Tanium XEM Core (Cloud) Setup for Workbench

This guide is for cloud-based Tanium XEM Core installations only. For on-prem installations, refer to Tanium XEM Core (On-Prem) Setup for Workbench.

Step 1: Enable Console Access

Expel requires console access to allow analysts to perform investigation and triage. Without this additional level of information, alerts cannot be verified by our analysts, and an investigation cannot be initiated. For more information, see Why Expel Asks for Console Access.

When you create a XEM Core user configuration, by default it has no computer management groups, alternative personas, user groups, or roles until you assign them. A user with no roles can log into the Tanium Console but can't access anything. Don't create configurations for user accounts that you import from an LDAP server.

We use the following Tanium API routes for our integration:

Route	Permission
/api/v2/session/login	Interact:Login
/api/v2/sensors/by-name	Interact:Read Sensor
/api/v2/parse_question	Interact:Ask Dynamic Questions
/api/v2/questions
/api/v2/result_data/question/
/plugin/products/detect3/api/v1/alerts	Threat Response: Detect Alert Read
/plugin/products/detect3/api/v1/intels	Threat Response: Detect Intel Read
/plugin/products/detect3/api/v1/sources	Threat Response: Detect Source Read
/plugin/products/detect3/api/v1/intels/<intel id>/labels	Threat Response: Detect Label Read

The Interact Basic User role grants us all the necessary permissions we need to access the question/sensor APIs and Interact console.

The Threat Response Read Only User role grants us all the necessary permissions we need to access the alerts APIs and Threat Response console.

If you are using a custom role, we also need Detect Use API permission as well as the necessary permissions to make Threat Response available in console.

The Tanium client uses a username/password combination to create an authenticated session. The returned session token is set in the session header for all subsequent requests.

1. From the Main menu, select Administration > Management > Users.
2. Select New User.
3. Specify a user name that matches one of the following:

   • A user account defined locally on the Tanium Server.
   • A user account defined in your IdP.
   • (Windows only) An AD account name. Specify just the user name, not the domain name. The Tanium Server uses Windows Authentication, and doesn't store or manage login credentials for the user.
4. Save the configuration and get ready to assign roles to a user.
5. From the main menu, select Administration > Management > Users.
6. Select the User Name of the user configuration that you want to edit.
7. In the Roles and Effective Permissions section, select Manage.
8. In the Grant Roles section, select Edit, select Interact Basic User and Threat Response Read Only User, and select Save.
9. Select Show Preview to Continue to review the impact of your changes.

Step 2: Create an API Token

1. Sign into the Tanium Console as the user and persona for whom you want to create a token.

The authentication credentials and authorization permissions of a token are those of the requesting persona. To limit access to computer groups and content sets, create a persona with the desired permissions and then sign in with the new persona.

1. From the Main menu, go to Administration > Permissions > API Tokens.
2. Select New API Token and configure the token settings:

   • Notes (optional) - enter a description of the purpose for this token.
   • Expire in days - enter the expiration interval 365. By default, the maximum interval is 365 days. If you don't enter a value, the interval defaults to 7 days.
3. Trusted IP addresses - enter the external IP addresses of the systems from which you will use this token to authenticate with the Tanium Server. Use commas or line breaks to separate multiple entries. Expel uses a group of static egress IP addresses to complete polling of the security device and for console access. Add the IPs from Configure an IP Allow List to the Trusted IP address allow list.
4. Select Save and review the token details.
5. Copy the token to your clipboard and store in a safe location as you need this to add this to Workbench.

You cannot view the token in the Tanium Console after the visibility timeout (5 minutes) expires, if you refresh the API Tokens page or grid, or if you navigate to another console page.

Step 3: Add Tanium XEM Core as a Security Device in Workbench

Now that you have the correct access configured and noted the credentials, you can integrate your tech with Workbench.

1. Log in to Workbench.
2. Navigate to Settings > Security Devices.
3. At the top of the page, select Add New Device.
4. Search for and select the Tanium XEM Core integration.

   
5. Complete the fields as follows:

   • Where is your device? - select Cloud.
   • Name - enter a name that might help you more easily identify this integration, such as “CompanyName Tanium”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
   • Location - enter the location of your integration, for example “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
   • Server address - enter your Tanium Cloud URL.
   • Username and Password - type the username and password created in Step 1.
   • Token - enter the API token from Step 2 using the format token-APItoken. Example: token-a1bcde2fg345h6ij7890123k4l5m6no78pq90r1s2tuv34567w8901x23y
6. Select Save.
7. On the console access screen, select Set up now.
8. In the Console Login area, type these details:

   • Console URL - enter the console URL from the Server address in the Connection Settings area above. At the end of the URL, type /login.
   • Username - enter the user name for the new user you created in Step 1.
   • Password - enter the password for the new user you created in Step 1.
   • Two-factor secret key (32-character code) - depending on how your organization enforces log-ins, this field may not apply to you. In these cases, you can leave it blank. This field is optional and if you have questions or concerns, reach out to your Customer Success Manager (CSM) or to support.
9. Click Save.

Your device should be created successfully within a few seconds. A few reminders:

• After your connection is healthy, it will take some time for your device to begin polling and receiving data.
• To check on the status, select the downward arrow for your device in the first column and choose View details.
• Polling will happen first; data will be received after that. You must refresh the page to see updates.
• If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, contact our support team for help.
• To check if alerts are coming through, navigate to Dashboards > Alert Analysis. Scroll to the device you want to check, and select the Expel Alerts tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we tune your device.