elastic / elastic/integrations

[meta][tanium] Improve setup and mappings, or switch data source

Open
#12,069 3 comments 0 reactions 1 assignee Claimed by @chrisberkhout View on GitHub
enhancement Integration:tanium Stalled Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

The Tanium integration's current [setup instructions](https://github.com/elastic/integrations/blob/main/packages/tanium/docs/README.md#to-collect-data-from-the-tanium-http-endpoint-follow-the-below-steps) for HTTP Endpoint and TCP inputs are very brief. The columns sent by default seem to have changed since Tanium version 7.5.5.1162 (current version 7.7.1.7207). The Tanium documentation does not cover column-level data or UI changes.

To make the **setup instructions** more reliable, they could be extended to step-by-step instructions with lists of specific columns to configure/confirm, perhaps with screenshots. The exact data source(s) should be defined for each data stream, as these are configured separately.

To improve **mappings**, they should be checked against data as sent by default or using the new setup instructions. There are also mapping choices that could be revisited, such as extensive use of `nested` alongside extraction of specific fields covering the same data.

---

An alternative to the above is to transition to **Tanium's preferred integration method: the GraphQL API** (see [Tanium Integration Methods](https://developer.tanium.com/site/global/docs/integration_methods/index.gsp)). All relevant data can be mapped because it is documented in the GraphQL API schema, and unexpected changes can be avoided by explicitly requesting the fields of interest. Setup should be easier for users, as all the data can come from the one API.

Documentation about the GraphQL API:
- [Using Gateway](https://help.tanium.com/bundle/ug_gateway_cloud/page/gateway/gateway.html)
- [Reference: Gateway examples](https://help.tanium.com/bundle/ug_gateway_cloud/page/gateway/gateway_examples.html)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.