V2R3 changes
Tanium 7.x STIG V2R3 (2025-07-02) replaced V2R2 (2025-04-02): 22 checks updated. It has 98 checks, against 98 in V2R2.
V2R3 checklistV2R2 checklist Compare V2R2 and V2R3 in STIG Compare
- 0 added
- 0 removed
- 22 updated
Updated fields: Discussion 11Fix text 9Check text 2
Updated in V2R3 (22)
V-253781CAT IITanium Client processes must be excluded from On-Access scan.Discussion
Discussion
Similar to any other host-based applications, the Tanium Client is subject to the restrictions other system-level software may place on an operating environment. Antivirus, intrusion prevention system (IPS), encryption, or other security and management stack software may disallow the Client from working as expected.
For more information, refer to https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/security_exceptions.html?Highlight=exclusion.
V-253787CAT IIThe Tanium application must manage bandwidth throttles to limit the effects of information flooding types of denial-of-service (DoS) attacks.Check text
Check text
1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with multifactor authentication.
2. Click "Administration" on the top navigation banner.
3. Under "Configuration", select "Bandwidth Throttles".
4. Work with the Tanium administrator to confirm settings.
For more information, refer to https://docs.tanium.com/platform_user/platform_user/console_bandwidth_throttling.html.
If the Bandwidth Throttles configuration is not accordance with organization's needs, this is a finding.
V-253794CAT IIThe Tanium application must provide an immediate real-time alert to the system administrator and information system security officer, at a minimum, of all audit failure events requiring real-time alerts.Fix text
Fix text
1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web UI and log on with multifactor authentication.
2. Click "Modules" on the top navigation banner.
3. Click "Connect".
4. Click "Create Connection".
5. In the Configuration section, select "Tanium Audit Source" as the "Event Source" from the "Source" drop-down menu.
6. In the "Destination" section, select "Socket Receiver" from the drop-down menu.
7. Enter "Destination Name".
8. Enter "Host".
9. Enter "Network Protocol".
10. Enter "Port".
11. Click "Save".
Consult documentation at https://docs.tanium.com/connect/connect/siem.html#siem for reference on configuring other applicable SIEM connections.
Work with the SIEM administrator to configure alerts based on audit failures.
V-253800CAT IIThe Tanium application must accept Personal Identity Verification (PIV) credentials from other federal agencies.Fix text
Fix text
Use the vendor documentation titled "Smart card authentication" to implement correct configuration settings for this requirement.
Vendor documentation can be downloaded from the following URL: https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/smart_card_authentication.html?Highlight=cac
1. Access the Tanium Server.
2. Log on to the server with an account that has administrative privileges.
3. Run regedit as Administrator.
4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.
5. Validate the value for REG_DWORD "ForceSOAPSSLClientCert" is set to "1".
6. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.
7. Configure the following keys:
REG_SZ "ClientCertificateAuthField"
For example:
X509v3 Subject Alternative Name.
REG_SZ "ClientCertificateAuthRegex"
For example-DoD:
.+?Name:1s*?(1S+@[._a-zA-Z0-9]+).*
Note: This regex may vary.
REG_SZ "ClientCertificateAuth"
For example:
C:1Program Files1Tanium1Tanium Server1dod.pem
V-253803CAT IITanium Server processes must be excluded from On-Access scan.Discussion
Discussion
Similar to any other host-based applications, the Tanium Server is subject to the restrictions other system-level software may place on an operating environment. Antivirus, intrusion prevention system (IPS), encryption, or other security and management stack software may disallow the Tanium Server from working as expected.
For more information, refer to https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/security_exceptions.html?Highlight=exclusion.
V-253812CAT IITanium Client directory and subsequent files must be excluded from On-Access scan.Discussion
Discussion
Similar to any other host-based applications, the Tanium Client is subject to the restrictions other system-level software may place on an operating environment. Antivirus, intrusion prevention system (IPS), encryption, or other security and management stack software may disallow the Client from working as expected.
For more information, refer to https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/security_exceptions.html?Highlight=exclusion.
V-253813CAT IITanium endpoint files must be excluded from host-based intrusion prevention system (HIPS) intervention.Discussion
Discussion
Similar to any other host-based applications, the Tanium Client is subject to the restrictions other system-level software may place on an operating environment. Antivirus, intrusion prevention system (IPS), encryption, or other security and management stack software may disallow the Tanium Server from working as expected.
For more information, refer to https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/security_exceptions.html?Highlight=exclusion.
V-253814CAT IIThe Tanium application must retain the session lock until the user reestablishes access using established identification and authentication procedures.Fix text
Fix text
Use the vendor documentation titled "Smart card authentication" to implement correct configuration settings for this requirement.
Vendor documentation can be downloaded from https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/smart_card_authentication.html?Highlight=cac.
1. Access the Tanium Server.
2. Log on to the server with an account that has administrative privileges.
3. Run regedit as Administrator.
4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.
5. Validate the value for REG_DWORD "ForceSOAPSSLClientCert" is set to "1".
6. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.
7. Configure the following keys:
REG_SZ "ClientCertificateAuthField"
For example:
X509v3 Subject Alternative Name.
REG_SZ "ClientCertificateAuthRegex"
For example-DoD:
.+?Name:1s*?(1S+@[._a-zA-Z0-9]+).*
Note: This regex may vary.
REG_SZ "ClientCertificateAuth"
For example:
C:1Program Files1Tanium1Tanium Server1dod.pem
V-253815CAT IIThe Tanium Application Server must be configured with a connector to sync to Microsoft Active Directory for account management functions.Fix text
Fix text
1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web UI and log on with multifactor authentication.
2. Click "Administration" on the top navigation banner.
3. Under "Configuration", select "LDAP/AD Sync Configurations".
4. Click "Add Server".
5. Complete the settings using guidancevendor fromdocumentation https://docsguidance.tanium.com/platform_user/platform_user/console_using_ldap.html.
6. Click "Show Preview to Continue".
7. Review the users and groups to be imported.
8. Click "Save".
V-253816CAT IIThe Tanium Application Server must be configured to only use LDAP for account management functions.Fix text
Fix text
Vendor documentation can be downloaded from https://docs.tanium.com/platform_user/platform_user/console_using_ldap.html?Highlight=LDAP.
1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web UI and log on with multifactor authentication.
2. Click "Administration" on the top navigation banner.
3. Under "Configuration", select "LDAP/AD Sync Configurations".
4. Follow the vendor documentation titled "Integrating with LDAP Servers" to implement correct configuration settings for this requirement.
V-253817CAT IITanium Computer Groups must be used to restrict console users from effecting changes to unauthorized computers.Fix text
Fix text
1. Using a web browser on a system that has connectivity to the Tanium Server, access the Tanium Server web UI and log on with multifactor authentication.
2. Click "Administration" on the top navigation banner.
3. Select the "Computer Groups" tab.
4. Configure specific Computer Groups to facilitate the management of computers by authorized individuals for those computers.
Note: Tanium offers two ways to define computer groups. Refer to the followingvendor documentation for explanation: https://docs.tanium.com/platform_user/platform_user/console_computer_groups.html#Computer_Group_types
V-253821CAT IMultifactor authentication must be enabled on the Tanium Server for network access with privileged accounts.Fix text
Fix text
Use the vendor documentation titled "Smartcard authentication" to implement correct configuration settings for this requirement. The documentation is at https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/smart_card_authentication.html?Highlight=cac.
1. Access the Tanium Server.
2. Log on to the server with an account that has administrative privileges.
3. Run regedit as Administrator.
4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> WOW6432Node >> Tanium >> Tanium Server.
5. Validate the value for REG_DWORD "ForceSOAPSSLClientCert" is set to "1".
6. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> WOW6432Node >> Tanium >> Tanium Server.
7. Configure the following keys:
REG_SZ "ClientCertificateAuthField"
For example:
X509v3 Subject Alternative Name
REG_SZ "ClientCertificateAuthRegex"
For example-DoD:
.+?Name:1s*?(1S+@[._a-zA-Z0-9]+).*
Note: This regex may vary.
REG_SZ "ClientCertificateAuth"
For example:
C:1Program Files1Tanium1Tanium Server1cac.pem
REG_SZ "TrustedHostList"
For example:
Append 127.0.0.1 (for IPv4) and [::1] (for IPv6)
V-253822CAT IIFirewall rules must be configured on the Tanium Server for Console-to-Server communications.Discussion
Discussion
An HTML5-based application, the Tanium Console runs from any device with a browser that supports HTML5. For security, the HTTP and SOAP communication to the Tanium Server is SSL encrypted, so the Tanium Server installer configures the server to listen for HTTP and SOAP requests on port 443. Without a proper connection to the Tanium Server, access to the system capabilities could be denied.
Port Needed: To Tanium Server over TCP port 443.
Network firewall rules:
Allow HTTP traffic on TCP port 443 from any computer on the internal network to the Tanium Server device.
For more information, refer to https://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.
V-253828CAT IIMultifactor authentication must be enabled and enforced on the Tanium Server for all access and all accounts.Fix text
Fix text
Use the vendor documentation titled "Smart card authentication" to implement correct configuration settings for this requirement.
Vendor documentation can be downloaded from https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/smart_card_authentication.html?Highlight=cac.
1. Access the Tanium Server.
2. Log on to the server with an account that has administrative privileges.
3. Run regedit as Administrator.
4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> WOW6432Node >> Tanium >> Tanium Server.
5. Configure the value for REG_DWORD "ForceSOAPSSLClientCert" to "1".
6. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> WOW6432Node >> Tanium >> Tanium Server.
7. Configure the following keys:
REG_SZ "ClientCertificateAuthField"
For example:
X509v3 Subject Alternative Name
REG_SZ "ClientCertificateAuthRegex"
For example-DoD:
.+?Name:1s*?(1S+@[._a-zA-Z0-9]+).*
Note: This regex may vary.
REG_SZ "ClientCertificateAuth"
For example:
E:1Program Files1Tanium1Tanium Server1cac.pem
REG_SZ "TrustedHostList"
For example:
Append 127.0.0.1 (for IPv4) and [::1] (for IPv6)
V-253832CAT IIThe Tanium database(s) must be installed on a separate system.Fix text
Fix text
Move the Tanium database from the Tanium Server or Tanium Module Server to a separate server. Steps to move the Tanium database can be found atin https://docsvendor documentation.tanium.com/platform_install/platform_install/installing_tanium_server.html#set_up_DB_server.
V-253836CAT IIFirewall rules must be configured on the Tanium Server for server-to-database communications.Discussion
Discussion
The Tanium Server can use either a SQL Server relational database management system (RDBMS) installed locally to the same device as the Tanium Server application or a remote dedicated or shared SQL Server instance. Using a local SQL Server database typically requires no changes to network firewall rules since all communication remains on the Tanium application server device. To access database resources installed to a remote device, however, the Tanium Server service communicates over the port reserved for SQL, by default port 1433, to the database.
Port Needed: Tanium Server to Remote SQL Server over TCP port 1433.
Network firewall rules:
Allow TCP traffic on port 1433 from the Tanium Server device to the remote device hosting the SQL Server RDBMS.
For more information, refer to https://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.
V-253848CAT IIFirewall rules must be configured on the Tanium Server for client-to-server communications.Discussion
Discussion
In addition to the client-to-server TCP communication that takes place over port 17472, Tanium Clients also communicate to other Tanium-managed computers over port 17472. Without proper firewall configurations, proper TCP communications may not take place as necessary for application functionality. The Tanium environment can perform hundreds or thousands of times faster than other security or systems management tools because the Tanium Clients communicate in secure, linearly controlled peer-to-peer rings. Because clients dynamically communicate with other nearby agents based on proximity and latency, rings tend to form automatically to match a customer's topology. For example, endpoints in California will form one ring while endpoints in Germany will form a separate ring.
For more information, refer to https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/network_ports.html.
V-253849CAT IIFirewall rules must be configured on the Tanium Zone Server for Client-to-Zone Server communications.Discussion
Discussion
In customer environments using the Tanium Zone Server, a Tanium Client may be configured to point to a Zone Server instead of a Tanium Server. The communication requirements for these Clients are identical to the Server-to-Client requirements. Without proper firewall configurations, proper TCP communications may not take place as necessary for application functionality. Additionally, without proper configuration, organizations may lose complete visibility into endpoints that cannot connect directly to the Tanium Server.
For more information, refer to https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/network_ports.html.
V-253856CAT IIFirewall rules must be configured on the Tanium module server to allow Server-to-Module Server communications from the Tanium Server.Discussion
Discussion
The Tanium Module Server is used to extend the functionality of Tanium through the use of various workbenches. The Tanium Module Server requires communication with the Tanium Server on port 17477. Without a proper connection from the Tanium Server to the Tanium Module Server, access to the system capabilities could be denied.
For more information, refer to https://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.
V-253857CAT IIFirewall rules must be configured on the Tanium Server for Server-to-Module Server communications.Discussion
Discussion
The Tanium Module Server is used to extend the functionality of Tanium through the use of various workbenches. The Tanium Module Server requires communication with the Tanium Server on port 17477. Without a proper connection from the Tanium Server to the Tanium Module Server, access to the system capabilities could be denied.
For more information, refer to https://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.
V-253861CAT IITanium Server directory and subsequent files must be excluded from On-Access scan.Discussion
Discussion
Similar to any other host-based applications, the Tanium Server is subject to the restrictions other system-level software may place on an operating environment. Antivirus, intrusion prevention system (IPS), encryption, or other security and management stack software may disallow the Tanium Server from working as expected.
For more information, refer to:
https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/security_exceptions.html?Highlight=exclusion
V-253871CAT IIThe Tanium application must limit the bandwidth used in communicating with endpoints to prevent a denial-of-service (DoS) condition at the server.Check text
Check text
1. Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with multifactor authentication.
2. Click "Administration" on the top navigation banner.
3. Under "Configuration", select "Bandwidth Throttles".
4. Work with the Tanium administrator to confirm settings.
If settings are not based on organization needs, this is a finding.
For more information, refer to https://docs.tanium.com/platform_user/platform_user/console_bandwidth_throttling.html.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R3 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.