--- title: Tanium Platform slug: connectors/tanium-platform docTags: createdAt: 2026-06-09T16:29:34.293Z --- The Tanium Platform connector enables automated interaction with the Tanium server for real-time endpoint data collection and action execution. Tanium provides comprehensive endpoint management and security, enabling real-time visibility and control over IT environments. The Tanium Platform connector for Swimlane Turbine allows users to initiate deployments, actions, and queries on endpoints, enhancing incident response and operational efficiency. By leveraging this integration, security teams can automate critical tasks, rapidly respond to incidents, and access real-time endpoint data, all within the Swimlane Turbine's low-code automation platform. This connector empowers users to extend their security capabilities and streamline endpoint management workflows, ensuring a proactive and informed security posture. ## Prerequisites To effectively utilize the Tanium Platform connector with Swimlane Turbine, ensure you have the following prerequisites: - API Key Authentication with the following parameters: - URL: The endpoint URL for the Tanium server. - API Token: A valid API token generated from the Tanium console for authentication. ## Capabilities This connector provides the following capabilities: - Create Action - Create Action by Host - Create Question - Get Question Results by ID - Get System Status ## Asset Setup To generate an API Token, please follow the instructions below: - From the homepage after logging into your Tanium instance, Navigate to **Administration** -> **API Tokens** - Click on **New API Token** at the right side of the page. - Set the Expiration, Persona and Trusted IP Addresses details and click on **Create**. Note: Only IP addresses mentioned in **Trusted IP Addresses**, will be able to make successful connections to the API. If you want to allow any IP, use **0.0.0.0/0** as the Trusted IP address. ## Action Setup ### Create Action The Action Object input to this action can be given in one of two ways: - Using the predefined parameters in the **JSON Body** parameters. - Using the Custom Action Object parameter. This will override all other parameters. ### Create Question This action takes a question object in string format as input. The following are some examples of the Question Object: ```javascript ## Example object { "query_text" : "Get Sample Sensor from all machines", "selects" : [ { "group" : { "and_flag" : false, "deleted_flag" : false, "filters" : [], "not_flag" : false, "sub_groups" : [] }, "sensor" : { "hash" : 393862523, "name" : "Sample Sensor" } } ], "sensor_references" : [ { "name" : "Sample Sensor", "start_char" : "4" } ] } ``` ```javascript ## Example object (canonical text for parameterized sensor) { "query_text" : "Get Folder Exists[/opt/Tanium/TaniumClient from all machines with Operating System contains Linux" } ``` ```javascript ## Example object (canonical text) { "query_text" : "Get Operating System from all machines" } ``` ## Notes - [Create Action](https://developer.tanium.com/site/global/apis/platform/index.gsp#api-Actions-CreateAction) - [Create Question](https://developer.tanium.com/site/global/apis/platform/index.gsp#api-Questions-CreateQuestion) # Configurations ## Tanium Platform API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | session | API token or Session ID in the authorization header of all requests that are sent to API Gateway. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Create Action Initiates a deployment of a specified package to targeted machines on a set schedule within the Tanium Platform. ### Endpoint - **URL:** `/api/v2/actions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------- | | `data_body` | string | Optional | Custom action object in string format. This will override all other parameters. | | `action_group` | object | Optional | Parameter for Create Action | | `action_group.id` | number | Optional | Unique identifier | | `package_spec` | object | Optional | Parameter for Create Action | | `package_spec.id` | number | Optional | Unique identifier | | `package_spec.source_id` | number | Optional | Unique identifier | | `package_spec.parameters` | array | Optional | Parameters for the Create Action action | | `package_spec.parameters.key` | string | Optional | Parameters for the Create Action action | | `package_spec.parameters.value` | string | Optional | Parameters for the Create Action action | | `name` | string | Optional | Name of the resource | | `comment` | string | Optional | Parameter for Create Action | | `expiration_time` | string | Optional | Time value | | `priority` | number | Optional | Parameter for Create Action | | `expire_seconds` | number | Optional | Parameter for Create Action | | `target_group` | object | Optional | Parameter for Create Action | | `target_group.id` | number | Optional | Unique identifier | ### Input Example `{"json_body":{"action_group":{"id":3},"package_spec":{"id":73,"source_id":73,"parameters":[{"key":"$1","value":"TestTagForWindowsEndpoints"},{"key":"$2","value":"TestTagForLinuxEndpoints"}]},"name":"Sample Action","comment":"Some Comment","expiration_time":"string","priority":1,"expire_seconds":3600,"target_group":{"id":1}},"data_body":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | number | Response data | | `data.name` | string | Response data | | `data.comment` | string | Response data | | `data.target_group` | object | Response data | | `data.target_group.id` | number | Response data | | `data.target_group.name` | string | Response data | | `data.action_group` | object | Response data | | `data.action_group.id` | number | Response data | | `data.action_group.name` | string | Response data | | `data.package_spec` | object | Response data | | `data.package_spec.id` | number | Response data | | `data.package_spec.content_set` | object | Response data | | `data.package_spec.content_set.id` | number | Response data | | `data.package_spec.content_set.name` | string | Response data | | `data.package_spec.name` | string | Response data | | `data.package_spec.display_name` | string | Response data | | `data.package_spec.creation_time` | string | Response data | | `data.package_spec.modification_time` | string | Response data | | `data.package_spec.last_modified_by` | string | Response data | | `data.package_spec.mod_user` | object | Response data | | `data.package_spec.mod_user.id` | number | Response data | | `data.package_spec.mod_user.name` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","date":"Fri, 01 Mar 2024 06:45:08 GMT","cache-control":"private,max-age=0,no-cache,no-store,must-revalidate","pragma":"no-cache","content-type":"application/json...` ## Create Action by Host Initiates a new action on specified hosts in Tanium Platform using package specifications and action group details. ### Endpoint - **URL:** `/api/v2/actions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------- | | `host_name` | string | Optional | Host Name. Please provide the value for either the Host Name or IP Address. | | `ip_address` | string | Optional | Host Name. Please provide the value for either the Host Name or IP Address. | | `name` | string | Optional | The action name. | | `expire_seconds` | number | Optional | How long from the start time of the action being issued before the action expires. | | `package_spec` | object | Optional | Parameter for Create Action by Host | | `package_spec.source_id` | string | Required | The unique ID of the Package Spec object. | | `package_spec.parameters` | array | Optional | Parameters for the Create Action by Host action | | `package_spec.parameters.key` | string | Optional | Parameters for the Create Action by Host action | | `package_spec.parameters.value` | string | Optional | Parameters for the Create Action by Host action | | `action_group` | object | Optional | Parameter for Create Action by Host | | `action_group.id` | string | Optional | The unique ID of the group object. | | `action_group.name` | string | Optional | A group name. Name must be unique. | ### Input Example `{"json_body":{"name":"Testing","expire_seconds":"3600","package_spec":{"source_id":"4036","parameters":[{"key":"$1","value":"TestTagForWindowsEndpoints"}]},"action_group":{"id":"4","name":"Test action group 1"}},"host_name":"google","ip_address":"127.4.1.1/24"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | number | Response data | | `data.name` | string | Response data | | `data.comment` | string | Response data | | `data.target_group` | object | Response data | | `data.target_group.id` | number | Response data | | `data.target_group.name` | string | Response data | | `data.action_group` | object | Response data | | `data.action_group.id` | number | Response data | | `data.action_group.name` | string | Response data | | `data.package_spec` | object | Response data | | `data.package_spec.id` | number | Response data | | `data.package_spec.content_set` | object | Response data | | `data.package_spec.content_set.id` | number | Response data | | `data.package_spec.content_set.name` | string | Response data | | `data.package_spec.name` | string | Response data | | `data.package_spec.display_name` | string | Response data | | `data.package_spec.creation_time` | string | Response data | | `data.package_spec.modification_time` | string | Response data | | `data.package_spec.last_modified_by` | string | Response data | | `data.package_spec.mod_user` | object | Response data | | `data.package_spec.mod_user.id` | number | Response data | | `data.package_spec.mod_user.name` | string | Response data | ### Output Example `{"data":{"id":123,"name":"Example Name","comment":"string","target_group":{"id":123,"name":"Example Name"},"action_group":{"id":123,"name":"Example Name"},"package_spec":{"id":123,"content_set":{},"name":"Example Name","display_name":"Example Name","creation_time":"string","modification_time":"string","last_modified_by":"string","mod_user":{},"mod_persona":{},"command":"string","command_timeout":123,"expire_seconds":123,"verify_expire_seconds":123,"skip_lock_flag":true,"hidden_flag":true},"skip_...` ## Create Question Initiates a new question on the Tanium Server, which is immediately executed to gather information. ### Endpoint - **URL:** `/api/v2/questions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------- | | `data_body` | string | Optional | The question object to create in string format. | ### Input Example `{"data_body":"question_object"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","date":"Fri, 01 Mar 2024 06:21:11 GMT","cache-control":"private,max-age=0,no-cache,no-store,must-revalidate","pragma":"no-cache","content-type":"application/json...` ## Get Question Results by ID Retrieve results for a specific question ID from the Tanium Platform, requiring the 'id' as a path parameter. ### Endpoint - **URL:** `/api/v2/result_data/question/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------------------------------------------- | | `path_parameters.id` | number | Required | Parameters for the Get Question Results by ID action | | `parameters.most_recent_flag` | number | Optional | Parameters for the Get Question Results by ID action | | `parameters.row_count` | number | Optional | Parameters for the Get Question Results by ID action | | `parameters.row_start` | number | Optional | Parameters for the Get Question Results by ID action | ### Input Example `{"parameters":{"most_recent_flag":0,"row_count":10,"row_start":0},"path_parameters":{"id":15165}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.now` | string | Response data | | `data.result_sets` | array | Response data | | `data.result_sets.id` | number | Response data | | `data.result_sets.report_count` | number | Response data | | `data.result_sets.saved_question_id` | number | Response data | | `data.result_sets.question_id` | number | Response data | | `data.result_sets.seconds_since_issued` | number | Response data | | `data.result_sets.issue_seconds` | number | Response data | | `data.result_sets.expire_seconds` | number | Response data | | `data.result_sets.tested` | number | Response data | | `data.result_sets.passed` | number | Response data | | `data.result_sets.mr_tested` | number | Response data | | `data.result_sets.mr_passed` | number | Response data | | `data.result_sets.estimated_total` | number | Response data | | `data.result_sets.select_count` | number | Response data | | `data.result_sets.error_count` | number | Response data | | `data.result_sets.no_results_count` | number | Response data | | `data.result_sets.row_count` | number | Response data | | `data.result_sets.row_count_machines` | number | Response data | | `data.result_sets.item_count` | number | Response data | | `data.result_sets.filtered_row_count` | number | Response data | | `data.result_sets.filtered_row_count_machines` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","date":"Tue, 05 Mar 2024 06:06:52 GMT","cache-control":"private,max-age=0,no-cache,no-store,must-revalidate","pragma":"no-cache","content-type":"application/json...` ## Get System Status Retrieve the current system status of the Tanium Platform server. ### Endpoint - **URL:** `/api/v2/system_status` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------------- | -------- | ------------ | ---------------------------- | | `headers` | object | Optional | HTTP headers for the request | | `headers.tanium-options` | object | Optional | HTTP headers for the request | | `headers.tanium-options.cache_filters` | array | Optional | HTTP headers for the request | | `headers.tanium-options.cache_filters.field` | string | Optional | The field to filter on. | | `headers.tanium-options.cache_filters.operator` | string | Optional | HTTP headers for the request | | `headers.tanium-options.cache_filters.value` | string | Optional | The value of the field | ### Input Example `{"headers":{"tanium-options":{"cache_filters":[{"field":"host_name","operator":"Equal","value":"diffusing.tanium.com"}]}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.computer_id` | number | Response data | | `data.full_version` | string | Response data | | `data.host_name` | string | Response data | | `data.ipaddress_client` | string | Response data | | `data.ipaddress_server` | string | Response data | | `data.last_registration` | string | Response data | | `data.port_number` | number | Response data | | `data.protocol_version` | string | Response data | | `data.public_key_valid` | boolean | Response data | | `data.receive_state` | string | Response data | | `data.registered_with_tls` | boolean | Response data | | `data.registration_error` | string | Response data | | `data.send_state` | string | Response data | | `data.status` | string | Response data | | `data.blocked_count` | number | Response data | | `data.leader_count` | number | Response data | | `data.normal_count` | number | Response data | | `data.receive_backward_count` | number | Response data | | `data.receive_forward_count` | number | Response data | | `data.receive_none_count` | number | Response data | | `data.receive_ok_count` | number | Response data | | `data.registered_with_errors_count` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","date":"Mon, 18 Mar 2024 05:38:05 GMT","cache-control":"private,max-age=0,no-cache,no-store,must-revalidate","pragma":"no-cache","content-type":"application/json...` # Response Headers | **Header** | **Description** | **Example** | | ----------------------------- | -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | cache-control | Directives for caching mechanisms | private,max-age=0,no-cache,no-store,must-revalidate | | content-encoding | HTTP response header: content-encoding | gzip | | content-length | The length of the response body in bytes | 1098 | | content-security-policy | HTTP response header: content-security-policy | default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 'self';worker-src 'self';media-src 'self';style-src 'self' 'unsafe-inline';img-src data: blob: 'self';frame-ancestors 'self';font-src 'self' data:;upgrade-insecure-requests;connect-src \* data: blob: 'unsafe-inline';block-all-mixed-content; | | Content-Type | The media type of the resource | application/json | | date | The date and time at which the message was originated | Sun, 11 Aug 2024 14:14:13 GMT | | pragma | HTTP response header: pragma | no-cache | | referrer-policy | HTTP response header: referrer-policy | no-referrer | | server | Information about the software used by the origin server | envoy | | server-timing | HTTP response header: server-timing | action-history-cache-refresh;dur=3.900;cnt=1, api;dur=119.575;cnt=1, api-token-cache-refresh;dur=2.583;cnt=1, auth;dur=7.719;cnt=1, content-set-cache-refresh;dur=1.363;cnt=1, group-cache-refresh;dur=15.346;cnt=2, gzip;dur=0.244;cnt=1, is-action-group-visible;dur=2.857;cnt=2, meta-data-cache-refresh;dur=6.262;cnt=1, package-cache-refresh;dur=9.833;cnt=1, rbac-cache-refresh;dur=3.755;cnt=1, saved-action-cache-refresh;dur=2.536;cnt=1, scim-server-cache-refresh;dur=1.958;cnt=1, user-cache-refresh;dur=3.043;cnt=1 | | strict-transport-security | HTTP response header: strict-transport-security | max-age=63072000; includeSubDomains; | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-envoy-upstream-service-time | HTTP response header: x-envoy-upstream-service-time | 260 | | x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN | | x-xss-protection | HTTP response header: x-xss-protection | 1 |