WIXLIB

QRadar IntegrationUser Guide V1.0

Introduction . 3Features .3Extension Contents .3Configuration . 4Prerequisites .4Tanium User Configuration.4QRadar Configuration .6Tanium Connect Configuration for Alerts.9Tanium Connect Configuration for Discover . 11Tanium Connect Configuration for Comply . 12Usage . 14Ingesting Tanium Events . 14Right-Click Actions. 16Help and Troubleshooting . 17 2020 Tanium Inc. All Rights ReservedPage 2

IntroductionThe Tanium App for QRadar allows you to easily bring your Tanium data into QRadar. Correlating the events fromvarious Tanium modules with the alerts from any system on your network gives your analysts the knowledge andcontext necessary to make faster, more informed decisions. You can further cut down on investigation time byinstantly lookup the real-time details of any machine right from QRadar’s Log Activity screen.Features Uses Tanium’s Connect module to forward your data from:Threat ResponseComplyDiscoverRight-Click actions for instant IP lookups using Tanium’s REST APIExtension ContentsThe following contents are included in this extension:Custom Properties (52):Comply Row TypeTanium SourceIP AddressFirst Found DateMatch VersionMatch TypeHashIntel TypeMatch NameIntel IDThreat Response Service IDComputer IPComputer NameOS GenerationUpdated AtIntel NameScriptMAC OrganizationManagedLast Discovered AtUnmanageableArpLast Managed AtMD5Tanium Created AtTimestampIntel LabelsSHA1Threat Response SourceTanium Computer IDPortsMAC AddressNmapFull Path 2020 Tanium Inc. All Rights ReservedSizeHostnameOSConnectedLocationsNAT IP AddressLabelsDiscover IDArgsCWDLast Found DateAlert IDSHA256CVEPIDPPIDStart TimeScoreGroups (1):TaniumLog Source Extensions (1):TaniumJSONCustom extLog Source Types (1):TaniumJSONQID Records (3):Tanium ComplyTanium DetectTanium DiscoverCustom Applications (1):TaniumPage 3

ConfigurationPrerequisites QRadar 7.3.1 or newerTanium version 7.3 or newerAccess from QRadar to the Tanium Server on port 443Access from Tanium Server to QRadar on port 6514Tanium User ConfigurationThe Tanium App for QRadar requires a Tanium User account to interact with the API. It is recommended to createa new role and user with the required permissions. In Tanium, create a new role for the QRadar app with the“Read Sensor” permission and add access to your sensors. Enable the Ask Dynamic Question feature. 2020 Tanium Inc. All Rights ReservedPage 4

Next, create a new user for the QRadar App to use, and assign it the role you just created. You will also need toassign the user access to computer groups. For most organizations, assigning this user “Unrestricted ManagementRights” will be the best option since that will allow all machines to respond to questions. 2020 Tanium Inc. All Rights ReservedPage 5

QRadar Configuration1. Download the Tanium Extension from the IBM X-Force Exchange app store2. From the QRadar Admin page, select Extensions Management3. Add the downloaded package to QRadar, selecting the “Install immediately” option.4. Once the package has successfully installed, navigate back to QRadar’s Admin screen and scroll down tothe bottom of the page where you will open up the Tanium app configuration page. 2020 Tanium Inc. All Rights ReservedPage 6

5. Select Application Configuration and enter the connection details for your Tanium Server. Please notethat if you choose to upload the public certificate for your Tanium server to use for verification, shouldexport it in PEM format and the value you enter for Server must match the hostname in the certificate.6. Next we will do a test call to confirm that the app has been properly configured and that it can communicatewith the Tanium Server. Click on the Lookup IP option at the top of the screen. Enter the IP address of amachine is managed by Tanium and that you know is currently online. Click Submit.7. It may take up to a minute depending on the size and architecture of your network, but you should get thebasic machine details back. If you get an error or no results, proceed to the Troubleshooting sectionbelow.8. Next create a Log Source in QRadar to receive the events from the Tanium Connect module.a. Select “TaniumJSON” for the Log Source Type and “TaniumJSONCustom ext” for the LogSource Extension.b. Select “TLS Syslog” for the Protocol Configuration and “TLS” for the Authentication Mode.c. Check the Store Event Payload option and uncheck the Coalescing Events option.d. Configure the remaining settings for the collector and port as desired. 2020 Tanium Inc. All Rights ReservedPage 7

e. Set the value of Log Source Identifier to be the IP address of your Tanium Module Server andinclude your log source in the Tanium group. Make sure to deploy changes after you save. 2020 Tanium Inc. All Rights ReservedPage 8

Tanium Connect Configuration for Alerts1. Open the Tanium Connect Module and select Create Connection Create. We will create a connectionto send Tanium Alert events to QRadar.2. For Source, check only “Match Alerts Raw”. For the Destination, enter your QRadar collector hostname orIP and select TCP port to match the log source settings. Check both the “Secure” and “Trust on First Use”options.3. Select JSON as the format and use ‘\n’ as the Row Delimiter. Don’t check either “Generate Document” or“Wrap Data with Source” options.4. Expand the “Columns” section and add a new custom field called “taniumsource” and populated it with theConnection Variable “Source Name. Ensure that the “Value Type” for the “Match Details” column is set to“Unmodified”. 2020 Tanium Inc. All Rights ReservedPage 9

2020 Tanium Inc. All Rights ReservedPage 10

Tanium Connect Configuration for Discover1. Open the Tanium Connect Module and select Create Connection Create. We will create a connectionto send Tanium Discover reports to QRadar. This will generally be the same as the instructions above forcreating the Event connection.2. Check the “Enable” box at the top right so that the connection will run on the defined schedule3. For Source, select “Tanium Discover” and then which report(s) you wish to send. For the Destination, enteryour QRadar collector hostname or IP and select TCP to Port to match the log source settings. Check boththe “Secure” and “Trust on First Use” options.4. Select JSON as the format and use ‘\n’ as the Row Delimiter. Don’t check either “Generate Document” or“Wrap Data with Source” options.5. Expand the “Columns” section and add a new custom field called “taniumsource” and populated it with theConnection Variable “Source Name. See the screenshot above for the Alert Connection configuration)6. Configure the Connection to run on the desired schedule. 2020 Tanium Inc. All Rights ReservedPage 11

Tanium Connect Configuration for Comply1. Open the Tanium Connect Module and select Create Connection Create. We will create a connectionto send Tanium Comply reports to QRadar. This will generally be the same as the instructions above forcreating the Event connection.2. Check the “Enable” box at the top right so that the connection will run on the defined schedule3. For Source, select Tanium Comply and Vulnerability for the Report Type. Typically you will want tocheck only the box for Include Endpoint Findings as the Include CVE details option will generally createmore data than what most users want to send to their SIEM.4. For the Destination, enter your QRadar collector hostname or IP and select TCP to Port to match the logsource settings. Check both the “Secure” and “Trust on First Use” options.5. Select JSON as the format and use ‘\n’ as the Row Delimiter. Don’t check either “Generate Document” or“Wrap Data with Source” options.6. Expand the “Columns” section and add a new custom field called “taniumsource” and populated it with theConnection Variable “Source Name. See the screenshot above for the Alert Connection configuration)7. Configure the Connection to run on the desired schedule 2020 Tanium Inc. All Rights ReservedPage 12

2020 Tanium Inc. All Rights ReservedPage 13

UsageIngesting Tanium EventsOnce you have configured the Tanium connections and the Tanium App for QRadar, you should begin to see dataflowing into QRadar. Most common fields already have custom properties created for them in QRadar. If you wantto create efficient searches using any of these custom properties, it is suggested that up update the settings so thatthey are indexed in QRadar. By default, none of the included Tanium custom properties are indexed. 2020 Tanium Inc. All Rights ReservedPage 14

Additional Event TypesThe Tanium Log Source in QRadar uses the custom taniumsource field to identify the incoming events as beingfrom Tanium. If you would like to ingest events or reports in addition to the ones above, just ensure they arecoming in JSON format with the taniumsource custom column added. 2020 Tanium Inc. All Rights ReservedPage 15

Right-Click ActionsThe Tanium App for QRadar include a right-click action available for any IP Addresses in the QRadar Log ActivitySummary. You can choose from either: Tanium – Basic Info Tanium – Running ProcessesThese actions will use the Tanium REST API to ask a Question and bring back the results in a table in a newbrowser tab. Tanium – Basic Info will bring back the list of users currently logged in and Tanium – RunningProcesses will bring back a list of all processes currently matching on the Tanium-managed machine with that IPaddress. 2020 Tanium Inc. All Rights ReservedPage 16