Endpoint management and security company Tanium Inc. today expanded its Security Operations portfolio with new detection, response and threat-hunting tools built on its Tanium Atlas agentic artificial intelligence platform.

The release is Tanium’s attempt to move customers closer to what it calls a self-driving security operations center. In that model, software agents work through investigation and response on their own, inside limits a human operator sets in advance.

An analyst chasing an alert today is usually working from logs pulled into a security information and event management platform some time earlier. Tanium says that data can already be hours old, and someone still has to correlate it by hand before any fix begins. Live queries straight to the endpoint are how Tanium gets around the lag, and the software is designed to sit alongside those platforms and the endpoint detection and response tools customers already run.

That lag matters more as attackers lean on software flaws to get in. Verizon Communications Inc.’s “Data Breach Investigations Report” this year ranked exploited vulnerabilities ahead of stolen credentials as the most common entry point for the first time in its 19-year history.

The new features start with detection. Endpoint Drift compares a device’s current behavior with its own historical baseline and surfaces whatever looks abnormal. Tanium’s Insights Engine handles advanced in-memory techniques, and the company says the two together should make hunting more focused and help teams rank suspicious activity across a fleet.

On the response side, actions run directly on the endpoint, whether that means quarantining a host or pulling forensic evidence. A new Federated SOC architecture lets separate teams work independently on one platform. Tanium also rebuilt its Windows quarantine with agent-initiated actions in mind.

Atlas handles the hunting and triage side. A new feature there, Alert Prioritization and Triage, sorts incoming alerts by priority. A recommended next step comes attached to each one, and Tanium says that should get analysts to a decision sooner. Atlas also checks historical records against live endpoint data when it validates an alert or traces the root cause of an incident.

Outside intelligence feeds into that work as well. Google LLC’s Google Threat Intelligence service is now built into Tanium’s investigation and hunting workflows, and reputation data from five providers the company did not name is meant to cut down on false positives. Analysts can move from an investigation straight to remediation without switching platforms.

Harman Kaur, chief technology officer at Tanium, said security teams “don’t need another tool that generates more alerts.” An accurate picture of endpoints in real time, plus the ability to act on it before an attacker does, is what they need. “The customer sets the rules and autonomy runs the workflow,” Kaur added.

For customers that want more hands-on help, Tanium is folding Atlas into Tanium HuntIQ, the expert-led threat-hunting service it launched last November. HuntIQ’s hunters work inside customer environments with Atlas agents at their side, and what they find feeds back into the platform’s detections. All of the Security Operations additions are available now.

Photo: Tanium