STIGQter: STIG Summary: Tanium 7.x Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Tanium application must reveal error messages only to the information system security officer (ISSO), information system security manager (ISSM), and system administrator (SA).

DISA Rule

SV-253789r997230_rule

Vulnerability Number

V-253789

Group Title

SRG-APP-000267

Rule Version

TANS-00-001190

Severity

CAT II

CCI(s)

• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.

Weight

10

Fix Recommendation

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Open a File Explorer window.

4. Navigate to Program Files >> Tanium >> Tanium Server.

5. Right-click the "Logs" folder.

6. Select "Properties".

7. Select the "Security" tab.

8. Click the "Advanced" button.

9. Disable folder inheritance.

10. Change/verify the owner of the directory to the [Tanium service account].

11. Reduce [Tanium service account] privileges to modify permissions on the directory.

12. Ensure [Tanium Admins] group has full permissions on the directory.

13. Right-click the "TDL_Logs" folder.

14. Select "Properties".

15. Select the "Security" tab.

16. Click the "Advanced" button.

17. Disable folder inheritance.

18. Change/verify the owner of the directory to the [Tanium service account].

19. Reduce [Tanium service account] privileges to modify permissions on the directory.

20. Ensure [Tanium Admins] group has full permissions on the directory.

Check Contents

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Open a File Explorer window.

4. Navigate to Program Files >> Tanium >> Tanium Server.

5. Right-click the "Logs" folder.

6. Select "Properties".

7. Select the "Security" tab.

8. Click the "Advanced" button.

- Validate the owner of the directory is the [Tanium service account].
- Validate the [Tanium service account] is the only account with modify permissions on the directory.
- Validate the [Tanium Administrators] group has full permissions on the directory.

9. Right-click the "TDL_Logs" folder.

10. Select "Properties".

11. Select the "Security" tab.

12. Click the "Advanced" button.

- Validate the owner of the directory is the [Tanium service account].
- Validate the [Tanium service account] privileges is the only account with modify permissions on the directory.
- Validate the [Tanium Administrators] group has full permissions on the directory.

If any of the specified permissions are not set as required, this is a finding.

Vulnerability Number

V-253789

Documentable

False

Rule Version

TANS-00-001190

Severity Override Guidance

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Open a File Explorer window.

4. Navigate to Program Files >> Tanium >> Tanium Server.

5. Right-click the "Logs" folder.

6. Select "Properties".

7. Select the "Security" tab.

8. Click the "Advanced" button.

- Validate the owner of the directory is the [Tanium service account].
- Validate the [Tanium service account] is the only account with modify permissions on the directory.
- Validate the [Tanium Administrators] group has full permissions on the directory.

9. Right-click the "TDL_Logs" folder.

10. Select "Properties".

11. Select the "Security" tab.

12. Click the "Advanced" button.

- Validate the owner of the directory is the [Tanium service account].
- Validate the [Tanium service account] privileges is the only account with modify permissions on the directory.
- Validate the [Tanium Administrators] group has full permissions on the directory.

If any of the specified permissions are not set as required, this is a finding.

Check Content Reference

M

Target Key

5476