STIGQter: STIG Summary: Tanium 7.x Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Tanium endpoint must have the Tanium Server's pki.db in its installation.

DISA Rule

SV-253805r960762_rule

Vulnerability Number

V-253805

Group Title

SRG-APP-000015

Rule Version

TANS-CL-000001

Severity

CAT II

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-000778 - Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

For systems that do not have a valid key for the Tanium Server, redeploy the client software from Tanium using Tanium Client Management or work with the Tanium system administrator to accomplish this.

1. Configure a deployment.

2. Deploy the package or installer.

3. Target appropriate systems.

Check Contents

1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with multifactor authentication.

2. Click "Administration" on the top navigation banner.

3. Under "Configuration", select "Client Status".

4. Change "Show systems that have reported in the last:"; enter "7" in the first field.

5. Select "Days" from the drop-down menu in the second field to determine if any endpoints connected with an invalid key.

If any systems are listed with "No" in the "Valid Key" column, this is a finding.

Vulnerability Number

V-253805

Documentable

False

Rule Version

TANS-CL-000001

Severity Override Guidance

1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with multifactor authentication.

2. Click "Administration" on the top navigation banner.

3. Under "Configuration", select "Client Status".

4. Change "Show systems that have reported in the last:"; enter "7" in the first field.

5. Select "Days" from the drop-down menu in the second field to determine if any endpoints connected with an invalid key.

If any systems are listed with "No" in the "Valid Key" column, this is a finding.

Check Content Reference

M

Target Key

5476