.result_sets.filtered_row_count_machines	number	Response data

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","date":"Tue, 05 Mar 2024 06:06:52 GMT","cache-control":"private,max-age=0,no-cache,no-store,must-revalidate","pragma":"no-cache","content-type":"application/json...

Get System Status

Retrieve the current system status of the Tanium Platform server.

Endpoint

URL: /api/v2/system_status

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.tanium-options	object	Optional	HTTP headers for the request
headers.tanium-options.cache_filters	array	Optional	HTTP headers for the request
headers.tanium-options.cache_filters.field	string	Optional	The field to filter on.
headers.tanium-options.cache_filters.operator	string	Optional	HTTP headers for the request
headers.tanium-options.cache_filters.value	string	Optional	The value of the field

Input Example

{"headers":{"tanium-options":{"cache_filters":[{"field":"host_name","operator":"Equal","value":"diffusing.tanium.com"}]}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.computer_id	number	Response data
data.full_version	string	Response data
data.host_name	string	Response data
data.ipaddress_client	string	Response data
data.ipaddress_server	string	Response data
data.last_registration	string	Response data
data.port_number	number	Response data
data.protocol_version	string	Response data
data.public_key_valid	boolean	Response data
data.receive_state	string	Response data
data.registered_with_tls	boolean	Response data
data.registration_error	string	Response data
data.send_state	string	Response data
data.status	string	Response data
data.blocked_count	number	Response data
data.leader_count	number	Response data
data.normal_count	number	Response data
data.receive_backward_count	number	Response data
data.receive_forward_count	number	Response data
data.receive_none_count	number	Response data
data.receive_ok_count	number	Response data
data.registered_with_errors_count	number	Response data

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","date":"Mon, 18 Mar 2024 05:38:05 GMT","cache-control":"private,max-age=0,no-cache,no-store,must-revalidate","pragma":"no-cache","content-type":"application/json...

Response Headers

Header	Description	Example
cache-control	Directives for caching mechanisms	private,max-age=0,no-cache,no-store,must-revalidate
content-encoding	HTTP response header: content-encoding	gzip
content-length	The length of the response body in bytes	1098
content-security-policy	HTTP response header: content-security-policy	default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 'self';worker-src 'self';media-src 'self';style-src 'self' 'unsafe-inline';img-src data: blob: 'self';frame-ancestors 'self';font-src 'self' data:;upgrade-insecure-requests;connect-src * data: blob: 'unsafe-inline';block-all-mixed-content;
Content-Type	The media type of the resource	application/json
date	The date and time at which the message was originated	Sun, 11 Aug 2024 14:14:13 GMT
pragma	HTTP response header: pragma	no-cache
referrer-policy	HTTP response header: referrer-policy	no-referrer
server	Information about the software used by the origin server	envoy
server-timing	HTTP response header: server-timing	action-history-cache-refresh;dur=3.900;cnt=1, api;dur=119.575;cnt=1, api-token-cache-refresh;dur=2.583;cnt=1, auth;dur=7.719;cnt=1, content-set-cache-refresh;dur=1.363;cnt=1, group-cache-refresh;dur=15.346;cnt=2, gzip;dur=0.244;cnt=1, is-action-group-visible;dur=2.857;cnt=2, meta-data-cache-refresh;dur=6.262;cnt=1, package-cache-refresh;dur=9.833;cnt=1, rbac-cache-refresh;dur=3.755;cnt=1, saved-action-cache-refresh;dur=2.536;cnt=1, scim-server-cache-refresh;dur=1.958;cnt=1, user-cache-refresh;dur=3.043;cnt=1
strict-transport-security	HTTP response header: strict-transport-security	max-age=63072000; includeSubDomains;
x-content-type-options	HTTP response header: x-content-type-options	nosniff
x-envoy-upstream-service-time	HTTP response header: x-envoy-upstream-service-time	260
x-frame-options	HTTP response header: x-frame-options	SAMEORIGIN
x-xss-protection	HTTP response header: x-xss-protection	1