Set up IoT Security and XSOAR for Tanium Integration
Table of Contents
Expand all | Collapse all
-
- Integrate IoT Security with AIMS
- Set up AIMS for Integration
- Set up IoT Security and XSOAR for AIMS Integration
- Send Work Orders to AIMS
- Integrate IoT Security with Microsoft SCCM
- Set up Microsoft SCCM for Integration
- Set up IoT Security and XSOAR for SCCM Integration
- Integrate IoT Security with Nuvolo
- Set up Nuvolo for Integration
- Set up IoT Security and XSOAR for Nuvolo Integration
- Send Security Alerts to Nuvolo
- Send Vulnerabilities to Nuvolo
- Integrate IoT Security with ServiceNow
- Set up ServiceNow for Integration
- Set up IoT Security and XSOAR for ServiceNow Integration
- Send Security Alerts to ServiceNow
- Send Vulnerabilities to ServiceNow
-
- Integrate IoT Security with Cortex XDR
- Set up Cortex XDR for Integration
- Set up IoT Security and XSOAR for XDR Integration
- Integrate IoT Security with CrowdStrike
- Set up CrowdStrike for Integration
- Set up IoT Security and XSOAR for CrowdStrike Integration
- Integrate IoT Security with Tanium
- Set up Tanium for Integration
- Set up IoT Security and XSOAR for Tanium Integration
-
- Integrate IoT Security with Aruba Central
- Set up Aruba Central for Integration
- Set up IoT Security and XSOAR for Aruba Central Integration
- Integrate IoT Security with Cisco DNA Center
- Set up Cisco DNA Center to Connect with XSOAR Engines
- Set up IoT Security and XSOAR for DNA Center Integration
- Integrate IoT Security with Cisco Meraki Cloud
- Set up Cisco Meraki Cloud for Integration
- Set up IoT Security and XSOAR for Cisco Meraki Cloud
- Integrate IoT Security with Cisco Prime
- Set up Cisco Prime to Accept Connections from IoT Security
- Set up IoT Security and XSOAR for Cisco Prime Integration
- Integrate IoT Security with Network Switches for SNMP Discovery
- Set up IoT Security and Cortex XSOAR for SNMP Discovery
- Integrate IoT Security with Switches for Network Discovery
- Set up IoT Security and Cortex XSOAR for Network Discovery
-
- Integrate IoT Security with Aruba WLAN Controllers
- Set up Aruba WLAN Controllers for Integration
- Set up IoT Security and XSOAR for Aruba WLAN Controllers
- Integrate IoT Security with Cisco WLAN Controllers
- Set up Cisco WLAN Controllers for Integration
- Set up IoT Security and XSOAR for Cisco WLAN Controllers
-
- Integrate IoT Security with Aruba ClearPass
- Set up Aruba ClearPass for Integration
- Set up IoT Security and XSOAR for ClearPass Integration
- Put a Device in Quarantine Using Aruba ClearPass
- Release a Device from Quarantine Using Aruba ClearPass
- Integrate IoT Security with Cisco ISE
- Set up Cisco ISE to Identify IoT Devices
- Set up Cisco ISE to Identify and Quarantine IoT Devices
- Configure ISE Servers as an HA Pair
- Set up IoT Security and XSOAR for Cisco ISE Integration
- Put a Device in Quarantine Using Cisco ISE
- Release a Device from Quarantine Using Cisco ISE
- Apply Access Control Lists through Cisco ISE
- Integrate IoT Security with Cisco ISE pxGrid
- Set up Integration with Cisco ISE pxGrid
- Put a Device in Quarantine Using Cisco ISE pxGrid
- Release a Device from Quarantine Using Cisco ISE pxGrid
- Integrate IoT Security with Forescout
- Set up Forescout for Integration
- Set up IoT Security and XSOAR for Forescout Integration
- Put a Device in Quarantine Using Forescout
- Release a Device from Quarantine Using Forescout
-
- Integrate IoT Security with Qualys
- Set up QualysGuard Express for Integration
- Set up IoT Security and XSOAR for Qualys Integration
- Perform a Vulnerability Scan Using Qualys
- Get Vulnerability Scan Reports from Qualys
- Integrate IoT Security with Rapid7
- Set up Rapid7 InsightVM for Integration
- Set up IoT Security and XSOAR for Rapid7 Integration
- Perform a Vulnerability Scan Using Rapid7
- Get Vulnerability Scan Reports from Rapid7
- Integrate IoT Security with Tenable
- Set up Tenable for Integration
- Set up IoT Security and XSOAR for Tenable Integration
- Perform a Vulnerability Scan Using Tenable
- Get Vulnerability Scan Reports from Tenable
Set up IoT Security and XSOAR for Tanium Integration
Set up IoT Security and Cortex XSOAR to integrate with Tanium.
To set up IoT Security to integrate through Cortex XSOAR with Tanium, configure XSOAR
with a Tanium integration instance and a job to import device details and
vulnerabilities. You can set the job to run at regular intervals or on demand. The
configuration requires the following information from Tanium:
- Domain URL of a cloud-hosted Tanium server, or an FQDN or IP address of an on-premises Tanium server
- Username and password of the user account that XSOAR uses when connecting to the Tanium API
To set up IoT Security to integrate through a cloud-hosted Cortex XSOAR instance with
an on-premises Tanium server, you must also add a Cortex XSOAR engine to your
network.
Cortex XSOAR Engine Installation
An on-premises XSOAR engine facilitates communications between the Cortex XSOAR
cloud and an on-premises Tanium server. Although it's possible to install an
XSOAR engine on machines running Windows, macOS, and Linux operating systems,
only an engine on a Linux machine supports IoT Security integrations. For more
information about operating system and hardware requirements, see the Cortex XSOAR Administrator's
Guide.
We recommend downloading the XSOAR engine using the shell installer script
and installing it on a Linux machine. This simplifies the deployment by
automatically installing all required dependencies and also enables
remote engine upgrades.
When placing the XSOAR engine on your network, make sure it can form HTTPS
connections to your on-premises Tanium server. By default, HTTPS uses TCP port
443.
The firewall must also allow the engine to form HTTPS connections on TCP port 443
to the Cortex cloud at https://<your-domain>.iot.demisto.live/. You can see
the URL of your XSOAR instance when you log in to the IoT Security portal and
click . It’s visible in the address bar of the web page displaying the
XSOAR interface.
Integrations
Launch Cortex XSOAR
To create an XSOAR engine, access the Cortex XSOAR interface (from the IoT
Security portal, click ). Click . Choose
Integrations
Launch Cortex XSOAR
Settings
Engines
+ Create New Engine
Shell
as the type.For installation instructions, see Install Cortex XSOAR Engines.
For help troubleshooting Cortex XSOAR engines, including installations, upgrades,
connectivity, and permissions, see Troubleshoot Cortex XSOAR Engines and
Troubleshoot Integrations Running on
Engines.
Configure IoT Security and Cortex XSOAR
- Log in to IoT Security and from there access Tanium settings in Cortex XSOAR.
- Log in to IoT Security and then clickIntegrations.
- IoT Security uses Cortex XSOAR to integrate with Tanium, and the settings you must configure to integrate with it are in the XSOAR interface. To access these settings, clickLaunch Cortex XSOAR.The Cortex XSOAR interface opens in a new browser window.
- ClickSettingsin the left navigation menu, search forto locate it among other instances.tanium
- Configure the Tanium integration instance.
- ClickAdd instanceto open the settings panel.
- Enter the following settings:Name: Use the default name of the instance or enter a new one.Remember the instance name because you are going to use it again when creating a job that Cortex XSOAR will run to gather data from the Tanium instance specified in this integration instance.Domain URL: Enter the domain URL of a cloud-hosted Tanium instance or static IP address of an on-premises Tanium server. Note that you can include or omithttps://from the URL. Both of these formats are acceptable:
- https://<customername>-api.cloud.tanium.com
- <customername>-api.cloud.tanium.com
Username: Type the name of the user account that you previously created for the XSOAR engine to use when connecting to the Tanium API.Password: Type the password associated with the user account.Use single engine: When using a cloud-based XSOAR instance and an on-premises Tanium server, choose the XSOAR engine that you want to communicate with the Tanium server. - When finished, clickTest.If the test is successful, a Success message appears. If not, check that the settings were entered correctly and then test the configuration again.
- After the test succeeds, clickDoneto save your changes, close the settings panel, and activate the instance.
- To integrate with other Tanium servers, repeat the previous steps to add more integration instances.
- Create a job for XSOAR to query Tanium for device vulnerabilities and import them to IoT Security.IoT Security only imports vulnerabilities for devices that are already in its database and whose MAC address matches that Tanium returns. If Tanium returns vulnerabilities for MAC addresses that aren’t in the IoT Security database, they’re ignored and dropped.
- Copy the name of the instance you just created, clickJobsnear the bottom of the left navigation menu and then clickNew Jobat the top of the page.
- In the New Job panel that appears, enter the following and leave the other settings at their default values:Recurring: Select this if you want to periodically import vulnerabilities from Tanium. Clear it if you want to import them on demand.Every: If you selectRecurring, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. (If you don’t select specific days, then the job will run everyday by default.) This determines how often XSOAR queries Tanium for device vulnerabilities. For example, every day at 2:00 AM.Name: Enter a name for the job.Playbook: ChooseImport Tanium Vulnerabilities to PANW IoT cloud.Integration Instance Name: Paste the instance name you copied a few moments ago.Import vulnerabilities by CVE severity levels: Choose one or more severity levels to determine which vulnerabilities to import:Critical,High,Medium,Low, orUnscored(that is, there is no severity score). Choosing all five severities is the same as not choosing any.The severity levels are based on Common Vulnerability Scoring System version 3 (CVSSv3).
- ClickCreate new job.
- Enable the job and run it.
- Check the Job Status for the job you created. If it’s Disabled, select its check box and then clickEnable.
- After you enable it, keep the check box selected and clickRun now. The Run Status changes from Idle to Running.If you selectedRecurring, XSOAR queries Tanium for device vulnerabilities at the defined interval and forwards imported information to IoT Security.If you clearedRecurring, XSOAR immediately queries Tanium and forwards imported device vulnerabilities to IoT Security.
- If you created more integration instances for multiple on-premises Tanium servers, add more jobs as necessary.Each Tanium server requires a separate job.Run the job for each integration instance you create. The first time you run a job that references an integration instance, it triggers XSOAR to report the instance to IoT Security, which then displays the integration instance on the Integrations page.
- When done, return to the IoT Security portal and check the status of the Tanium integration.An integration instance can be in one of the following four states, which IoT Security displays in the Status column on the Integrations page:
- Disabledmeans that either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
- Errormeans that the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
- Inactivemeans that the integration was configured and enabled but no job has run for at least the past 60 minutes.
- Activemeans that the integration was configured and enabled and is functioning properly.
When you see that its status isActive, the setup is complete.