STIGQter: STIG Summary: Tanium 7.x Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Tanium must alert the ISSO, ISSM, and other individuals designated by the local organization when the following Indicators of Compromise (IOCs) or potential compromise are detected: real-time intrusion detection; threats identified by authoritative sources (e.g., CTOs); and Category I, II, IV, and VII incidents in accordance with CJCSM 6510.01B.

DISA Rule

SV-253802r997241_rule

Vulnerability Number

V-253802

Group Title

SRG-APP-000471

Rule Version

TANS-00-001600

Severity

CAT II

CCI(s)

CCI-002664 - Alert organization-defined personnel or roles when organization-defined compromise indicators generate the occurrence of a compromise or a potential compromise.

Weight

Fix Recommendation

1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web UI and log on with multifactor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Alerts".

6. Filter on status "Unresolved".

7. Resolve any open IOC-based alerts and change status to applicable status.

Check Contents

Note: If THR is not licensed or used for detection, this is not applicable.

1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with multifactor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Alerts".

6. Filter on status "Unresolved".

If any alerts are unresolved, this is a finding.

Vulnerability Number

V-253802

Documentable

False

Rule Version

TANS-00-001600

Severity Override Guidance

Check Content Reference

Target Key

5476