Tanium Integration

Connect Tanium to Atlas AVD: endpoint inventory linked to your session hosts, computer groups, and Threat Response alerts you can acknowledge.

Before you begin

  • An Enterprise plan or above. The Integrations hub is locked below Enterprise
  • The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
  • A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
  • A Tanium server whose web address is reachable from the internet (Atlas does not connect to private or internal addresses)
  • A persistent Tanium API token
  • Tanium Threat Response, if you want to see alerts

What you can do

  • See every Tanium endpoint with its IP address, Tanium client version and last registration, and jump from an endpoint to the matching session host in Atlas.
  • See which endpoints have registered recently, and how many alerts are open.
  • List your computer groups with their type and filter.
  • See Threat Response alerts and acknowledge them from Atlas.
  • Read and acknowledge Threat Response alerts from your own automation with an Atlas API key.

Step 1: Create an API token in Tanium

In the Tanium console, go to Administration → Permissions → API Tokens and create a persistent token for Atlas, owned by a user whose role can read endpoints and computer groups and, if you use it, read and update Threat Response alerts. Copy the token.

Step 2: Connect in Atlas

Once connected, the card shows Manage, which opens the Tanium page, and Disconnect. The token is stored encrypted.

  1. Select the tenant in the tenant picker.
  2. Go to Administration → Integrations and click Connect on the Tanium card.
  3. Enter the Server URL (your Tanium server's address, starting with https://, for example https://tanium.example.com) and paste the API Token.
  4. Click Connect. Atlas checks the token against your server before saving anything; if Tanium rejects it, nothing is stored.

What you see

  • Overview: Total Endpoints, Online, Offline and Active Alerts, the share of endpoints registered recently, and the number of computer groups. An endpoint counts as online when it has registered with Tanium in the last 10 minutes.
  • Endpoints: host name, IP address, Tanium client version, status (online or stale) and last registration. Search, sort any column, and click the AVD link to open the matching session host. An endpoint links when its host name matches a VM name exactly, or when its short name matches exactly one VM.
  • Alerts: Threat Response alerts with endpoint, severity, type and when they were raised. Search, and filter by Critical, High, Medium or Low.
  • Computer Groups: each group's name, type and filter.

Atlas reads Tanium live each time you open a tab or click Refresh; it does not copy your Tanium data into Atlas or sync it in the background.

Acknowledge alerts

Each alert row has an Acknowledge action, which sets the alert's state to In Progress in Threat Response straight away, with no confirmation step.

Use it from your own tools

An Atlas API key with the integration.tanium.read scope can list Threat Response alerts at GET /api/integration/tanium/alerts, and one with integration.tanium.write can acknowledge an alert at POST /api/integration/tanium/alerts/{id}/acknowledge. See API Access for how keys are issued.

What the integration does not do

  • It does not ask questions, read sensors, deploy actions or packages, patch, or open a remote session. Use Tanium for those, or Atlas Reach.
  • It does not show alerts without Tanium Threat Response.
  • Its only change in Tanium is setting an alert to In Progress; it does not resolve or close alerts.
  • Online and offline come from how recently an endpoint registered, not from a live client status.
  • It shows up to 5,000 endpoints, 2,000 computer groups and the 500 most recent alerts.
  • It connects one Tanium server per Atlas tenant, and cannot reach a server on a private network.
  • Credentials cannot be edited in place: disconnect and connect again with the new token.
  • Atlas Advisor can tell you whether Tanium is connected, but does not answer questions about endpoints or alerts.

GCC High tenants

On a tenant or deployment in Azure Government (GCC High), calls to Tanium are blocked by default, because they can carry VM, host-pool and tenant names to a service outside the Government boundary. Connect fails with an Azure Government (GCC High) egress boundary message and nothing is stored, and pages that read from Tanium stay empty. The operator who runs your Atlas deployment can approve Tanium as a destination that is allowed to receive that data; once approved, the connector works normally. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.

Disconnecting

Click Disconnect on the card and confirm. Atlas deletes its stored copy of the token; nothing changes in Tanium. Revoke the token in Tanium too if you no longer need it. You can reconnect at any time.

Troubleshooting

  • Tanium rejected the supplied credentials: the token is wrong, expired or revoked, or its owner lacks permission.
  • Could not connect to Tanium — verify the server URL and credentials: check the address, that it is reachable from the internet with a valid certificate, and that the server is up.
  • The Tanium server URL is not allowed: the address resolves to a private or internal IP address.
  • Alerts are unavailable. Tanium Threat Response may not be installed on this server: install Threat Response, or give the token's owner access to it.
  • The Endpoints tab is empty when you expect data: click Refresh. An empty tab can also mean Tanium returned an error; if it persists, disconnect and connect again to re-test the token.

Next steps