Configuring Threat Response

If you did not install Threat Response with the Apply All Tanium recommended configurations option, you must enable and configure certain features.

Install and configure Configure Tanium Endpoint Configuration

Manage solution configurations with Tanium Endpoint Configuration

Tanium Endpoint Configuration delivers configuration information and required tools for Tanium Solutions to endpoints. Endpoint Configuration consolidates the configuration actions that traditionally accompany additional Tanium functionality and eliminates the potential for timing errors that occur between when a solution configuration is made and the time that configuration reaches an endpoint. Managing configuration in this way greatly reduces the time to install, configure, and use Tanium functionality, and improves the flexibility to target specific configurations to groups of endpoints.

For solutions to Solutions cannot perform configuration changes or tool deployment through Endpoint Configuration on endpoints with action locks turned on, you must enable the Manifest Package Ignore Action Lock and Deploy Client Configuration and Support Package Ignore Action Lock settings. To access these settings, from the Endpoint Configuration Overview page, click Settings and select Global. on. As a best practice, do not turn on action locks. For more information about action locks, see Tanium Console User Guide: Managing action locks.

For more information about Endpoint Configuration, see Tanium Endpoint Configuration User Guide.

If you enabled configuration approvals, the following configuration changes must be approved in Endpoint Configuration before they deploy to endpoints:

• Creating, updating, or deleting patch lists
• Adding or removing enforcements
• Removing all enforcements
• Updating scan configuration priorities
• Creating deployments
• Stopping deployments
• Adding targets to deployments
• User-initiated actions, such as initializing endpoints, uploading custom field files, enabling Linux

Configure Threat Response

(Optional) Configure the Threat Response action group

Importing the Threat Response module automatically creates an action group to target specific endpoints. If you did not use automatic configuration or you enabled restricted targeting when you imported Threat Response, the action group targets No Computers.

If you used automatic configuration and restricted targeting was disabled when you imported Threat Response, configuring the Threat Response action group is optional.

Select the computer groups to include in the Threat Response action group.

Clear the selection for No Computers and make Make sure that all operating systems that are supported by Threat Response are included in the Threat Response action group.

1. From the Main menu, go to Administration > Actions > Action Groups.
2. Click Tanium Threat Response.
3. Select the computer groups that you want to include in the action group and click Save.
   If you select multiple computer groups, choose an operator (AND or OR) to combine the groups.

Remove legacy Index dependencies from endpoints

If you have previously installed Tanium Index as a standalone application, or used the standalone application to upgrade Tanium Index, ensure that all legacy Index assets are uninstalled from endpoints before deploying the latest Threat Response tools to endpoints. To ensure complete removal of legacy Index dependencies, deploy the Index - Remove Legacy Dependent package to endpoints where legacy versions of Tanium Index dependencies exist.

1. To target endpoints, issue a question in Interact. Ask the question Get Tanium File Exists[Tools/EPI/dependents.txt] from all machines. If the results for an endpoint display Index it indicates that the standalone Index content has been used in the past.
2. In the Question Results grid, select the rows for the endpoints that require the action, and click Deploy Action.
3. From the Deploy Action page, use the Deployment Package search box typeaheads to select packages. Select the Index - Remove Legacy Dependent [Windows] or Index - Remove Legacy Dependent [Non-Windows] package.
4. Configure a Deployment Schedule and Targeting Criteria. Click Deploy Action. For more information, see Deploying actions.

After you have performed these steps, if the results of the Client Extensions - Status sensor displays recorder|has_subscription|index.fileevents you can use the Recorder - Clear Subscription [OS] package to remove a single subscription from recorder.

Set up Threat Response users

You can use the following set of predefined user roles to set up Threat Response users.

To review specific permissions for each role, see User role requirements.

On installation, Threat Response creates a Threat Response user to automatically manage the Threat Response service account. Do not edit or delete the Threat Response user.

For more information about assigning user roles, see Tanium Core Platform User Guide: Manage role assignments for a user.

Threat Response Administrator

Assign the Threat Response Administrator role to users who manage the configuration and deployment of Threat Response functionality to endpoints.
This role can perform the following tasks:

• Configure Threat Response service settings
• Read and modify Threat Response configurations
• Take action on alerts
• Connect to remote endpoints
• Dismiss or reject approvals for Threat Response tasks in Tanium Endpoint Configuration

Threat Response Operator

Assign the Threat Response Operator role to users who manage the configuration and deployment of Threat Response functionality to endpoints.
This role can perform the following tasks:

• Configure Threat Response service settings
• Read and modify Threat Response configurations
• Take action on alerts
• Connect to remote endpoints
• Dismiss or reject approvals for Threat Response tasks in Tanium Endpoint Configuration

Threat Response User

Assign the Threat Response User role to users who work with alerts and performing analysis on remote endpoints.
This role can perform the following tasks:

• View service settings
• View and modify alerts and intel documents
• Suppress and take action on alerts
• Run and review on-demand scans
• Connect to remote endpoints and manage downloads from them, and read configurations and profiles

Threat Response Read Only User

Assign the Threat Response Read Only User role to users who need visibility into Threat Response data and Threat Response findings on endpoints.
This role can perform the following tasks:

• View service settings, alerts, and intel documents
• Review on-demand scans
• Read connections to remote endpoints
• Read configurations and profiles

Threat Response Endpoint Configuration Approver

Assign the Threat Response Endpoint Configuration Approver role to a user who approves or rejects Threat Response configuration items in Tanium Endpoint Configuration.
This role approves, rejects, or dismisses changes that target endpoints where Threat Response is installed.

Do not assign the Threat Response Service Account and Threat Response Service Account - All Content Sets roles to users. These roles are for internal purposes only.