IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Tanium integration GitHub repo

    Posted Thu May 23, 2019 01:26 PM
    Hi,

    I've been working on integration with the Tanium platform.  The app will allow you to query the endpoints for various data like running processes, autoruns, etc.

    more can be found here:

    https://github.com/ft44k/resilient_public/tree/master/tanium

    ------------------------------
    Jaroslav Brtan
    ------------------------------


  • 2.  RE: Tanium integration GitHub repo

    Posted Fri May 24, 2019 02:11 AM
    Hi Jaroslav,

    Thanks a lot for sharing it. I'll definitely have a look !

    We have used the REST API function from fn_utilities package to get results from a saved question. They allow us to get results even if the machine is offline. Of course it can't be done for all data but for generic one it's quite usefull.



    ------------------------------
    Clément Fouque
    ------------------------------

    Original Message


  • 3.  RE: Tanium integration GitHub repo

    Posted Fri May 24, 2019 04:44 AM
    Hi Jaroslav,

    This is cool!

    Did you know anyone in the Community can submit Apps to our App Exchange.

    App Exchange: https://exchange.xforce.ibmcloud.com/hub/Resilient

    Signup/Login, scroll down and click Submissions Portal:



    ------------------------------
    Shane Curtin
    Integrations Engineer - IBM Resilient
    ------------------------------

    Original Message


  • 4.  RE: Tanium integration GitHub repo

    Posted Tue May 28, 2019 05:48 AM
    Hi Shane,

    that's awesome, if nothing else I get my code reviewed :)

    Thank you

    -Jaro

    ------------------------------
    Jaroslav Brtan
    ------------------------------

    Original Message


  • 5.  RE: Tanium integration GitHub repo

    Posted Tue May 28, 2019 04:53 AM
    Hi Clément,

    could you please share what data you query for with saved questions? Just looking for some inspiration.
    The integration I made is focused more on Incident Response.

    Thank you

    -Jaro

    ------------------------------
    Jaroslav Brtan
    ------------------------------

    Original Message


  • 6.  RE: Tanium integration GitHub repo

    Posted Wed May 29, 2019 04:58 AM
    Hi Jaroslav,

    Due to Tanium architecture, you're only able to get results from systems that are currently online. At the time you do incident response, the system might be offline. To workaround this, we have created a saved question in Tanium with the merge feature. You'll have results presented as following

    System1 - Value1 - Value2 - Age
    PC01       - xxx        - xxx        - current
    PC01       - xxx        - xxx        - 1 week

    Even if the result is outdated, you can still get the latest value when the system was online. For example, we are retieving the last logged in user, last reboot and members of Local groups. You can think of user usage. Keep in mind that data is stored on servers, so you should be carefull with the storage it could take.

    ------------------------------
    Clément Fouque
    ------------------------------

    Original Message


  • 7.  RE: Tanium integration GitHub repo

    Posted Thu June 06, 2019 02:23 AM
    Hi Clément,

    I store such data into mongodb so I can find anomalies during threat hunts.
    There is a new version on GitHub which adds function tanium_search_agent.
    Tanium seems to store information about connected agents for a month or so. This function helps to decide if an endpoint runs the agent.

    -Jaro

    ------------------------------
    Jaroslav Brtan
    ------------------------------

    Original Message