Tanium

Posted by Patchewski@reddit | sysadmin | View on Reddit | 15 comments

We’re thinking hard about Tanium. Seems to check all the boxes with respect to a single place to manage, monitor, and maintain the areas we think are critical to our security posture. Looking for any insights from folks that have or had used it. Good, bad, and ugly. Also if there are alternatives that do the same or close to the same. It’s pricy - I think doable but pricy. Thanks in advance.

Reply to Post

15 Comments

[-]

Igot1forya@reddit

We're currently in the middle of a POC right now. The amount of data coming back from the endpoints is massive. We found that having Tanium and CrowdStrike agents installed on the same system tanks performance, so tuning is a necessity. At the moment our focus is patch management for our DMZ or non-domain joined servers (we want to go away from SCCM) and it seems to be the bees knees, especially with 3rd party apps. We're still playing with it but it's been impressive so far. As others have stated it's a rightfully so complicated system that will take a sizable amount of training to get the most out of it but dang it, those dashboards are pretty and scratch those OCD itches lol

[-]

deramirez25@reddit

If you haven't made a decision yet, and still looking, have you given Action 1 a try? They still require an agent installed, but when I tested their product it performed well. Automox is also good, but it is expensive. We are sticing with SCCM and Intune and will throw PmyPC to the mix for fun.

[-]

Igot1forya@reddit

Thanks for the suggestion, we ended up passing on Tanium as the cost was literally 10x more than we have budget for because the licensing model makes the cost of entry prohibitive unless you're a fortune 500 company. I'm in the Education space and funds are limited at best.

[-]

deramirez25@reddit

Did you and your team decide on a solution?

[-]

Igot1forya@reddit

At the moment, it's been shelved as a huge server project has gobbled up any available funds.

[-]

MikeWalters-Action1@reddit

Btw, if funding is completely unavailable, Action1 is always free for your first 100 endpoints (servers or workstations, doesn't matter), with no functional limits: [https://action1.com/free](https://action1.com/free)

[-]

Igot1forya@reddit

Thanks, I am checking it out. New school year kicking off so time is limited, but I'm going to take a look as soon as I get back from the holiday break.

[-]

MikeWalters-Action1@reddit

Sure, let me know if you have any questions or need help!

[-]

MikeWalters-Action1@reddit

Tanium is hyper-expensive. Here is one thread: [https://www.reddit.com/r/sysadmin/comments/12bz4zz/comment/jf128w1/?utm\_source=share&utm\_medium=web2x&context=3](https://www.reddit.com/r/sysadmin/comments/12bz4zz/comment/jf128w1/?utm_source=share&utm_medium=web2x&context=3) \- $1,000,000 for 1,500 endpoints for 3 years. This is A LOT. Action1 costs roughly 20x less.

[-]

MikeWalters-Action1@reddit

Thanks for recommending Action1, u/deramirez25 ! Action1 is definitely a lot less expensive than Tanium, and based on the description ("patch management for our DMZ or non-domain joined servers...especially with 3rd party apps") it has all that's needed. It is also very simple, compared to Tanium, as we are ranked as #1 easy-to-use patch management product on G2. Here is more info on 3rd-party patching: [https://www.action1.com/patch-management/third-party-patching/](https://www.action1.com/patch-management/third-party-patching/)

[-]

LP79Custom@reddit

In a nutshell, just as many others have already observed here, I'm right out of a new partial implementation. Agent is wreaking havoc with endpoints (20-30% cpu increases across the board) Does not play well with EDR and is putting substantial strain on our network. On top of all that, it is a nightmare to implement and has a relatively steep learning curve. For the sizable expense and the aggregate negative effects on every other aspect of the infrastructure I give it a healthy thumbs down.

[-]

yeshenamkha@reddit

you have the freedom to adjust almost anything. if you're dealing with a delicate environment, such as vdi infrastructures, you can easily reduce the number of modules installed on these endpoints or even across the board. there are maintenance window configs, index/recorder scan exclusions configs, client settings to specifically reduce the cx process' cpu percentage, client settings to reduce or turn off logging all together,...,.. as far as your network concerns, if you have sensitive subnets, you can throttle the bandwidth either by site or globally. a sustained 20-30% increase in cpu usage is not expected behavior and we have almost all tanium modules running on our endpoints. may want to check for interference from other av inspecting tanium's processes. take a process trace from a machine and you should be able to pinpoint where exclusions need to be set

[-]

LP79Custom@reddit

In a nutshell, kind of difficult to deploy (nightmare), the agent puts an enormous overhead on CPUs (and there is no current fix as of now) and it is extremely expensive for what you get. The additional stress on your network and endpoints alone is just not worth the aggregate costs and headache. IMHO product is not ready for prime time.

[-]

realslacker@reddit

We have Tanium. I hate it. We have about 3500 endpoints running a mix of windows and Linux. We ended up removing it from the Linux endpoints. Problems: * slow * resources hog * hard to troubleshoot * unreliable * no persistence * doesn't play nice with AV or Rapid7 It does ok with patching Windows, but everything else is meh. Comply module is hot garbage. Deploy module is a mess. The sensors in Interact are buggy. Everything runs in 32-bit, so you have to be aware when you write your own sensors. My least favorite thing is the thing they tout the most, the live data. We're global, so only half my endpoints are online at any given time. Live data kind of sucks for that. Their support is good, in that they are responsive... But the actual software is junk. Everything that isn't python is vbs garbage. I'm pushing for anything else when the renewal comes up. We did a POC with Automox before Tanium, we might give that another shot. BTW - I keep editing this because I keep thinking about things I hate about it.

[-]

yeshenamkha@reddit

\-temporarily disable wow64 redirection before running your script. should work for sensor executions to avoid 32vs64 redirections \-tanium also caches data within their data service for endpoints that are not online. if your data is not being cached then you can register the sensor to start caching itself \-the sensors are written in python and vbs but the client executables on the endpoints are not written in python or vbs. yea there are some scripts the client executables call but the main components of Tanium Client on the machine is not written in vbs or python \-you can always create your own sensors for the ones you dont like. you can even register your sensor, like I said above, so that its brings back cached data for endpoints that are not online \-deploy is probably one the more dependable modules. the thing that tripped me up about Deploy at first was how the applicability logic works for software packages. once you truly understand how the Install Requirement and Verification works, then there shouldnt be a problem. \-Deploy just calls the native command line of the machine and pipes whatever command you give it. tanium is just the delivery mechanism