STIGQter: STIG Summary: Tanium 7.x Application on TanOS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Tanium applications must provide the capability to filter audit records for events of interest based upon organization-defined criteria.

DISA Rule

SV-254900r960924_rule

Vulnerability Number

V-254900

Group Title

SRG-APP-000115

Rule Version

TANS-AP-000280

Severity

CAT II

CCI(s)

• CCI-000158 - Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.

Weight

10

Fix Recommendation

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Connect".

4. Expand the left menu.

5. Click "Connections".

6. Click "Create Connection" or if importing, click "Import".

7. Give the "Connection" a name and description.

8. In the "Configuration" section, select "Event" as the source.

9. Select appropriate source under "Event Group". Any source to generate interest-based events (Discover, Asset, IM, THR, etc.).

10. Select the appropriate events to send.

Note: Consult with the Tanium System Administrator for the Destination.

11. Select "Listen for this Event".

12. Click "Save".

Check Contents

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Connect".

4. Expand the left menu.

5. Click "Connections".

5. Review the configured Connections.

If there are no configured connections, this is a finding.

Vulnerability Number

V-254900

Documentable

False

Rule Version

TANS-AP-000280

Severity Override Guidance

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Connect".

4. Expand the left menu.

5. Click "Connections".

5. Review the configured Connections.

If there are no configured connections, this is a finding.

Check Content Reference

M

Target Key

5492