STIGQter: STIG Summary: Tanium 7.x Application on TanOS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

Tanium must alert the ISSO, ISSM, and other individuals designated by the local organization when the following Indicators of Compromise (IOCs) or potential compromise are detected: real time intrusion detection; threats identified by authoritative sources (e.g., CTOs); and Category I, II, IV, and VII incidents in accordance with CJCSM 6510.01B.

DISA Rule

SV-254950r961728_rule

Vulnerability Number

V-254950

Group Title

SRG-APP-000471

Rule Version

TANS-AP-001250

Severity

CAT II

CCI(s)

• CCI-002664 - Alert organization-defined personnel or roles when organization-defined compromise indicators generate the occurrence of a compromise or a potential compromise.

Weight

10

Fix Recommendation

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Alerts".

6. Filter on status "Unresolved".

7. Resolve any open IOC-based alerts and change status to applicable status.

Check Contents

Note: If THR is not licensed or used for detection then this is not applicable.

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Alerts".

6. Filter on status "Unresolved".

If any alerts are unresolved, this is a finding.

Vulnerability Number

V-254950

Documentable

False

Rule Version

TANS-AP-001250

Severity Override Guidance

Note: If THR is not licensed or used for detection then this is not applicable.

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication.

2. Click "Modules" on the top navigation banner.

3. Click "Threat Response".

4. Expand the left menu.

5. Click "Alerts".

6. Filter on status "Unresolved".

If any alerts are unresolved, this is a finding.

Check Content Reference

M

Target Key

5492