Tanium

Download 11
Last updated Apr 18, 2022

tanium-network-events

Retrieve network events from Tanium

tanium-network-events profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] ip=IP [offset=NUM] [limit=NUM]
profile=PROFILE
Tanium profile name
duration=NUM{mon|w|d|h|m|s}
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP
Target IP
offset=NUM
Skip count
limit=NUM
Max output count

Output Fields

FieldTypeNameDescription
_timeDateTime
profileStringConnect profile
nt_domainStringNT domain
nt_userStringNT user
operationStringOperatione.g. Connect, Disconnect
src_ipIP addressSource IP
src_portIntegerSource 포트
dst_ipIP addressDestination IP
dst_portIntegerDestination port
pguidStringProcess GUID
pidIntegerProcess ID
imageStringProcess command line
idStringEvent ID