slug: tanium
provider: Tanium
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 6
edges:
- tag: Alerts
  spec_file: tanium-alerts-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.92
  evidence: GET /plugin/products/threat-response/api/v1/alerts listAlerts List Threat Alerts; PUT .../alerts/{alertId}
    updateAlertState
  reason: Threat Response alerts — listing and triaging threat detections for incident response. Plainly
    Threat Detection & Response Management, not generic monitoring or financial-crime alerting.
- tag: Intel Documents
  spec_file: tanium-intel-documents-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.82
  evidence: '"Upload An Intel Document" / "List Intel Documents" under the Threat Response API which "enables
    starting investigations, viewing Recorder events, gathering evidence, and performing file and directory
    operations on endpoints for threat detection and incident response"'
  reason: Intel documents here are threat-intelligence signatures (IOC/IOA) used by Tanium Threat Response
    for detection, squarely threat detection and response rather than any document-management capability.
- tag: Processes
  spec_file: tanium-processes-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.82
  evidence: '"Get Events For A Specific Process", "Get A Process Tree" with schemas ProcessInfo, ProcessEvent
    in the Threat Response API for "threat detection and incident response"'
  reason: Process trees and process events on endpoints are forensic investigation artefacts for security
    incident response, not business process management.
- tag: Evidence
  spec_file: tanium-evidence-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.8
  evidence: GET /plugin/products/threat-response/api/v1/evidence listEvidence List Investigation Evidence;
    POST .../evidence createEvidence Create Evidence From A Process
  reason: Collection and management of forensic evidence during threat investigations, per the spec's
    'starting investigations, viewing Recorder events, gathering evidence'. Supports security incident
    response rather than internal audit evidence.
- tag: Snapshots
  spec_file: tanium-snapshots-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.75
  evidence: '"Create An Endpoint Snapshot" in the Threat Response API for "gathering evidence" and "incident
    response"'
  reason: Endpoint snapshots here are forensic evidence captures for security investigations, not backup/DR
    of a SaaS service.
- tag: Actions
  spec_file: tanium-actions-api-openapi.yml
  capability_id: BC-600.40
  capability_id_l1: BC-600
  capability_name: IT Operations Management
  confidence: 0.7
  evidence: POST /api/v2/saved_actions createSavedAction Create And Execute An Action; GET /api/v2/action_groups/by-name/{name}
  reason: Tanium Actions deploy and execute packages/actions on managed endpoints at scale — day-to-day
    endpoint operations and automation. Maps to IT Operations Management; some ambiguity versus endpoint/infrastructure
    management hence moderate confidence.