AgileSec Tanium: Custom Configuration

Customize AgileSec Tanium actions to meet custom functionality requirements.

Overview

This guide covers creating a custom configuration file for AgileSec Tanium Discover and Run actions. After creating the configuration file, users should load the configuration files to the appropriate action package in their Tanium UI, then proceed through AgileSec Tanium: Execute Scans steps.

1. Configure Run Action

Perform the following actions to configure the AgileSec Tanium Run action:

Create configuration files tanium_run_linux.yml and tanium_run_windows.yml with the following templates:

tanium_run_linux.yml

YAML

scan_config:
  plugins: "${cfg:values.plugins}"
  config:
    network_discover:
      name: network_discover
      plugin_config:
        <<: *standard_network_discover_config
    discover:
      name: discover
      plugin_config:
        <<: *standard_discover_linux_config
        scan_path: "${cfg:values.scan_path}"
        exclude_dir: "${cfg:values.exclude_dir}"
        on_startup: "${cfg:values.on_startup}"
        priority: "${cfg:values.priority}"
        workers: "${cfg:values.workers}"
        max_size: "${cfg:values.max_size}"
        no_case: "${cfg:values.no_case}"
        from_date: "${cfg:values.start_date}"
        to_date: "${cfg:values.end_date}"
    deep_discover:
      name: discover
      plugin_config:
        <<: *deep_discover_linux_config
        scan_path: "${cfg:values.scan_path}"
        exclude_dir: "${cfg:values.exclude_dir}"
        on_startup: "${cfg:values.on_startup}"
        priority: "${cfg:values.priority}"
        workers: "${cfg:values.workers}"
        max_size: "${cfg:values.max_size}"
        no_case: "${cfg:values.no_case}"
        from_date: "${cfg:values.start_date}"
        to_date: "${cfg:values.end_date}"
    discover_metadata:
      name: plugin_metadata
      plugin_config:
        observation:
          sensor:
            name: "Tanium Host Scan"
            type: "${cfg:values.sensor_type}"
    local_export:
      name: local_export
    export:
      name: export
      plugin_config:
        <<: *export_config
        ran_by: "${cfg:values.user}"
        sensor_name: "Tanium Host Scan"
        sensor_type: "${cfg:values.sensor_type}"
        token: "${profile:ingestionToken}"
        url: "${profile:ingestionServiceUri}"
    db_export:
      name: db_export
      plugin_config:
        database: "${cfg:values.database}"

context:
  name: "incremental"
  enable: False
  option:
    scan_count: 5
  user: "${cfg:values.user}"
  id: ctx-tanium
settings:
  resource:
    memory: 0
    cpu: 0
  log_level: warn
  keep_temp: false
values:
  plugins: ['deep_discover', 'export']
    - '/home'
  exclude_dir:
    - '**Keyfactor**'
    - '**Tanium**'
    - '**{cache,tmp,temp,snapshot}**'
# on_startup: ['/usr/local/Keyfactor/isg/isg_agilescan_linux_sensor/scripts/script_linux-skip-mounts.sh']
  on_startup: [ ]
  priority: 30
  workers: 4
  max_size: 100
  no_case: True
  start_date: ""
  end_date: ""
  sensor_type: "Host Filesystem"
  database: "noop.db"
  user: "Tanium"

tanium_run_windows.yml

YAML

scan_config:
  plugins: "${cfg:values.plugins}"
  config:
    network_discover:
      name: network_discover
      plugin_config:
        <<: *standard_network_discover_config
    discover:
      name: discover
      plugin_config:
        <<: *standard_discover_windows_config
        scan_path: "${cfg:values.scan_path}"
        exclude_dir: "${cfg:values.exclude_dir}"
        on_startup: "${cfg:values.on_startup}"
        priority: "${cfg:values.priority}"
        workers: "${cfg:values.workers}"
        max_size: "${cfg:values.max_size}"
        no_case: "${cfg:values.no_case}"
        from_date: "${cfg:values.start_date}"
        to_date: "${cfg:values.end_date}"
    deep_discover:
      name: discover
      plugin_config:
        <<: *deep_discover_windows_config
        scan_path: "${cfg:values.scan_path}"
        exclude_dir: "${cfg:values.exclude_dir}"
        on_startup: "${cfg:values.on_startup}"
        priority: "${cfg:values.priority}"
        workers: "${cfg:values.workers}"
        max_size: "${cfg:values.max_size}"
        no_case: "${cfg:values.no_case}"
        from_date: "${cfg:values.start_date}"
        to_date: "${cfg:values.end_date}"
    discover_metadata:
      name: plugin_metadata
      plugin_config:
        observation:
          sensor:
            name: "Tanium Host Scan"
            type: "${cfg:values.sensor_type}"
    local_export:
      name: local_export
    export:
      name: export
      plugin_config:
        <<: *export_config
        ran_by: "${cfg:values.user}"
        sensor_name: "Tanium Host Scan"
        sensor_type: "${cfg:values.sensor_type}"
        token: "${profile:ingestionToken}"
        url: "${profile:ingestionServiceUri}"
    db_export:
      name: db_export
      plugin_config:
        database: "${cfg:values.database}"

context:
  name: "incremental"
  enable: False
  option:
    scan_count: 5
  user: "${cfg:values.user}"
  id: ctx-tanium
settings:
  resource:
    memory: 0
    cpu: 0
  log_level: warn
  keep_temp: false
values:
  plugins: ['deep_discover', 'export']
  scan_path:
    - 'C:\\Users'
  exclude_dir:
    - '**Keyfactor**'
    - '**Tanium**'
    - 'C:\\Windows'
    - 'C:\\$WINDOWS.~BT'
    - 'C:\\$Recycle.Bin'
    - 'C:\\ProgramData\\Microsoft\\Windows'
    - 'C:\\ProgramData\\Package Cache'
    - 'C:\\ProgramData\\Packages'
    - 'C:\\ProgramData\\Microsoft\\Windows Defender'
    - 'C:\\Users\\**\\AppData\\**\\Microsoft\\**'
    - 'C:\\Users\\**\\AppData\\**\\Packages\\**'
    - '**{cache,tmp,temp,snapshot}**'
# on_startup: ['C:\\Program Files (x86)\\Keyfactor\\isg\\isg_agilescan_windows_sensor\\scripts\\script_win-skip-mounts.ps1']
  on_startup: [ ]
  priority: 30
  workers: 4
  max_size: 100
  no_case: True
  start_date: ""
  end_date: ""
  sensor_type: "Host Filesystem"
  database: "noop.db"
  user: "Tanium"

Update lines 70+ (values: ) with custom configuration parameters. See the following tables for configuration guidance.
Load the configuration file(s) to the Run package in Tanium UI.
When performing AgileSec Tanium: Execute Scans, ensure you update the Run action’s Config File parameter with the updated configuration file.

Note: The custom configuration .yml may be named differently as long as the correct name is passed into the Config File parameter when Executing.

Run Action Fields: UI or Configuration .yaml

Custom configuration will fully replace all parameters set in UI.

Run Action Field	Description	Recommended Default	Custom Configuration Example
Scan Path `values.scan_path`	Set the Directories or Drives to include in the analysis	Windows: `C:/, D:/` Linux: `/` Note: using / for Linux or C:/ for Windows may be heavy and time-consuming as it scans the entire target machine. Adjust the path based on performance and scope requirements.	`values.scan_path: - '/path/one' - '/path/two'` Important: Windows paths may use either `\\` or `/` in paths. If using `\` in file path, yaml requires an escape slash to be used `\\`. Example: `values.scan_path: - '\\path\\one' - '\\path\\two'`
Host Scan Type `values.plugins`	Select the type of scan to run: Run-Incremental: Perform Incremental Scan since last scan and export results to AgileSec Server. After every 5 incremental scans, a complete scan executes. `context.enable: True` Run-Full: Perform complete scan and export results to AgileSec Server. `deep_discover`: Full host file scan of all files in path. `export`: Export results to AgileSec platform. Network: Only scan network interfaces and export results to AgileSec Server `network_discover`: Host Network scan. Note: Incremental scan should not be enabled for Network Scan (`context.enable: False`) to avoid undefined behavior.	Run-Full	Run-Full `values.plugins: [ 'deep_discover', 'export' ]` Run-Incremental: `values.plugins: [ 'deep_discover', 'export' ] context.enable: True` Network: `values.plugins: [ 'network_discover', 'export' ] values.sensor_type: "Network Sensor" context.enable: False`
Include Tanium `values.exclude_dir`	By default, Tanium directory is excluded from the scan process. To include Tanium in the scan process, comment out this line or remove `Tanium` from `exclude_dir`.	Not Enabled (Exclude Tanium directory)	Enable, excluding Tanium from scan: `values.exclude_dir: Tanium` Disable, including Tanium in scan (remove `Tanium`): `values.exclude_dir:`
Skip Mounts `values.on_startup`	Set to skip network mounts	Enabled	Uncomment `values.on_startup` line and set to `<installation_directory>/isg` Example: `values.on_startup: [/usr/local/Keyfactor/isg]`
Scan Priority `values.priority`	Set priority of the discovery process vs other processes: Low: Set Low priority for discovery process Normal: Set Normal priority for discovery process High: Set High priority for discovery process	Low	Low: `values.priority: 30` Normal: `values.priority: 0` High: `values.priority: 3`
CPU Priority `values.workers`	Set number of workers to parallelize the discovery process run: Low: Set single worker / core usage Normal: Set 4 workers usage High: Set 16 workers usage	Normal	Low: `values.workers: 1` Normal: `values.workers: 4` High: `values.workers: 16`
Log Level `settings.log_level`	Sets the log level for the log file to Warn, Info, or Debug. When scan runs, a log file is created in the installation directory on the execution machine. Log files can be examined if there is remote access to machine.	Warn	`settings.log_level: warn`

Run Action Field

Description

Recommended Default

Custom Configuration Example

Scan Path

values.scan_path

Set the Directories or Drives to include in the analysis

Windows: C:/, D:/

Linux: /

Note: using / for Linux or C:/ for Windows may be heavy and time-consuming as it scans the entire target machine.

Adjust the path based on performance and scope requirements.

values.scan_path:
- '/path/one'
- '/path/two'

Important: Windows paths may use either \\ or / in paths. If using \ in file path, yaml requires an escape slash to be used \\.

Example:

values.scan_path: 
- '\\path\\one'
- '\\path\\two'

Host Scan Type

values.plugins

Select the type of scan to run:

Run-Incremental: Perform Incremental Scan since last scan and export results to AgileSec Server. After every 5 incremental scans, a complete scan executes.

context.enable: True

Run-Full: Perform complete scan and export results to AgileSec Server.

deep_discover: Full host file scan of all files in path.
export: Export results to AgileSec platform.

Network: Only scan network interfaces and export results to AgileSec Server

network_discover: Host Network scan.

Note:

Incremental scan should not be enabled for Network Scan (context.enable: False) to avoid undefined behavior.

Run-Full

values.plugins: [ 'deep_discover', 'export' ]

Run-Incremental:

values.plugins: [ 'deep_discover', 'export' ]

context.enable: True

Network:

values.plugins: [ 'network_discover', 'export' ]

values.sensor_type: "Network Sensor"

context.enable: False

Include Tanium

values.exclude_dir

By default, Tanium directory is excluded from the scan process.

To include Tanium in the scan process, comment out this line or remove **Tanium** from exclude_dir.

Not Enabled (Exclude Tanium directory)

Enable, excluding Tanium from scan:

values.exclude_dir: **Tanium**

Disable, including Tanium in scan (remove **Tanium**):

values.exclude_dir:

Skip Mounts

values.on_startup

Set to skip network mounts

Enabled

Uncomment values.on_startup line and set to <installation_directory>/isg

Example:

values.on_startup: [/usr/local/Keyfactor/isg]

Scan Priority

values.priority

Set priority of the discovery process vs other processes:

Low: Set Low priority for discovery process
Normal: Set Normal priority for discovery process
High: Set High priority for discovery process

Low

Low:

values.priority: 30

Normal:

values.priority: 0

High:

values.priority: 3

CPU Priority

values.workers

Set number of workers to parallelize the discovery process run:

Low: Set single worker / core usage
Normal: Set 4 workers usage
High: Set 16 workers usage

Normal

Low:

values.workers: 1

Normal:

values.workers: 4

High:

values.workers: 16

Log Level

settings.log_level

Sets the log level for the log file to Warn, Info, or Debug.

When scan runs, a log file is created in the installation directory on the execution machine. Log files can be examined if there is remote access to machine.

Warn

settings.log_level: warn

Run Action Fields: Configuration .yaml Only

The following fields are only configurable via custom configuration file:

Run Action Field	Description	Recommended Default	Custom Configuration Example
Exclude Directory `values.exclude_dir`	Add directories to exclude from search.	None	`values.exclude_dir: - /path/one - /path/two` Important: Windows paths may use either `\\` or `/` in paths. If using `\` in file path, yaml requires an escape slash to be used `\\`. Example: `values.exclude_dir: - \\path\\one - \\path\\two`
No Case `values.no_case`	Determines if `values.exclude_dir` is case-sensitive (`False`) or case-insensitive (`True`)	`False`, case-sensitive	`values.no_case: False`
Enable Context `context.enable`	Enables incremental scanning. When set to `True`, saving a scan state for faster subsequent scans.	False	`context: name: "incremental" enable: True`
Scan Count `context.option.scan_count`	When Host Scan Type is `Run-Incremental` ( `context.enable: True`), the default scan cycle count is 5: 1 full scan followed by 4 incremental scans. Update Scan Count to change this default. For example, a value of 10 means we do 1 full scan, 9 incremental scans, then 1 full scan, 9 incremental scans, then 1 full scan, and repeat.	N/A	Setting scan cycle to 1 full scan, 9 incremental scans: `context: name: "incremental" enable: True option: scan_count: 10`

Run Action Fields: UI Only

The following fields can only be set via UI:

Run Action Field	Description	Recommended Configuration in UI
Background Mode (Async Mode)	When enabled, scan runs as an asynchronous background process.	Enabled
EDR Id	An organization ID used by sensor to retrieve a token	EDR Id obtained from AgileSec UI (Settings → EDR Management)
Ingest URL	Ingest URL of your AgileSec Server Examples: `https://ingest.agilesec.net/`	`<Your AgileSec Server Ingest URL>`
Config File	Add a custom configuration file	Set to config file `tanium_run_linux.yml`, `tanium_run_windows.yml`, or your custom file name.
Ignore Missing Path	Avoid fail if a given scan path is missing. For example, when targeting Windows systems, if `C:/, D:/, E:/, F:/` are given as scan paths, some machines may not have `D:/`, causing a fail if this option is not enabled. When enabled, scan will still fail if all given scan paths do not exist.	Enabled

2. Configure Discover Action

Perform the following actions to configure the AgileSec Tanium Discover action:

Create configuration files tanium_discover_linux.yml and tanium_discover_windows.yml with the following templates:

tanium_discover_linux.yml

YAML

scan_config:
  plugins: "${cfg:values.plugins}"
  config:
    network_discover:
      name: network_discover
      plugin_config:
        <<: *standard_network_discover_config
    discover:
      name: discover
      plugin_config:
        <<: *standard_discover_linux_config
        scan_path: "${cfg:values.scan_path}"
        exclude_dir: "${cfg:values.exclude_dir}"
        on_startup: "${cfg:values.on_startup}"
        priority: "${cfg:values.priority}"
        workers: "${cfg:values.workers}"
        max_size: "${cfg:values.max_size}"
        no_case: "${cfg:values.no_case}"
        from_date: "${cfg:values.start_date}"
        to_date: "${cfg:values.end_date}"
    deep_discover:
      name: discover
      plugin_config:
        <<: *deep_discover_linux_config
        scan_path: "${cfg:values.scan_path}"
        exclude_dir: "${cfg:values.exclude_dir}"
        on_startup: "${cfg:values.on_startup}"
        priority: "${cfg:values.priority}"
        workers: "${cfg:values.workers}"
        max_size: "${cfg:values.max_size}"
        no_case: "${cfg:values.no_case}"
        from_date: "${cfg:values.start_date}"
        to_date: "${cfg:values.end_date}"
    discover_metadata:
      name: plugin_metadata
      plugin_config:
        observation:
          sensor:
            name: "Tanium Host Scan"
            type: "${cfg:values.sensor_type}"
    local_export:
      name: local_export
    export:
      name: export
      plugin_config:
        <<: *export_config
        ran_by: "${cfg:values.user}"
        sensor_name: "Tanium Host Scan"
        sensor_type: "${cfg:values.sensor_type}"
        token: "${profile:ingestionToken}"
        url: "${profile:ingestionServiceUri}"
    db_export:
      name: db_export
      plugin_config:
        database: "${cfg:values.database}"

context:
  name: "incremental"
  enable: False
  option:
    scan_count: 5
  user: "${cfg:values.user}"
  id: ctx-tanium
settings:
  resource:
    memory: 0
    cpu: 0
  log_level: warn
  keep_temp: false
values:
  plugins: ['discover', 'discover_metadata', 'db_export']
  scan_path:
    - '/home'
  exclude_dir:
    - '**Keyfactor**'
    - '**Tanium**'
    - '**{cache,tmp,temp,snapshot}**'
# on_startup: ['/usr/local/Keyfactor/isg/isg_agilescan_linux_sensor/scripts/script_linux-skip-mounts.sh']
  on_startup: [ ]
  priority: 30
  workers: 4
  max_size: 100
  no_case: False
  start_date: ""
  end_date: ""
  sensor_type: "Tanium Sensor"
  database: "/usr/local/Keyfactor/isg/discover.db"
  user: "Tanium"

tanium_discover_windows.yml

YAML

scan_config:
  plugins: "${cfg:values.plugins}"
  config:
    network_discover:
      name: network_discover
      plugin_config:
        <<: *standard_network_discover_config
    discover:
      name: discover
      plugin_config:
        <<: *standard_discover_windows_config
        scan_path: "${cfg:values.scan_path}"
        exclude_dir: "${cfg:values.exclude_dir}"
        on_startup: "${cfg:values.on_startup}"
        priority: "${cfg:values.priority}"
        workers: "${cfg:values.workers}"
        max_size: "${cfg:values.max_size}"
        no_case: "${cfg:values.no_case}"
        from_date: "${cfg:values.start_date}"
        to_date: "${cfg:values.end_date}"
    deep_discover:
      name: discover
      plugin_config:
        <<: *deep_discover_windows_config
        scan_path: "${cfg:values.scan_path}"
        exclude_dir: "${cfg:values.exclude_dir}"
        on_startup: "${cfg:values.on_startup}"
        priority: "${cfg:values.priority}"
        workers: "${cfg:values.workers}"
        max_size: "${cfg:values.max_size}"
        no_case: "${cfg:values.no_case}"
        from_date: "${cfg:values.start_date}"
        to_date: "${cfg:values.end_date}"
    discover_metadata:
      name: plugin_metadata
      plugin_config:
        observation:
          sensor:
            name: "Tanium Host Scan"
            type: "${cfg:values.sensor_type}"
    local_export:
      name: local_export
    export:
      name: export
      plugin_config:
        <<: *export_config
        ran_by: "${cfg:values.user}"
        sensor_name: "Tanium Host Scan"
        sensor_type: "${cfg:values.sensor_type}"
        token: "${profile:ingestionToken}"
        url: "${profile:ingestionServiceUri}"
    db_export:
      name: db_export
      plugin_config:
        database: "${cfg:values.database}"

context:
  name: "incremental"
  enable: False
  option:
    scan_count: 5
  user: "${cfg:values.user}"
  id: ctx-tanium
settings:
  resource:
    memory: 0
    cpu: 0
  log_level: warn
  keep_temp: false
values:
  plugins: ['discover', 'network_discover', 'discover_metadata', 'db_export']
  scan_path:
    - 'C:\\Users'
  exclude_dir:
    - '**Keyfactor**'
    - '**Tanium**'
    - 'C:\\Windows'
    - 'C:\\$WINDOWS.~BT'
    - 'C:\\$Recycle.Bin'
    - 'C:\\ProgramData\\Microsoft\\Windows'
    - 'C:\\ProgramData\\Package Cache'
    - 'C:\\ProgramData\\Packages'
    - 'C:\\ProgramData\\Microsoft\\Windows Defender'
    - 'C:\\Users\\**\\AppData\\**\\Microsoft\\**'
    - 'C:\\Users\\**\\AppData\\**\\Packages\\**'
    - '**{cache,tmp,temp,snapshot}**'
# on_startup: ['C:\\Program Files (x86)\\Keyfactor\\isg\\isg_agilescan_windows_sensor\\scripts\\script_win-skip-mounts.ps1']
  on_startup: [ ]
  priority: 30
  workers: 4
  max_size: 512
  no_case: False
  start_date: ""
  end_date: ""
  sensor_type: "Tanium Sensor"
  database: "C:\\Program Files (x86)\\Keyfactor\\isg\\discover.db"
  user: "Tanium"

Update lines 70+ (values: ) with custom configuration parameters. See the following tables for configuration guidance.
Load the configuration file(s) to the Discover package in Tanium UI.
When performing AgileSec Tanium: Execute Scans, ensure you update the Discover action’s Config File parameter with the updated configuration file.

Note: The custom configuration .yml may be named differently as long as the correct name is passed into the Config File parameter when Executing.

Discover Action Fields: UI or Configuration .yaml

Custom configuration will fully replace all parameters set in UI.

Discover Action Field	Description	Recommended Default	Custom Configuration Example
Scan Path `values.scan_path`	Set the Directories or Drives to include in the analysis	Windows: `C:/, D:/` Linux: `/` Note: using `/` for Linux may be heavy and time-consuming as it scans the entire Linux target machine. Adjust the path based on performance and scope requirements.	`values.scan_path: - '/path/one' - '/path/two'` Important: Windows paths may use either `\\` or `/` in paths. If using `\` in file path, yaml requires an escape slash to be used `\\`. Example: `values.scan_path: - '\\path\\one' - '\\path\\two'`
Host Scan Type `values.plugins`	Select the type of scan to run: Regular: Perform optimized scan excluding archive files (zip, tar, etc.) and system directories. Full: Perform complete scan of all files in path. None: No host case.	None	Regular: `values.plugins: [ 'discover', 'discover_metadata', 'db_export' ]` Full: `values.plugins: [ 'deep_discover','discover_metadata', 'db_export' ]`
Network Scan Type `values.plugins`	Select the network scan type: Host: Scan local processes on host to check if they allow SSH or TLS connections. `network_discover`: Host Network scan `discover`: Optimized host file scan excluding archive files (zip, tar, etc.) and system directories. `deep_discover`: Full host file scan of all files in path. `discover_metadata`: Enrich findings `db_export`: Save results to local database for AgileSec Tanium Sensors to retrieve.	Host	Perform network scan only: `values.plugins: [ 'network_discover', 'discover_metadata', 'db_export' ]` Perform host scan and network scan: `values.plugins: [ 'network_discover', 'discover', 'discover_metadata', 'db_export' ]`
Include Tanium `values.exclude_dir`	By default, Tanium directory is excluded from the scan process. To include Tanium in the scan process, comment out this line or remove `Tanium` from `exclude_dir`.	Not Enabled (Exclude Tanium directory)	Enable, excluding Tanium from scan: `values.exclude_dir: Tanium` Disable, including Tanium in scan (remove `Tanium`): `values.exclude_dir:`
Skip Mounts `values.on_startup`	Set to skip network mounts with a script on startup.	Enabled	Uncomment `values.on_startup` line and set to `<installation_directory>/isg` Example: `values.on_startup: [/usr/local/Keyfactor/isg]`
Scan Priority `values.priority`	Set priority of the discovery process vs other processes: Low: Set Low priority for discovery process Normal: Set Normal priority for discovery process High: Set High priority for discovery process	Low	Low: `values.priority: 30` Normal: `values.priority: 0` High: `values.priority: 3`
CPU Priority `values.workers`	Set number of workers to parallelize the discovery process run: Low: Set single worker / core usage Normal: Set 4 workers usage High: Set 16 workers usage	Normal	Low: `values.workers: 1` Normal: `values.workers: 4` High: `values.workers: 16`
Scan files modified since days `values.start_date`	Limit scan to only new or modified files since x days ago. For example, if the last scan was 3 days ago, set the value to 3 to scan for new results.	0	`values.start_date: "now - Xd" (e.g. "now - 3d")`
Log Level `settings.log_level`	Sets the log level for the log file to `Warn`, `Info`, or `Debug`. When scan runs, a log file is created in the installation directory on the execution machine. Log files can be examined if there is remote access to machine.	Warn	`settings.log_level: warn`

Discover Action Field

Description

Recommended Default

Custom Configuration Example

Scan Path

values.scan_path

Set the Directories or Drives to include in the analysis

Windows: C:/, D:/

Linux: /

Note: using / for Linux may be heavy and time-consuming as it scans the entire Linux target machine. Adjust the path based on performance and scope requirements.

values.scan_path:
- '/path/one'
- '/path/two'

Important: Windows paths may use either \\ or / in paths. If using \ in file path, yaml requires an escape slash to be used \\.

Example:

values.scan_path:
- '\\path\\one'
- '\\path\\two'

Host Scan Type

values.plugins

Select the type of scan to run:

Regular: Perform optimized scan excluding archive files (zip, tar, etc.) and system directories.
Full: Perform complete scan of all files in path.
None: No host case.

None

Regular:

values.plugins: [ 'discover', 'discover_metadata', 'db_export' ]

Full:

values.plugins: [ 'deep_discover','discover_metadata', 'db_export' ]

Network Scan Type

values.plugins

Select the network scan type:

Host: Scan local processes on host to check if they allow SSH or TLS connections.

network_discover: Host Network scan
discover: Optimized host file scan excluding archive files (zip, tar, etc.) and system directories.
deep_discover: Full host file scan of all files in path.
discover_metadata: Enrich findings
db_export: Save results to local database for AgileSec Tanium Sensors to retrieve.

Host

Perform network scan only:

values.plugins: [ 'network_discover', 'discover_metadata', 'db_export' ]

Perform host scan and network scan:

values.plugins: [ 'network_discover', 'discover', 'discover_metadata', 'db_export' ]

Include Tanium

values.exclude_dir

By default, Tanium directory is excluded from the scan process.

To include Tanium in the scan process, comment out this line or remove **Tanium** from exclude_dir.

Not Enabled (Exclude Tanium directory)

Enable, excluding Tanium from scan:

values.exclude_dir: **Tanium**

Disable, including Tanium in scan (remove **Tanium**):

values.exclude_dir:

Skip Mounts

values.on_startup

Set to skip network mounts with a script on startup.

Enabled

Uncomment values.on_startup line and set to <installation_directory>/isg

Example:

values.on_startup: [/usr/local/Keyfactor/isg]

Scan Priority

values.priority

Set priority of the discovery process vs other processes:

Low: Set Low priority for discovery process
Normal: Set Normal priority for discovery process
High: Set High priority for discovery process

Low

Low:

values.priority: 30

Normal:

values.priority: 0

High:

values.priority: 3

CPU Priority

values.workers

Set number of workers to parallelize the discovery process run:

Low: Set single worker / core usage
Normal: Set 4 workers usage
High: Set 16 workers usage

Normal

Low:

values.workers: 1

Normal:

values.workers: 4

High:

values.workers: 16

Scan files modified since days

values.start_date

Limit scan to only new or modified files since x days ago. For example, if the last scan was 3 days ago, set the value to 3 to scan for new results.

values.start_date: "now - Xd" (e.g. "now - 3d")

Log Level

settings.log_level

Sets the log level for the log file to Warn, Info, or Debug.

When scan runs, a log file is created in the installation directory on the execution machine. Log files can be examined if there is remote access to machine.

Warn

settings.log_level:  warn

Discover Action Fields: Configuration .yaml Only

The following fields are only configurable via custom configuration files:

Discover Action Field	Description	Recommended Default	Custom Config Example
Database `values.database`	Must use the same directory as specified in the `DB Path` field when Tanium package was deployed.	If `DB Path` was not specified, then it will be `<installation_directory>/isg`.	Default installation directory example: `values.database: /usr/local/Keyfactor/isg`
Exclude Directory `values.exclude_dir`	Add directories to exclude from search.	None	`values.exclude_dir: - /path/one - /path/two` Important: Windows paths may use either `\\` or `/` in paths. If using `\` in file path, yaml requires an escape slash to be used `\\`. Example: `values.exclude_dir: - \\path\\one - \\path\\two`
No Case `values.no_Case`	Determines if `values.exclude_dir` is case-sensitive (`False`) or case-insensitive (`True`)	`False`, case-sensitive	`values.no_case: False`

Discover Action Field

Description

Recommended Default

Custom Config Example

Database

values.database

Must use the same directory as specified in the DB Path field when Tanium package was deployed.

If DB Path was not specified, then it will be <installation_directory>/isg.

Default installation directory example:

values.database: /usr/local/Keyfactor/isg

Exclude Directory

values.exclude_dir

Add directories to exclude from search.

None

values.exclude_dir:
- /path/one
- /path/two

Important: Windows paths may use either \\ or / in paths. If using \ in file path, yaml requires an escape slash to be used \\.

Example:

values.exclude_dir: 
- \\path\\one 
- \\path\\two

No Case

values.no_Case

Determines if values.exclude_dir is case-sensitive (False) or case-insensitive (True)

False, case-sensitive

values.no_case: False

Discover Action Fields: UI Only

The following fields can only be set via UI:

Discover Action Field

Description

Recommended Configuration in UI

Background Mode (Async Mode)

When enabled, scan runs as an asynchronous background process.

Enabled

Config File

Add a custom configuration file

Set to config file tanium_run_linux.yml, tanium_run_windows.yml, or your custom file name.

Ignore Missing Path

Avoid fail if a given scan path is missing. For example, when targeting Windows systems, if C:/, D:/, E:/, F:/ are given as scan paths, some machines may not have D:/, causing a fail if this option is not enabled.

When enabled, scan will still fail if all given scan paths do not exist.

Enabled