Tanium

Download 11
Last updated Apr 18, 2022

tanium-process-events

Retrieve process events from Tanium

tanium-process-events profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] ip=IP [offset=NUM] [limit=NUM]
profile=PROFILE
Tanium profile name
duration=NUM{mon|w|d|h|m|s}
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP
Target IP
offset=NUM
Skip count
limit=NUM
Max output count

Output Fields

FieldTypeNameDescription
_timeDateStart time
profileStringConnect profile
end_timeDateEnd time
nt_domainStringNT domain
nt_userStringNT user
md5StringImage MD5
pidIntegerProcess ID
imageStringImage file path
cmd_lineStringCommand line
ppidIntegerParent process ID
parent_imageStringParent image path
parent_cmd_lineStringParent command line
parent_md5StringParent image MD5
ppguidStringParent process GUID
pguidStringprocess GUID
exit_codeIntegerExit code
idStringEvent ID