Defining applications

A business application is a collection of software components. You can create a business application by selecting a predefined application from the application gallery, or by defining your own application processes and ports.

Explore the application gallery

The application gallery includes a set of commonly-defined application definitions. You can import these definitions as an application in your environment and modify them as necessary.

  1. From the Map menu, click Applications > Application Gallery.
  2. To import an application, click Import and provide your user account information.
  3. An application is created that contains the definition. To edit the application, go to Applications > Defined Applications.

Create application

  1. From the Map menu, click Applications. Click New Application.
  2. Enter a name and description for the application.
  3. Define software packages. The software packages that you define are known components of the business application. For example, if you have a web application that consists of a front end, database, and client, add packages for each of these pieces. The packages are combined with the OR operator, so any package in the list that returns true causes the application to be found on an endpoint. Click Add Package.
  4. Define rules. Each software package contains a set of rules that define processes, ports, and optional file paths. If the package consists of multiple processes or files, you can add more rules. Click New Rule > Process or New Rule > File. You might need to define ports or command line arguments for specific web applications. For file paths, you must specify a process name and path to the file in Windows or Linux style. If your package contains files on both Windows and Linux systems, add multiple rules to cover different paths.

    Package rules are combined with an AND operator. All rules must return true for the package to be considered found on an endpoint.
  5. Click Save. After you click Save, the endpoints should have the update within 1-2 minutes.

Discover single processes

Use application discovery to identify running processes on your endpoints and add those processes to applications.

By default, application discovery queries seven days of historical data. To change this default, go to Settings , then click the Application Discovery tab. Edit the Discovery Time Range setting.

  1. From the Map menu, click Applications > Application Discovery.
  2. (Optional) You can define a minimum and maximum number of connections. A process must have a number of connections between these two values to be displayed in the list of discovered processes.
  3. To find the processes that are currently running on the endpoints, click Discover Processes.
  4. Add processes to applications.
    • To add a single process to a new or existing application, hover on the row of the process and click Add to application.
    • To add several processes to an existing application, select the processes, then click Actions > Add to existing application.
    • To move a process from the Identified tab to the Archived tab, hover on the process in the row and click Archive. Archive processes that are not a critical part of any business applications, such as web browsers or other client-based applications.
  5. If you want to check for processes that are not already defined as part of an application in Map, select only Not Defined in Applications.

Discover connected processes

From a single identified process, you can explore the connections in the network to identify related processes and endpoints. The resulting information can then be used as input for a new application definition.

  1. After running process discovery, hover on the row of the process and click Discover Connected Processes.
  2. A list of endpoints that are connected to the process is displayed. If you want to find more processes that use the selected process, increase the Discovery Depth setting. Select at an initial endpoint from which to find processes and click Continue.
  3. The discovery runs, showing each phase and tier of the process discovery.
  4. Click Create Application. An application creation page displays the processes that were found by the discovery process.
  5. Save the application.

Edit application

When you edit an application, all maps that reference that application are affected.

  1. From the Map menu, click Applications. Click the name of the application that you want to edit.
  2. Before you update the application, review the list of maps that reference this application. All these maps are affected by the updates.
  3. Click Edit.
  4. Click Save. After you click Save, the endpoints should have the update within 1-2 minutes.

Export application definition

You can export an application definition as a JSON file to back up the information or to import it into another Tanium Server.

  1. From the Map menu, click Applications. Click the name of the application that you want to export.
  2. Click Export. The JSON file for the application definition downloads to your local downloads folder.

Import application definition

You can import an application definition JSON file.

  1. From the Map menu, click Applications.
  2. Click Import. Browse to the JSON file that contains the application definition and click Import.