Tanium

Use Tanium data in Cortex XSIAM.

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

This connector is available with any active Cortex XSIAM or Cortex AgentiX license.

Integrate with Tanium to hunt, detect, investigate, and remediate threats and vulnerabilities across your endpoints. Manage questions, actions, saved questions, packages, and sensor information through the Tanium REST API, and manage endpoint processes, evidence, alerts, files, snapshots, and connections with Tanium Threat Response.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Tanium Threat Response: Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. This Integration works with Tanium Threat Response version below 3.0.159. In order to use Tanium Threat Response version 3.0.159 and above, use Tanium Threat Response V2 Integration.

• Tanium Threat Response v2: Use the Tanium Threat Response integration to manage endpoint processes, evidence, alerts, files, snapshots, and connections. This integration works with Tanium Threat Response version 3.0.159 and above.

• Tanium v2: Tanium endpoint security and systems management, filters out [current results unavailable] when returning question results.

To configure this connector, follow the steps outlined in the configuration wizard.