> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/q-z-integrations/tanium/tanium-xem-core-cloud-setup-for-workbench.md).
# Tanium XEM Core (Cloud) Setup for Workbench
{% hint style="info" %}
This guide is for cloud-based Tanium XEM Core installations only. For on-prem installations, refer to [Tanium XEM Core (On-Prem) Setup for Workbench](/connect-your-technology/q-z-integrations/tanium/tanium-xem-core-on-prem-setup-for-workbench.md).
{% endhint %}
## Step 1: Enable Console Access
Expel requires console access to allow analysts to perform investigation and triage. Without this additional level of information, alerts cannot be verified by our analysts, and an investigation cannot be initiated. For more information, see [Why Expel Asks for Console Access](https://support.expel.io/hc/en-us/articles/12871722483347-Why-Expel-Asks-for-Console-Access).
When you create a XEM Core user configuration, by default it has no computer management groups, alternative personas, user groups, or roles until you assign them. A user with no roles can log into the Tanium Console but can't access anything. Don't create configurations for user accounts that you import from an LDAP server.
We use the following Tanium API routes for our integration:
| Route | Permission |
| --------------------------------------------------------- | ----------------------------------- |
| /api/v2/session/login | Interact:Login |
| /api/v2/sensors/by-name | Interact:Read Sensor |
| /api/v2/parse\_question | Interact:Ask Dynamic Questions |
| /api/v2/questions | |
| /api/v2/result\_data/question/ | |
| /plugin/products/detect3/api/v1/alerts | Threat Response: Detect Alert Read |
| /plugin/products/detect3/api/v1/intels | Threat Response: Detect Intel Read |
| /plugin/products/detect3/api/v1/sources | Threat Response: Detect Source Read |
| /plugin/products/detect3/api/v1/intels/\/labels | Threat Response: Detect Label Read |
The [Interact Basic User role](https://help.tanium.com/bundle/ug_interact_cloud/page/interact/requirements.html#user_roles) grants us all the necessary permissions we need to access the question/sensor APIs and Interact console.
The [Threat Response Read Only User role](https://help.tanium.com/bundle/ug_threat_response_cloud/page/threat_response/requirements.html#user_roles) grants us all the necessary permissions we need to access the alerts APIs and Threat Response console.
If you are using a custom role, we also need **Detect Use API** permission as well as the necessary permissions to make Threat Response available in console.
The Tanium client uses a username/password combination to create an authenticated session. The returned session token is set in the session header for all subsequent requests.
1. From the Main menu, select **Administration > Management > Users**.
2. Select **New User**.
3. Specify a user name that matches one of the following:
* A user account defined locally on the Tanium Server.
* A user account defined in your IdP.
* (Windows only) An AD account name. Specify just the user name, not the domain name. The Tanium Server uses Windows Authentication, and doesn't store or manage login credentials for the user.
4. Save the configuration and get ready to assign roles to a user.
5. From the main menu, select **Administration > Management > Users**.
6. Select the **User Name** of the user configuration that you want to edit.
7. In the Roles and Effective Permissions section, select **Manage**.
8. In the Grant Roles section, select **Edit**, select **Interact Basic User** and **Threat Response Read Only User**, and select **Save**.
9. Select **Show Preview to Continue** to review the impact of your changes.
## Step 2: Create an API Token
1. Sign into the Tanium Console as the user and persona for whom you want to create a token.
{% hint style="info" %}
The authentication credentials and authorization permissions of a token are those of the requesting persona. To limit access to computer groups and content sets, create a persona with the desired permissions and then sign in with the new persona.
{% endhint %}
2. From the Main menu, go to **Administration > Permissions > API Tokens**.
3. Select **New API Token** and configure the token settings:
* **Notes** (optional) - enter a description of the purpose for this token.
* **Expire in days** - enter the expiration interval **365**. By default, the maximum interval is 365 days. If you don't enter a value, the interval defaults to 7 days.
4. **Trusted IP addresses** - enter the external IP addresses of the systems from which you will use this token to authenticate with the Tanium Server. Use commas or line breaks to separate multiple entries. Expel uses a group of static egress IP addresses to complete polling of the security device and for console access. Add the IPs from [Configure an IP Allow List](/workbench-setup/configure-an-ip-allow-list.md) to the Trusted IP address allow list.
5. Select **Save** and review the token details.
6. **Copy the token to your clipboard** and store in a safe location as you need this to add this to Workbench.
{% hint style="warning" %}
You cannot view the token in the Tanium Console after the visibility timeout (5 minutes) expires, if you refresh the API Tokens page or grid, or if you navigate to another console page.
{% endhint %}
## Step 3: Add Tanium XEM Core as a Security Device in Workbench
Now that you have the correct access configured and noted the credentials, you can integrate your tech with Workbench.
1. [Log in to Workbench](https://workbench.expel.io/).
2. Navigate to **Settings > Security Devices**.
3. At the top of the page, select **Add New Device**.
4. Search for and select the **Tanium XEM Core** integration.
5. Complete the fields as follows:
* **Where is your device?** - select **Cloud.**
* **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Tanium”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
* **Location** - enter the location of your integration, for example “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
* **Server address** - enter your Tanium Cloud URL.
* **Username and Password** - type the username and password created in [Step 1](https://support.expel.io/hc/en-us/articles/5042493348627-Tanium-XEM-Core-Setup-for-Workbench#h_01HYE70KX02GNJ55VS09F02WHK).
* **Token** - enter the API token from [Step 2 ](#h_01hye70kx0kz8mwg06axcanfhk)using the format token-APItoken**.** \
Example: token-a1bcde2fg345h6ij7890123k4l5m6no78pq90r1s2tuv34567w8901x23y
6. Select **Save**.
7. On the console access screen, select **Set up now**.
8. In the Console Login area, type these details:
* **Console URL** - enter the console URL from the Server address in the Connection Settings area above. At the end of the URL, type **/login**.
* **Username** - enter the user name for the new user you created in [Step 1](#h_01hye70kx02gnj55vs09f02whk).
* **Password** - enter the password for the new user you created in [Step 1](#h_01hye70kx02gnj55vs09f02whk).
* **Two-factor secret key (32-character code)** - depending on how your organization enforces log-ins, this field may not apply to you. In these cases, you can leave it blank. This field is optional and if you have questions or concerns, reach out to your Customer Success Manager (CSM) or to support.
9. Click **Save**.
Your device should be created successfully within a few seconds. A few reminders:
* After your connection is healthy, it will take some time for your device to begin polling and receiving data.
* To check on the status, select the downward arrow for your device in the first column and choose **View details**.
* Polling will happen first; data will be received after that. **You must refresh the page to see updates.**
* If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, [contact our support team for help](/support/how-to-reach-us.md).
* To check if alerts are coming through, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.expel.io/connect-your-technology/q-z-integrations/tanium/tanium-xem-core-cloud-setup-for-workbench.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.