[{"data":1,"prerenderedAt":468},["ShallowReactive",2],{"connector-en-tanium":3},{"id":4,"title":5,"body":6,"category":458,"description":459,"extension":460,"meta":461,"navigation":462,"path":463,"seo":464,"sidebar":465,"stem":466,"updatedAt":458,"__hash__":467},"connectorsEn\u002Fen\u002Fconnectors\u002Ftanium.md","Tanium",{"type":7,"value":8,"toc":443},"minimark",[9,18,21,43,46,51,77,81,135,139,144,176,179,183,217,220,224,227,280,283,286,290,326,329,332,415,419],[10,11,12,13,17],"p",{},"The Tanium connector imports into OverView the inventory of endpoints managed by Tanium. It queries the ",[14,15,16],"strong",{},"Tanium Gateway"," GraphQL API in read-only mode with an API token, on Tanium Cloud as well as on a Tanium platform installed on premises.",[10,19,20],{},"The connector reads the data already collected by the Tanium Data Service: it asks no real-time question to the endpoints and therefore adds no load on your fleet. The data imported depends on the Tanium modules you own and on the permissions granted:",[22,23,24,31,37],"ul",{},[25,26,27,30],"li",{},[14,28,29],{},"Core",": name, domain, serial number, manufacturer, operating system, IP and MAC addresses, primary user, last seen date",[25,32,33,36],{},[14,34,35],{},"Endpoint Management",": installed software",[25,38,39,42],{},[14,40,41],{},"Comply",": vulnerabilities (CVE) detected on each endpoint",[10,44,45],{},"A module the token has no permission for is skipped: the import carries on with the other data.",[47,48,50],"h2",{"id":49},"prerequisites","Prerequisites",[22,52,53,56,67],{},[25,54,55],{},"A Tanium administrator account allowed to create roles, users and API tokens",[25,57,58,61,62,66],{},[14,59,60],{},"Tanium Cloud",": an HTTPS flow allowed from the OverView outbound IP addresses to ",[63,64,65],"code",{},"https:\u002F\u002F\u003CcustomerName>-api.cloud.tanium.com",". OverSOC support provides these addresses",[25,68,69,72,73,76],{},[14,70,71],{},"Tanium on premises",": an ",[14,74,75],{},"OverView OutPost"," deployed in your network and an HTTPS flow allowed from the OutPost VM to the Tanium server",[47,78,80],{"id":79},"information-to-provide-in-overview","Information to provide in OverView",[82,83,84,97],"table",{},[85,86,87],"thead",{},[88,89,90,94],"tr",{},[91,92,93],"th",{},"Field",[91,95,96],{},"Description",[98,99,100,121],"tbody",{},[88,101,102,108],{},[103,104,105],"td",{},[14,106,107],{},"API URL",[103,109,110,111,114,115,117,118],{},"Base URL of the Tanium API, without the ",[63,112,113],{},"\u002Fplugin\u002Fproducts\u002Fgateway\u002Fgraphql"," path. Tanium Cloud: ",[63,116,65],{},". On premises: ",[63,119,120],{},"https:\u002F\u002F\u003Ctanium-server>",[88,122,123,128],{},[103,124,125],{},[14,126,127],{},"API Token",[103,129,130,131,134],{},"Tanium API token, including its ",[63,132,133],{},"token-"," prefix (see the procedure below)",[47,136,138],{"id":137},"procedure","Procedure",[140,141,143],"h3",{"id":142},"create-the-role","Create the role",[145,146,147,161,167],"ol",{},[25,148,149,150,153,154,153,157,160],{},"In the Tanium console, go to ",[14,151,152],{},"Administration"," > ",[14,155,156],{},"Permissions",[14,158,159],{},"Roles",".",[25,162,163,164,160],{},"Create a role dedicated to OverView, for example ",[63,165,166],{},"OverView Connector",[25,168,169,170,175],{},"Grant it the permissions listed in ",[171,172,174],"a",{"href":173},"#required-permissions","Required permissions",", only for the modules you own.",[10,177,178],{},"Tanium's predefined roles are designed for console users. A dedicated role limits the token to the reads OverView needs.",[140,180,182],{"id":181},"create-the-service-account","Create the service account",[145,184,185,199,202],{},[25,186,187,188,153,190,153,192,195,196,160],{},"Go to ",[14,189,152],{},[14,191,156],{},[14,193,194],{},"Users"," and create a dedicated user, for example ",[63,197,198],{},"overview-connector",[25,200,201],{},"Assign it the role created in the previous step.",[25,203,204,205,208,209,212,213,216],{},"In its ",[14,206,207],{},"Computer Groups",", remove ",[14,210,211],{},"No Computers"," and add ",[14,214,215],{},"All Computers",", or the computer groups to import into OverView.",[10,218,219],{},"The token only reaches the endpoints of its user's computer groups. Without a computer group, the import succeeds but brings back no endpoint.",[140,221,223],{"id":222},"generate-the-api-token","Generate the API token",[10,225,226],{},"An API token inherits every permission of the identity that creates it. Generate it from the service account, or from a persona limited to the role created above.",[145,228,229,242,268,274],{},[25,230,187,231,153,233,153,235,238,239,160],{},[14,232,152],{},[14,234,156],{},[14,236,237],{},"API Tokens",", then click ",[14,240,241],{},"New API Token",[25,243,244,245],{},"Fill in the form:\n",[22,246,247,256,262],{},[25,248,249,252,253],{},[14,250,251],{},"Notes",": an explicit label, for example ",[63,254,255],{},"OverView",[25,257,258,261],{},[14,259,260],{},"Expiration",": the validity period your security policy allows, 365 days at most",[25,263,264,267],{},[14,265,266],{},"Trusted IP addresses",": the OverView outbound IP addresses for Tanium Cloud, or the LAN IP address of the OutPost VM for an on-premises platform",[25,269,270,271,160],{},"Click ",[14,272,273],{},"Save",[25,275,276,277,279],{},"Copy the token, including its ",[63,278,133],{}," prefix, and keep it somewhere safe: it will not be displayed again.",[10,281,282],{},"Tanium rejects calls made with a token from an address outside its trusted addresses. For an on-premises platform, the LAN IP address of the OutPost VM is shown on the hypervisor console banner.",[10,284,285],{},"A Tanium API token cannot be renewed. Before it expires, generate a new one and replace it in OverView.",[140,287,289],{"id":288},"configure-the-connector-in-overview","Configure the connector in OverView",[145,291,292,301,310,313,321],{},[25,293,294,295,153,298,160],{},"In OverView, go to ",[14,296,297],{},"Data Sources Settings",[14,299,300],{},"Sources",[25,302,303,304,306,307,160],{},"Select ",[14,305,5],{}," and click ",[14,308,309],{},"Configure",[25,311,312],{},"For an on-premises Tanium platform, choose your OutPost as the collection point.",[25,314,315,316,318,319,160],{},"Enter the ",[14,317,107],{}," and the ",[14,320,127],{},[25,322,270,323,160],{},[14,324,325],{},"Save Configuration",[47,327,174],{"id":328},"required-permissions",[10,330,331],{},"The connector only performs reads. The core row is mandatory, the other rows only apply to the modules you own.",[82,333,334,344],{},[85,335,336],{},[88,337,338,341],{},[91,339,340],{},"Data",[91,342,343],{},"Permissions to grant to the role",[98,345,346,371,382,401],{},[88,347,348,353],{},[103,349,350,352],{},[14,351,29],{},": endpoint inventory",[103,354,355,358,359,362,363,366,367,370],{},[14,356,357],{},"Gateway User"," role (",[14,360,361],{},"API Gateway User"," on earlier versions), ",[14,364,365],{},"Sensors"," read on the ",[14,368,369],{},"Core Content"," content set, computer groups to import",[88,372,373,377],{},[103,374,375,36],{},[14,376,35],{},[103,378,379,381],{},[14,380,365],{}," read on the content sets that hold the software inventory",[88,383,384,389],{},[103,385,386,388],{},[14,387,41],{},": vulnerabilities",[103,390,391,394,395,366,397,400],{},[14,392,393],{},"Comply Report Reviewer"," role and ",[14,396,365],{},[14,398,399],{},"Comply Reporting"," content set",[88,402,403,409],{},[103,404,405,408],{},[14,406,407],{},"Asset",": enriched hardware inventory",[103,410,411,414],{},[14,412,413],{},"Asset Report Reader"," role",[47,416,418],{"id":417},"official-documentation","Official Documentation",[22,420,421,429,436],{},[25,422,423],{},[171,424,428],{"href":425,"rel":426},"https:\u002F\u002Fdeveloper.tanium.com\u002Fsite\u002Fglobal\u002Fdocs\u002Fhow_tos\u002Fauth\u002Findex.gsp",[427],"nofollow","Tanium: API authentication",[25,430,431],{},[171,432,435],{"href":433,"rel":434},"https:\u002F\u002Fdeveloper.tanium.com\u002Fsite\u002Fglobal\u002Fdocs\u002Fhow_tos\u002Frbac\u002Findex.gsp",[427],"Tanium: RBAC for integrations",[25,437,438],{},[171,439,442],{"href":440,"rel":441},"https:\u002F\u002Fkb.tanium.com\u002FTanium_Cloud_Release_Notes_Gateway",[427],"Tanium: Tanium Gateway release notes",{"title":444,"searchDepth":445,"depth":445,"links":446},"",2,[447,448,449,456,457],{"id":49,"depth":445,"text":50},{"id":79,"depth":445,"text":80},{"id":137,"depth":445,"text":138,"children":450},[451,453,454,455],{"id":142,"depth":452,"text":143},3,{"id":181,"depth":452,"text":182},{"id":222,"depth":452,"text":223},{"id":288,"depth":452,"text":289},{"id":328,"depth":445,"text":174},{"id":417,"depth":445,"text":418},null,"Import into OverView the inventory of endpoints managed by Tanium, their installed software and their vulnerabilities","md",{},true,"\u002Fen\u002Fconnectors\u002Ftanium",{"title":5,"description":459},{"label":5},"en\u002Fconnectors\u002Ftanium","wuOj1OshHh8siCqgYhEn27t_XyLJFKl4E_HVHCuaFTw",1793099399758]