STIGQter: STIG Summary: Tanium 7.x Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Tanium Server installer's account database permissions must be reduced to an appropriate level.

DISA Rule

SV-253835r1015848_rule

Vulnerability Number

V-253835

Group Title

SRG-APP-000381

Rule Version

TANS-DB-000004

Severity

CAT II

CCI(s)

• CCI-003938 - Automatically generate audit records of the enforcement actions.

Weight

10

Fix Recommendation

1. Access the Tanium SQL server interactively.

2. Log on to the server with an account that has administrative privileges.

3. Open SQL Server Management Studio.

4. Connect to Tanium instance of SQL Server.

5. In the left pane, click "Databases".

6. Select the Tanium database.

7. Click "Security".

8. Click "Users".

9. In the "Users" pane, right-click the Tanium Server service user account.

10. On the shortcut menu, click "Properties".

11. Under Database role membership, change role from "sysadmin" to "db_owner".

12. Click "OK".

13. In the left pane, click "Databases".

14. Select the Tanium_archive database.

15. Click "Security".

16. Click "Users".

17. In the "Users" pane, right-click the Tanium Server service user account.

18. On the shortcut menu, click "Properties".

19. Under Database role membership, change role from "sysadmin" to "db_owner".

20. Click "OK"

21. If using Postgres:

Configure PostgreSQL to enforce access restrictions associated with changes to the configuration of PostgreSQL or database(s).

Use ALTER ROLE to remove accesses from roles:

$ psql -c "ALTER ROLE <role_name> NOSUPERUSER"

Check Contents

1. Access the Tanium SQL server interactively.

2. Log on to the server with an account that has administrative privileges.

3. Open SQL Server Management Studio.

4. Connect to Tanium instance of SQL Server.

5. In the left pane, click "Databases".

6. Select the Tanium database.

7. Click "Security".

8. Click "Users".

9. In the "Users" pane, review the role assigned to the Tanium Server service user account.

10. In the left pane, click "Databases".

11. Select the Tanium_archive database.

12. Click "Security".

13. Click "Users".

14. In the "Users" pane, review the role assigned to the Tanium Server service user account.

15. If the role assigned to the Tanium Server service account is not "db_owner", this is a finding.

16. If using Postgres:

Only owners of objects can change them. To view all functions, triggers, and trigger procedures, and their ownership and source, as the database administrator (shown here as "postgres"), run the following SQL:

$ sudo su - postgres
$ psql -x -c "\df+"

Vulnerability Number

V-253835

Documentable

False

Rule Version

TANS-DB-000004

Severity Override Guidance

1. Access the Tanium SQL server interactively.

2. Log on to the server with an account that has administrative privileges.

3. Open SQL Server Management Studio.

4. Connect to Tanium instance of SQL Server.

5. In the left pane, click "Databases".

6. Select the Tanium database.

7. Click "Security".

8. Click "Users".

9. In the "Users" pane, review the role assigned to the Tanium Server service user account.

10. In the left pane, click "Databases".

11. Select the Tanium_archive database.

12. Click "Security".

13. Click "Users".

14. In the "Users" pane, review the role assigned to the Tanium Server service user account.

15. If the role assigned to the Tanium Server service account is not "db_owner", this is a finding.

16. If using Postgres:

Only owners of objects can change them. To view all functions, triggers, and trigger procedures, and their ownership and source, as the database administrator (shown here as "postgres"), run the following SQL:

$ sudo su - postgres
$ psql -x -c "\df+"

Check Content Reference

M

Target Key

5476