STIGQter: STIG Summary: Tanium 7.x Application on TanOS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

Tanium Threat Response must be configured to receive IOC streams only from trusted sources.

DISA Rule

SV-254888r960804_rule

Vulnerability Number

V-254888

Group Title

SRG-APP-000039

Rule Version

TANS-AP-000135

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Consult the documentation on trusted intel subscription feeds.

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Intel".

6. Select "Sources".

7. Click "New Source".

8. Select the specified Source from the list.

9. Fill out the specified information based on the documented trusted intel feeds.

10. Select "Create".

Check Contents

Consult with the Tanium System Administrator to determine if the Threat Response module is being used, if not this is Not Applicable.

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Intel".

6. Select "Sources".

7. Verify all configured Threat Response Streams are configured to a documented trusted source.

If Threat Response is configured to a stream that has not been documented as trusted, this is a finding.

Vulnerability Number

V-254888

Documentable

False

Rule Version

TANS-AP-000135

Severity Override Guidance

Consult with the Tanium System Administrator to determine if the Threat Response module is being used, if not this is Not Applicable.

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Intel".

6. Select "Sources".

7. Verify all configured Threat Response Streams are configured to a documented trusted source.

If Threat Response is configured to a stream that has not been documented as trusted, this is a finding.

Check Content Reference

M

Target Key

5492