Tanium

The Tanium connector imports into OverView the inventory of endpoints managed by Tanium. It queries the Tanium Gateway GraphQL API in read-only mode with an API token, on Tanium Cloud as well as on a Tanium platform installed on premises.

The connector reads the data already collected by the Tanium Data Service: it asks no real-time question to the endpoints and therefore adds no load on your fleet. The data imported depends on the Tanium modules you own and on the permissions granted:

• Core: name, domain, serial number, manufacturer, operating system, IP and MAC addresses, primary user, last seen date
• Endpoint Management: installed software
• Comply: vulnerabilities (CVE) detected on each endpoint

A module the token has no permission for is skipped: the import carries on with the other data.

Prerequisites

• A Tanium administrator account allowed to create roles, users and API tokens
• Tanium Cloud: an HTTPS flow allowed from the OverView outbound IP addresses to https://<customerName>-api.cloud.tanium.com. OverSOC support provides these addresses
• Tanium on premises: an OverView OutPost deployed in your network and an HTTPS flow allowed from the OutPost VM to the Tanium server

Information to provide in OverView

Procedure

Create the role

1. In the Tanium console, go to Administration > Permissions > Roles.
2. Create a role dedicated to OverView, for example OverView Connector.
3. Grant it the permissions listed in Required permissions, only for the modules you own.

Tanium's predefined roles are designed for console users. A dedicated role limits the token to the reads OverView needs.

Create the service account

1. Go to Administration > Permissions > Users and create a dedicated user, for example overview-connector.
2. Assign it the role created in the previous step.
3. In its Computer Groups, remove No Computers and add All Computers, or the computer groups to import into OverView.

The token only reaches the endpoints of its user's computer groups. Without a computer group, the import succeeds but brings back no endpoint.

Generate the API token

An API token inherits every permission of the identity that creates it. Generate it from the service account, or from a persona limited to the role created above.

1. Go to Administration > Permissions > API Tokens, then click New API Token.
2. Fill in the form:
   • Notes: an explicit label, for example OverView
   • Expiration: the validity period your security policy allows, 365 days at most
   • Trusted IP addresses: the OverView outbound IP addresses for Tanium Cloud, or the LAN IP address of the OutPost VM for an on-premises platform
3. Click Save.
4. Copy the token, including its token- prefix, and keep it somewhere safe: it will not be displayed again.

Tanium rejects calls made with a token from an address outside its trusted addresses. For an on-premises platform, the LAN IP address of the OutPost VM is shown on the hypervisor console banner.

A Tanium API token cannot be renewed. Before it expires, generate a new one and replace it in OverView.

Configure the connector in OverView

1. In OverView, go to Data Sources Settings > Sources.
2. Select Tanium and click Configure.
3. For an on-premises Tanium platform, choose your OutPost as the collection point.
4. Enter the API URL and the API Token.
5. Click Save Configuration.

Required permissions

The connector only performs reads. The core row is mandatory, the other rows only apply to the modules you own.

Official Documentation

• Tanium: API authentication
• Tanium: RBAC for integrations
• Tanium: Tanium Gateway release notes