Skip to content

Latest commit

 

History

History
67 lines (40 loc) · 2.93 KB

tanium.md

File metadata and controls

67 lines (40 loc) · 2.93 KB
Raw
pcx_content_type title weight meta
how-to
Tanium
4
title
Integrate Tanium with Access

Tanium

Cloudflare Access can use endpoint data from Tanium™ to determine if a request should be allowed to reach a protected resource. When users attempt to connect to a resource protected by Access with a Tanium rule, Cloudflare Access will validate the user's identity, and the browser will connect to the Tanium agent before making a decision to grant access.

{{

}}

The Tanium integration cannot be used with Gateway device posture policies.

{{

}}

Prerequisites

  • Tanium Core Platform version 7.2 or later
  • {{}}

Integrate Tanium with Cloudflare Access

{{

}}

The integration does not currently support Safari.

{{

}}

  1. Configure your Tanium deployment using the step-by-step documentation provided. You will need the public key to integrate your Tanium deployment with Cloudflare Access.

  2. In Zero Trust, go to Settings > WARP Client.

  3. Scroll down to WARP client checks and select Add new.

  4. Select Tanium from the list of providers.

  5. Enter any Name for the integration.

  6. For Port, enter 17472.

    This is the default port used by the Tanium endpoints to communicate inbound and outbound with Cloudflare Access. You may need to modify it to reflect your organization's deployment.

  7. Input the public certificate generated in Step 1.

    Adding the certificate allows Cloudflare to validate that the response from the Tanium agent is valid.

You can now build Access policies that check device posture signals from the Tanium endpoint.

Example Access policy

This example will only grant access to users who are part of your team's email domain and running the Tanium agent.

Action Rule type Selector Value
Allow Include Emails Ending in @team.com
Require Device Posture - Tanium Managed

The Tanium rule will require that the device connecting is managed in your Tanium deployment and has checked into the Tanium server in the last 7 days.

Tanium endpoint signals

Signal Value Description
Managed Boolean Validates that the device is managed in your organization's Tanium account.