Getting started
- Install Taniumâ„¢ Incident Response solutions.
More information: Installing Incident Response solutions
- Deploy IR tools to the endpoints that are running Tanium Client.
More information: Deploying IR tools
- Use IR sensors to scope and hunt incidents, examine forensic artifacts, collect real time data, and monitor endpoints for malicious activity.
More information: Using IR sensors and packages
- Index operating systems.
Use the Tanium Index solution to index the local file systems on Tanium Client endpoints that are running Windows or Mac OS X operating systems. After the file systems are indexed, you can use sensors to query specific file attributes, such as path, hash, and modified dates.
More information: Indexing file systems
-
Collect files from endpoints.
- Move a set of arbitrary files. You can define this list of files with a comma-separated list.
More information: Copying IR data to a central location - With Live Response, you can configure what files and what destinations you want to use to collect data from endpoints.
More information: Collecting data with Live Response
- Move a set of arbitrary files. You can define this list of files with a comma-separated list.
- Isolate endpoints.
You can apply a quarantine on endpoints that show evidence of compromise or other suspicious activity. When applied, the endpoint cannot communicate with any resource other than the Tanium Server.
More information: Isolating endpoints
Last updated: 2/16/2021 11:09 AM | Feedback