TA-Tanium

Tanium, an Autonomous IT company, gives IT and security teams complete, accurate endpoint data in real time, at enterprise scale. TA-Tanium is the technology add-on that makes that data usable in Splunk. It parses events sent by Tanium Connect and Tanium Stream, assigns sourcetypes, extracts fields, and maps them to the Splunk Common Information Model (CIM). With the add-on installed, Tanium data populates Splunk Enterprise Security data models (Endpoint, Network Traffic, Authentication, Change, Malware, Vulnerabilities, and others) without custom parsing work. Coverage spans real-time endpoint telemetry (process, network, file, registry, and DNS activity), threat detection signals, asset inventory, vulnerability reports, patch status, and configuration data. Pair this add-on with the Tanium Splunk Application (dashboards) and see the full integration guide in the Tanium Resource Center: https://help.tanium.com/bundle/Integrating-Splunk-with-Tanium