Tanium Comply

Vulnerability Management

Overview

The Tanium Comply connector integrates with the Tanium platform to synchronize vulnerability findings produced by Tanium Comply. Findings are retrieved by running a configured Tanium saved question and are mapped to the Brinqa Vulnerability model.

Data retrieved from Tanium Comply

Connector Object	Required	Maps to Data Model
Vulnerability	Yes	Vulnerability

note

For detailed steps on how to view the data retrieved from Tanium Comply in the Brinqa Platform, see How to view your data.

note

This connector ships in the Tanium bundle but its connector entry point is not currently enabled by default. The model, configuration, and mapping below are documented for reference and for activation when required.

Setup

Connection settings

When setting up a data integration, select Tanium Comply from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	No	—	Tanium server URL
Username	No	—	Tanium account username
Password	No	—	Tanium account password
Domain	No	—	(Optional) Tanium account domain name
Page size	No	—	Maximum number of records to get per API request
SSL / TLS	No	—	Skip certificate verification
Saved question ID	Yes	—	Your saved question ID that returns vulnerability results. For example,<br><br>\

Authentication

The connector uses API token authentication, identical to the rest of the Tanium bundle. The configured API token is sent in the session request header on every call, along with an Accept: application/json header.

Endpoint

Method	URL
GET	https://<servername>/api/v2/result_data/saved_question/<savedQuestion>

Request Headers

Header	Value
session	<api-token>
Accept	application/json

Request Body

Requests are GET calls with no body. Results are paged with query parameters:

Query Parameter	Description
row_count	Page size (from the pageSize configuration property)
row_start	Zero-based starting row, incremented per page

Sample Response

The saved-question result is returned as nested result_sets containing columns and rows:

{
  "data": {
    "result_sets": [
      {
        "columns": [
          { "name": "Computer ID" },
          { "name": "Computer Name" },
          { "name": "IP Address" },
          { "name": "CVE" },
          { "name": "Title" },
          { "name": "CVSS Score" }
        ],
        "rows": [
          {
            "id": "1",
            "cid": "987654321",
            "data": [
              [ { "text": "987654321" } ],
              [ { "text": "WIN-HOST-01" } ],
              [ { "text": "10.1.2.3" } ],
              [ { "text": "CVE-2024-0001" } ],
              [ { "text": "Sample vulnerability" } ],
              [ { "text": "7.5" } ]
            ]
          }
        ]
      }
    ]
  }
}

Response Fields

Field	Description
data.result_sets[]	Result sets returned by the saved question
result_sets[].columns[].name	Column names used to align row cell values
result_sets[].rows[]	One row per endpoint; cid is the computer id, data holds per-column cell arrays
data[].text	Cell text value (multiple cells per column are supported)

Usage

The configured API token is attached to the session header of all requests. Rows are read page-by-page (row_start incremented) until no further rows are returned. Each row may yield multiple findings — one per CVE in the row's CVE column.

---

Sync Behavior

Each sync is a full sync. The connector does not maintain a sync token and does not apply an incremental filter; every run re-runs the configured Tanium saved question and enumerates all returned records.

---

How to obtain Tanium Comply credentials

Obtain the required credentials (savedQuestion) from your Tanium Comply administrator or the Tanium Comply admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Vulnerability

Source Field Name	SDM Attribute
Computed MD5 of COMPUTER_ID + CVE + TITLE + RESULT (seeded from row cid)	SYS_ID
Computer ID column	COMPUTER_ID
Computer Name column	COMPUTER_NAME
CVE column	CVE
CVSS Score column	CVSS_SCORE
CVSS Vector column	CVSS_VECTOR
First Found Date column	FIRST_FOUND
IP Address column (non-: value)	IPv4_ADDRESS
IP Address column (value containing :)	IPv6_ADDRESS
Last Seen Date column	LAST_FOUND
OVAL Definition column	OVAL_DEFINITION
Result column	RESULT
Title column	TITLE

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Vulnerability

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Vulnerability on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/result_data/saved_question/{savedQuestion}

Changelog

Changelog

The Tanium Comply connector has undergone the following changes:

Version	Description	Migration Steps
3.0.6	No changes in this release.	N/A
3.0.5	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.4	No changes in this release.	N/A
3.0.3	No changes in this release.	N/A
3.0.2	Improvements - Standardized the attribute schema for Vulnerability findings so field names are consistent and stable across syncs, with explicit data types (for example, CVSS score as a number and first/last-found as timestamps).	• Vulnerability: The attribute identifiers used for Vulnerability findings have changed (for example, Sys ID is now SYS_ID), while their display labels are unchanged. Any mappings or rules that reference the previous attribute identifiers must be updated, and a full sync should be run after upgrading so records are repopulated with the new attribute names. The record identifier itself is unchanged, so existing records will continue to match.
3.0.1	No changes in this release.	N/A
3.0.0	Overview The Tanium Vulnerability connector integrates with Tanium Comply to synchronize vulnerability findings discovered on endpoints, including CVE identifiers, CVSS scoring, affected hosts, and first/last-found dates. Category: Vulnerability Management Models	N/A