tanium-dns-events

Retrieve DNS events from Tanium

tanium-dns-events profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] ip=IP [offset=NUM] [limit=NUM]

profile=PROFILE: Tanium profile name
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP: Target IP
offset=NUM: Skip count
limit=NUM: Max output count

Output Fields

Field	Type	Name	Description
_time	Date	Time
profile	String	Connect profile
nt_domain	String	NT domain
nt_user	String	NT user
pid	Integer	Process ID
pguid	String	Process GUID
image	String	Image file path
operation	String	Operation	e.g. DNS Query Complete, Cache Lookup Complete, Query Response
dns_query	String	DNS query	Domain name
dns_response	String	DNS response	Resource records separated by semicolon
id	String	Event ID