tanium-file-events

Retrieve file events from Tanium

tanium-file-events profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] ip=IP [offset=NUM] [limit=NUM]

profile=PROFILE: Tanium profile name
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP: Target IP
offset=NUM: Skip count
limit=NUM: Max output count

Output Fields

Field	Type	Name	Description
_time	Date	Date
profile	String	Connect profile
nt_domain	String	NT domain
nt_user	String	NT user
pid	Integer	Process ID
pguid	String	Process GUID
image	String	Process image path
operation	String	Operation	e.g. Create, Write, Move
file_path	String	File path
details	String	Details	Previous file path for Move
id	String	Event ID