tanium-network-events

Retrieve network events from Tanium

tanium-network-events profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] ip=IP [offset=NUM] [limit=NUM]

profile=PROFILE: Tanium profile name
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP: Target IP
offset=NUM: Skip count
limit=NUM: Max output count

Output Fields

Field	Type	Name	Description
_time	Date	Time
profile	String	Connect profile
nt_domain	String	NT domain
nt_user	String	NT user
operation	String	Operation	e.g. Connect, Disconnect
src_ip	IP address	Source IP
src_port	Integer	Source 포트
dst_ip	IP address	Destination IP
dst_port	Integer	Destination port
pguid	String	Process GUID
pid	Integer	Process ID
image	String	Process command line
id	String	Event ID