Threat Response Live Connection And Snapshot
A 3-step recipe with Tanium. We can help you get access.
Recipe · 3 steps
Threat Response Live Connection And Snapshot
with Tanium · Threat Detection & Response Management
Connect to an endpoint, poll until connected, and capture a snapshot.
- Initiate a live connection to the target endpoint for investigation.
- Poll the connection by id until its status reports that the endpoint is connected and ready for snapshot capture.
- Initiate a point-in-time Recorder snapshot from the connected endpoint for offline analysis.
What you'll need to have ready
- sessionToken: API token or session token passed in the session header.
- clientId: Tanium client identifier of the target endpoint.
- ip: IP address of the target endpoint.
- platform: Operating system platform of the target endpoint.
- hostname: Hostname of the target endpoint.
For your developer
Arazzo workflow tanium:live-connection-snapshot, 3 operations: postPluginProductsThreatResponseApiV1ConnsConnect → getPluginProductsThreatResponseApiV1ConnsByConnectionId → createSnapshot. Specs on APIs.io.