Other resources

Release Notes

Video Tutorial

Support Knowledge Base
(login required)

Discover overview

With Discover, you can find and maintain an inventory of interfaces. By installing the Tanium™ Client on your endpoints, you can actively monitor the local subnet, detecting unmanaged interfaces. You can then perform the following tasks:

  • Get real-time information about unmanaged interfaces on your network.
  • Block unmanaged interfaces from network access.

Interfaces are unique media access control (MAC) addresses. An endpoint with multiple network interface controllers (NICs) displays as multiple interfaces in Discover.

Managed interfaces are on endpoints that have the Tanium Client running and are managed by Tanium. Unmanaged interfaces are on the network but do not have the Tanium Client running.

Managed endpoints scan for or detect unmanaged interfaces at configurable intervals. Discover queries endpoints for updated detection data periodically. New information is immediately available. The detection process provides continuous scanning without impact to network operations.

Unmanaged interface discovery

Create profiles to detect interfaces that are on the network but not under Tanium management. Each profile consists of a set of network inclusions and exclusions, a discovery method, and schedule information. You can configure multiple profiles to cover different parts of the network. For more information, see Discovering unmanaged interfaces.

Interface management

Organize interfaces by applying locations or labels. View statistics about interfaces over time.

Locations

Assign interfaces to geographic, physical, or logical locations. Define a hierarchy of network addresses, network address translation (NAT) addresses, and locations. Addresses can consist of an IP, IP range, or classless inter-domain routing (CIDR) address. After the hierarchy is defined, locations are matched with the interfaces during the import process of a discovery scan. For more information, see Locations.

Labels

Labels include descriptive information or metadata that you can use to identify and group interfaces. Then, you can classify or search for interfaces based on the labels. You can also automatically apply labels or ignore interfaces based on a specifically defined set of conditions. For more information about labels, see Labels.

Statistics

With module sources for Discover in Tanium™ Trends, you can create boards that show interface statistics and module health over time. For more information, see Tanium Trends User Guide: Building and publishing boards.

Blocking

Use the Tanium™ Network Quarantine shared service to set up a network access control (NAC) that can block by IP or MAC address as a built-in action of Discover.

For more information, see Block network access with Network Quarantine.

Notifications

Discover records the following events:

  • Found an unmanaged interface
  • Found a new managed endpoint
  • Lost an interface

With a connection in Tanium™ Connect, Discover can send these events to a destination, such as security information and event management (SIEM) system, email, or file. For more information about configuring the Discover notifications connection, see Configure event notifications.

Last updated: 10/15/2019 1:57 PM | Feedback