| Checked | Name | Title |
|---|
| ☐ | SV-254874r1067675_rule | The Tanium max_soap_sessions_total setting must be explicitly enabled to limit the number of simultaneous sessions. |
| ☐ | SV-254875r1067678_rule | The Tanium max_soap_sessions_per_user setting must be explicitly enabled to limit the number of simultaneous sessions. |
| ☐ | SV-254876r1067681_rule | The Tanium Application Server console must be configured to initiate a session lock after a 15-minute period of inactivity. |
| ☐ | SV-254877r1067684_rule | The Tanium Server must be set to only allow connections from endpoints when TLS is used. |
| ☐ | SV-254878r960762_rule | Tanium Trusted Content providers must be documented. |
| ☐ | SV-254879r960762_rule | Content providers must provide their public key to the Tanium administrator to import for validating signed content. |
| ☐ | SV-254880r960762_rule | Tanium public keys of content providers must be validated against documented trusted content providers. |
| ☐ | SV-254881r1043176_rule | The Tanium Application Server must be configured to only use LDAP for account management functions. |
| ☐ | SV-254882r960792_rule | Tanium Computer Groups must be used to restrict console users from affecting changes to unauthorized computers. |
| ☐ | SV-254883r960792_rule | Documentation identifying Tanium console users, their respective User Groups, Computer Groups, and Roles must be maintained. |
| ☐ | SV-254884r960792_rule | The Tanium application must be configured to use Tanium User Groups in a manner consistent with the model outlined within the environment's system documentation. |
| ☐ | SV-254885r960792_rule | Documentation identifying Tanium console users and their respective Computer Group rights must be maintained. |
| ☐ | SV-254886r1067687_rule | The Tanium Action Approval feature must be enabled for two-person integrity when deploying actions to endpoints. |
| ☐ | SV-254887r960804_rule | The Tanium documentation identifying recognized and trusted IOC streams must be maintained. |
| ☐ | SV-254888r960804_rule | Tanium Threat Response must be configured to receive IOC streams only from trusted sources. |
| ☐ | SV-254889r960804_rule | The Tanium documentation identifying recognized and trusted folders for Threat Response Local Directory Source must be maintained. |
| ☐ | SV-254891r960804_rule | The Tanium documentation identifying recognized and trusted SCAP sources must be maintained. |
| ☐ | SV-254892r960804_rule | The Tanium documentation identifying recognized and trusted OVAL feeds must be maintained. |
| ☐ | SV-254893r960804_rule | Tanium Comply must be configured to receive SCAP content only from trusted sources. |
| ☐ | SV-254894r960804_rule | Tanium Comply must be configured to receive OVAL feeds only from trusted sources. |
| ☐ | SV-254895r1067691_rule | The publicly accessible Tanium application must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the application. |
| ☐ | SV-254896r1067694_rule | The publicly accessible Tanium application must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access. |
| ☐ | SV-254897r1015861_rule | Multifactor authentication must be enabled and enforced on the Tanium Server for all access and all accounts. |
| ☐ | SV-254898r960912_rule | The Tanium application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure. |
| ☐ | SV-254899r960918_rule | The Tanium application must be configured to send audit records from multiple components within the system to a central location for review and analysis of audit records. |
| ☐ | SV-254900r960924_rule | The Tanium applications must provide the capability to filter audit records for events of interest based upon organization-defined criteria. |
| ☐ | SV-254901r960933_rule | Access to Tanium logs on each endpoint must be restricted by permissions. |
| ☐ | SV-254902r960939_rule | The Tanium application must prohibit user installation, modification, or deletion of software without explicit privileged status. |
| ☐ | SV-254903r1067697_rule | The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server. |
| ☐ | SV-254904r1067700_rule | The Tanium cryptographic signing capabilities must be enabled on the Tanium Server. |
| ☐ | SV-254905r1043177_rule | Firewall rules must be configured on the Tanium Endpoints for Client-to-Server communications. |
| ☐ | SV-254906r1043177_rule | Firewall rules must be configured on the Tanium Server for Client-to-Server communications. |
| ☐ | SV-254907r1043177_rule | Firewall rules must be configured on the Tanium Zone Server for Client-to-Zone Server communications. |
| ☐ | SV-254908r1067702_rule | The Tanium Application Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments. |
| ☐ | SV-254909r960999_rule | The Tanium endpoint must have the Tanium Servers public key in its installation. |
| ☐ | SV-254910r1015864_rule | The Tanium application must enforce a minimum 15-character password length. |
| ☐ | SV-254912r1015865_rule | Tanium must enforce 24 hours/one day as the minimum password lifetime. |
| ☐ | SV-254913r1043190_rule | The Tanium application must enforce a 60-day maximum password lifetime restriction. |
| ☐ | SV-254914r961038_rule | The Tanium Server certificates must have Extended Key Usage entries for the serverAuth object TLS Web Server Authentication and the clientAuth object TLS Web Client Authentication. |
| ☐ | SV-254915r961044_rule | The Tanium application must be configured for LDAP user/group synchronization to map the authenticated identity to the individual user or group account for PKI-based authentication. |
| ☐ | SV-254916r961053_rule | The Tanium application must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users). |
| ☐ | SV-254917r961095_rule | The Tanium application must separate user functionality (including user interface services) from information system management functionality. |
| ☐ | SV-254918r961125_rule | The Tanium Server and Client applications must have logging enabled. |
| ☐ | SV-254919r1067705_rule | The Tanium application must restrict the ability of individuals to use information systems to launch organization-defined denial-of-service (DoS) attacks against other information systems. |
| ☐ | SV-254920r961155_rule | The Tanium application must manage bandwidth throttles to limit the effects of information flooding types of Denial of Service (DoS) attacks. |
| ☐ | SV-254921r961170_rule | The Tanium application must reveal error messages only to the ISSO, ISSM, and SA. |
| ☐ | SV-254923r1067707_rule | Tanium must notify system administrator (SA) and the information system security officer (ISSO) when accounts are created. |
| ☐ | SV-254924r1067709_rule | Tanium must notify system administrators (SAs) and the information system security officer (ISSO) when accounts are modified. |
| ☐ | SV-254925r1067711_rule | Tanium must notify system administrators (SAs) and the information system security officer (ISSO) for account disabling actions. |
| ☐ | SV-254926r1067713_rule | Tanium must notify system administrators (SAs) and the information system security officer (ISSO) for account removal actions. |
| ☐ | SV-254927r1067716_rule | The Tanium application must set an inactive timeout for sessions. |
| ☐ | SV-254928r1015871_rule | The Tanium Application Server must be configured with a connector to sync to Microsoft Active Directory for account management functions. |
| ☐ | SV-254929r1067719_rule | Tanium must notify the system administrator (SA) and information system security officer (ISSO) of account enabling actions. |
| ☐ | SV-254930r961317_rule | Control of the Tanium Client service must be restricted to SYSTEM access only for all managed clients. |
| ☐ | SV-254931r961317_rule | The ability to uninstall the Tanium Client service must be disabled on all managed clients. |
| ☐ | SV-254932r961317_rule | The permissions on the Tanium Client directory must be restricted to only the SYSTEM account on all managed clients. |
| ☐ | SV-254933r1067722_rule | The Tanium application must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements. |
| ☐ | SV-254934r961395_rule | The Tanium application must offload audit records onto a different system or media than the system being audited. |
| ☐ | SV-254935r961398_rule | The Tanium application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity. |
| ☐ | SV-254936r1067725_rule | The Tanium application must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts. |
| ☐ | SV-254938r1015873_rule | The Tanium application must prohibit user installation of software without explicit privileged status. |
| ☐ | SV-254939r961461_rule | The application must enforce access restrictions associated with changes to application configuration. |
| ☐ | SV-254942r1067730_rule | Firewall rules must be configured on the Tanium module server to allow Server-to-Module Server communications from the Tanium Server. |
| ☐ | SV-254943r1067733_rule | Firewall rules must be configured on the Tanium Server for Server-to-Module Server communications. |
| ☐ | SV-254944r961470_rule | Firewall rules must be configured on the Tanium Server for Server-to-Zone Server communications. |
| ☐ | SV-254945r962034_rule | The SSLHonorCipherOrder must be configured to disable weak encryption algorithms on the Tanium Server. |
| ☐ | SV-254946r962034_rule | The SSLCipherSuite must be configured to disable weak encryption algorithms on the Tanium Server. |
| ☐ | SV-254947r961596_rule | The Tanium Server certificate must be signed by a DOD Certificate Authority. |
| ☐ | SV-254948r961620_rule | The Tanium application must limit the bandwidth used in communicating with endpoints to prevent a denial of service (DoS) condition at the server. |
| ☐ | SV-254949r961683_rule | The Tanium application must install security-relevant software updates within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs). |
| ☐ | SV-254950r961728_rule | Tanium must alert the ISSO, ISSM, and other individuals designated by the local organization when the following Indicators of Compromise (IOCs) or potential compromise are detected: real time intrusion detection; threats identified by authoritative sources (e.g., CTOs); and Category I, II, IV, and VII incidents in accordance with CJCSM 6510.01B. |
| ☐ | SV-254951r961860_rule | The application must, at a minimum, offload interconnected systems in real time and offload standalone systems weekly. |
| ☐ | SV-254952r961863_rule | Tanium Client processes must be excluded from on-access scan. |
| ☐ | SV-254953r961863_rule | Tanium Client directory and subsequent files must be excluded from on-access scan. |
| ☐ | SV-254954r1067672_rule | Tanium endpoint files must be excluded from host-based intrusion prevention intervention. |
STIGQter: STIG Summary: