This article provides prerequisites and onboarding steps for connecting your XEM Core Cloud installation to the Expel Workbench.
Step 1: Enable Console Access
When you create a XEM Core user configuration, by default it has no computer management groups, alternative personas, user groups, or roles until you assign them. A user with no roles can log into the Tanium Console but can't access anything. Don't create configurations for user accounts that you import from an LDAP server.
Doc reference: https://help.tanium.com
We use the following Tanium API routes for our integration:
|
Route |
Permission |
|---|---|
|
/api/v2/session/login |
Interact:Login |
|
/api/v2/sensors/by-name |
Interact:Read Sensor |
|
/api/v2/parse_question |
Interact:Ask Dynamic Questions |
|
/api/v2/questions |
|
|
/api/v2/result_data/question/ |
|
|
/plugin/products/detect3/api/v1/alerts |
Threat Response: Detect Alert Read |
|
/plugin/products/detect3/api/v1/intels |
Threat Response: Detect Intel Read |
|
/plugin/products/detect3/api/v1/sources |
Threat Response: Detect Source Read |
|
/plugin/products/detect3/api/v1/intels/<intel id>/labels |
Threat Response: Detect Label Read |
The Interact Basic Userrole grants us all the necessary permissions we need to access the question/sensor APIs and Interact console.
The Threat Response Read Only User role grants us all the necessary permissions we need to access the alerts APIs and Threat Response console.
If you are using a custom role, we also need Detect Use API permission as well as the necessary permissions to make Threat Response available in console.
The Tanium client uses a username/password combination to create an authenticated session. The returned session token is set in the session header for all subsequent requests.
-
From the Main menu, select Administration > Management > Users.
-
Select New User.
-
Specify a user name that matches 1 of the following:
-
A user account defined locally on the Tanium Server.
-
A user account defined in your IdP.
-
(Windows only) An AD account name. Specify just the user name, not the domain name. The Tanium Server uses Windows Authentication, and doesn't store or manage login credentials for the user.
-
-
Save the configuration and get ready to assign roles to a user.
-
From the main menu, select Administration > Management > Users.
-
Select the User Name of the user configuration that you want to edit.
-
In the Roles and Effective Permissions section, select Manage.
-
In the Grant Roles section, select Edit, select Interact Basic User and Threat Response Read Only User, and select Save.
-
Select Show Preview to Continue to review the impact of your changes.
Step 2: Create an API Token
-
Sign into the Tanium Console as the user and persona for whom you want to create a token.
Note
The authentication credentials and authorization permissions of a token are those of the requesting persona. To limit access to computer groups and content sets, create a persona with the desired permissions and then sign in with the new persona. -
From the Main menu, go to Administration > Permissions > API Tokens.
-
Select New API Token and configure the token settings:
-
Notes (optional): type a description of the purpose for this token.
-
Expire in days: type the expiration interval 365. By default, the maximum interval is 365 days. If you don't enter a value, the interval defaults to 7 days.
-
-
Trusted IP addresses: Enter the external IP addresses of the systems from which you will use this token to authenticate with the Tanium Server. Use commas or line breaks to separate multiple entries. Expel uses a group of static egress IP addresses to complete polling of the security device and for console access. Add the following IPs to the Trusted IP address list:
-
Select Save and review the token details.
-
Copy the token to your clipboard and store as you need this to add this to Workbench.
Note
You cannot view the token in the Tanium Console after the visibility timeout (5 minutes) expires, or you refresh the API Tokens page or grid, or you navigate to another console page.
Step 3: Configure the Technology in Workbench
-
Login to https://workbench.expel.io.
-
Navigate to Settings > Security Devices.
-
At the top of the page, select Add New Device.
-
Search for and select your technology (Tanium).
-
Complete the fields as follows:
-
For Name, type the host name of the Tanium device.
-
For Location, type the geographic location of the appliance.
-
For Server address, type your Tanium Cloud URL.
-
For Username and Password, type the username and password created in Step 1.
-
For Token, type the API token that you created in Step 2.
-