5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor
Key Takeaways
- Threat Response detects, reacts to and recovers from attacks, while Interact remains the faster route for establishing whether something is present across the fleet right now.
- Comply identifies vulnerabilities and misconfigurations against a standard, and Enforce applies policies that prevent the drift Comply finds from recurring.
- Reveal identifies sensitive data and embedded libraries on endpoints, which pairs naturally with custom tags to scope stricter policies to the endpoints it finds.
- Discover is the only module concerned with unmanaged endpoints, because an endpoint without a Tanium Client cannot answer a question at all.
- Comply and Discover can use designated satellite clients for remote authenticated scans and non-line-of-sight scans in segments the Module Server cannot reach directly.
5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor
Quick overview: The security side of the module estate answers a different family of questions from the operations side. Where Deploy and Patch ask is this endpoint current?, these modules ask is this endpoint safe, compliant, exposed, or even known to us? Objective NAV-1 expects you to reach the right workbench for a basic task; objective NAV-3 expects you to know which of them holds the information a given task needs.
1. The security module estate at a glance
| Module | What it owns (Tanium's own description) |
|---|---|
| Threat Response | Detect, react and recover quickly from attacks and the resulting business disruptions |
| Comply | Identify vulnerabilities and misconfigurations to reduce attack surface and improve security posture |
| Enforce | Apply policies to harden your environment and prevent unwanted activity |
| Reveal | Identify sensitive data and embedded libraries on endpoints, for regulatory compliance, information security and data privacy |
| Discover | Find, report on and take action against unmanaged endpoints |
| Integrity Monitor | Plan, install and monitor file and registry integrity |
| Impact | Visualise and contextualise access rights to reduce the attack surface |
| Investigate | Resolve incidents through collaboration and activity organisation |
| Certificate Manager | Visibility into digital certificates across endpoints |
2. Threat Response
The task it answers: something has been detected, or something is suspected — now what?
Threat Response is the incident workbench: detection, investigation of what happened on an endpoint, and the response actions that contain and recover. For an operator the boundary is worth stating plainly: Interact tells you what is true across the fleet right now; Threat Response tells you the story of an endpoint over time and gives you the response tooling.
| You want to… | Where |
|---|---|
| Check whether a process, file or connection exists across the fleet right now | Interact — a question is faster and covers everything |
| Understand what happened on a specific endpoint, in sequence | Threat Response |
| Contain a compromised endpoint | Threat Response, or a containment package deployed as an action |
| Look inside one endpoint interactively | Direct Connect (section 5.5) |
The operator's hunting pattern
The pattern generalises well beyond any one module and is worth carrying into a scenario item:
- Ask broadly. A counting question across the fleet — running processes, listening ports, a file path.
- Read the counts, not the names. In a fleet of tens of thousands, a legitimate binary appears thousands of times. Something present on three endpoints is interesting because it is rare.
- Drill down into the outlier rows to identify the endpoints (section 3.2).
- Merge in context — last logged-in user, IP address (section 3.3).
- Contain with an action, then verify by re-asking (section 4.3).
- Investigate depth in Threat Response, where the timeline lives.
[!TIP] Steps 1 and 2 are the ones candidates skip. Tanium's advantage in a hunt is that it can ask the whole fleet cheaply, so statistical rarity becomes your first-pass detection method — no signature required.
3. Comply
The task it answers: where are we vulnerable or misconfigured, measured against a standard?
Comply runs compliance and vulnerability assessments against endpoints and reports the findings. It is the module for "are we CIS-aligned?", "which endpoints fail this benchmark?" and "what vulnerabilities are present?" — questions that need a definition of correct that Interact does not carry.
Comply is also one of the consumers of satellites: a designated Tanium Client can perform remote authenticated scans on behalf of the Module Server, which is how segments that cannot host a client are still assessed.
4. Enforce
The task it answers: how do we stop the misconfiguration happening again?
Comply finds drift; Enforce applies policies to harden the environment and prevent unwanted activity. The pairing is the important idea, and it maps neatly onto chapter 4: a finding without enforcement is a ticket that recurs every month.
| Approach | Nature |
|---|---|
| Deploy a remediation action once | Fixes today's instances |
| Scheduled recurring action (section 4.3) | Re-remediates drift on a cycle |
| Enforce policy | Applies the configuration as policy so drift is prevented rather than repaired |
5. Reveal
The task it answers: where is our sensitive data, and what libraries are embedded in our software?
Reveal identifies sensitive data and embedded libraries on endpoints. The two halves serve different stakeholders — data privacy and regulatory compliance for the first, software supply-chain risk for the second — but both are "search the fleet's contents", which is a different problem from "search the fleet's state".
Reveal findings pair naturally with custom tags (section 3.5): tag the endpoints found to hold regulated data, then build a dynamic computer group on that tag and scope stricter policies to it.
6. Discover
The task it answers: what is on our network that we are not managing?
Discover finds, reports on and takes action against unmanaged endpoints. Every other module in this chapter operates on endpoints running a Tanium Client; Discover is about the ones that are not.
This is a genuine blind spot in most environments, and it is why Discover exists as a separate module rather than a sensor: an endpoint with no client cannot answer a question. Discover can also use satellites for non-line-of-sight scans, reaching segments the Module Server cannot see directly.
The natural follow-on task is deploying the Tanium Client to what it found, which converts an unmanaged endpoint into a managed one.
7. Integrity Monitor
The task it answers: did a file or registry key that should not change, change?
Integrity Monitor plans, installs and monitors file and registry integrity. It is the module for regulated environments where "nobody modified this configuration" needs to be demonstrable rather than assumed, and it is a standing monitor rather than a question you ask.
8. Routing a security scenario
| Scenario | Where you go |
|---|---|
| "Is this process running anywhere in the fleet right now?" | Interact |
| "Walk me through what happened on this endpoint" | Threat Response |
| "Which endpoints fail the benchmark?" | Comply |
| "Stop that setting drifting back" | Enforce |
| "Where is our regulated data?" | Reveal |
| "What is on the network without a Tanium Client?" | Discover |
| "Did this configuration file change?" | Integrity Monitor |
| "Who has administrative access to what?" | Impact |
| "Are any certificates about to expire?" | Certificate Manager |
| "Coordinate the incident work" | Investigate |
[!IMPORTANT] A recurring exam pattern: the scenario describes a live, fleet-wide, right-now question and lists module names among the options. When the requirement is current state across everything, Interact is the answer — modules add domain state, workflow and history, none of which you need in order to ask whether a process is running.
A SOC analyst needs to know, right now, whether a specific process name is running anywhere in a 40,000-endpoint fleet. What is the fastest correct route?
A misconfiguration that Comply flags keeps returning a few weeks after each remediation. Which module addresses the underlying problem?
Why is Discover a separate module rather than a sensor that Interact could run?
A data privacy team needs to apply stricter policy to endpoints that hold regulated data. Which combination of Tanium capabilities achieves a self-maintaining scope?