ISG Tanium

This page provides an overview of the integration between AgileSec Analytics and the Tanium Environment, including overall integration flow and an overview of provided files.

The following guides are available to leverage the capabilities of Tanium with AgileSec Analytics:

Integration Overview

This integration includes specific content created and provided separately by AgileSec to leverage the capabilities of Tanium to perform cryptographic inventory at scale.

Integrating Tanium with AgileSec allows rapid deployment of AgileSec Analytics sensors for broad cryptographic discovery. Integration setup and flow is straightforward:

1. Depending on the Tanium infrastructure type, ISG-Tanium content can be loaded manually via the Tanium UI or via the Tanium SaaS API with a provided AgileSec Load Script.

2. Tanium triggers Cryptographic Discovery operations using the Tanium Infrastructure across all targeted Hosts via AgileSec Tanium Actions.

3. Tanium Agent will deploy and trigger the AgileSec Sensor for Tanium across all hosts.

4. AgileSec Sensor for Tanium will perform the cryptographic discovery and immediately send the findings to the AgileSec Server from the Host. 

5. AgileSec Server receives the findings generated by the multiple Hosts.

Key Files

ISG Tanium integration content, ISG-Sensor-<version>-Tanium.zip, is provided in a single archive zip file by AgileSec separately through a secure download link.

The zip file contains the following key components, which can be loaded manually via UI for Tanium Appliance or via provided API scripts for Tanium SaaS:

• ISG-Tanium-Packages: Used to deploy AgileSec discovery capabilities to end-points through Tanium Agent.

• ISG-Tanium-Sensors: Used to query cryptographic findings from ISG packages.

• ISG-Tanium-Saved-Questions: Used to leverage a set of pre-built saved questions.

• ISG-Tanium-Connect Jobs: Used to export cryptographic findings to an external source.

Note: Saved Questions and Connect jobs are only compatible with Tanium Platform. Tanium SaaS API does not allow importing Saved Questions or Connect jobs.

The zip file contains scripts in the API-Loader folder to enable uploading via API to Tanium SaaS.

• verify.sh: Verifies connectivity to the Tanium API and checks the provided token and URL are valid with a test request.

• deploy.sh : Loads the ISG Tanium integration packages to Tanium via API.

• shared.sh: Contains common functions used by other scripts.

ISG-Tanium-Packages

ISG-Tanium-Packages-<version>.json contains packages to load into Tanium Appliance.

ISG packages are used to deploy the ISG discovery plugin via the Tanium infrastructure. The packages are split into 3 main categories, including:

1. Deployment of the ISG package

2. Execution of the ISG package (discover and run packages)

3. Removal of the ISG package.

The following packages are provided:

ISG-Tanium-Sensors

ISG-Tanium-Sensors-3<version>.json contains sensors to load into Tanium Appliance.

The Sensors in ISG-Tanium-Sensors-<version>.json will be loaded into Tanium. The sensors will be used to interact with the ISG packages and query specific cryptographic information. The sensors are usually divided into 2 groups:

1. File level sensors which return information about the location plus the metadata of the associated cryptographic object.

2. Detailed information about the cryptographic object.

As Tanium limits the number of events returned by Sensors by hosts, ISG implemented specific parameters allowing Sensors to return only a subset of information.

NOTE: Sensors are used to query for scan information without exporting to Analytics Server.

ISG-Tanium-Saved-Questions

ISG-Tanium-Saved-Questions-<version>.json contains saved questions to load into Tanium Appliance.

ISG saved questions are pre-built questions leveraging the ISG sensors. The default saved questions have been designed to split queries returning a large amount of data into isolated queries, such as queries related to X.509 certificates. Saved questions include:

1. Event Saved questions aiming to return the location of cryptographic objects associated with the associated metadata

2. Objects returning detailed information about the related cryptographic objects (especially for X509 certificates that contain several useful information). 

Custom sensors are created to return only specific information to ISG backend or when a sensor returns more items by host than allowed by Tanium.

ISG-Tanium-Connect

ISG-Tanium-Connect-<version>.json

The Tanium Connect jobs match the ISG Saved Question to export the result of saved questions to the ISG backend Server. The following Tanium connect jobs are provided: