.png)
Tanium has relaunched Tanium Security Operations to address AI-assisted attacks in which adversaries use legitimate administrative tools to blend into normal activity and spread across endpoints. The platform is designed to detect this behavior, support response across affected endpoints and help analysts investigate threats.
With AI, attackers no longer need malware that a scanner can catch. They sign in with stolen credentials and run the same administrative tools IT uses every day. To a security tool hunting for known-bad files, that activity looks like a normal workday. Catching that behavior means knowing what normal looks like on every endpoint and acting on all of them the moment something drifts. Tanium already does that job for IT teams. Tanium Security Operations turns that same foundation on the attacker, working alongside the SIEM and EDR tools teams already own.
“AI has changed who the attacker is and how fast they move. The next breach won’t look like malware. It will look like one of your own administrators,” said Harman Kaur, chief technology officer at Tanium. “We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn’t belong and stop it everywhere at once. That is what security operations has to become in the AI era.”
Detection, response, and hunting as one continuous loop
Tanium Security Operations runs on the same platform and real-time data IT teams already use to manage every endpoint. With the relaunch, detection, response, and hunting are no longer separate steps handed from tool to tool. They run as one continuous loop.
Detection that looks for behavior, not just known-bad files. When attackers use the same tools as IT, a list of bad files will not catch them. New Endpoint Drift learns how each endpoint normally behaves and ranks the machines acting out of character, so hunters start where it matters. New Insights Engine replaces Tanium’s process injection detection with an engine built to catch attackers hiding inside trusted processes.
Response sized to the threat. Detection without action is just an alert queue. When an attack spreads across thousands of endpoints in minutes, one quarantine button is too blunt and too slow. Tanium runs a range of responses directly on the endpoint, from stopping a single process or collecting forensic evidence to isolating a host, on one machine or across the whole fleet at once. A new Federated SOC model lets separate security teams share one platform while each sets its own suppressions and automatic reactions, so one team’s rules never land on another team’s endpoints. People set the guardrails, and every automated action stays inside them.
Hunting for every analyst, not just a few experts. Most teams rarely hunt because it takes deep skill and days of work. Tanium Atlas changes that. An analyst asks a question in plain language, gets an answer from every endpoint in seconds, and acts on it in the same place. Hunt strategies written by Tanium threat hunters guide each step. Tanium Atlas also ranks the alert queue and recommends whether to dismiss, escalate, hunt, or contain each one, and new SecOps dashboards and templates give every team a place to start. With Tanium, hunting becomes a routine, repeatable workflow any analyst can run.
“The AI-fueled threat landscape has changed the dynamics of security operations,” said Dave Gruber, chief analyst at Omdia. “Speed is more important than ever before, as attack execution speeds out pace current security operations mechanisms and processes. Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium’s approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures.”
For organizations that want experts on their side, Tanium HuntIQ pairs Tanium threat hunters with the same platform and AI. HuntIQ hunters work directly in customer environments to find threats, strengthen detections, and support incident response, and can build a hunt before a patch or CVE exists, as they did for the FalconFlank zero-day. What they learn feeds back into the platform, so every hunt that follows starts smarter.
from Help Net Security https://ift.tt/YmRFQxg
