6.4 Scheduled Delivery and Exporting to External Systems with Tanium Connect

6.4 Scheduled Delivery and Exporting to External Systems with Tanium Connect

Quick overview: A manual export ends when the operator stops doing it. Tanium Connect is how Tanium data leaves the platform on a schedule, unattended, into the systems that consume it — a mailbox, a file share, an HTTP receiver, a SIEM, or a database. A connection pairs a source with a destination, optionally filters and shapes the columns in between, and optionally runs on a schedule.

---

1. What Connect is for

Connect captures accurate and complete endpoint data from Tanium and delivers it elsewhere. It answers the requirements that neither a CSV nor a dashboard can:

Tanium makes the retention case explicitly: if you need to retain audit logs or system notifications for longer periods than a module holds them, send the data to Tanium Connect.

---

2. The anatomy of a connection

   +----------+     +-----------+     +-----------+     +---------------+
   |  SOURCE  | --> |  FILTERS  | --> |  COLUMNS  | --> |  DESTINATION  |
   +----------+     +-----------+     +-----------+     +---------------+
        |                 |                 |                   |
   saved question,   narrow the data   choose fields,      Email, File, HTTP,
   module source,    before it is      set Destination     Socket Receiver,
   Reporting report  sent              Label, Value Type   Splunk, SQL Server
   or dashboard                        and Customization
                                  +-------------------+
                                  |     SCHEDULE      |
                                  |  Enable Schedule  |
                                  +-------------------+

Sources

Destinations

Connect destinations include Email, File, HTTP, Socket Receiver, Splunk and SQL Server. Which format options are available depends on the destination type you select.

Filters and columns

Filters modify the data coming from the source before it is sent — narrowing rows so the destination receives what it needs rather than everything. In the Columns section you select the available source items and configure each one's Destination Label, Value Type and Customization, which is how a Tanium column name becomes the field name the receiving system expects.

Schedule

A connection can be run manually with Run Now, or scheduled by selecting Enable Schedule and configuring the timing.

[!IMPORTANT] Connections scheduled to run during an upgrade of Connect — or of any Tanium solution configured as a connection source — might be interrupted or fail. Build maintenance windows into your connection schedules, and check the delivery after any upgrade.

---

3. Building and validating a connection

Step 7 is not optional in practice. A connection that has never been run has never been proven, and a scheduled connection that silently fails is worse than no connection at all — the audience assumes no news is good news.

---

4. Choosing among the export routes

[!TIP] The blueprint objective is determine the correct method to export required data for use outside of the application. The word method is doing real work: recognising when a manual export is the wrong answer is exactly what is being assessed. Ask who consumes it, how often, and what happens if nobody does it this week — those three answers select the method every time.

---

5. Governance considerations

• Delivered data leaves Tanium's access model. Content sets, roles and computer management groups govern the console. A CSV on a file share or a table in SQL Server is governed by that system's controls instead. Scope the connection's filters and columns to the minimum the destination needs.
• Note the scope. A connection sourced from a saved question inherits the visibility rules of the question. Record which computer groups the delivered data represents, because the file itself will not say.
• Prefer filtering at the source. Sending everything and filtering downstream costs bandwidth, storage and, when the data is sensitive, risk.
• Monitor delivery, not just configuration. Upgrades, credential expiry and destination changes all break connections silently. The connection's log level and the destination's own records are where you find out.