Tanium Threat Response

Prerequisites

To authenticate this connector, you need an API Token.

Capabilities

This connector provides the following capabilities:

Create Connection

Create liveResponse Action

Download File Evidence

Get Alert by ID

Get Collection Configs

Get Intel Doc by ID

Get Response Actions

List Alerts

List Connections

List File Evidence

Update Alert State by ID

Asset Setup

To generate an API Token, please follow the instructions below:

From the homepage after logging into your Tanium instance, Navigate to Administration -> API Tokens

Click on New API Token at the right side of the page.

Set the Expiration, Persona and Trusted IP Addresses details and click on Create.

Note: Only IP addresses mentioned in Trusted IP Addresses, will be able to make successful connections to the API. If you want to allow any IP, use 0.0.0.0/0 as the Trusted IP address.

Configurations

Tanium Threat Response API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
session	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create Connection

Create a user connection.

Endpoint

URL: /plugin/products/threat-response/api/v1/conns/connect

Method: POST

Input

Argument Name	Type	Required	Description
target	object	Optional	Parameter for Create Connection
target.hostname	string	Optional	Name of the resource
target.clientId	string	Optional	Unique identifier
target.platform	string	Optional	Parameter for Create Connection
target.ip	string	Optional	Parameter for Create Connection

Input Example

{"json_body":{"target":{"hostname":"localhost","clientId":"2871630594","platform":"Linux","ip":"10.70.145.92"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":202,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"0dc48760-a134-4fb1-81b3-7775eaccced0","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...

Create liveResponse Action

Creates a new liveResponse action.

Endpoint

URL: /plugin/products/threat-response/api/v1/response-actions

Method: POST

Input

Argument Name	Type	Required	Description
type	string	Optional	Response action type. Do not change.
computerName	string	Optional	Name of the resource
eid	number	Optional	Unique identifier
options	object	Optional	Parameter for Create liveResponse Action
options.packageName	string	Required	Package to deploy for this response action.
options.packageParameters	array	Required	Parameters for the package being deployed. At least 4 parameters should be defined.
options.packageParameters.key	string	Optional	Parameters for the Create liveResponse Action action
options.packageParameters.value	string	Optional	Parameters for the Create liveResponse Action action
expirationTime	string	Optional	Time value

Input Example

{"json_body":{"type":"liveResponse","computerName":"computerName","eid":4,"options":{"packageName":"Threat Response - Live Response [Windows]","packageParameters":[{"key":"$1","value":"Memory Collection"},{"key":"$2","value":"test aws"},{"key":"$3","value":"collectionSet"},{"key":"$4","value":"DestinationSet"}]},"expirationTime":"2019-09-20T13:50:53.699Z"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.type	string	Response data
data.computerName	string	Response data
data.options	object	Response data
data.options.packageName	string	Response data
data.options.packageParameters	array	Parameters for the Create liveResponse Action action
data.options.packageParameters.key	string	Parameters for the Create liveResponse Action action
data.options.packageParameters.value	string	Parameters for the Create liveResponse Action action
data.options.packageSkipLockFlag	boolean	Response data
data.status	string	Response data
data.userId	number	Response data
data.personaId	object	Response data
data.userName	string	Response data
data.results	object	Response data
data.expirationTime	string	Response data
data.createdAt	string	Response data
data.updatedAt	string	Response data
data.id	number	Response data
data.eid	object	Response data

Output Example

{"status_code":201,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"44bbb276-26ce-4a5d-9952-d1bfb3a57442","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...

Download File Evidence

Download the File Evidence File.

Endpoint

URL: /plugin/products/threat-response/api/v1/filedownload/data/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Download File Evidence action

Input Example

{"path_parameters":{"id":"string"}}

Output

Parameter	Type	Description
file	object	Attachments
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"file":{"file":"string","file_name":"Example Name"}}

Get Alert by ID

Get an alert by ID.

Endpoint

URL: /plugin/products/threat-response/api/v1/alerts/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Parameters for the Get Alert by ID action

Input Example

{"path_parameters":{"id":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data
data.state	string	Response data
data.type	string	Response data
data.guid	string	Response data
data.priority	object	Response data
data.severity	string	Response data
data.intelDocId	number	Response data
data.intelDocRevisionId	number	Response data
data.scanConfigId	number	Response data
data.scanConfigRevisionId	number	Response data
data.computerName	string	Response data
data.computerIpAddress	string	Response data
data.eid	number	Response data
data.details	string	Response data
data.alertedAt	string	Response data
data.createdAt	string	Response data
data.updatedAt	string	Response data

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"dad03cb0-49fc-49e4-86ec-e5f2165dd8fd","tanium-threat-response-version":"4.5.126.0000","content-encoding":"gzip","cache-control":...

Get Collection Configs

Gets all of the live response collection configs, with offset, limit.

Endpoint

URL: /plugin/products/threat-response/api/v1/liveresponse/collectionConfigs

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Get Collection Configs action
parameters.offset	number	Optional	Parameters for the Get Collection Configs action

Input Example

{"parameters":{"limit":1000,"offset":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	number	Response data
data.name	string	Response data
data.description	string	Response data
data.enabledModules	array	Response data
data.enabled	boolean	Response data
data.userDefined	boolean	Response data
data.revision	number	Response data
data.createdAt	string	Response data
data.updatedAt	string	Response data
data.hashes	array	Response data
data.fileCollectors	array	Response data
data.fileCollectors.file_name	string	Response data
data.fileCollectors.file	string	Response data
data.fileCollectorSets	array	Response data
data.fileCollectorSets.id	number	Response data
data.fileCollectorSets.name	string	Response data
data.fileCollectorSets.description	string	Response data
data.fileCollectorSets.enabled	boolean	Response data
data.fileCollectorSets.userDefined	boolean	Response data
data.fileCollectorSets.revision	number	Response data
data.fileCollectorSets.createdAt	string	Response data
data.fileCollectorSets.updatedAt	string	Response data

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"04d59489-3380-4d86-9b6c-1439da1c4a89","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...

Get Intel Doc by ID

Get intel doc by ID.

Endpoint

URL: /plugin/products/threat-response/api/v1/intels/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Parameters for the Get Intel Doc by ID action

Input Example

{"path_parameters":{"id":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data
data.revisionId	number	Response data
data.type	string	Response data
data.typeVersion	string	Response data
data.intrinsicId	string	Response data
data.md5	string	Response data
data.name	string	Response data
data.description	string	Response data
data.size	number	Response data
data.alertCount	number	Response data
data.unresolvedAlertCount	number	Response data
data.throttledFindingCount	number	Response data
data.labelIds	array	Response data
data.labelIds.file_name	string	Response data
data.labelIds.file	string	Response data
data.sourceId	number	Response data
data.blobId	string	Response data
data.isSchemaValid	boolean	Response data
data.contents	string	Response data
data.createdAt	string	Response data
data.updatedAt	string	Response data
data.allowAutoDisable	boolean	Response data

Output Example

Get Response Actions

Gets all response actions.

Endpoint

URL: /plugin/products/threat-response/api/v1/response-actions

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	number	Optional	Parameters for the Get Response Actions action
parameters.limit	number	Optional	Parameters for the Get Response Actions action
parameters.sortBy	string	Optional	Parameters for the Get Response Actions action
parameters.sortOrder	string	Optional	Parameters for the Get Response Actions action
parameters.queryPartialComputerName	string	Optional	Parameters for the Get Response Actions action
parameters.queryStatus	string	Optional	Parameters for the Get Response Actions action
parameters.queryType	string	Optional	Parameters for the Get Response Actions action

Input Example

{"parameters":{"offset":0,"limit":1000,"sortBy":"createdAt","sortOrder":"asc","queryPartialComputerName":"ComputerName","queryStatus":"QUEUED","queryType":"liveResponse"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	number	Response data
data.type	string	Response data
data.status	string	Response data
data.computerName	string	Response data
data.userId	number	Response data
data.personaId	object	Response data
data.userName	string	Response data
data.options	object	Response data
data.options.packageName	string	Response data
data.options.packageParameters	array	Parameters for the Get Response Actions action
data.options.packageParameters.key	string	Parameters for the Get Response Actions action
data.options.packageParameters.value	string	Parameters for the Get Response Actions action
data.options.packageSkipLockFlag	boolean	Response data
data.results	object	Response data
data.results.taskIds	array	Response data
data.results.actionIds	array	Response data
data.results.actionIds.file_name	string	Response data
data.results.actionIds.file	string	Response data
data.results.errorCount	number	Response data
data.results.retryCount	number	Response data
data.expirationTime	string	Response data
data.createdAt	string	Response data

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"b4a6f11b-3743-484f-8c7e-3d3f0f8f3167","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...

List Alerts

List alerts with optional filtering, sorting, and pagination.

Endpoint

URL: /plugin/products/threat-response/api/v1/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.state	string	Optional	Parameters for the List Alerts action
parameters.type	string	Optional	Parameters for the List Alerts action
parameters.matchType	string	Optional	Parameters for the List Alerts action
parameters.path	string	Optional	Parameters for the List Alerts action
parameters.priority	string	Optional	Parameters for the List Alerts action
parameters.severity	string	Optional	Parameters for the List Alerts action
parameters.intelDocId	number	Optional	Parameters for the List Alerts action
parameters.intelType	string	Optional	Parameters for the List Alerts action
parameters.intelDocName	string	Optional	Parameters for the List Alerts action
parameters.intelSource	string	Optional	Parameters for the List Alerts action
parameters.labelName	string	Optional	Parameters for the List Alerts action
parameters.mitreId	string	Optional	Parameters for the List Alerts action
parameters.scanConfigId	number	Optional	Parameters for the List Alerts action
parameters.computerName	string	Optional	Parameters for the List Alerts action
parameters.computerIpAddress	string	Optional	Parameters for the List Alerts action
parameters.platform	string	Optional	Parameters for the List Alerts action
parameters.details	string	Optional	Parameters for the List Alerts action
parameters.alertedAtFrom	string	Optional	Parameters for the List Alerts action
parameters.alertedAtUntil	string	Optional	Parameters for the List Alerts action
parameters.guid	string	Optional	Parameters for the List Alerts action
parameters.include	string	Optional	Parameters for the List Alerts action
parameters.sort	string	Optional	Parameters for the List Alerts action
parameters.expand	string	Optional	Parameters for the List Alerts action
parameters.limit	number	Optional	Parameters for the List Alerts action
parameters.offset	number	Optional	Parameters for the List Alerts action

Input Example

{"parameters":{"state":"string","type":"string","matchType":"string","path":"string","priority":"string","severity":"string","intelDocId":123,"intelType":"string","intelDocName":"Example Name","intelSource":"string","labelName":"Example Name","mitreId":"string","scanConfigId":123,"computerName":"Example Name","computerIpAddress":"string","platform":"string","details":"string","alertedAtFrom":"string","alertedAtUntil":"string","guid":"string","include":"string","sort":"string","expand":"string","limit":123,"offset":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.totalCount	number	Count value
meta.filteredCount	number	Count value
data	array	Response data
data.id	number	Response data
data.state	string	Response data
data.type	string	Response data
data.guid	string	Response data
data.priority	object	Response data
data.severity	string	Response data
data.intelDocId	number	Response data
data.intelDocRevisionId	number	Response data
data.scanConfigId	number	Response data
data.scanConfigRevisionId	number	Response data
data.computerName	string	Response data
data.computerIpAddress	string	Response data
data.eid	number	Response data
data.details	object	Response data
data.matchType	string	Response data
data.path	string	Response data
data.alertedAt	string	Response data
data.createdAt	string	Response data
data.updatedAt	string	Response data

Output Example

List Connections

List user connections.

Endpoint

URL: /plugin/products/threat-response/api/v1/conns

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"4cb9ada9-7f2a-4d3e-8ae1-552a43853b01","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...

List File Evidence

Get all file evidence records from the database.

Endpoint

URL: /plugin/products/threat-response/api/v1/filedownload

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Maximum number of results to return. Default - 1000
parameters.offset	number	Optional	Offset into the result set. Default - 0
parameters.sort	string	Optional	Column by which to sort. Default - downloaded

Input Example

{"parameters":{"limit":1000,"offset":0,"sort":"downloaded"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
fileEvidence	array	Unique identifier
fileEvidence.uuid	string	Unique identifier
fileEvidence.hostname	string	Unique identifier
fileEvidence.path	string	Unique identifier
fileEvidence.downloaded	string	Unique identifier
fileEvidence.hash	string	Unique identifier
fileEvidence.size	number	Unique identifier
fileEvidence.created	string	Unique identifier
fileEvidence.created_by	string	Unique identifier
fileEvidence.created_by_proc	string	Unique identifier
fileEvidence.last_modified	string	Unique identifier
fileEvidence.last_modified_by	string	Unique identifier
fileEvidence.last_modified_by_proc	string	Unique identifier
fileEvidence.tags	string	Unique identifier
fileEvidence.comments	string	Unique identifier
fileEvidence.createdAt	string	Unique identifier
fileEvidence.updatedAt	string	Unique identifier
totalCount	number	Count value

Output Example

{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"7da57a9c-244b-4f9d-bd46-cb7579476934","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...

Update Alert State by ID

Update the state of a single alert by ID.

Endpoint

URL: /plugin/products/threat-response/api/v1/alerts/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Parameters for the Update Alert State by ID action
state	string	Optional	Parameter for Update Alert State by ID

Input Example

{"path_parameters":{"id":123},"state":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
alert	object	Output field: alert
alert.id	number	Unique identifier
alert.state	string	Output field: alert.state
alert.type	string	Type of the resource
alert.guid	string	Unique identifier
alert.priority	object	Output field: alert.priority
alert.severity	string	Output field: alert.severity
alert.intelDocId	number	Unique identifier
alert.intelDocRevisionId	number	Unique identifier
alert.scanConfigId	number	Unique identifier
alert.scanConfigRevisionId	number	Unique identifier
alert.computerName	string	Name of the resource
alert.computerIpAddress	string	Output field: alert.computerIpAddress
alert.eid	number	Unique identifier
alert.details	string	Output field: alert.details
alert.matchType	string	Type of the resource
alert.path	string	Output field: alert.path
alert.alertedAt	string	Output field: alert.alertedAt
alert.createdAt	string	Output field: alert.createdAt
alert.updatedAt	string	Output field: alert.updatedAt

Output Example

Response Headers

Header	Description	Example
cache-control	Directives for caching mechanisms	no-cache, no-store, must-revalidate
content-encoding	HTTP response header: content-encoding	gzip
content-security-policy	HTTP response header: content-security-policy	default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 'self';worker-src 'self';media-src 'self';style-src 'self' 'unsafe-inline';img-src data: blob: 'self';frame-ancestors 'self';font-src 'self' data:;upgrade-insecure-requests;connect-src * data: blob: 'unsafe-inline';block-all-mixed-content;
Content-Type	The media type of the resource	application/json
date	The date and time at which the message was originated	Mon, 18 Mar 2024 06:54:23 GMT
expires	The date/time after which the response is considered stale	0
pragma	HTTP response header: pragma	no-cache
referrer-policy	HTTP response header: referrer-policy	no-referrer
server	Information about the software used by the origin server	envoy
strict-transport-security	HTTP response header: strict-transport-security	max-age=63072000; includeSubDomains;
tanium-threat-response-version	HTTP response header: tanium-threat-response-version	4.5.131.0000
transfer-encoding	HTTP response header: transfer-encoding	chunked
x-content-type-options	HTTP response header: x-content-type-options	nosniff
x-envoy-upstream-service-time	HTTP response header: x-envoy-upstream-service-time	463
x-frame-options	HTTP response header: x-frame-options	SAMEORIGIN
x-request-id	A unique identifier for the request	0dc48760-a134-4fb1-81b3-7775eaccced0
x-xss-protection	HTTP response header: x-xss-protection	1