Exporting data to destinations

You can configure Asset to export data to external destinations, such as Tanium Connect, Flexera, and ServiceNow.

Flexera integrations with Asset are not currently possible because Flexera does not support the authentication method required to integrate with Tanium Cloud.

CSV file

You can copy data from an asset report table to the clipboard and paste the data in an application that can interpret a CSV file, such as a database. Select the rows that you want to copy and click Copy. You can then paste the information about the rows you selected.

To save the entire report as displayed in a CSV file, click Export . You might see an Export requested status message before you see a Download link for the CSV file. Each Asset user can export a single report at a time. Multiple Asset users can be signed in, each exporting a single report at the same time.

For scheduling, formatting, and large data sets, consider setting up a Connect destination that uses a view.

Tanium Connect

To export data from Asset to Connect destinations such as email, file, HTTP, Socket Receiver, Splunk, and SQL Server, create a connection.

SQL Server on Azure, Amazon Relational Database Service, and other database as a service providers are not supported as SQL Server destinations.

Requirements

• Access to Connect with the Connect User role.
• An Asset report or view from which you want to export data. See Building reports and Configuring views.

Exporting reports with large data sets (more than 100,000 results) can have a significant performance impact.
If you need to export a large data set, select Asset Computers as the Type for the source and use a view. This source is available with Connect 4.8 and later. For more information about views, see Configuring views.

Create a connection

With Connect 4.3 to 4.7, choose Asset Report as the connection source. You can choose a predefined or custom Asset report as a connection source.

With Connect 4.8 and later, choose Choose Tanium Asset as the connection source. You can choose from the following types of Asset source: 

Asset Reports

Select a predefined or custom report as the connection source.

Asset Computers

1. Select any view as a connection source and export structured data using an Asset view.
2. If you do not enable Flatten Results, the entire data set that is retrieved for one computer is a single record. For example, if you are exporting Installed Applications, a computer has a single row with the entire list of installed applications in that same record. Any change that is made to this data set shows up in the destination. By enabling the Flatten Results setting, each installed application for a computer is processed as a single record.
3. With Enhanced JSON, the results contain an array of objects for each reference table, instead of an array of strings, numbers, or dates for each reference attribute. The correlation between attributes and destinations can be easier to implement.
4. Use the default batch size (200). Higher batch sizes can be slower due to increased processing for each batch.
5. Configure the export format.
   • If you enable Enhanced JSON, you must also choose JSON as the format for your connection.
   • To customize the column names, expand the Columns section and click Add or Modify Columns. Change the display values in the Destination column as needed.
   • If you customize the columns, leave the Value Type as Unmodified to get the expected object output.

COMPATIBILITY

Use the following recommendations for Enhanced JSON and Flatten Results settings for each format in Connect. If you use an unsupported combination, connection failures might occur or incorrect data might get written to the destination.

Connect destination format compatibility

Format	Enhanced JSON Support	Recommendation
CEF		Use Flatten Results
CSV		Use Flatten Results
Delimiter separated		Use Flatten Results
Elasticsearch		Use Enhanced JSON without Flatten Results
HTML		Use Flatten Results without Enhanced JSON
JSON		Use Enhanced JSON without Flatten Results
LEEF		(Optional) Use Flatten Results
SQL Server		(Required) Use Flatten Results
Syslog		(Optional) Use Flatten Results

Filtering No Results and Errors

Asset automatically filters no results and common error messages and does not send that data to the connection destination.

Examples

Compare the data that is returned from Asset installed applications. View JSON examples

Example: Enhanced JSON

{
	"Computer Name": "WIN-2012-R2",
	"Asset Installed Applications": [{
		"name": "Tanium Server 7.2.314.3019",
		"version": "7.2.314.3019",
		"vendor": "Tanium Inc."
	}, {
		"name": "Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026",
		"version": "14.0.23026.0",
		"vendor": "Microsoft Corporation"
	}, {
		"name": "Microsoft SQL Server 2012 Native Client",
		"version": "11.3.6540.0",
		"vendor": "Microsoft Corporation"
		}]
}

Example: Flattened JSON

[{
	"computer name": "WIN-2012-R2",
	"name": "Tanium Server 7.2.314.3019",
	"vendor": "Tanium Inc.",
	"version": "7.2.314.3019"
}, {
	"computer name": "WIN-2012-R2",
	"name": "Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026",
	"vendor": "Microsoft Corporation",
	"version": "14.0.23026.0"
}, {
	"computer name": "WIN-2012-R2",
	"name": "Microsoft SQL Server 2012 Native Client",
	"vendor": "Microsoft Corporation",
	"version": "11.3.6540.0"
}] 

For more information about creating connections, see Tanium Connect User Guide.

ServiceNow: Tanium Asset integration

Requirements

• ServiceNow Jakarta or later release. ServiceNow Software Asset Management Pro is also supported.
• Access to both a test and production instance of your ServiceNow Enterprise CMDB.
• A service account for ServiceNow that has elevated privileges. After the initial integration is complete, you can Configure least privilege access in ServiceNow.

Test the data export against a copy of your ServiceNow instance before you configure Tanium Asset to export all data to your production instance of ServiceNow. Because the built in identification rules in ServiceNow assume unique computer names or serial numbers, you might need to add one or more identification rules to achieve consistent and expected results.

Prepare ServiceNow to receive Tanium data

1. In ServiceNow, go to All > System Definition > Choice Lists.

   Enter Choice Lists in the menu filter to quickly navigate to that menu item.

   
2. Click New.
3. In the Table dropdown menu, select Configuration Item [cmdb_ci].
4. In the Element field, enter discovery_source.
5. In the Label field, enter Tanium.
6. In the Value field, enter Tanium.
7. Click Submit.

Confirm that you successfully created the item:

1. Go to to All > System Definition > Choice Lists.
2. Click Show/Hide filter .
3. In the -- choose field -- dropdown menu, select Table.
4. Leave the default operator, starts with, and in the Input value field, enter cmdb_ci.
5. Click AND.
6. In the -- choose field -- dropdown menu, select Element.
7. Leave the default operator, starts with, and in the Input value field, enter discovery_source.
8. Click AND.
9. In the -- choose field -- dropdown menu, select Label.
10. Leave the default operator, starts with, and in the Input value field, enter Tanium.
11. Click Run.

You should see the Tanium choice that you added. If you do not see it, go back and check to confirm that you completed each step.

If you are using ServiceNow Paris 10 or Quebec or later with the Tanium Asset integration, ServiceNow creates duplicate entries for some CIs (such as Network Adapters, Storage Devices, and File Systems) in the ServiceNow CMDB when an export runs. To resolve this issue, see Fix duplicate entries in ServiceNow with Tanium Asset integration.

Add tables and Update Identification Rules

You can optionally work with Tanium Support and your ServiceNow administrator to add tables or update identification rules in ServiceNow. For more information about contacting Tanium Support, see Contact Tanium Support.

Adding identification rules is required if any endpoints in your environment have duplicate serial numbers or computer names. For more information about configuring identification rules, see ServiceNow Documentation: Create or edit a CI identification rule.

Add ServiceNow as a destination

To enable data to be exported to the ServiceNow CMDB from Asset, enter your ServiceNow Host URL and credentials.

1. From the Asset menu, click Inventory Management > Destinations.
2. Click Create Destination > ServiceNow Destination.
3. Edit the settings, including the ServiceNow Host URL and credentials, log level, view, and the schedule at which you want the export to occur.
   The log level affects the logging in the job/date_time_job#_servicenow_config#.log files. If you enable Trace level logging on your ServiceNow configuration, numbered subdirectories, for example job/65, are created that contain all of the POST and GET requests for that job.
   For more information about Cron, see Reference: Cron syntax.

Exclude computers from exported ServiceNow data

(Optional) When you create a ServiceNow destination, a reserved view is created. The ServiceNow (reserved) view includes all computers. Create a view with filters enabled if you want to narrow the scope of the export.

1. From the Asset menu, click Views. Hover over the ServiceNow (reserved) view, and click Create Copy .
2. Edit and rename the copy of the reserved view. Add a filter to limit the computers that are exported. In this new view, do not select Should be filtered out of the view on any of the filters.

3. From the Asset menu, click Inventory Management > Destinations > ServiceNow_Destination. Click Edit .

4. In the View section, select the new view that you created.
5. Click Update to save the changes.

Edit ServiceNow export mappings

(Optional) After you create the ServiceNow destination, you can edit the Asset to ServiceNow mappings.

1. To add an attribute, find the details for the attribute.

   1. From the Asset menu, click Inventory Management > Attributes.

   2. Click Customize Columns, and select Table Name and Field Name.

   3. Use the Filter Items search to find the attribute.

2. Click Inventory Management > Destinations > ServiceNow. Click Edit . In the ServiceNow Export Mapping section, add the new mapping. You can also edit individual mappings.

   For more information about the mappings, see Reference: ServiceNow mappings. Contact Tanium Support to properly edit the ServiceNow export mappings. For more information, Contact Tanium Support.

Run export

You can run an export to ServiceNow CMDB outside of the configured schedule. From the Asset menu, click Inventory Management > Schedules> Export Schedules. Under your ServiceNow destination in the Asset Export Destinations section, click Run Now.

Check data in ServiceNow

After the Status in the schedule says complete, you can check for the data in ServiceNow CMDB.

1. Sign in to your ServiceNow Enterprise CMDB.
2. Search for an Asset attribute, such as Computer.
3. Check the data that got imported into the table.

Configure least privilege access in ServiceNow

After the initial integration with ServiceNow is complete, you can create a role for the Tanium Service Account. This role has an ACL that provides only the necessary permissions.

For more information, see Tanium Community article: Configuring least privilege access for ServiceNow integration (registration is required).

ServiceNow: Service Graph Connector

If you have ServiceNow Orlando Patch 7 or later or Paris Patch 1 or later, you can configure the ServiceNow Service Graph Connector for Tanium app in ServiceNow to import data from Tanium into the ServiceNow CMDB. This integration uses a MID server to collect data from the Tanium Asset API, then sends the data to the ServiceNow data source. For more information, see ServiceNow Store: Service Graph Connector for Tanium.

Tanium requirements

• Tanium Server 7.4.5 or later

• Tanium™ Asset 1.17.130 or later

• A user with the Asset Report Reader role to use with the Tanium Asset API
• An API token owned by the user that has the Asset Report Reader role

You do not need to configure a ServiceNow destination in Asset. If you already have a ServiceNow destination configured in Asset that you set up previously, disable the destination after you complete the integration instructions.

Additionally, the logs generated when importing Asset data into the Service Graph Connector using the API are available only in ServiceNow. If you run into issues with the import you must create a ticket with ServiceNow before contacting Tanium Support.

Integration instructions

This integration depends on a custom view from Tanium. To create this view, complete the following steps.

1. From the Asset menu, click Views.
2. If you have not already done so, click Create View > Create ServiceNow View to create the ServiceNow (reserved) view.

The ServiceNow (reserved) view cannot be modified. You must create a copy of this view to use in this integration.

3. In the list of views, locate the ServiceNow (reserved) view and click Create Copy.
4. Rename the new view. 
5. In the Select Columns from Asset Tables section, add the following data to the view: 
   • Add everything under SIU Product Usage.
   • Expand Asset and add Last Seen.
   • Expand Network Adapter and add Model.
6. Click Submit to save the view.