STIGQter: STIG Summary: Tanium 7.x Application on TanOS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Tanium application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.

DISA Rule

SV-254898r960912_rule

Vulnerability Number

V-254898

Group Title

SRG-APP-000108

Rule Version

TANS-AP-000260

Severity

CAT II

CCI(s)

CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.

Weight

Fix Recommendation

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Connect".

4. Expand the left menu.

5. Click "Connections".

6. Configure a Connection for the "Tanium Audit Source" source from the Tanium Application to a SIEM tool.

Work with the SIEM administrator to configure an alert when no audit data is received from Tanium based on the defined schedule of connections.

Check Contents

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Connect".

4. Review the configured Connections under "Connections" section.

Work with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected.

If there is no alert configured, this is a finding.

Vulnerability Number

V-254898

Documentable

False

Rule Version

TANS-AP-000260

Severity Override Guidance

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Connect".

4. Review the configured Connections under "Connections" section.

Work with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected.

If there is no alert configured, this is a finding.

Check Content Reference

Target Key

5492