Configuring Benchmark

If you did not install Benchmark with the Apply All Tanium recommended configurations option, you must enable and configure certain features.

(Tanium Core Platform 7.4.5 or later only) You can set the Benchmark action group to target the No Computers filter group by enabling restricted targeting before adding Benchmark to your Tanium licenseimporting Benchmark. This option enables you to control tools deployment through scheduled actions that are created during the import and that target the Tanium Benchmark action group. For example, you might want to test tools on a subset of endpoints before deploying the tools to all endpoints. In this case, you can manually deploy the tools to an action group that you configured to target only the subset. To configure an action group, see Tanium Console User Guide: Managing action groups. To enable or disable restricted targeting, see Tanium Console User Guide: Dependencies, default settings, and tools deployment.

When you import Benchmark with automatic configuration, the following default setting is configured:

The following default setting is configured:

Setting Default value
Action group
  • Restricted targeting disabled (default): All Computers computer group
  • Restricted targeting enabled: No Computers computer group

Install and configure Configure Tanium Endpoint Configuration

Manage solution configurations with Tanium Endpoint Configuration

Tanium Endpoint Configuration delivers configuration information and required tools for Tanium Solutions to endpoints. Endpoint Configuration consolidates the configuration actions that traditionally accompany additional Tanium functionality and eliminates the potential for timing errors that occur between when a solution configuration is made and the time that configuration reaches an endpoint. Managing configuration in this way greatly reduces the time to install, configure, and use Tanium functionality, and improves the flexibility to target specific configurations to groups of endpoints.

Endpoint Configuration is installed as a part of Tanium Client Management. For more information, see the Tanium Client Management User Guide: Installing Client Management.

Optionally, you can use Endpoint Configuration to require approval of configuration changes. When configuration approvals are enabled, Endpoint Configuration does not deploy a configuration change to endpoints until a user with approval permission approves the change. For information about the roles and permissions that are required to approve configuration changes for Benchmark, see User role requirements. For more information about enabling and using configuration approvals in Endpoint Configuration, see Tanium Endpoint Configuration User Guide: Managing approvals.

For solutions to Solutions cannot perform configuration changes or tool deployment through Endpoint Configuration on endpoints with action locks turned on, you must enable the Manifest Package Ignore Action Lock and Deploy Client Configuration and Support Package Ignore Action Lock settings. To access these settings, from the Endpoint Configuration Overview page, click Settings and select Global. on. As a best practice, do not turn on action locks. For more information about action locks, see Tanium Console User Guide: Managing action locks.

For more information about Endpoint Configuration, see Tanium Endpoint Configuration User Guide.

Configure Benchmark

(Optional) Configure the Benchmark action group

Importing the Benchmark module automatically creates an action group to target specific endpoints. If you did not use automatic configuration or you enabled restricted targeting when you imported Benchmark, the action group targets No Computers.

If you used automatic configuration and restricted targeting was disabled when you imported Benchmark, configuring the Benchmark action group is optional.

Select the computer groups to include in the Benchmark action group.

Clear the selection for No Computers and make Make sure that all operating systems that are supported by Benchmark are included in the Benchmark action group.

  1. From the Main menu, go to Administration > Actions > Action Groups.
  2. Click Tanium Benchmark.
  3. Select the computer groups that you want to include in the action group and click Save.
    If you select multiple computer groups, choose an operator (AND or OR) to combine the groups.

(Optional) Configure computer groups

By default, Benchmark uses the All Computers computer group. If needed, you can change this default computer group. You can also configure the computer groups that are available to select when you analyze benchmarks and risk scores. These computer groups are available in the Computer Groups dropdown list on all Benchmark pages.

  1. On the Benchmark Overview page, click Settings , then click Computer Groups.
  2. If you want to change the default computer group to use as the default for all pages, select that computer group in the Default column.
  3. If you want to add computer groups, click Select Computer Groups and select additional computer groups. Click Save.
  4. If you want to remove computer groups from the list, click Remove .

(Optional) Configure data collection frequency

Benchmark collects data from endpoints every two hours by default. If needed, you can modify this frequency.

If you make changes to endpoint criticality rules, be aware that Tanium Criticality uses a different update frequency than Benchmark. Criticality updates each hour, whereas Benchmark can update from every 15 minutes or once a day, depending on your configuration. If it is 10:00, for example, and you modify the Benchmark data collection time period to be 15 minutes, Benchmark does not receive updated criticality levels until 11:00, even though Benchmark collects data at 10:15, 10:30, and 10:45.

  1. On the Benchmark Overview page, click Settings , then click Data Collection.
  2. Specify a time period and select Minutes or Hours.

(Optional) Assign target goals

You can add goal values in addition to the benchmark metric values. These goals are tracked on the detail page charts for each benchmark metric. You must have the Benchmark Settings write permission to set goal values.

  1. On the Benchmark Overview page, click Settings , then Target Goals.
  2. For each metric you want to track, select a goal. The goal can be linked dynamically to the 50th or 75th percentile value, or a specific value. To set goals for all metrics, click Set Method for All.
  3. Save your changes. Goals can take up to 24 hours to collect data and display on the Results chart for the metric. To start data collection, click Collect Data.

(Optional) Assign endpoint criticality

Endpoint criticality is a level on an individual endpoint that is used to add context about the endpoint in the organization. A higher criticality for a particular endpoint multiples the risk score.

Benchmark uses Tanium Criticality to manage criticality levels for endpoints. Benchmark receives the levels from Criticality and factors the criticality into the risk scores for endpoints. For more information, see Tanium Criticality User Guide: Criticality overview.

Set up Benchmark users

You can use the following set of predefined user roles to set up Benchmark users.

To review specific permissions for each role, see User role requirements.

On installation, Benchmark creates a Benchmark user to automatically manage the Benchmark service account. Do not edit or delete the Benchmark user.

For more information about assigning user roles, see Tanium Core Platform User Guide: Manage role assignments for a user.

Do not assign the Benchmark Service Account and Benchmark Service Account - All Content Sets roles to users. These roles are for internal purposes only.

Benchmark Administrator

Assign the Benchmark Administrator role to users who manage the configuration and deployment of Benchmark functionality to endpoints.
This role can perform the following tasks:

  • Configure Benchmark service settings
  • View and modify Benchmark endpoint criticality configurations

Benchmark Operator

Assign the Benchmark Operator role to users who manage the configuration and deployment of Benchmark functionality to endpoints.
This role can perform the following tasks:

  • Configure Benchmark service settings
  • View and modify Benchmark endpoint criticality configurations

Benchmark User

Assign the Benchmark User role to users who need visibility into Benchmark data.
This role can view Benchmark.

Benchmark Endpoint Configuration Approver

Assign the Benchmark Endpoint Configuration Approver role to a user who approves or rejects Benchmark configuration items in Tanium Endpoint Configuration.
This role approves, rejects, or dismisses changes that target endpoints where Benchmark is installed.

Sensors that are registered by default

When you install Benchmark, the The following sensors are registered for collection by default. The Tanium Data Service immediately begins collecting and storing results for the registered sensors.

  • Sensors used to gather information about compensating controls:
    • CredGuard Status
    • Data Execution Prevention Enabled
    • DeviceGuard Status
    • Enforce - Host Firewall Enabled
    • Enforce - TPM Status
    • Storage Encryption Status
    • Tanium PowerShell Execution Policy
    • USB Write Protected
    • Windows Credential Security Settings
    • Windows Security Center Registered Antivirus Software
  • Sensors used to gather information about health status:
    • Comply - Coverage Status
    • Impact - Coverage Status
    • Reveal - Coverage Status
    • SSL Server Audit Tools Required
  • Sensors used to gather information for reports and calculations:
    • Comply - Compliance Findings
    • Comply - CVE Findings
    • SSL Server Certificate CA Short Name
    • SSL Server Certificate Details
    • Endpoint Criticality
  • Sensors used to gather information about vectors:
    • Reveal - Background Scan Results
    • SSL Server Cipher Suite
    • SSL Server Certificate Expiry
    • Risk - Vector Base Score
    • Impact Rating

To manage which sensors are registered in the Tanium Data Service, see Tanium Console User Guide: Manage sensor results collection.

Do not modify the default collection settings for these sensors.