Retrieve driver events from Tanium

profile=PROFILE

Tanium profile name

duration=NUM{mon|w|d|h|m|s}

Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.

from=yyyyMMddHHmmss

Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

to=yyyyMMddHHmmss

End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

ip=IP

Target IP

offset=NUM

Skip count

limit=NUM

Max output count

Output Fields