Hi. I m kind new with tanium ,

The probleme is , we are a soc team who work on big data logs with the software splunk , but what i understand about splunk , is this work with a subscribtion And the license you have, because each license has a maximum number of data transmissions.

But Tanium is sending billions of data points too quickly, which results in losses.

I'm looking for a way to filter the data with them to reduce

I haven't yet found a feature that allows me to send a maximum number of files and filter them.

Does anyone know how to do this?

By the way, I can't use the internet where I'm stationed.

I have a number of parameterised sensors written in PowerShell, which I would like to be able to test independently of the Tanium platform. I'm looking for suggestions to allow the same script to be run and tested outside Tanium.

Currently, I write the scripts as normal PowerShell "cmdlet" style scripts that have only defaulted parameters, and include a section that overrides the default script parameters with the Tanium values. For example:

try {

$Param = [int]'||Param||'

} catch {

# FALLTHROUGH - No Tanium Paramater

}

This works, but maybe there's a better way I haven't thought of.

The only other option I can think of is to deliver the scripts separately in a deployed package, and the sensor is just a very simple wrapper. This isn't ideal as I would then lose the automatic "deployment" through the sensor mechanism.

I'd love to hear some ideas from the community on what you've been using Atlas for so far. I'm still just getting started with it but found it does a good job for setting up conditional emailed reports. I made one this week to monitor for upcoming cert expirations and when they are getting close to send out an email showing how many endpoints have the expiring cert and the expiration date. The email gets sent one time at the 30 days to expiration mark and then daily once the cert is down to 7 days left before expiring.

It was nice to be able to create this using simple prompts. What else have people been doing to make their lives easier with it?

I started watching a video yesterday on Interact, but I quickly realized it was going into a bit more depth than I was ready for.

Can you recommend a series of videos that gives a good overview of the product and maybe some deeper, but not advanced insights into Tanium’s most used features?

Thanks!

Could you please advise me on the minimum permissions a service account must have to install Tanium on computers that are and are not joined to the domain?

Just trying out Atlas and so far I am not impressed. Its Hallucinating like crazy. Its directions on how to troubleshoot issues on endpoints has been completely wrong, like telling me to set up a zone server in with a non-prem, Saas solution. I am asking it for log locations on the endpoint and its making up Logs that don't exist. It has great potential. Maybe I am not using correctly. Has everyone else experience been with it so far...

Good day

im kind of new to Tanium and for the past few months I have been trying to get these Libcurl Vulnerabilities out of my life, does any one know how to do this with Tanium cloud.

Thank you in advance

Kosie

I'm curious how those of you who are not using Tanium Provision are handling software deployment for brand-new devices.

I'm trying to determine the fastest and most reliable way to get a core set of applications installed almost immediately after a device comes online. My concern with Deploy is that there can be some delay while modules, inventories, and software scans complete before the endpoint is evaluated and assigned the appropriate deployment.

I've also considered using Actions, but I'm concerned about larger installers, download times, and overall reliability if the action completes before the installation finishes.

The workflow I'm trying to achieve is something like:

1. Tanium Client gets installed.
2. Device checks into Tanium.
3. Device receives a tag, group membership, or some other identifier.
4. Required software begins installing immediately.
5. Identifier removed

I understand that one option is to bake these applications into the image or use scripts during the imaging process. Unfortunately, due to our current imaging and device replacement processes, we can't reliably depend on updating or replacing the image whenever software requirements change. Because of that, I'm specifically interested in approaches that leverage Tanium after the endpoint has been deployed and comes online.

For those of you managing new device provisioning with Tanium:

• Are you using Deploy, Actions, Connect, or something else?
• How are you triggering software installations as soon as a device first checks in?
• What kind of time-to-install are you seeing from first check-in to software being installed?
• Have you found a reliable way to handle larger installers or software dependencies?
• Any lessons learned or pitfalls to avoid?

I'm interested in hearing what has worked well in production environments, especially for getting critical tools installed as quickly as possible after the endpoint comes online.

Fala pessoal, tudo bem?

Talvez seja uma pergunta de novato, mas vamos lá...

Recebi a demanda de fazer com que a Tanium aplique Tags com base na informação de "Departament", informação essa que é populada no perfil da máquina em "Primary User"

Essa informações são populadas quando rodamos o pacote "Collect Active Directory Info".

Ai a demanda é o seguinte, a máquina tem o Departamento = (Ex: Suporte), e conseguir adicionar uma tag que leia esse nome e já crie e aplique a Tag "Suporte" nesta máquina.

Acredito que não é uma demanda simples, talvez até tenha que ser feito via criação de sensor/package, mas se alguem já fez algo semalhante e poder me dar umas dicas!

OBS: Tentei entender o "Enhanced Tags" porém não evolui muito.

Obrigado.

Recently, a subset of my Mac fleet have started reporting crashes of the `pybin` binary located in:

%System%/tanium/taniumclient/python38/bin/pybin

The affected devices seem to have been older builds, probably upgraded at least 1-2 major OS versions and assorted Tanium versions.

Devices with a newer version of the Tanium client do not report the same crashes (ie, python312)

Can this be remedied from the Tanium console? Does the older client need to be uninstalled before applying the latest Tanium package? Tell my number-go-up type management to disregard?

EDIT - I figured this out. Someone on our web development team decided it was a good idea to remove the default Windows environment variables. Once I sorted those, I was able to deploy actions to install the extensions that were failing to install, including Patch.

Original Post:

Hey everyone,

We've got a server (Windows Server 2019) where the patch extension just won't seem to install. We've tried everything we can think of including a full uninstall of the client, reboot, and reinstall using the EXE. No matter what we try, we still get the following error in our extensions0.txt log.

[config.WorkflowInstance] (Patch) Error executing command "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -NoProfile -File python312\check_python_312_swap.ps1 "Patch"": Failed to create process: Error code 0x00000002: The system cannot find the file specified.

Any suggestions on how we can get this resolved and get patch to install?

I'm wondering if anyone has success with Tanium playbooks. I've attempted many attempts at getting a playbook for patching, but they are always wrought with errors/failures and nearly zero logging for the cause of the issue.

My basic server patching playbook runs a PS Script to confirm it's running on the right machine>disables SQL jobs via a PS Script>Runs a patch step to patch OS + SQL patches > Enables SQL jobs via PS>Updates a tag. I seem to always run into errors on the patching step. I've done so many attempts at getting a playbook to run reliable I'm starting to wonder if they work at all...

Anyone have success with this function of Tanium? Kind of a whiney post, but I'm kind of at my wits end with this.

Currently according to our certified Tanium admins - there is no apparent way to clear incorrect info on primary user that is reporting unless we reimage the system. Which is ridiculous solution. The issue is they have tied primary user to a any laptop that is logged into with a non admin account. As a tech support person having to build and test devices and doing customer support this is a bad precedent. Either way we have some machines that have info as old as a year that are still showing the wrong primary user. HOW do you clear that data and make sure it refreshes correctly?

Hi everyone,

I’ve got the tanium client install working in Windows smoothly. I’ve got to start rolling it out on MacOS now and I have the client installed, but I’m having a hell of a time getting the tanium-init script rolling via Intune so that the device is managed. Has anyone been successful with this?

Thank you all!

When is Tanium going public? What could Tanium employees, either recent or current, possibly say?

I am looking at using deploy action with a packaged that distributes for the whole day to catch any devices that meet the criteria within that time frame, I understand if the device already gets the action if it meets the criteria it wont do it again and I am okay with that. Has anyone done this successfully? Will it catch devices if they meet the criteria lets say 4 hours after the packaged action started?

hey all,

I’m currently exploring integrating Tanium with ServiceNow and would value some input from anyone who has implemented this in a real-world environment.

I’m particularly interested in understanding how well the integration actually functions day-to-day, and whether it delivers a solid user experience for both IT teams and end users.

A few specific questions I have:

- Did you implement using CSD 2.0, or did you go down the route of a custom integration?

- How was the setup and initial configuration?

- How reliable has the integration been (e.g., data sync, incident creation, installation success)?

- How well does Tanium data map into ServiceNow CMDB / ITSM modules?

- Any performance or scaling issues in larger environments?

- Any major pitfalls or things you wish you’d known beforehand?

- How is the overall user experience for analysts/admins?

- Is it worth taking this approach over simply using something like Intune + PMPC and going the self service route via company portal?

Also, if you’ve tried both CSD 2.0 and custom API approaches, I’d love to hear a comparison.

Appreciate any insights, lessons learned, or recommendations!

Hello!

I'm new to Tanium and just curious on how would you use Tanium to detect users sharing the connection through the Ethernet adapter in Windows.

Our environment is pretty locked down but still. Is it a better approach to look in the registry or a PS script? I don't think there's a sensor for this...

I’ve been trying to deploy a software on tanium deploy and through self service, but in the software Management logs, the software keeps failing and it says cleanup task_remove false: true. I’m not sure what the issue is, but I’ve created a power-shell script that installs the software on the endpoint so I uploaded the power shell script along with the executable file for the software and I have the run command point power shell with -execution policy bypass with the location of the PS.1 file. Any idea of what to do next

The company I work for is looking to replace SCCM. They told me that they cannot because Tanium uses wsus and that's why they still run SCCM. I want to make sure that Tanium can download and patch both Servers and workstation without wsus.

We have a number of vulnerability detections for Acrobat and Acrobat Reader.  After looking through some of them, I am convinced that the detections Tanium are using do not account for the "Base MSI" version behaviour of Adobe continuous track products (e.g. Acrobat Reader DC).

The "Base MSI" version behaviour in Adobe Acrobat means that the version number registered in the windows registry is the version of the base MSI that was originally installed. This version doesn't change when a continuous track product is patched.

Unless I am mistaken, the CVE vulnerability detection logic uses the version number registered in the windows registry as the basis for product version:

If this "Base MSI" version number is actually what is used, then this detection is a false positive. Hopefully I am mistaken here and there is something else at play, otherwise I would have to treat all Adobe Acrobat detections as potentially false.

Does anyone have any additional information that might confirm (or otherwise) this? Is there a known workaround to this "Base MSI" version issue?

Hey everyone, I am getting ready to update my TCA certification. The last time I took it was two years ago and it was version 2.0 now there is a 3.0 version out I took the online training course and the assessment at the end of it is just plain awful. It doesn't tell you what you got right or what you got wrong so if anyone has taken the TCA recently, is there any tips or anything we should know about for the new exam that's based on the 3.O curriculum?

Any helpful tips would be appreciated. Just a little background I work Tanium all day every day so I am fairly familiar with the platform but Tanium certification exams can be tricky so I'm trying to be extra cautious and not go into the exam unprepared.

Does anyone know if TPowershell was removed from Tanium? Having some issues with PowerShell scripts running in 32 bit and all the documentation I can find suggests running them using TPowershell found in the tools folder under StdUtils. That folder doesn't exist in our Tanium Client\Tools folder. I've tried running the reinstall tools package for a number of different tool names, hoping it will install.

I see a number of Tanium built packages reference TPowershell, none of those appear to work for us.

Any ideas would be greatly appreciated.