Tanium™ Discover 2.11 User Guide

PDF 2.11
PDF 2.10
  • All Files
Documentation Home > Tanium Discover User Guide

Discover requirements

Review the requirements before you install and use Discover.

Tanium dependencies

In addition to a license for the Discover product module, make sure that your environment also meets the following requirements.

Component Requirement
Platform Version 7.0 or later
Tanium Client All Tanium Client versions are supported
Tanium Connect

Version 3.2 or later (Optional; for network blocking and notifications)
Tanium Network Quarantine Version 1.0.2 or later (Optional; for network blocking)
License For information about licensing Discover, contact your Technical Account Manager (TAM). The license for Discover includes the following solutions:
  • Discover
  • Discover Client Deploy

Tanium™ Module Server

Discover is installed and runs as a service on the Module Server host computer. The impact on Module Server host computer sizing is minimal and depends on usage. Contact your TAM for details.

Third-party software

  • PsExec v2.11 or later (Optional; for using PSEXEC to deploy Tanium Client)

Host and network security requirements

Specific ports and processes are needed to run Discover.

Ports

The following ports are required for Discover communication.

Component Port Direction Service Purpose
Module Server 17446 Loopback Discover Internal purposes; not externally accessible
17447 Loopback Discover Internal purposes; not externally accessible

Security exclusions

If security software is in use in the environment to monitor and block unknown host system processes, your security administrator must create exclusions to allow the Tanium processes to run without interference.

Target Device Process or Directory Exclusions
Tanium Module Server
  • <Tanium Module Server>\services\discover\node.exe

  • <Tanium Module Server>\plugins\content\discover-proxy\proxyplugin.exe

  • <Tanium Module Server>\services\twsm-v1\twsm.exe
Endpoint Computers

  • C:\Program Files\Npcap

  • <Tanium Client>\Tools\Discover\nmap\nmap.exe

Internet URLs

If security software is deployed in the environment to monitor and block unknown URLs, your security administrator must whitelist the following URLs:

  • content.tanium.com

User role requirements

Tanium Server 7.0

Administrator user role is required for all Discover functions.

Tanium Server 7.1 or later

Role-based access control (RBAC) permissions control access to the Discover workbench. The predefined roles are Discover Service Account, Discover Admin, Discover User, and Discover Read Only User.

Table 1:   Discover user role privileges for Tanium 7.1.314.3071 or later
Privilege Discover Service Account1 Discover Administrator Discover User Discover Read Only User


Show Discover

View managed and unmanaged interfaces

Discover Asset Read

View lists of managed and unmanaged interfaces, export data from interface tables

Discover Asset Write

Apply or remove label on an interface

Discover Asset Block

Block interface with Palo Alto Dynamic Address Group (Connect User module role also required)

Discover Asset Unblock

Unblock interface with Palo Alto Dynamic Address Group (Connect User module role also required)

Discover Tag Write

Create or remove labels

Discover Manual Import Execute

Import interfaces manually with the Discover Unmanaged Interfaces button

Discover Settings Write

Edit Discover settings, create discovery methods

Discover Components Manage

Manage backend components, including Discover action groups and computer groups

 1

1 Provides the Administrator reserved role.

 

Table 2:   Provided Discover Micro Admin and Advanced user role permissions for Tanium 7.1.314.3071 or later
Permission Role type Content set for permission Discover Service Account Discover Administrator Discover User Discover Read Only User
Read Computer Group Micro Admin  
Write Computer Group Micro Admin  
Ask Dynamic Questions Advanced  
Execute Plugin Advanced Discover Content
Execute Plugin Advanced Reserved
Read Own Action Advanced Discover Content
Read Own Action Advanced Reserved
Read Package Advanced Discover Content
Read Package Advanced Reserved
Read Saved Question Advanced Discover Content
Read Saved Question Advanced Reserved
Read Sensor Advanced Discover Content
Read Sensor Advanced Reserved
Write Action Advanced Discover Content
Write Action Advanced Reserved
Write Package Advanced Discover Content
Write Package Advanced Reserved
Write Saved Question Advanced Discover Content
Write Saved Question Advanced Reserved

 

Table 3:   Optional roles for Discover
Role Enables
Connect User

For signed in user: 

  • Configure connections for Discover notifications
  • Configure connections for blocking and unblocking interfaces

For service account: 

  • Send Discover notifications
Administrator
  • Set up and run Discover client deployments
  • When a user is Tanium Service Account role, Administrator role is implied
Network Quarantine User
  • View quarantined interfaces on Interfaces pages
  • Quarantine and unquarantine interfaces
Network Quarantine Read Only User
  • View quarantined interfaces on Interfaces pages

Last updated: 1/15/2019 1:45 PM | Feedback