Tanium

Download 11
Last updated Apr 18, 2022

tanium-file-events

Retrieve file events from Tanium

tanium-file-events profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] ip=IP [offset=NUM] [limit=NUM]
profile=PROFILE
Tanium profile name
duration=NUM{mon|w|d|h|m|s}
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP
Target IP
offset=NUM
Skip count
limit=NUM
Max output count

Output Fields

FieldTypeNameDescription
_timeDateDate
profileStringConnect profile
nt_domainStringNT domain
nt_userStringNT user
pidIntegerProcess ID
pguidStringProcess GUID
imageStringProcess image path
operationStringOperatione.g. Create, Write, Move
file_pathStringFile path
detailsStringDetailsPrevious file path for Move
idStringEvent ID