Creating configurations

Configurations are groups of settings that control the behavior of Threat Response components. You can create different configurations for each Threat Response component to control how it performs on specific groups of endpoints.

For example, you might want to apply and scan for specific intel on one group of endpoints, but not other groups. Or, you might want to apply a subset of Threat Response capabilities to a group of endpoints. Use configurations to customize which intel to apply, how and when to evaluate intel, how to index file systems, and which events to record on all the endpoints in an enterprise.

You can orchestrate configurations for detection, the recorder, and index in a profile that is assigned to one or more computer groups. You can import and export configurations to make them easy to apply to target groups of computers.

Threat Response provides example configurations that feature the most common configuration settings for specific operating systems. While you cannot edit example configurations, you can copy them to use as templates for creating configurations and applying to profiles.

Detection configurations provide directions for scanning endpoints for intel matches. To avoid scanning important endpoints or to limit when detection is active, you can include blockout periods to prevent scans during those times.

1. From the Threat Response menu, click Management > Configurations. Click Create > Detection.
2. In the General Settings section, provide a name and description for the detection configuration.
3. (Optional) In the Engine Options section, select Use UTC instead of the local time on the endpoint when calculating Scan Blockout.
4. In the Engine Options section, select the hours and days for the Scan Blockout period to stop scanning against available intel during the times you select.
5. Configure the Settings.
1. (Optional) Select Consume Deep Instinct Alerts to enable Threat Response to consume Deep Instinct alerts and display alerts from Deep Instinct detection. Selecting Consume Deep Instinct Alerts requires the Deep Instinct agent to be running on the endpoint. By default this option is disabled.

   For the integration to work correctly, you must configure additional flags for the Deep Instinct Agent (D-Client) using the Deep Instinct CLI. For more information refer to the Deep Instinct documentation or contact Deep Instinct support.

2. (Optional) Select Consume Defender Alerts to enable Threat Response to consume Defender alerts and display alerts from Defender on Windows endpoints. By default this option is enabled.
3. (Optional) Select Consume Process Injection Alerts to enable Threat Response to consume Process Injection alerts. Selecting Consume Process Injection Alerts requires configuring the Process Injection intel document. See Process injection. By default this option is disabled.
4. Specify a value (in days) for Initial Lookback. The initial lookback value that you provide defines the number of days in the past to look in the Recorder database for matching.
6. In the Intel section, click Add Intel. Select the intel you want to add. Click Add.
7. Select Intel that you have added to Threat Response. Click OK. Click Save.

Use an index configuration to detect and report threat indicators for files at rest. Index creates an index of local file systems, computes file hashes, and gathers file attributes and magic numbers in an SQLite database on the endpoint. Index returns the files that are contained in zip archives. For information on Index configuration settings, see Client Index Extension User Guide.

1. From the Threat Response menu, click Management > Configurations. Click Create > Index. Provide a name and description for the index configuration.
2. Select the Hashes To Calculate. Index can record any combination of three different hash types: MD5, SHA-1, SHA-256, or SHA512. Do not select any hash type to disable calculation of hashes.

   If legacy index configurations included the Include Malicious Hash List setting, you must add the new Reputation intel document to intel configurations. When you upgrade to Threat Response 3.4 or later, any malicious hashes that exist in the reputation database are added to the Reputation Intel document. All malicious hashes identified after upgrade are added to this same intel document moving forward. Open each intel configuration and ensure that the Reputation source is added anywhere you want endpoints to match against the malicious hashes.

3. In the Priority List section, select filters that you want to designate as high-priority paths. See Create filters for more information. Click Manage Priority List to select existing filters. Select any or all of the available filters. Only filters that have already been created are available to select. When you have selected the filters that you want to add to the configuration, click Apply. See Create filters for more information on filter methods. Click Save. You cannot add more than 24 filter definitions.
4. In the Exclusions section, click Manage Exclusions to exclude specific file paths by using regular expressions and names from indexing. Default indexing exclusions are provided that feature common paths and files to exclude. For more information about indexing exclusions, see Indexing exclusions.
5. Click Save.
6. Click Create.

Filters provide a way to define the event information to record to reduce performance impacts and enable quick event identification. Filters are applied in index, recorder, and stream configurations and are created for specific types of recorder events. Threat Response provides a default set of filters for each type of recorder event that you can use in configurations. You can also create your own filters. You can either include or exclude filters. The Include method of filtering enables you to replace the default filter to only include the filters you specify to reduce performance impact and enable quick event identification. The Exclude method of filtering prevents events that match the criteria you provide from recording.

Filters are constructed in Signals syntax. You cannot have more than 55 unique terms in a Signal.

If a configuration enables process, file and network event types but an include filter only includes process events. No file or network events are recorded. When using an include filter for network events, the associated process events are automatically included.

1. From the Threat Response menu, click Management > Filters. Click Create.
2. Select a Filter Type.

   File

   File filters define criteria for files to record when path or operation values match.

   High Priority Path

   Threat Response uses Index to scan the entire disk on an endpoint at regular intervals that typically occur between once a day and once a week. Index does not use recorder events to update file data across the entire disk. It is common to want more frequent updates for files in certain regions of the disk. To provide this visibility, in addition to the baseline disk scan, Threat Response enables you to specify high priority paths that use recorder events to update data and also scans every 24 hours by default. To change the default setting:

   1. From the Main menu, click Modules >Threat Response to open the Threat Response Overview page.
   2. Click Settings and open the Service tab.
   3. In the Misc section provide a value (in hours) for the High Priority Path Scanning for Index Configurations (Hours) setting.
   4. Click Save.

   A high priority path must include a file.path starts with clause in Tanium signal syntax. Escape backslash characters in paths. For example, use C:\\Users\\Administrator to make C:\Users\Administrator a high profile path.
   
   

   • Supported: file.path starts with 'C:\\Users\\Administrator'
   • Unsupported: file.path starts with 'C:\'
     
     

   A high priority path, in addition to the file.path starts with clause, can additionally specify one or more file.path ends with clauses to narrow the file types to inspect.
   
   

   • Supported: file.path starts with 'C:\\Users\\Administrator' and file.path ends with '.dat'
   • Supported: file.path starts with 'C:\\Windows\\System32' and file.path ends with '.dll' and file.path ends with '.exe'
   • Unsupported: file.path ends with '.dat'
     
     

   Image

   Image filters define criteria for image events to record when path, hash, or signature values match.

   Network

   Network filters define criteria for network events to record when a match is made for a defined IP address, port, or DNS query.

   Process

   Process filters exclude events based on the process path, hash, user name, user group, or command-line.

   Registry

   Registry filters define criteria for Windows registry events to record when specific key-value pairs match.

   System (Windows and Linux only)

   System filters provide paths of files to match or filter from the Linux audit daemon (auditd) logging. On Windows endpoints, system filters exclude particular processes from having the Tanium Driver inject into them for API monitoring and process injection monitoring.

   
   
3. Select an Operating System. Provide a name and description for the filter.
4. In the Filter Definition section, click Filter Builder.
5. Click Row or Grouping to add a filter definition using the filter builder. Select a type, a property, and condition. The available properties and conditions differ for each filter type. You can use properties and conditions to create logical patterns for matching specific events. You can add multiple statements to each filter. For each statement that you add, specify a logical and or a logical or to define the relationship of the statements in a filter. The following table provides a reference for properties and conditions for each filter type.
   

   Type	Property	Supported Conditions	Comments
   File	operation	is is not	One of create, write, open_write, rename, or delete.
   	path	is is not contains contains not starts with starts with not ends with ends with not	The full path to the file.
   Process	path	is is not contains contains not starts with starts with not ends with ends with not	The full path to the process executable. Process path filters do not exclude child processes from being captured to recorder.db. Use an ancestry statement to exclude child processes.
   	hash	is is not	The MD5 hash of the process executable file.
   	command line	is is not contains contains not starts with starts with not ends with ends with not	The full command line of the process.
   	user name	is is not contains contains not starts with starts with not ends with ends with not	The user name executing the process.
   	user group	is is not contains contains not starts with starts with not ends with ends with not	The user group or domain of the user executing the process.
   	parent path	is is not contains contains not starts with starts with not ends with ends with not	The full path to the parent process file.
   	parent command line	is is not contains contains not starts with starts with not ends with ends with not	The full command line of the parent process.
   	ancestry path	is is not contains contains not starts with starts with not ends with ends with not	The full path to any of the parent processes.
   	ancestry hash	is is not	The MD5 hash of any of the parent processes.
   	ancestry command line	is is not contains contains not starts with starts with not ends with ends with not	The full command line of any of the parent processes.
   	ancestry user name	is is not contains contains not starts with starts with not ends with ends with not	The user name executing any of the parent processes.
   	ancestry user group	is is not contains contains not starts with starts with not ends with ends with not	The user group or domain of the user executing any of the parent processes.
   	signature status	is is not	One of verified, unverified, or no_signature
   	signature issuer	is is not contains contains not starts with starts with not ends with ends with not	The signature issuer of the process.
   	signature subject	is is not contains contains not starts with starts with not ends with ends with not	The signature subject of the process.
   Network	address	is is not contains contains not starts with starts with not ends with ends with not	The IPv4 remote address.
   	port	is is not contains contains not starts with starts with not ends with ends with not	A direction-specific non-ephemeral port. Local on incoming, remote on outgoing.
   	dns query	is is not contains contains not starts with starts with not ends with ends with not	The hostname requested for DNS resolution.
   	operation	is is not	Network operations that include connect and accept.
   Registry	key path	is is not contains contains not starts with starts with not ends with ends with not	The full path to the registry key, including the full hive name.
   	operation	is is not	Registry operations that include create, set_value, delete, and rename.
   	value name	is is not contains contains not starts with starts with not ends with ends with not	The registry value name.
   Image	path	is is not contains contains not starts with starts with not ends with ends with not	The full path to the file.
   	hash	is is not	The MD5 hash.
   	signature status	is is not	One of verified, unverified, or no_signature
   	signature issuer	is is not contains contains not starts with starts with not ends with ends with not	The signature issuer of the process.
   	signature subject	is is not contains contains not starts with starts with not ends with ends with not	The signature subject of the process.
   System	path (Linux)	starts with starts with not	The full path to the file.
   	actor path (Windows)	is is not starts with starts with not	The full path to the process or file that performs the process injection. When using is or is not filter construction, the filter must match a file and not a folder. For example, process_injection.actor_path is C:\\exclude\\ is invalid construction.

   Property values can be an integer, a simple alphanumeric string, or they can be more complex and include other characters, such as spaces, backslashes, and hex-encoded values. Property values do not support regular expressions or wildcards. On Windows platforms, case is not sensitive for provided property values; for example, TaniumClient or taniumclient has the same effect. To create patterns for properties that start with, contain, or end with, use conditions and add additional statements to filters. For searches with non-alphanumeric values or spaces, enclose the value in single quotes. To escape special characters within the single quotes, the following sequences are supported:

   • \r For carriage return
   • \n For newline
   • \t For tab
   • \\ For the backslash itself
   • \' For a single quote within the quotes
   • \x To allow a single-byte hex-encoded sequence. For example \x20 would translate to a single space.

   The hex-encoding is required to handle UTF-8 characters outside of the single-byte character set. Any UTF-8 character can be added via the hex-encoding, if needed

   The following sample expressions demonstrate combined expressions, precedence, and escaped special characters:

   • process.command_line contains 'evil' AND process.path starts with 'c:\\windows'
   • (file.path starts with 'c:\\temp' OR file.path ends with '.evil.tmp') AND process.path contains cmd.exe
6. (Optional) Click Group. Using a group indicates that you intend to match all conditions in the group against a single event. For example, to ensure that matches happen against the same file event, you should group those events. You can then include multiple groups to achieve matches against different events in time. You can use logical AND and logical OR to further refine group behavior.
7. Click Save.
8. In the Filters section of a Recorder or Stream configuration, click Include or Exclude next to any filter that you have added to designate the method you want to apply for each set of filters. The Include method of filters enables you to replace the default filter to only include the filters you specify to reduce performance impact and enable quick event identification. For example, for registry events, if you provide one or more registry filters as include, those replace the default include filter of ‘registry’. The Exclude method enables you to effectively prevent events from recording. If a set of filters that you designate to Include contains a specific filter that has been designated to a set of filters to Exclude, a warning displays in the workbench.

   DNS filters are not supported as valid Include filters.

1. From the Threat Response menu, click Management > Configurations.
2. Select one or more configurations to export. Click Actions > Export to export the selected configurations. To export all configurations, click Export All.
3. On the export page, provide a name and click Export. All of the configurations in the Threat Response environment are exported.

1. From the Threat Response menu, click Management > Filters.
2. Click Export All.
3. On the export page, provide a name and click Export. All of the filters in the Threat Response environment are exportedop

1. From the Threat Response menu, click Management > Configurations.
2. Click Import/Export. Select Import JSON and browse to a JSON file.
3. Click Import.

1. From the Threat Response menu, click Management > Filters.
2. Click Import. Browse to a JSON file.
3. Click Import.