Elisity integrates with Tanium, an endpoint management platform, as a method to enrich device discovery and identity. Once connected to the Tanium Gateway via API, Cloud Control Center imports the endpoint attributes that Tanium collects into IdentityGraph, including hostname, type, operating system, vendor, model, fully qualified domain name (FQDN), serial number, last logged-in user, and installed software.
Administrators can also map up to 30 Tanium sensors to custom attributes, so environment-specific endpoint data is available alongside the standard attributes. Cloud Control Center matches Tanium endpoints to devices by MAC address and IP address together, or by MAC address alone, and refreshes Tanium data every 30 minutes. The imported attributes are displayed on the device and are available as match criteria for Policy Group definition.
Prerequisites
- A Tanium environment that is reachable through the Tanium API Gateway.
- The Tanium API Gateway URL. This is the host name that includes
-api, in the formhttps://<instance>-api.<domain>, for examplehttps://example-api.cloud.tanium.com. - A Tanium administrator who can create users and roles in the Tanium Console. Prepare Tanium covers the service account, role, and API token that the connector uses.
- Tanium Core Content and Tanium Asset installed. The connector reads software inventory from the Asset SIU Installed Products sensor.
- The outbound (egress) IP addresses of your Elisity tenant, for the trusted IP list of the API token. Contact Elisity Support to obtain these addresses.
- Outbound HTTPS connectivity from Cloud Control Center to the Tanium API Gateway. See Platform Connectivity Requirements.
- To map custom attributes, the Tanium sensors you plan to map must be actively collected in Tanium. Only collected sensors are available for mapping.
Steps to Connect Tanium
Prepare Tanium
The connector is read-only and never changes anything in Tanium. It uses a dedicated service account with two roles: the built-in Gateway User role and a custom role that grants Sensor (Read) on specific content sets.
Step 1. In the Tanium Console, prepare the service account, custom role, and API token that the connector uses, as described in Steps 1a through 1d.
Step 1a. Create a dedicated, non-personal service account, such as svc-elisity. On Tanium Cloud, create the account in your identity provider and make it available to Tanium. On premises, create a local Tanium user. Navigate to Administration > Permissions > Users and confirm that the account appears.
Step 1b. Navigate to Administration > Permissions > Roles and select New Role. Name the role, for example Elisity Integration - Read Only, and add the following permissions:
- Platform Content Permissions > Sensor (Read), on the content sets in the following table. Each Tanium sensor belongs to a content set, and the connector can read a sensor only if the role grants Sensor (Read) on that content set.
- Administration > Token - View, which the service account needs to generate its own API token.
| Content set | What Elisity reads from it |
|---|---|
| Reserved | Computer name, IP addresses, operating system name, entity type |
| Base | Domain, MAC addresses, Tanium Client IP address |
| Core Content | Serial number, manufacturer, model, last logged-in user, installed applications |
| Asset | Software inventory from the Asset SIU Installed Products sensor, read on every sync |
| The content set of each mapped sensor | The values of the sensors mapped to custom attributes. See Configure Custom Attributes. |
Leave the role-level Content Sets section empty. Content sets added there apply to every permission in the role. Save the role.
Step 1c. Navigate to Administration > Permissions > Users, open the service account, and assign the built-in Gateway User role and the custom role from Step 1b. Set the management rights to Unrestricted Management Rights so that the connector reads every endpoint, or to specific computer groups if only part of the fleet should be enriched. Endpoints outside the selected computer groups are not imported into Cloud Control Center. Save the account. Role changes can take up to 10 minutes to apply.
Step 1d. Sign in to the Tanium Console as the service account. Open the account menu, select API Tokens, and then select New API Token. Complete the following fields:
-
Trusted IP addresses: The egress IP addresses of your Elisity tenant, in CIDR notation. Avoid
0.0.0.0/0. - Expiration: An interval that matches your token rotation policy.
- Notes: A description that names the integration, such as Elisity integration.
Copy the token value, which starts with token-. Tanium displays the token only once. This token is the Client Secret in Cloud Control Center.
NOTE:
Generate the token while signed in as the service account. A token carries the live permissions of the account that created it.
NOTE:
Tanium API tokens expire one week after creation unless a longer expiration is set. Cloud Control Center does not rotate tokens or track their expiry, and an expired token stops every sync. To rotate the token, generate a new token, update the Client Secret on the connector, and then revoke the old token.
Add the Connector in Cloud Control Center
Step 2. Log into Elisity Cloud Control Center and navigate to IdentityGraph > Connectors, then select the + Add Connector button.
Step 3. A list of tiles slides out from the right side of the screen. Enter Tanium in the search field to filter the list, then select Configure on the Tanium tile.
Step 4. On the Basic Configuration tab of the Add Tanium page, complete the connector fields. The Initial Setup notice at the top of the tab indicates that the connector is created with default settings. Custom attributes are configured by editing the connector after it is added, as described in Configure Custom Attributes.
| Field | Description |
|---|---|
| Connector Name | A name that identifies this connector, such as Tanium - Corporate Endpoints. |
| Tanium API Base URL | The Tanium API Gateway host, which includes -api in the host name, for example https://example-api.cloud.tanium.com. |
| Client Secret | The Tanium API token created in Step 1d. The value is masked. When you edit the connector later, leave this field unchanged to keep the saved token. |
NOTE:
The Tanium API Base URL must be the Tanium API Gateway host, which includes -api in the host name. The Tanium Console host name does not work.
Step 5. Select Test & Discover to verify the connection. When the test succeeds, a Connected message confirms that the connection to the Tanium Gateway was verified. If Connection failed is displayed, check the Tanium API Base URL and Client Secret, then test again. See Troubleshooting for common causes.
NOTE:
Test & Discover confirms only that Cloud Control Center can reach the Tanium Gateway with the token. It does not check sensor permissions. After the first sync, confirm that matched devices show the serial number, model, operating system, and installed software.
Step 6 (optional). Select the Advanced Settings tab to configure query exclusions, data purging, trust, and the initial delay for the connector. These settings are described in Advanced Settings and can also be changed after the connector exists.
Step 7. Select Add. The message Connector created successfully confirms that the connector was added, and the connector appears in the Connectors list.
Configure Custom Attributes
Custom attributes import values from Tanium sensors that you select, in addition to the standard attributes. Custom attributes are optional. The connector enriches devices with the standard attributes without any mapping.
Each connector provides 30 custom attribute slots. Custom Attribute 1 through Custom Attribute 20 hold String values, and a String attribute can hold several values for a device. Custom Attribute 21 through Custom Attribute 30 hold Integer values. Each mapped attribute is displayed on the device under its Attribute Alias, and every mapped attribute is available as a Policy Group match criterion. Unmapped slots are not displayed.
Step 8. Navigate to IdentityGraph > Connectors, locate the Tanium connector, and select Edit from the row's Actions (⋮) menu. The Basic Configuration tab of the connector includes the Custom Attributes (Optional) section.
| Column | Description |
|---|---|
| Attribute Name | The custom attribute slot that holds the sensor value, such as Custom Attribute 3. |
| Attribute Alias | The name shown for the attribute on the device and in Policy Group match criteria. |
| Sensor Name | The Tanium sensor that supplies the value. |
| Data Type | String or Integer, determined by the slot. |
| Actions | Edit or remove the mapping. |
NOTE:
Before you map a sensor, add its content set to the Sensor (Read) permission of the custom role created in Step 1b. To find the content set, navigate to Administration > Content > Sensors in the Tanium Console and check the Content Set column. Also confirm that Tanium harvests the sensor, including the exact parameter values of a parameterized sensor. If a mapped sensor is one that the service account cannot read, Tanium rejects the whole sync, and no endpoint data updates until the permission is fixed.
Step 9. Select Add attribute. The Add Sensor dialog displays the number of available sensors. Only sensors that Tanium is actively collecting and that the service account can read are listed. A missing sensor usually means that its content set is not on the custom role. Search for the sensor in the Sensor Name field, select it, and select Add.
NOTE:
The Add attribute button is unavailable when all 30 slots are mapped, and when the Tanium API Base URL or Client Secret has been changed but not yet tested. Remove a mapping to free a slot, or select Test & Discover to test the changed credentials.
Step 10. In the Add Sensor panel, complete the Sensor Configuration and Attribute Configuration fields.
| Field | Description |
|---|---|
| Sensor Name | The sensor selected in the Add Sensor dialog. This field is read-only. |
| Filter by column | The sensor column that supplies the attribute value. A column is required when the sensor returns more than one column. |
| Filter by Parameters | One Key and Value row for each parameter the sensor declares. See Sensor Parameters. |
| Attribute Name | The custom attribute slot, listed as Custom Attribute N - String or Custom Attribute N - Integer. |
| Attribute Alias | The name shown for the attribute on the device and in Policy Group match criteria. The alias must be unique on the connector and 30 characters or fewer. |
Step 11 (optional). Select Test to validate the sensor configuration. A successful test displays Sensor configuration validated. and can show a Values from Sensor sample of hostnames and their values. If Sensor configuration invalid please verify. is displayed, review the column and parameter selections.
Step 12. Select Add to add the mapping to the Custom Attributes (Optional) table, then select Save Changes to save the connector. Mapping changes are not applied until the connector is saved. To change an existing mapping, select Edit from its Actions (⋮) menu and select Save in the panel. Each sensor and source combination can be mapped to only one attribute.
NOTE:
Changing the Tanium API Base URL removes all custom attributes, because sensor mappings are specific to a Tanium instance. After the new URL is tested, the Remove Sensor Mappings? dialog asks you to select Confirm and Remove. This action cannot be undone. Changing only the Client Secret keeps the existing custom attributes.
Sensor Parameters
Some Tanium sensors declare parameters, which appear under Filter by Parameters as one Key and Value row each. Every parameter must have a value, because Tanium does not return data for a partial set of parameters. The Value field offers only the values that Tanium has registered for the sensor, and values cannot be typed. A parameter with one registered value is filled in automatically and cannot be changed. A parameter with several registered values requires a selection. If Tanium has no registered values for a sensor's parameters, the panel displays a warning that Tanium cannot return data for the sensor.
If the registered values for a mapped sensor change in Tanium, Cloud Control Center updates the mapping at the next refresh. It keeps the selected value when that value is still registered and otherwise uses the first available value, so the attribute continues to receive data. Edit the mapping to select a different value. If the selected combination is still registered but Tanium is not collecting data for it, the mapping is not changed, and the attribute remains empty until Tanium collects the data or the mapping is edited.
Advanced Settings
The Advanced Settings tab controls how Cloud Control Center queries the Tanium connector and how the data it returns is used. Configure these settings while adding the connector, or later by selecting Edit from the Tanium row's Actions (⋮) menu in the Connectors list and opening the Advanced Settings tab.
| Setting | Description |
|---|---|
| Query Exclusion Rules: Subnet | Enable this toggle and select the subnets to exclude. Devices attached from the selected subnets are not queried against Tanium. Up to 100 subnets can be selected. |
| Query Exclusion Rules: Virtual Edge Node | Enable this toggle and select the Virtual Edge Nodes to exclude. Devices connected through the selected Virtual Edge Nodes are not queried against Tanium. Up to 100 Virtual Edge Nodes can be selected. |
| Query Exclusion Rules: Random MAC | Enable this toggle to exclude devices that present a randomized MAC address. Randomized addresses produce unreliable matches. This option is enabled by default. |
| Connector Data Purging | When Enable Connector Data Purging is on, Cloud Control Center purges all data learned about a device from this connector if the device is no longer found in Tanium. Set the interval between purge events with the Time Period selector, which accepts a value between 1 and 90 days. The default is 7 days. |
| Trusted Connector | When enabled, enrichment from this source is set to Trusted for Policy Groups, and the connector is designated an authoritative identity source for Insights. This option is enabled by default. |
| Initial Delay | The delay, in seconds, before Cloud Control Center checks the connector for updates. The default is 180 seconds. |
Select Add to create the connector with these settings, or Save Changes to apply changes to an existing connector.
Connector Status
The connector status reflects its health and availability based on recent query performance. To ensure accuracy and reduce false positives, the status is determined using a rolling 15-minute evaluation window. The current status is displayed in the Status column of the Connectors list.
Connector Status Levels:
- Active: Normal operation with minimal query failures.
- Degraded: Increased query failures detected, but the connector is still operational.
- Inactive: The connector is unresponsive due to persistent failures.
Failures are defined as unsuccessful query responses, and the platform continuously monitors performance to update the status accordingly. These status changes are visible in the UI, event logs, and notifications pane for better troubleshooting. Email alerts can also be configured for connector status changes. If the connector has not been queried within the evaluation window, the last known status is retained.
Troubleshooting
| Symptom | Likely Cause | Fix |
|---|---|---|
Test & Discover fails with a 403 RBACInsufficientPrivilege error. |
The service account does not have the Gateway User role. | Assign the Gateway User role to the service account (Step 1c). |
| Test & Discover fails with a 401 or 403 error after previously succeeding. | The token expired or was revoked, or the request came from an IP address outside the trusted IP list of the token. | Generate a new token (Step 1d), update the Client Secret, and check the trusted IP addresses. |
| Test & Discover succeeds, but no endpoints sync, and the error reports missing permissions. | Sensor (Read) is missing a content set, often Asset or the content set of a newly mapped sensor. | Add the content set to the custom role (Step 1b) and wait up to 10 minutes. |
| Cloud Control Center shows fewer endpoints than Tanium. | The management rights of the service account are limited to specific computer groups. | Set Unrestricted Management Rights, or add the computer groups (Step 1c). |
| A mapped custom attribute shows no values. | The sensor or its parameter values are not harvested in Tanium. | Ask your Tanium administrator to register the sensor for collection. |
| A sensor is missing from the Add Sensor dialog. | The content set of the sensor is not on the custom role. | Add the content set to the custom role (Step 1b). |
| A permission change has no effect. | Tanium can take up to 10 minutes to apply role changes. | Wait up to 10 minutes, then test again. |
Leveraging Tanium with Elisity
When the Tanium connector is active, Cloud Control Center matches devices that Elisity discovers on the network to Tanium endpoints by MAC address and IP address together, or by MAC address alone. Devices without a usable MAC address are not matched, and devices with randomized MAC addresses are excluded while the Random MAC query exclusion rule is enabled. Tanium data is refreshed every 30 minutes. The enriched data is displayed on the IdentityGraph tab of the device, on the Tanium source card, and Tanium appears as a source card under KNOWN IN in the Trust Attributes section of matched devices.
The following attributes are imported from Tanium. Attributes marked Yes in the Policy Group Match Criteria column can also be selected as match criteria when defining a Policy Group. The remaining attributes are displayed in IdentityGraph for visibility and troubleshooting but are not available in the Policy Group builder.
| Attribute | Policy Group Match Criteria |
|---|---|
| Hostname | Yes |
| Type | Yes |
| Category | Yes |
| Operating System | Yes |
| Vendor | Yes |
| Model | Yes |
| FQDN | Yes |
| Last Logged In User | Yes |
| Custom attributes (displayed under their Attribute Alias) | Yes |
| Serial Number | No |
| Installed Applications | No (shown in the software list) |
| Software Products SIU | No (shown in the software list) |
| Matched on | No |
The Software row on the Tanium source card lists the software installed on the device. Select View List to open a dialog with the Installed Applications and Software Products SIU tabs, which list each item's Name, Vendor, and Version. The row displays Unavailable when Tanium returned no software for the device. Matched on shows whether the device was matched by MAC address and IP address together or by MAC address alone.
To learn more about how to leverage IdentityGraph Core Effective Attributes, review the IdentityGraph article. To learn more about how to leverage IdentityGraph Trust Attributes, review Leveraging Trust Attributes for Policy Group Definition.