Tanium 7.0 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Tanium must notify System Administrators and Information System Security Officers for account disabling actions.
When application accounts are disabled, user accessibility is affected. Accounts are used for identifying individual application users or for identifying the application processes themselves. In o...Rule Medium Severity -
The Tanium SQL server must be dedicated to the Tanium database.
Failure to protect organizational information from data mining may result in a compromise of information. Data storage objects include, for example, databases, database records, and database field...Rule Medium Severity -
The Tanium Server installers account SQL database permissions must be reduced from sysadmin to db_owner.
Creating the tanium and tanium_archive databases through the Tanium Server installer program or using the database create SQL scripts requires Sysadmin-level permissions. Once the databases have be...Rule Medium Severity -
The Tanium Server console must be configured to initiate a session lock after a 15-minute period of inactivity.
The Tanium Console, when CAC is enabled, will initiate a session lock based upon the ActivClient or other Smart Card software. By initiating the session lock, the console will be locked and not al...Rule Medium Severity -
Tanium Trusted Content providers must be documented.
A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information ...Rule Medium Severity -
Tanium public keys of content providers must be validated against documented trusted content providers.
A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information ...Rule Medium Severity -
The Tanium Action Approval feature must be enabled for two person integrity when deploying actions to endpoints.
The Tanium Action Approval feature provides a "four eyes" control mechanism designed to achieve a high level of security and reduce the possibility of error for critical operations. When this feat...Rule Medium Severity -
The Tanium Server must protect audit tools from unauthorized access, modification, or deletion.
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on au...Rule Medium Severity -
The Tanium Server must be configured to only allow signed content to be imported.
Changes to any software components can have significant effects on the overall security of the application. Verifying software components have been digitally signed using a certificate that is reco...Rule Medium Severity -
The Tanium Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.