Device Security
Tanium Attribute Reference
Table of Contents
Expand All
|
Collapse All
Device Security Docs
Tanium Attribute Reference
This reference lists the attributes that Device Security collects from Tanium,
their names as stored in Device Security, and the Device Security device and vulnerability fields
they map to.
When Device Security integrates with Tanium, it imports endpoint
management data to enrich the device inventory. The attributes in this reference cover
device identification, hardware, OS, and vulnerability findings from Tanium-managed
endpoints.
The third-party attribute name in Device Security refers to the attribute name
as it appears in the Assets Inventory table and in Query Engine. This follows the format
of third-party-name.attribute-name.
When viewing the attribute name in the Assets Inventory table column selector or on a
Device Details page, where the third-party name can be found as a header for the
attributes section, then the third-party name is removed from the attribute name.
For example, micrsoft_defender_xdr.macAddress would appear in the
Query Builder and in the Assets Inventory table, but under Device DetailsAttributesIntegration Specific AttributesMicrosoft Defender, the attribute would appear as macAddress.
Device Attributes
Device Security collects device attributes from the Tanium gateway GraphQL device API. The following table lists each Tanium attribute, its name as stored in Device Security, and the Device Security device field it maps to (if applicable).
|
Tanium Attribute
|
Device Security Attribute Name
|
Device Security Common Attribute*
|
Description
|
|---|---|---|---|
|
chassisType
|
tanium.chassisType
|
—
|
Chassis type
|
|
computerID
|
tanium.computerID
|
—
|
Computer ID
|
|
disks.0.free
|
tanium.disks.free
|
—
|
Disk free space
|
|
disks.0.usedPercentage
|
tanium.disks.usedPercentage
|
—
|
Disk used percentage
|
|
disks.0.usedSpace
|
tanium.disks.usedSpace
|
—
|
Disk used space
|
|
domainName
|
tanium.domainName
|
AD Domain
|
Domain name
|
|
entityProviderName
|
tanium.entityProviderName
|
—
|
Entity provider name
|
|
entityType
|
tanium.entityType
|
user_defined_device_type
|
Entity type
|
|
installedApplications
|
—
|
third_party_learned_installed_software
|
Installed applications
|
|
ipAddress
|
tanium.ipAddress
|
ipv4_address
|
IP address
|
|
isEncrypted
|
tanium.isEncrypted
|
—
|
Indicates whether the device is encrypted
|
|
isEndpoint
|
tanium.isEndpoint
|
—
|
Indicates whether the device is an endpoint
|
|
isVirtual
|
tanium.isVirtual
|
—
|
Indicates whether the device is virtual
|
|
isWireless
|
tanium.isWireless
|
Wired - Wireless
|
Indicates whether the device is wireless
|
|
lastLoggedInUser
|
tanium.lastLoggedInUser
|
—
|
Last logged in user
|
|
macAddress
|
tanium.macAddress
|
—
|
MAC address
|
|
manufacturer
|
tanium.manufacturer
|
Vendor
|
Manufacturer
|
|
memory.ram
|
tanium.memory.ram
|
—
|
RAM size
|
|
memory.total
|
tanium.memory.total
|
—
|
Memory total
|
|
model
|
tanium.model
|
Model
|
Model
|
|
name
|
tanium.name
|
Hostname
|
Name
|
|
networking.adapters
|
—
|
third_party_learned_network_interfaces
|
Network adapters
|
|
os.name
|
tanium.os.name
|
OS Name
|
OS name
|
|
os.platform
|
tanium.os.platform
|
OS Group
|
OS platform
|
|
os.windows.majorVersion
|
tanium.os.windows.majorVersion
|
OS Version
|
OS Windows major version
|
|
os.windows.releaseId
|
tanium.os.windows.releaseId
|
—
|
OS Windows release ID
|
|
os.windows.type
|
tanium.os.windows.type
|
—
|
OS Windows type
|
|
primaryUser.country
|
tanium.primaryUser.country
|
—
|
Primary user country
|
|
primaryUser.department
|
tanium.primaryUser.department
|
—
|
Primary user department
|
|
primaryUser.email
|
tanium.primaryUser.email
|
—
|
Primary user email
|
|
primaryUser.name
|
tanium.primaryUser.name
|
—
|
Primary user name
|
|
primaryUser.phoneNumber
|
tanium.primaryUser.phoneNumber
|
—
|
Primary user phone number
|
|
processor.architecture
|
tanium.processor.architecture
|
—
|
Processor architecture
|
|
processor.cacheSize
|
tanium.processor.cacheSize
|
—
|
Processor cache size
|
|
processor.consumption
|
tanium.processor.consumption
|
—
|
Processor consumption
|
|
processor.cpu
|
tanium.processor.cpu
|
—
|
Processor CPU
|
|
processor.family
|
tanium.processor.family
|
—
|
Processor family
|
|
processor.logicalProcessors
|
tanium.processor.logicalProcessors
|
—
|
Processor logical processors
|
|
processor.manufacturer
|
tanium.processor.manufacturer
|
—
|
Processor manufacturer
|
|
serialNumber
|
tanium.serialNumber
|
Serial Number
|
Serial number
|
|
systemUUID
|
tanium.systemUUID
|
—
|
System UUID
|
Vulnerability Attributes
Device Security collects vulnerability attributes from the Tanium gateway GraphQL vulnerability API. The following table lists each Tanium vulnerability attribute, its name as stored in Device Security, and the Device Security vulnerability field it maps to (if applicable).
|
Tanium Attribute
|
Device Security Attribute Name
|
Device Security Common Attribute*
|
Description
|
|---|---|---|---|
|
cveId
|
tanium.cveId
|
cve
|
CVE ID
|
|
cveYear
|
tanium.cveYear
|
—
|
CVE year
|
|
cvssScore
|
tanium.cvssScore
|
cvss_base_score
|
CVSS score
|
|
firstFound
|
tanium.firstFound
|
—
|
First found
|
|
ipAddress
|
—
|
ipv4_address
|
IP address
|
|
lastFound
|
tanium.lastFound
|
detected_time
|
Last found
|
|
macAddress
|
—
|
—
|
MAC address
|
|
severityV3
|
tanium.severityV3
|
risk_level
|
Severity v3
|
|
summary
|
tanium.summary
|
Description
|
Description
|
* Only some attributes map to a Device Security Common Attribute.