Skip to main content
SAFE Security

Course Catalog

All Topics

Tanium

  • By SAFE Security
  • Published: Oct 16, 2026
  • Rating
    Average rating: 0 No reviews

Outline

Introduction

SAFE integrates with Tanium to continuously ingest endpoint asset inventory, vulnerability findings, installed software, and configuration assessment results from Tanium into SAFE. This enables organizations to centralize endpoint cyber risk data, enrich enterprise risk visibility, and prioritize remediation based on business impact.

The integration uses Tanium REST and GraphQL APIs and supports automated synchronization of endpoint security data into SAFE.

What SAFE Imports from Tanium

SAFE imports the following data from Tanium to provide comprehensive endpoint visibility and cyber risk context.

Data Category Description
Assets Endpoint inventory and metadata, including hostname, IP address, operating system, hardware configuration, CPU, memory, asset identifiers, and last observed timestamps.
Vulnerabilities CVE-based vulnerability findings, including severity, CVSS score, description, first and last observed timestamps, affected software, and remediation recommendations.Only vulnerabilities that meet the following criteria are imported into SAFE: - The vulnerability severity is Critical, High, Medium, or Low. - The vulnerability is not marked as Accepted in Tanium.
Configuration Assessment Findings Compliance and configuration assessment findings from Tanium Comply, including benchmarks, benchmark rules, control states, compliance standards, and scan timestamps.
Software Inventory Installed software inventory, including product name, vendor, version, and installation source.
Tags SAFE supports importing Tanium tags using either of the following methods: - Custom Tag Fields – During connector configuration, specify one or more Tanium custom tag fields as a comma-separated list. Only first-level string and numeric fields are supported. - Native Tag Import – Tanium custom tags are imported into the SAFE Tags field. No custom field is needed.

Data Synchronization Behavior

Operation Behavior
Initial Sync Imports all supported Tanium asset data via full refresh.
Subsequent Sync No Incremental Sync. Runs full refresh.
Auto Sync Configurable (Default: 7 days)
Manual Sync Supported
Failed Sync Checkpoint-based progress is tracked, and can resume from last saved point for the same running sync context.

Prerequisites and Permissions

Before configuring the integration, ensure the following prerequisites are met.

  • Tanium API Base URL

    Example: https://<customerName>-api.cloud.tanium.com

  • Tanium Access Token. Refer to Generate Connection Details.

Roles

  • A Tanium user account with the required roles:

    • Comply Report Reviewer
    • API Gateway User or Gateway User, depending on the Tanium versionTo create a user profile with these specific roles, ensure you possess a Tanium user role permitting user creation. Detailed instructions can be found in the Generate Connection Details section.
    • Read access to the Tanium Asset module

  • For configuration and vulnerability assessment access, the user should also have appropriate computer group access, such as the required in-scope computer groups or All Computers.

Computer Group Access

  • Grant access to required in-scope computer groups, or assign All Computers for full endpoint visibility.

  • Remove the default No Computers group.

Custom Role: Platform Content Permissions

Content Set Required For Why
Core Content Configuration and vulnerability assessments Provides access to core sensor data required for assessments
Comply Reporting Vulnerability assessment Provides access to CVE vulnerability data from Tanium Comply

Permission Combinations by Use Case

Use Case Required Roles Sensor Permissions
Configuration assessment only Comply Report Reviewer + API Gateway User + Asset module read access Core Content
Vulnerability assessment only Comply Report Reviewer + API Gateway User + Asset module read access Core Content + Comply Reporting
Both (recommended) Comply Report Reviewer + API Gateway User + Asset module read access Core Content + Comply Reporting

Generate Connection Details

Create a User in Tanium

  1. Log in to your Tanium account. Ensure you have a Tanium user role that permits user creation.

  2. Navigate to Administration > Permissions > Users.

  3. Click the New User button.

  4. Fill in the User Details.

  5. Click the Manage Roles button.

  6. Search and select the two roles, Comply Report Reviewer and API Gateway User (or Gateway User if present in your environment), and a role with read access to the Tanium Asset module. (All of these permissions are needed for configuration and vulnerability assessments).

  7. Click the Apply button. The system displays the selected roles under the Roles section.

  8. Assign Computer Groups to the user as follows:

    1. Scroll down to the Computer Groups section and click the Manage Computer Groups button.
    2. Remove the No Computers group and add any in-scope computer groups as required, or the All Computers group.

  9. Scroll down and click the Save button. The system displays the created user on the Users page.

  10. Adding a Custom Role to the Tanium User

    1. Log in to the Tanium portal.
    2. Navigate to Administration > Roles.
    3. Click on New Role.
    4. Name the role as you prefer, then under the Users section, click Manage User.
    5. Select the user intended for SAFE's integration.

  11. In the Permissions section, expand Platform Content Permissions and select the read permission for Sensor (a green tick icon will appear).

  12. Click the small (0+) icon next to the green tick icon.

  13. From the list, select Core Content(Needed for both configuration and vulnerability assessments) and Comply Reporting (needed for vulnerability assessment only).

  14. Click Save. Confirm by choosing Yes.

Generate API Token

  1. Log in to your Tanium Account with the API Gateway User (or Gateway User) and Comply Report Reviewer roles.

  2. Go to Administration from the Main menu.

  3. Navigate to Permissions > API Tokens.

  4. Click New API Token.

  5. Enter the Notes and Expiry.

  6. In the Trusted IP addresses field, fill in the “Private IP address of the Tanium” and add the SAFE IP addresses based on the region where the safe is deployed.

  7. Click the Save button.

  8. The system displays the APIToken. Copy the token to use it while configuring Tanium in SAFE.

Configure Tanium in SAFE

  1. Log in to SAFE as admin and navigate to Integrations on the left navigation

  2. Click on the + icon on the top right of the page.

  3. Click Tanium from the list.

  4. Enter the Integration Name.

  5. Enter the Tanium API Base URL (Example: https://<customerName>-api.cloud.tanium.com).

  6. Enter the Tanium Access Token obtained from Tanium. Refer to Generate Connection Details.

  7. Tanium Custom Tag Fields: Enter the field names to be custom tagged in a comma-separated format. Only first-level fields with numeric or string values are supported for ingestion as tags.

  8. [Optional] Enter the View ID. It limits data fetch to specific Tanium views.

  9. [Optional] Use Asset View: Select this checkbox to limit the asset data returned to only the fields and systems defined in a view.

  10. Click the Test Connection button once you have entered your credentials.

  11. Once the connection is verified, click Save.

  12. Once the integration is saved, click the Sync Now button to trigger an on-demand sync.

API Details

API Endpoint Method Purpose Data Retrieved
/plugin/products/asset/v1/assets GET Retrieves endpoint asset inventory Asset metadata, hardware details, operating system, network information, installed software, tags, and asset attributes
/plugin/products/gateway/graphqlOperation: filterEndpointVulnerability POST (GraphQL) Retrieves endpoint vulnerability findings CVE findings, severity, CVSS score, affected products, remediation recommendations, first and last observed timestamps
/plugin/products/gateway/graphql\Operation: endpointComplianceFindings POST (GraphQL) Retrieves configuration assessment and compliance findings Compliance controls, benchmark information, rule status, compliance state, scan dates, and standards
/plugin/products/comply/v1/benchmarks GET Retrieves benchmark definitions Compliance benchmark metadata
/plugin/products/comply/v1/benchmarks/{benchmark_id}/rules GET Retrieves benchmark rule details Rule descriptions, remediation guidance, rationale, and control metadata

FAQs

Q: How frequently does SAFE sync data from Tanium?

A: Sync frequency depends on the auto sync frequency.

Q: Does SAFE support both CVE and non-CVE findings from Tanium?

A: Yes, both CVE and non-CVE vulnerabilities are ingested.

Q: What happens if API rate limits are exceeded?

A: SAFE automatically manages rate limits by pausing and retrying API calls after the designated wait time.

Q: How are duplicate assets or findings handled?

A: Assets are deduplicated based on unique identifiers.

Q: Can historical data be re-ingested?

A: Yes, historical data can be re-ingested by re-running the integration.

Did this article help?

Let us know by leaving a star rating at the top of this article.