Search Knowledge Base by Keyword

Tanium

< Back

Overview

Tanium is an endpoint management and security platform. An agent runs on every managed machine and the agents form a peer chain, so a question asked at the console propagates across the estate and answers come back in seconds rather than through a central server polling each device in turn. That architecture is what makes Tanium useful as a source of truth about endpoints: it reports what is on the machine now, not what a scan recorded some time last month. The Asset module builds on that live data to keep a normalised inventory of hardware, installed software, network identity and last-seen times, and publishes it over a REST API.

The ReadyWorks connector calls that REST API through the json_rest_api.php driver. Authentication is different from the password-based connectors: no authentication recipe is stored, and the credential travels as a custom header on the request itself. The connection form ships with one header pre-populated, named session, and you paste a Tanium token into its value. You also supply the API domain of the Tanium server and a server-side working path used while responses are parsed.

Tanium is normally the strongest device feed an organisation has, which makes it the natural spine of the ReadyWorks estate rather than one more source among many. Reconciling it against Active Directory, the CMDB and the endpoint-management tools exposes the machines each of those has wrong: devices present in the directory that no agent has seen for months, devices reporting to Tanium that no asset record covers, and hardware specifications that decide whether a machine can take the next operating system. Last-seen times and hardware attributes together drive readiness scoring and wave assignment for device refresh and platform migration programmes.

The connector is registered as bidirectional. Two inbound templates ship, one of them a real Asset pull and the other a blank REST shell, and both are disabled until you enable them. The outbound side posts a record from ReadyWorks to an endpoint you nominate and captures status, message and record key from the reply, and it ships untargeted.

NOTE: The “Get Devices” template calls a path under the Asset module plugin. Deployments that have Tanium without the Asset module licensed and installed will get an error from this endpoint rather than data.

Connector Properties

Property Value
Identifier TANIUM
Name Tanium
Description Connector for pulling Device data from Tanium
Job Types Both Inbound and Outbound
Order 130
Enabled Yes
Locked Yes
Block Update No
Single Authentication No
Windows Only No
Connector Version 2025-11-18
Hooks None
Additional Job Fields None
Image

Authentication Methods

Tanium offers a single authentication method, and it is the default for new connections. It sends a token in a custom header instead of negotiating a credential.

Method Identifier Base Method Script Order Enabled Config Fields
Tanium TANIUM_custom JSON Rest API_custom json_rest_api.php 60 Yes 4

Method 1: Tanium (TANIUM_custom)

Connect to a GET method API with custom header fields

Sends whatever headers you define in the Custom Header Fields list on every request. The list is pre-populated with one entry named session, which is the header Tanium’s API expects the token in, and its value is stored encrypted. Paste a Tanium API token generated for a service account with read access to the Asset data you intend to collect.

Connection Configuration Fields (4)

Order Label Type Required Default Max Len Tooltip
10 API Domain text Yes 255 Enter API domain of the Connection
30 Server Temporary Working Path text Yes storage/etl5 255 Enter path where temporary files are stored during data processing (exclude starting and ending backslash)
210 Custom Header Fields fields_list Yes [{"name":"session","value":""}] Enter the list of custom header fields for the connection
250 Additional Job Fields fields_list No Enter list of additional fields to add to staging data for all jobs

No authentication recipe is stored. The driver script authenticates natively using the fields above.

NOTE: ReadyWorks stores the header value exactly as entered and never refreshes it. If you use a token that expires, collection stops silently on the expiry date and the token has to be regenerated in Tanium and re-entered here.

NOTE: No authentication recipe is stored against this method, so there is no separate authentication call for a Single Authentication setting to suppress. This is why the connection form does not offer that field.

Inbound Job Fields Enabled (44)

Inbound jobs expose the full REST field set, including three levels of enumeration and all five pagination modes.

Order Label Type Required Default Tooltip
10 Job Description text Yes Enter description of the Job
20 Job Schedule lookup Yes Daily Select frequency Job should run
30 Enabled radio Yes Yes Choose if Job is enabled
40 Use Unparsed Data radio No No Choose if you wish to parse the incoming data, or leave it in its raw format
50 Log Raw API Calls radio Yes No Choose if raw API calls are logged
70 Destination Table text Yes Enter name of the destination table
80 Data Identity text No Enter identity of the Job
120 Append New Data to Existing Tables radio No No Choose if new data will append to the existing destination table, or will create a new destination table
130 Fields to Index text No Enter fields to index
170 Method Type select Yes GET Select method type of the Job
190 API End Point text No Enter API end point of the Job
200 API Data Parameters fields_list No Enter API data parameters of the Job
210 Body Data Sending Method select Yes JSON Encoded Data Select method for sending the body data
220 Raw JSON Body Data textarea No Enter the raw JSON body to send. Do not use body selections in the API Parameters if this is used.
230 API Return Data Node text No Enter API return data node of the Job
250 Pagination Type select No None Select request paging type of the Job
270 API Pagination Node text No Enter API pagination node of the Job
280 Pagination Offset Start text No Enter request paging offset start of the Job
290 Pagination Limit text No Enter request pagination limit of the Job
300 Pagination Termination Node text No Enter request paging termination node and value of the Job
310 Maximum API Calls text No Enter maximum number of API calls for the Job to make
320 Enumeration 1 Type select No None Enter enumeration level 1 type
330 Enumeration 1 ETL Job lookup No Select ETL job for the enumeration values
340 Enumeration 1 Data Type data_type No Select the data type and fields for enumeration 1 values
350 Enumeration 1 Keys End Point text No Enter enumeration 1 keys end point of the Job
360 Enumeration 1 Node text No Enter enumeration 1 node of the Job
370 Enumeration 1 Fields fields_list No Enter enumeration 1 fields of the Job
380 Enumeration 2 Type select No None Enter enumeration level 2 type
390 Enumeration 2 ETL Job lookup No Select ETL job for the enumeration 2 values
400 Enumeration 2 Data Type data_type No Select the data type and fields for enumeration 2 values
410 Enumeration 2 Keys End Point text No Enter enumeration 2 keys end point of the Job
420 Enumeration 2 Node text No Enter enumeration 2 node of the Job
430 Enumeration 2 Fields fields_list No Enter enumeration 2 fields of the Job
440 Enumeration 3 Type select No None Enter enumeration level 3 type
450 Enumeration 3 ETL Job lookup No Select ETL job for the enumeration 3 values
460 Enumeration 3 Data Type data_type No Select the data type and fields for enumeration 3 values
470 Enumeration 3 Keys End Point text No Enter enumeration 3 keys end point of the Job
480 Enumeration 3 Node text No Enter enumeration 3 node of the Job
490 Enumeration 3 Fields fields_list No Enter enumeration 3 fields of the Job
500 Pause Enumeration text No Enter values for pausing enumeration every X calls for Y seconds
510 Kill Enumeration on Error radio No No Choose to stop the enumeration loop on an error or continue processing the loop
520 Additional Fields fields_list No Enter list of additional fields to add to staging data
550 Retry Pause text No Enter values for retrying a failed API connection. Retry X times, waiting Y seconds between each try, with an API timeout of Z seconds.
560 Order text Yes Enter order of the Job

NOTE: Several labels and tooltips in this form carry defects inherited from the shared ETL5 field templates: the Enumeration 1 Node label reads “Enumaration”, the Append New Data label reads “Exisiting”, and the help text on Enumeration 1 Keys End Point and Enumeration 3 Fields both refer to enumeration 2. The underlying fields behave as their labels say.

Outbound Job Fields Enabled (13)

Outbound jobs expose the REST posting field set, including the outbound field list, the return data mapping and an optional raw JSON body template.

Order Label Type Required Default Tooltip
10 Job Description text Yes Enter description of the Job
30 Enabled radio Yes Yes Choose if Job is enabled
50 Log Raw API Calls radio Yes No Choose if raw API calls are logged
170 Method Type select Yes GET Select method type of the Job
180 Data Sending Method select Yes JSON Encoded Data Select method for sending the outbound data
190 API End Point text No Enter API end point of the Job
200 API Data Parameters fields_list No Enter API data parameters of the Job
210 Body Data Sending Method select Yes JSON Encoded Data Select method for sending the body data
260 Return Data Fields List fields_list Yes Enter return data fields of the Job
530 Outbound Fields List fields_list Yes Enter outbound fields of the Job
540 Ignore Empty Outbound Fields radio No Yes Ignore, and do not include, any outbound fields that are empty and have no data
550 Raw JSON Outbound Template textarea No Enter the raw JSON outbound template to send. This will replace any automated structures defined in the outbound fields.
560 Order text Yes Enter order of the Job

Inbound Job Templates (2)

Two inbound templates ship: one real Asset collection and one blank REST shell. Both are disabled by default, so enabling “Get Devices” is the first thing to do after testing the connection.

# Job Description Destination Table API End Point Enabled What It Pulls
1 Rest GET API api_data Not set No An empty starting point for a GET request, with no API End Point, no return data node and no pagination, writing to a placeholder staging table called api_data. Clone it when you need a Tanium endpoint that “Get Devices” does not cover.
2 Get Devices tanium_devices /plugin/products/asset/v1/assets No A GET against the Asset module’s assets resource, returning the normalised endpoint inventory Tanium maintains: one row per managed device with its hardware, identity and last-seen attributes as defined by the Asset view the job requests. Rows land in tanium_devices on the Weekly schedule. It pages through the full set 100 records at a time, following the meta.nextAssetId cursor from one call to the next and stopping when the response reports meta.endOfReader as true.

Job Template Configuration

Settings Common to All Two Templates

Setting Value
Enabled No
Allow Empty Table Yes
Append Files to Same Destination Table No
Append New Data to Existing Tables No
Use Unparsed Data No
Convert UUID-Keyed Objects to Rows No
Ignore XML Attributes No
Log Raw API Calls No
Method Type GET
Body Data Sending Method JSON Encoded Data

Settings That Vary by Template

Template ID Order Job Schedule Destination Table Data Identity API End Point API Return Data Node
Rest GET API 207 10 Daily (15 1 * * *) api_data api_data Not set Not set
Get Devices 208 20 Weekly (30 1 * * 0) tanium_devices tanium_devices /plugin/products/asset/v1/assets data

Settings That Vary by Template (continued)

Template ID Pagination Type API Pagination Node Pagination Limit Pagination Offset Start Pagination Termination Node
Rest GET API 207 Not set Not set Not set Not set Not set
Get Devices 208 Next Record Node meta.nextAssetId 100 0 meta.endOfReader=true

Job Parameters and Enumeration

Get Devices

API data parameters:

Key Value
viewId 2
minimumAssetId %pagination_offset%
limit %pagination_limit%

NOTE: “Get Devices” is the only template in this connector with pagination fully configured. It uses cursor paging on meta.nextAssetId with an explicit termination condition, which is the pattern to copy if you build further Asset jobs.

Outbound Job Templates (1)

One outbound template ships, and it is the generic REST skeleton.

# Job Description Method API End Point Enabled What It Does
1 Rest POST API POST Not set No An empty POST job. It sends a single required string field named record_key as a JSON body to an endpoint you supply, and reads status, message and data.record_key back out of the response.

Job Template Configuration

Settings

Setting Value
Order 10
Enabled No
Log Raw API Calls No
Method Type POST
Body Data Sending Method JSON Encoded Data
Data Sending Method JSON Encoded Data
Ignore Empty Outbound Fields Yes

Job Parameters and Enumeration

Rest POST API

Outbound fields list:

Label Name Type Required Pattern
Record Key record_key String on

Return data fields:

Label Name
Return Status status
Return Message message
Record Key data.record_key
Tags: