What are common Threat Response use cases in Tanium for incident response?

• A. Real-time video capture of endpoints for surveillance;
• B. Generating marketing reports for customers;
• C. Scheduling routine backups of endpoints;
• D. Investigation, containment of compromised hosts, remediation actions, artifact collection, and post-incident analysis.

Answer: (D)

In incident response, the strongest use case is the end-to-end workflow across endpoints: investigate to understand what happened and the scope, contain compromised hosts to stop further spread, perform remediation actions to restore a secure state, collect artifacts for forensics, and conduct post-incident analysis to improve defenses. This aligns with Tanium Threat Response’s capabilities—providing real-time endpoint visibility, searching for indicators of compromise, isolating or containing devices, executing remediation steps, gathering artifacts (like process trees, registry keys, file hashes), and generating post-incident reports. The other options don’t fit incident response: real-time video capture isn’t a typical IR capability, marketing reports are unrelated business analytics, and routine backups are IT operations tasks rather than incident response actions.