Tanium sells a self-driving SOC with Atlas tools for autonomous detection, hunting and response

An analyst who opens an alert in a SIEM is reading a copy of what an endpoint did, pulled in some time earlier. Tanium says that copy can already be hours old, and that someone still has to correlate it by hand before a fix starts ^[3]. Tanium's answer is a live query sent straight to the endpoint ^[4]. When Atlas validates an alert or traces the root cause of an incident, it checks historical records against that live data ^[11].

Harman Kaur, Tanium's chief technology officer, said security teams "don't need another tool that generates more alerts" ^[14]. On who is in charge, she said: "The customer sets the rules and autonomy runs the workflow" ^[15].

Most of the features shipping today help a person run the workflow. Tanium says the triage feature's recommended next step should get analysts to a decision sooner ^[10]. Endpoint Drift flags a device whose behavior departs from its own historical baseline ^[6]. Tanium says pairing it with its Insights Engine, which handles advanced in-memory techniques, should make hunting more focused and help teams rank suspicious activity across a fleet ^[7]. Analysts can also go from an investigation to remediation without switching platforms ^[13].

Compare that with Kaur's first line. Endpoint Drift produces findings of its own, and the triage feature, as described, sorts the queue. The part of the release aimed at fewer alerts is the outside reputation data, which is meant to cut false positives ^[12].

Among the response changes, the Windows quarantine rebuild is the one Tanium describes as designed for an agent to start ^[8]. Both the self-driving pitch and Kaur's line about rules depend on it, because a quarantine an agent can trigger needs written limits before it runs.

SiliconANGLE's report of the release does not include pricing or customer figures for false positives or time to decision ^[18]. All of the additions are available now ^[17], so the first numbers will come from customers who switch agent-initiated actions on.

Before deciding who presses the button, I'd sort each Atlas action on two questions. The first is whether a wrong call stops someone working. Pulling forensic evidence from a host does not, and quarantining it does ^[8]. The second is what the agent checked before acting: live endpoint state, or historical records alone ^[11]. Evidence collection backed by a live check can run on its own, with a person reviewing afterward. When the same pull rests only on historical records, the agent can still run it and note the gap in the ticket. For a quarantine backed by a live check, the agent proposes and a named person approves within a fixed window. A quarantine based only on historical records stays a human action until the team has its own figures on how often the agent's calls hold up.