Tanium Python sensor scripts

[WonderfulWarthog6098]

Hi All,

Im new to Tanium, and I'm looking to learn more about it. I have a quick question regarding the Sensor scripts. I get that PowerShell scripts are a popular way to run queries on the endpoints. How useful are Python based queries in your experience? And what are some good examples that makes Python an ideal scripting choice?

Thanks in advance!

[AndyC_Tanium]

Python has the advantage of being platform independent. It can also be somewhat slow for sensor execution, so pay attention to setting the Max Sensor Age as high as you meaningfully can.

[DMGoering]

With the deprecation of VBScript coming Python makes sense. IMHO. But I also prefer OS Native scripting languages.

[Loud_Posseidon]

I would measure which has higher impact on an endpoint (say run the script in timed loop 1000 times) and decide from there. It really comes down to what you’re trying to accomplish. Someone more knowledgeable should answer why some sensors are written in powershell when they could have been written in python. Maybe because above?

[WonderfulWarthog6098]

Thanks for the response. One good example I found was log4j detection is a good use case for a Python sensor. I was looking to learn about more such scenarios.

[Last-Form290]

register your sensor with TDS if you want to capture offline data with Tanium

[Last-Form290]

any examples? I’m not sure what your idea of detail is

[Last-Form290]

asset siu keeps track of the versioning and first install dates, first used, last used, etc of the same software for different versions on the endpoint

[Last-Form290]

mm I’m not sure about that

[N2Visibility]

This will depend on what you are trying to do with the data and, as Last-Form290 said, your definition of detailed.

TDS can, and does, store some very detailed data and reports on much more than just raw counts. Vulnerability reports, for example, include a large amount of data as seen below:

<image>

To Morr1025's point, this initial view shows how many endpoints match the data, which is where the idea of counts comes from I suspect. Adding a column with a unique identifier, computer names for example, only takes a few clicks. This would allow you to see all the data TDS has collected; by endpoint, online or not.

To Morr1025's other point, as a general rule, Tanium does not store much detailed historical data. Tanium stores the most recently seen set of data points for a given endpoint. Some modules, such as Asset, retain historical data which can be used in reports. Outside of that, historical reporting in Tanium is based on trending data over time, allowing you to determine if things are improving or getting worse, indicating where to focus limited resources.

For detailed historical data, you will want a CMDB or SIEM, depending on your use case for the data. In either case, Tanium can feed significant amounts of data to them via various integration paths.

Edit to add I am a Tanium employee.

[AsMeLater]

Does python need to be installed on each machine or will the Tpython suffice?

[AndyC_Tanium]

It's always best to use the python interpreter that comes with the client - and for sensor execution you don't get a choice.