Tanium

Connect Tanium to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Tanium:

   1. In Tanium Console, from the Main menu, go to Administration › Permissions › Users and click New User (or use an existing service account). Specify a User Name that matches an account in your IdP and click Save.
   2. From the Main menu, go to Administration › Permissions › API Tokens.
   3. Click New API Token and configure the token: Notes (optional purpose), Expiration in days (default 7, maximum 365 by default), Persona (the user account or persona the token is bound to; choose the read-only account from the previous step), and Trusted IP addresses (the external IPs that will use the token).
   4. Click Save and review the token details.
   5. Copy the token value, which includes the token- prefix, and click Close. It cannot be viewed again after five minutes, a page refresh or navigating away.
   6. From the Main menu, go to Administration › Permissions › Users, click the user Name and click Edit Mode.
   7. In the Roles section, click Manage Roles, select the read-only roles (for Threat Response, Threat Response Read Only User) and click Apply, then click Save. The token carries exactly the role permissions of the account or persona it is bound to.

   Where to find the other values:

   • Host: The address of your Tanium Cloud instance, the host you open Tanium Console on. The public docs do not show a dedicated screen for it.

   Tanium shows the secret only once, so copy it before you leave the page.

   Tanium's public documentation does not cover every step.

   Pages on help.tanium.com render with JavaScript; their content was read from Tanium's own documentation backend (help-be.tanium.com/api/bundle/...). Tanium recommends binding each token to a service account and using one token per process; tokens expire (default 7 days, maximum 365) and must be rotated (Token - Rotate permission). The role name 'Threat Response Read Only User' is from the Threat Response requirements page; a Console role named exactly 'Read Only User' was not found on the fetched pages, so pick the equivalent read-only role your Tanium admin uses. Where the Host value is shown in the Console was not sourced.

   Source: help.tanium.com, help.tanium.com, help.tanium.com, checked 2026-10-07.

   The permissions Safeguard needs: Read Only User, Threat Response Read Only.

2. On Compliance › Connectors, open Tanium, click Connect, choose API token and fill in:

   Field	What to enter
   Host	Required. An address under cloud.tanium.com.
   API token	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Tanium and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Endpoint Detection & Response connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks