STIGQter: STIG Summary: Tanium 7.x Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Tanium Threat Response must be configured to receive IOC streams only from trusted sources.

DISA Rule

SV-253843r997267_rule

Vulnerability Number

V-253843

Group Title

SRG-APP-000039

Rule Version

TANS-SV-000008

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Consult the documentation on trusted intel subscription feeds.

1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web UI and log on with multifactor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Intel".

6. Select "Sources".

7. Click "New Source".

8. Select the specified Source from the list.

9. Fill out the specified information based on the documented trusted intel feeds.

10. Select "Create".

Check Contents

Consult with the Tanium system administrator to determine if the Threat Response module is being used. If it is not, this is not applicable.

1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with multifactor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Intel".

6. Select "Sources".

7. Verify all configured Threat Response Streams are configured to a documented trusted source.

If Threat Response is configured to a stream that has not been documented as trusted, this is a finding.

Vulnerability Number

V-253843

Documentable

False

Rule Version

TANS-SV-000008

Severity Override Guidance

Consult with the Tanium system administrator to determine if the Threat Response module is being used. If it is not, this is not applicable.

1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with multifactor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Intel".

6. Select "Sources".

7. Verify all configured Threat Response Streams are configured to a documented trusted source.

If Threat Response is configured to a stream that has not been documented as trusted, this is a finding.

Check Content Reference

M

Target Key

5476