Tanium Distribution

Copy

• Copy for LLM

  Copy page as Markdown for LLMs
• View as Markdown

  Open this page as Markdown
• Open in ChatGPT

  Get insights from ChatGPT
• Open in Claude

  Get insights from Claude
• Connect to Cursor

  Install MCP server on Cursor
• Connect to VS Code

  Install MCP server on VS Code

Deploy Capsule Security hooks for AI coding assistants across your fleet using Tanium. This guide covers deployment for Cursor, Windsurf, GitHub Copilot, and Claude Code on both Windows and macOS using Tanium Deploy packages.

Prerequisites

• Access to the Tanium Console with administrative privileges
• Tanium Deploy module enabled
• A Capsule Security account with admin access
• Target endpoints managed by Tanium

Cursor

Deploy the Cursor hooks configuration using a Tanium Deploy package.

Step 1: Download the Configuration

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Cursor integration
4. Download the hooks.json file

Windows Deployment

1. Log in to the Tanium Console

2. Navigate to Tanium Deploy > Packages

3. Click Create Package and configure:

   • Name: Capsule Security – Cursor Hooks (Windows)
   • Description: Deploys Capsule Security hooks configuration for Cursor

4. Upload the hooks.json file to the package files

5. Set the Command to run the following script:

   cmd.exe /c mkdir "C:\ProgramData\Cursor" & copy /Y "hooks.json" "C:\ProgramData\Cursor\hooks.json"

6. Create a Deployment:

   • Navigate to Tanium Deploy > Deployments
   • Click Create Deployment
   • Select the Capsule Security – Cursor Hooks (Windows) package
   • Target the appropriate Computer Groups or use a Tanium question to filter endpoints
   • Configure the schedule:
     • Type: Single or Recurring
     • Restart required: No
   • Deploy

macOS Deployment

1. Navigate to Tanium Deploy > Packages

2. Click Create Package and configure:

   • Name: Capsule Security – Cursor Hooks (macOS)
   • Description: Deploys Capsule Security hooks configuration for Cursor on macOS

3. Upload the hooks.json file to the package files

4. Set the Command to run the following script:

   #!/bin/bash
   HOOKS_DIR="/Library/Application Support/Cursor"
   mkdir -p "$HOOKS_DIR"
   cp hooks.json "$HOOKS_DIR/hooks.json"
   chmod 644 "$HOOKS_DIR/hooks.json"
   exit 0

5. Create a Deployment targeting macOS endpoints using the appropriate Computer Groups

Verification

After deployment, restart Cursor on target devices, then:

1. Open Cursor Settings
2. Navigate to the Hooks tab
3. Confirm the hooks are listed and enabled

Windsurf

Deploy the Windsurf hooks configuration using a Tanium Deploy package.

Step 1: Download the Configuration

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Windsurf integration
4. Download the hooks.json file

Windows Deployment

1. Log in to the Tanium Console

2. Navigate to Tanium Deploy > Packages

3. Click Create Package and configure:

   • Name: Capsule Security – Windsurf Hooks (Windows)
   • Description: Deploys Capsule Security hooks configuration for Windsurf

4. Upload the hooks.json file to the package files

5. Set the Command to run the following script:

   cmd.exe /c mkdir "C:\ProgramData\Windsurf" & copy /Y "hooks.json" "C:\ProgramData\Windsurf\hooks.json"

6. Create a Deployment:

   • Navigate to Tanium Deploy > Deployments
   • Click Create Deployment
   • Select the Capsule Security – Windsurf Hooks (Windows) package
   • Target the appropriate Computer Groups or use a Tanium question to filter endpoints
   • Configure the schedule:
     • Type: Single or Recurring
     • Restart required: No
   • Deploy

macOS Deployment

1. Navigate to Tanium Deploy > Packages

2. Click Create Package and configure:

   • Name: Capsule Security – Windsurf Hooks (macOS)
   • Description: Deploys Capsule Security hooks configuration for Windsurf on macOS

3. Upload the hooks.json file to the package files

4. Set the Command to run the following script:

   #!/bin/bash
   HOOKS_DIR="/Library/Application Support/Windsurf"
   mkdir -p "$HOOKS_DIR"
   cp hooks.json "$HOOKS_DIR/hooks.json"
   chmod 644 "$HOOKS_DIR/hooks.json"
   exit 0

5. Create a Deployment targeting macOS endpoints using the appropriate Computer Groups

Verification

After deployment, restart Windsurf on target devices, then:

1. Open Windsurf Settings
2. Navigate to the Hooks tab
3. Confirm the hooks are listed and enabled

GitHub Copilot

Deploy the GitHub Copilot hooks configuration using a Tanium Deploy package.

Step 1: Download the Configuration

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the GitHub Copilot integration
4. Download the hooks.json file

Windows Deployment

1. Log in to the Tanium Console

2. Navigate to Tanium Deploy > Packages

3. Click Create Package and configure:

   • Name: Capsule Security – GitHub Copilot Hooks (Windows)
   • Description: Deploys Capsule Security hooks configuration for GitHub Copilot in VS Code

4. Upload the hooks.json file to the package files

5. Set the Command to run the following PowerShell script:

   $userProfiles = Get-ChildItem "C:\Users" -Directory | Where-Object { $_.Name -notin @('Public', 'Default', 'Default User') }
   
   foreach ($profile in $userProfiles) {
       $hooksDir = Join-Path $profile.FullName "AppData\Roaming\Code\User\hooks"
       if (-not (Test-Path $hooksDir)) {
           New-Item -ItemType Directory -Path $hooksDir -Force | Out-Null
       }
       Copy-Item -Path "hooks.json" -Destination "$hooksDir\hooks.json" -Force
   }
   
   Write-Output "Capsule hooks configuration deployed successfully."
   exit 0

6. Create a Deployment:

   • Navigate to Tanium Deploy > Deployments
   • Click Create Deployment
   • Select the Capsule Security – GitHub Copilot Hooks (Windows) package
   • Target the appropriate Computer Groups
   • Deploy

macOS Deployment

1. Navigate to Tanium Deploy > Packages

2. Click Create Package and configure:

   • Name: Capsule Security – GitHub Copilot Hooks (macOS)
   • Description: Deploys Capsule Security hooks configuration for GitHub Copilot on macOS

3. Upload the hooks.json file to the package files

4. Set the Command to run the following script:

   #!/bin/bash
   for USER_HOME in /Users/*/; do
       USERNAME=$(basename "$USER_HOME")
       if [ "$USERNAME" = "Shared" ] || [ "$USERNAME" = ".localized" ]; then
           continue
       fi
       HOOKS_DIR="$USER_HOME/Library/Application Support/Code/User/hooks"
       mkdir -p "$HOOKS_DIR"
       cp hooks.json "$HOOKS_DIR/hooks.json"
       chmod 644 "$HOOKS_DIR/hooks.json"
       chown "$USERNAME" "$HOOKS_DIR/hooks.json"
   done
   exit 0

5. Create a Deployment targeting macOS endpoints using the appropriate Computer Groups

Verification

After deployment, restart VS Code on target devices, then:

1. Right-click in the Chat view and select Diagnostics
2. Confirm the hooks are loaded and enabled

Claude Code

Deploy the Claude Code managed settings configuration using a Tanium Deploy package.

Step 1: Download the Configuration

1. Log in to the Capsule Security portal
2. Navigate to Settings > Integrations
3. Locate the Claude Code integration
4. Click Install and select your target platform
5. Download the managed-settings.json file

Windows Deployment

1. Log in to the Tanium Console

2. Navigate to Tanium Deploy > Packages

3. Click Create Package and configure:

   • Name: Capsule Security – Claude Code Hooks (Windows)
   • Description: Deploys Capsule Security managed settings for Claude Code

4. Upload the managed-settings.json file to the package files

5. Set the Command to run the following script:

   cmd.exe /c mkdir "C:\Program Files\ClaudeCode" & copy /Y "managed-settings.json" "C:\Program Files\ClaudeCode\managed-settings.json"

6. Create a Deployment:

   • Navigate to Tanium Deploy > Deployments
   • Click Create Deployment
   • Select the Capsule Security – Claude Code Hooks (Windows) package
   • Target the appropriate Computer Groups
   • Deploy

macOS Deployment

1. Navigate to Tanium Deploy > Packages

2. Click Create Package and configure:

   • Name: Capsule Security – Claude Code Hooks (macOS)
   • Description: Deploys Capsule Security managed settings for Claude Code on macOS

3. Upload the managed-settings.json file to the package files

4. Set the Command to run the following script:

   #!/bin/bash
   SETTINGS_DIR="/Library/Application Support/ClaudeCode"
   mkdir -p "$SETTINGS_DIR"
   cp managed-settings.json "$SETTINGS_DIR/managed-settings.json"
   chmod 644 "$SETTINGS_DIR/managed-settings.json"
   exit 0

5. Create a Deployment targeting macOS endpoints using the appropriate Computer Groups

Verification

After deployment, restart Claude Code on target devices, then:

1. Run /hooks in Claude Code to confirm all hooks are listed
2. Start a session and verify events appear in the Capsule Security portal

Monitoring Deployments

After deploying packages, monitor status in the Tanium Console:

1. Navigate to Tanium Deploy > Deployments
2. Select the relevant deployment
3. Review the deployment status:
   • Complete: Configuration successfully deployed
   • Pending: Deployment waiting for endpoint check-in
   • Failed: Review error details and retry

You can also use Tanium Interact to ask questions across your fleet to verify deployment:

• Windows (Cursor): Get File Exists[C:\ProgramData\Cursor\hooks.json] from all machines
• Windows (Windsurf): Get File Exists[C:\ProgramData\Windsurf\hooks.json] from all machines
• Windows (Claude Code): Get File Exists[C:\Program Files\ClaudeCode\managed-settings.json] from all machines
• macOS (Cursor): Get File Exists[/Library/Application Support/Cursor/hooks.json] from all machines
• macOS (Windsurf): Get File Exists[/Library/Application Support/Windsurf/hooks.json] from all machines
• macOS (Claude Code): Get File Exists[/Library/Application Support/ClaudeCode/managed-settings.json] from all machines

Key Considerations

• Tanium packages run as SYSTEM (Windows) or root (macOS) by default
• Cursor, Windsurf, and Claude Code use system-level paths — deploy to Device computer groups
• GitHub Copilot uses user-level paths — the deployment scripts iterate over all user profiles to cover each user on the endpoint
• For GitHub Copilot CLI users, create an additional package targeting %USERPROFILE%\.github\hooks\hooks.json (Windows) or ~/.github/hooks/hooks.json (macOS)
• Use Tanium Computer Groups or saved questions to target specific OS versions or departments
• All four integrations can be deployed as separate packages and assigned independently
• For recurring enforcement, configure deployments with a recurring schedule

Support

For help with deployment:

• Email: support@capsule.security
• Include: Your organization ID, Tanium environment details, and any error messages

References

• Tanium Deploy User Guide