Tanium - Add or Remove Tag to/from Assets

Tanium - Add or Remove Tag to/from Assets adds or removes tags to or from:

• Assets that match the results of the selected saved query, and match the Enforcement Action Conditions, if defined or assets selected on the relevant asset page.

General Settings

• Use stored credentials from Tanium Interact adapter - Select this option to use (the first) Tanium connected adapter credentials.
  • When you select this option, the Select Adapter Connection drop-down is available, and you can choose which adapter connection to use for this Enforcement Action.

Required Fields

These fields are required to run the Enforcement Set.

• Action type - Select whether to Add tags or Remove tags.
• Tags names - Enter the names of the tags to add or remove, separated by a blank space.

Additional Fields

These fields are optional.

• Re-ask every fetch - When fetching data for a connection, ask Tanium to issue a new question to get the current results for each value supplied to Names of Saved Questions to fetch (comma separated).

• Re-ask if results are older than N hours (default: 24) - When fetching data for a connection, if the results for each value supplied to Names of Saved Questions to fetch (comma separated) are older than this many hours, ask Tanium to issue a new question to get the current results.

  • If the value provided is 0, no age check is performed and a new question will not be issued based on the value supplied here.

• Re-asking waits until all answers are returned - When a new question is issued for a Saved Question, wait until the question expires (10 minutes) before fetching assets.

• Use Server Side Export - Utilize Tanium's Server Side Export to export all of the data on the Tanium platform into one XML file instead of paging through the data utilizing the Tanium REST API.

• Parse Dynamic Fields (default: True) - Enable/disable the creation of adapter specific dynamic fields being created for every sensor included in the supplied Saved Questions.

• Parse Advanced View (optional, default: True) - Enable/disable the processing of raw data from Tanium into the Advanced View of each asset.

• Get hostname from "Short Hostname" instead of "Computer Name" - When selected, the hostname will be parsed with local name of the machine.

• Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

• HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.

See Tanium Interact adapter documentation for more details.

Required Permissions

The user must have permission to manage actions and action groups (more information on that can be found on Tanium Console and Interact Requirements in the “User role requirements” section.

If your environment has Action Approval configured, you can assign a role to the Axonius user to bypass it (see Managing Action Approval) or you can approve the action each time it runs.