How to integrate Tanium with Splunk?

[akshatj2]

Hi,

We need to integrate Tanium with Splunk but it seems there are no app/or add-on available. I tried to search online and everywhere its mentioned it can be easily integrated but no information is available. Can anyone provide me with details for integration. Also the modules available in tanium that is supported with Splunk.

[ussina04]

I did have covered the steps from the above document.

But still we are not able to see any relevant data. i have seen these logs like thousands of time :

2018-11-07T05:33:06.609000-08:00 "thetaniumservername" Tanium[1299088] 5

[muralikoppula]

Here is the Splunk configuration guide - https://docs.tanium.com/connect/connect/siem.html

The syslog-ng server need to be configured on source(Tanium) side to send logs to Splunk

[ussina04]

Is the app going to be installed only on search heads or both searchheads and forwarder..??

[akshatj2]

The app is used to build dashboards and reports from Tanium logs and contain only search time operations.

It needs to be installed on Search Head only.

To integrate tanium with Splunk, tanium has inbuilt connector which can be configured to send tanium queries as events to Splunk(a total of 19 queries are executed by tanium).

you need to enable a syslog input on specific port on your forwarder and set sourcetype to "tanium" in inputs.conf.

[TGanga]

I'm trying to integrate Tanium Connect with Splunk Cloud ( Not Splunk Enterprise ) to forward data from Tanium to Splunk Cloud in the 'syslog' format. In this regard, I would like to know details on the following - 1. Connection settings that need to be done in Tanium Connect ( like what to be filled in port no ,host name etc ) , 2. Is there any difference in forwarding data from Tanium Connect to Splunk Enterprise and Splunk Cloud OR is it same for both, 3. what are the list of ports that need to be opened in the system where Tanium console is installed, 4. Which port is used for communication between Tanium connect and Splunk cloud, 5. Any URL that need to be white-listed in the Firewall that is present in the network where, Tanium is present, 6. what are the methods that are implemented in Splunk cloud to secure data, 7. What are the security measures that are followed while sending data from Tanium to Splunk cloud etc.,

[rnoyes]

To ingest Tanium data you will need to have configured a Connector within the Tanium console. Saved questions, Detect, IOC and various other iformation can be forwarded to Splunk and utilized within the Splunk app mentioned in the previous post. Tanium support or the Tanium Connect user guide provides details on how to set this up.

[Anam]

Hey akshajt2

I found this app on splunkbase: https://splunkbase.splunk.com/app/1862/
I don't have any experience with it but it might be what you are looking for.