Tanium API Gateway

View as Markdown

Community Platform

runZero imports data from the Tanium Gateway API to sync your endpoints, applications, and vulnerabilities from Tanium for better visibility over your network.

Getting started with Tanium

To set up the Tanium integration:

  1. Generate an API token with the permissions the integration needs.
  2. Add the Tanium credential to runZero.
  3. Choose whether to run the integration as a scan probe or a connector task.
  4. Activate the integration to pull your data into runZero.

Step 1: Generate an API key in Tanium Dashboard

  1. Sign in to Tanium and go to Administration > Roles.
  2. Create a role with the permissions the integration needs:
    1. Search for the Gateway User role.
    2. Select it and click the Clone button that appears.
    3. On the Clone Role screen, enable Platform Content Permissions > Sensor > Read and add these Content Sets with the n+ button beside the green check:
      • Base
      • Comply
      • Comply Reporting
      • Core AD Query Content
      • Core Content
      • Reserved
      • Tanium Data Service
    4. Save the role.
  3. Go to Administration > Personas and click New Persona to create a persona with the role you just created:
    1. Name the persona.
    2. Under Manage Roles, search for and apply your new role.
    3. Under Computer Groups, add the groups you need, or check Unrestricted Management Rights to allow access to all Computer Groups.
    4. Assign a user or service account that has the permissions granted to the persona.
    5. Save the persona.
  4. Go to Administration > API Tokens and click New API Token.
    1. Enter a name and select a TTL.
    2. Select the persona you just created from the dropdown (you may need to refresh the page for it to appear).
    3. Enter the IP addresses to allow requests from:
      • If you run the integration from an Explorer or the CLI, enter the IP addresses or ranges of your hosts.
      • Otherwise, enter 0.0.0.0/0.
    4. Save the API token.

Step 2: Add the Tanium API token to runZero

  1. Go to the Credentials page in runZero.
  2. Choose Tanium API Token from the list of credential types.
  3. Name the credential, for example Tanium.
  4. Fill in the fields:
    • Enter your Tanium API Gateway URL in Tanium API URL. The full URL looks like https://<customername>-api.cloud.tanium.com/plugin/products/gateway/graphql. If you leave off the path (/plugin/products/gateway/graphql), runZero adds it when it calls the API.
    • In Tanium API token, enter the token (including the token- prefix) you created in step 1.
    • Enable Insecure to allow authentication with untrusted endpoints. It turns off certificate validation, so use it with caution.
  5. To share this credential with other organizations, select Make this a global credential. Otherwise, you can grant access per organization.
  6. Verify and save the credential.

Step 3: Choose how to configure the Tanium integration

You can run the Tanium integration as a scan probe or a connector task. A scan probe gathers integration data during a scan task. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync.

Step 4: Set up and activate the integration to sync data

Step 4a: Configure the Tanium integration as a connector task

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new Tanium-only assets.

  1. Activate a connection to Tanium. You can also reach every third-party connection from the integrations page, your inventory, or the tasks page.
  2. Choose the credentials you added earlier. If they aren’t listed, check that they have access to your current organization.
  3. Optionally, enter a comma-separated list of computer groups to include. runZero then imports data only for those groups.
  4. Enter a name for the task, like Tanium Sync (optional).
  5. Choose the Explorer that runs this connector task (optional).
  6. Choose the site for your assets. runZero stores all newly discovered assets there.
  7. Enter a description for the task (optional).
  8. To leave out assets runZero hasn’t scanned, switch the Exclude unknown assets toggle to Yes. The import includes them by default.
  9. Schedule the sync to run once or on a recurring schedule, starting on the date and time you set.
  10. Activate the connection. The sync runs on your schedule, and the Scheduled tasks page shows when the next one will run.

Step 4b: Configure the Tanium integration as a scan probe

Run the Tanium integration as a scan probe to have the runZero Explorer pull your Tanium assets into the runZero Console.

In a new or existing scan configuration:

  • Set the TANIUM option to Yes in the Probes and SNMP tab and change any default options you need.
  • Set the correct TANIUM credential to Yes in the Credentials tab.

Step 5: View Tanium assets

After a successful sync, your Tanium assets appear in your inventory with a Tanium icon in the Source column.

To filter by Tanium assets, run this query:

Open an asset to see the attributes runZero gathered from Tanium.

Updated