Study guide
5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor
Tanium Certified Operator TCO
Track your progress as you read
Finished sections get a check mark.
1 Tanium Certified Operator Exam and Platform Foundations
1.1 The Tanium Certified Operator Exam: Blueprint, Logistics and Certification Path 1.2 Tanium Platform Components, Client Registration and Linear Chain Peering
2 Asking Questions (22% of the TCO Blueprint)
2.1 Sensors: Execution Model, Output Structure and Data Types 2.2 Parameterized Sensors and Question Parameter Syntax 2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy 2.4 Creating Saved Questions: Reissue Intervals, Merge and Drill-Down Flags, and RBAC 2.5 Defending Tanium as an Efficient User of Network Resources
3 Refining Questions (23% of the TCO Blueprint)
3.1 Targeting Endpoints: from and with Filters, Operators and Boolean Logic 3.2 Drilling Down into Question Results 3.3 Merging Questions to Add Columns 3.4 Computer Groups: Management versus Filter, Dynamic versus Manual 3.5 Custom Tags and Tag-Based Grouping
4 Taking Action (15% of the TCO Blueprint)
4.1 Packages: Anatomy, Command Syntax, Parameters and File Distribution 4.2 Deploying Actions: Entry Points, Targeting, Distribution and Approval 4.3 Verifying Endpoint State and Automating with Scheduled Recurring Actions
5 Navigation and Basic Module Functions (23% of the TCO Blueprint)
5.1 Console Layout, the Main Menu and Where Things Live 5.2 Operations Modules: Deploy, Patch, Asset, Performance and Provision 5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor 5.4 Interpreting Module-Specific Historical Results and Tanium Data Service 5.5 Choosing the Right Area: Client Status, Direct Connect and Action History 5.6 Content Sets, Roles and Personas: Why You Can See What You Can See
6 Report Generation and Data Export (17% of the TCO Blueprint)
6.1 Exporting Question Results: CSV, Headers, Flatten Rows and Copy 6.2 Creating Reusable Reports with Tanium Reporting 6.3 Dashboards, Boards and Metric Sources: Trends, Its Replacement and Migration 6.4 Scheduled Delivery and Exporting to External Systems with Tanium Connect
5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor
Key Takeaways Explain This Topic AI
Threat Response detects, reacts to and recovers from attacks, while Interact remains the faster route for establishing whether something is present across the fleet right now.
Comply identifies vulnerabilities and misconfigurations against a standard, and Enforce applies policies that prevent the drift Comply finds from recurring.
Reveal identifies sensitive data and embedded libraries on endpoints, which pairs naturally with custom tags to scope stricter policies to the endpoints it finds.
Discover is the only module concerned with unmanaged endpoints, because an endpoint without a Tanium Client cannot answer a question at all.
Comply and Discover can use designated satellite clients for remote authenticated scans and non-line-of-sight scans in segments the Module Server cannot reach directly.
Last updated: August 2026
5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor
Quick overview: The security side of the module estate answers a different family of questions from the operations side. Where Deploy and Patch ask is this endpoint current? , these modules ask is this endpoint safe, compliant, exposed, or even known to us? Objective NAV-1 expects you to reach the right workbench for a basic task; objective NAV-3 expects you to know which of them holds the information a given task needs.
1. The security module estate at a glance
- Module What it owns (Tanium's own description)
- Threat Response Detect, react and recover quickly from attacks and the resulting business disruptions
- Comply Identify vulnerabilities and misconfigurations to reduce attack surface and improve security posture
- Enforce Apply policies to harden your environment and prevent unwanted activity
Reveal Identify sensitive data and embedded libraries on endpoints, for regulatory compliance, information security and data privacy
- Discover Find, report on and take action against unmanaged endpoints
- Integrity Monitor Plan, install and monitor file and registry integrity
- Impact Visualise and contextualise access rights to reduce the attack surface
- Investigate Resolve incidents through collaboration and activity organisation
- Certificate Manager Visibility into digital certificates across endpoints
- 2. Threat Response
The task it answers: something has been detected, or something is suspected — now what?
Threat Response is the incident workbench: detection, investigation of what happened on an endpoint, and the response actions that contain and recover. For an operator the boundary is worth stating plainly: Interact tells you what is true across the fleet right now; Threat Response tells you the story of an endpoint over time and gives you the response tooling.
You want to… Where
Check whether a process, file or connection exists across the fleet right now Interact — a question is faster and covers everything
- Understand what happened on a specific endpoint, in sequence Threat Response
- Contain a compromised endpoint Threat Response , or a containment package deployed as an action
- Look inside one endpoint interactively Direct Connect (section 5.5)
- The operator's hunting pattern
The pattern generalises well beyond any one module and is worth carrying into a scenario item:
Ask broadly. A counting question across the fleet — running processes, listening ports, a file path.
Read the counts, not the names. In a fleet of tens of thousands, a legitimate binary appears thousands of times. Something present on three endpoints is interesting because it is rare.
Drill down into the outlier rows to identify the endpoints (section 3.2).
Merge in context — last logged-in user, IP address (section 3.3).
Contain with an action, then verify by re-asking (section 4.3).
Investigate depth in Threat Response, where the timeline lives.
Tip
Steps 1 and 2 are the ones candidates skip. Tanium's advantage in a hunt is that it can ask the whole fleet cheaply, so statistical rarity becomes your first-pass detection method — no signature required.
3. Comply
The task it answers: where are we vulnerable or misconfigured, measured against a standard?
Comply runs compliance and vulnerability assessments against endpoints and reports the findings. It is the module for "are we CIS-aligned?", "which endpoints fail this benchmark?" and "what vulnerabilities are present?" — questions that need a definition of correct that Interact does not carry.
Comply is also one of the consumers of satellites : a designated Tanium Client can perform remote authenticated scans on behalf of the Module Server, which is how segments that cannot host a client are still assessed.
4. Enforce
The task it answers: how do we stop the misconfiguration happening again?
Comply finds drift; Enforce applies policies to harden the environment and prevent unwanted activity . The pairing is the important idea, and it maps neatly onto chapter 4: a finding without enforcement is a ticket that recurs every month.
- Approach Nature
- Deploy a remediation action once Fixes today's instances
- Scheduled recurring action (section 4.3) Re-remediates drift on a cycle
- Enforce policy Applies the configuration as policy so drift is prevented rather than repaired
- 5. Reveal
The task it answers: where is our sensitive data, and what libraries are embedded in our software?
Reveal identifies sensitive data and embedded libraries on endpoints. The two halves serve different stakeholders — data privacy and regulatory compliance for the first, software supply-chain risk for the second — but both are "search the fleet's contents ", which is a different problem from "search the fleet's state ".
Reveal findings pair naturally with custom tags (section 3.5): tag the endpoints found to hold regulated data, then build a dynamic computer group on that tag and scope stricter policies to it.
6. Discover
The task it answers: what is on our network that we are not managing?
Discover finds, reports on and takes action against unmanaged endpoints. Every other module in this chapter operates on endpoints running a Tanium Client; Discover is about the ones that are not.
This is a genuine blind spot in most environments, and it is why Discover exists as a separate module rather than a sensor: an endpoint with no client cannot answer a question. Discover can also use satellites for non-line-of-sight scans , reaching segments the Module Server cannot see directly.
The natural follow-on task is deploying the Tanium Client to what it found, which converts an unmanaged endpoint into a managed one.
7. Integrity Monitor
The task it answers: did a file or registry key that should not change, change?
Integrity Monitor plans, installs and monitors file and registry integrity. It is the module for regulated environments where "nobody modified this configuration" needs to be demonstrable rather than assumed, and it is a standing monitor rather than a question you ask.
8. Routing a security scenario
- Scenario Where you go
- "Is this process running anywhere in the fleet right now?" Interact
- "Walk me through what happened on this endpoint" Threat Response
- "Which endpoints fail the benchmark?" Comply
- "Stop that setting drifting back" Enforce
- "Where is our regulated data?" Reveal
- "What is on the network without a Tanium Client?" Discover
- "Did this configuration file change?" Integrity Monitor
- "Who has administrative access to what?" Impact
- "Are any certificates about to expire?" Certificate Manager
- "Coordinate the incident work" Investigate
Important
A recurring exam pattern: the scenario describes a live, fleet-wide, right-now question and lists module names among the options. When the requirement is current state across everything, Interact is the answer — modules add domain state, workflow and history, none of which you need in order to ask whether a process is running.