STIGQter STIGQter: STIG Summary: Tanium 7.x Application on TanOS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Tanium endpoint must have the Tanium Servers public key in its installation.

DISA Rule

SV-254909r960999_rule

Vulnerability Number

V-254909

Group Title

SRG-APP-000158

Rule Version

TANS-AP-000415

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

For systems which do not have a valid key for the Tanium Server, redeploy the client software using the Tanium Client Management (TCM) or work with the Tanium System Administrator to accomplish this.

Documentation on TCM: https://docs.tanium.com/client/client/index.html.

Check Contents

The Tanium endpoint makes a connection to the Tanium Server; the endpoint's copy of the Tanium Server's public key is used to verify the validity of the registration day coming from the Tanium Server.

If any endpoint systems do not have the correct Tanium Server public key in its configuration, they will not perform any instructions from the Tanium Server and a record of those endpoints will be listed in the Tanium Server's System Status.

To validate:

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Administration" on the top navigation banner.

3 . Select the "Client Status" tab.

4. Click "Administration".

5. Change "Show systems that have reported in the last:", enter "7" in the first field.

6. Select "Days" from the drop-down menu in the second field to determine if any endpoints connected with an invalid key.

If any systems are listed with "No" in the "Valid Key" column, this is a finding.

Vulnerability Number

V-254909

Documentable

False

Rule Version

TANS-AP-000415

Severity Override Guidance

The Tanium endpoint makes a connection to the Tanium Server; the endpoint's copy of the Tanium Server's public key is used to verify the validity of the registration day coming from the Tanium Server.

If any endpoint systems do not have the correct Tanium Server public key in its configuration, they will not perform any instructions from the Tanium Server and a record of those endpoints will be listed in the Tanium Server's System Status.

To validate:

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Administration" on the top navigation banner.

3 . Select the "Client Status" tab.

4. Click "Administration".

5. Change "Show systems that have reported in the last:", enter "7" in the first field.

6. Select "Days" from the drop-down menu in the second field to determine if any endpoints connected with an invalid key.

If any systems are listed with "No" in the "Valid Key" column, this is a finding.

Check Content Reference

M

Target Key

5492