Investigate requirements

Review the requirements before you install and use Investigate.

Core platform dependencies

Make sure that your environment meets the following requirements:

• Tanium license that includes Investigate

• Tanium™ Core Platform servers: 7.5.4.1158 or later

• Tanium™ Client:
  Any supported version of Tanium Client. For more information about specific Tanium Client versions, see Tanium Client Management User Guide: Client version and host system requirements.

  • (Linux, macOS*, Windows) Any supported version of Tanium Client
  • (macOS 10.15.x and later) 7.2.314.3608 or later

  * = macOS earlier than 10.15.x Catalina

  Any supported version of Tanium Client. For the Tanium Client versions supported for each OS, see Tanium Client Management User Guide: Client version and host system requirements.

  If you use a client version that is not listed, certain product features might not be available, or stability issues can occur that can only be resolved by upgrading to one of the listed client versions.

Computer group dependencies

When you first sign in to the Tanium Console after a fresh installation of Tanium Server 7.4.2 or later, the server Tanium Cloud automatically imports the computer groups that Investigate requires:

• All Computers

• All Windows

• All Linux

• All Mac

For earlier versions of the Tanium Server, or after upgrading from an earlier version, you must manually create the computer groups. See Tanium Console User Guide: Create a computer group.

Client extensions

Tanium Endpoint Configuration installs client extensions for Investigate on endpoints. Client Extensions perform tasks that are common to certain Tanium solutions. The Tanium Client uses code signatures to verify the integrity of each client extension prior to loading the extension on the endpoint. Each client extension has recommended security exclusions to allow the Tanium processes to run without interference. See Security exclusions for more information. The following client extensions perform Investigate functions:

• Performance CX - Provides Performance functions on the endpoint. Tanium Investigate and Tanium Performance install this client extension.
• Config CX - Provides installation and configuration of extensions on endpoints. Tanium Client Management installs this client extension.
• Core CX - Provides a management framework API for all other client extensions and exposes operating system metrics. Tanium Client Management installs this client extension.
• Support CX - Provides the ability to gather troubleshooting content from endpoints through Tanium Client Management. Tanium Client Management installs this client extension.
• Software Manager CX - Provides a catalog of all installed software on an endpoint. Tanium Asset or Tanium Patch installs this client extension.
• DEC CX - Provides a direct connection between endpoint and Module ServerTanium Cloud. Tanium Direct Connect installs this client extension.
• Extras CX - Provides a helper library that contains re-usable functions for various client extensions to use. Tanium Asset, Tanium Discover, Tanium Integrity Monitor, and Tanium Investigate install this client extension.

Endpoints

Supported operating systems

The following endpoint operating systems are supported with Investigate. 

Host and network security requirements

Specific ports and processes are needed to run Investigate.

Ports

The following ports are required for Investigate communication.

Configure firewall policies to open ports for Tanium traffic with TCP-based rules instead of application identity-based rules. For example, on a Palo Alto Networks firewall, configure the rules with service objects or service groups instead of application objects or application groups.

For Tanium Cloud ports, see Tanium Cloud Deployment Guide: Host and network security requirements.

Security exclusions

If security software is in use in the environment to monitor and block unknown host system processes, Tanium recommends that a security administrator create exclusions to allow the Tanium processes to run without interference. The configuration of these exclusions varies depending on AV software. For a list of all security exclusions to define across Tanium, see Tanium Core Platform Deployment Reference Guide: Host system security exclusions.

User role requirements

The following tables list the role permissions required to use Investigate.

Do not assign the Investigate Service Account and Investigate Service Account - All Content Sets roles to users. These roles are for internal purposes only.

For more information about role permissions and associated content sets, see Tanium Console User Guide: Managing RBAC.

Investigate user role permissions

Permission	Investigate Administrator1	Investigate Operator1	Investigate User1	Investigate Read Only User
Investigate Allows viewing the Investigate workbench	SHOW	SHOW	SHOW	SHOW
Investigate API Allows using the Investigate API	EXECUTE	EXECUTE	EXECUTE	EXECUTE
Investigate Artifacts Allows deleting Investigate artifacts	DELETE	DELETE	DELETE
Investigate Comments Allows deleting Investigate comments	DELETE	DELETE	DELETE
Investigate Direct Connect Allows issuing Direct Connect queries on an endpoint for an investigation	READ	READ	READ
Investigate Investigations Allows reading, authoring, updating, and deleting investigations	READ WRITE DELETE	READ WRITE DELETE	READ WRITE	READ
Investigate Remote Management Allows remote management in Single Endpoint View.	SHOW	SHOW
Investigate Partner Integration Allows issuing queries to partner integrations for an investigation	READ	READ	READ
1 This role provides module permissions for Tanium Direct Connect. You can view which Direct Connect permissions are granted to this role in the Tanium Console. For more information, see Tanium Direct Connect User Guide: User role requirements.

Provided Investigate platform content permissions

Permission	Investigate Administrator1	InvestigateOperator1	InvestigateUser1	Investigate Read Only User
Plugin	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE
To view which content set permissions are granted to a role, see Tanium Console User Guide: View effective role permissions. 1 This role provides module permissions for Tanium Direct Connect. You can view which Direct Connect permissions are granted to this role in the Tanium Console. For more information, see Tanium Direct Connect User Guide: User role requirements.