Tanium

Download 11
Last updated Apr 18, 2022

tanium-driver-events

Retrieve driver events from Tanium

tanium-driver-events profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] ip=IP [offset=NUM] [limit=NUM]
profile=PROFILE
Tanium profile name
duration=NUM{mon|w|d|h|m|s}
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP
Target IP
offset=NUM
Skip count
limit=NUM
Max output count

Output Fields

FieldTypeNameDescription
_timeDateTime
profileStringConnect profile
nt_domainStringNT domain
nt_userStringNT user
event_nameStringEvent message
event_idStringWindows event ID
imageStringImage file path