Tanium Release Notes

Improvements

• Added Tanium TSL scripting engine support for the Machine Policy Status sensor on Windows.
• Windows Firewall v2 (GPO apply) policies now hide the policy-level Rule Management field and show a banner explaining that rule merging is set per network profile.
• Dependency updates.

Resolved Issues

• Fixed a crash that could occur when processing malformed Kubernetes cluster label data.
• Fixed a search issue where a limited-rights user searching for FileVault recovery keys triggered a request for up to 1,000 keys on the first keystroke.
• Fixed an issue where FileVault keys beyond the first 1,000 were re-encrypted every 5 minutes.
• Fixed an issue where limited-rights users saw no results when searching for FileVault recovery keys.
• Fixed excessive action creation by improving cleanup logic to ensure only one status action exists at a time.
• Fixed the Machine Policy Status sensor so fully superseded policies are reported as Superseded instead of Error.
• Importing a Group Policy Object (GPO) backup that contains no supported settings now shows a clear error instead of a false success message.
• Security Updates.

Enhancements

• Added the Quick Start: Vulnerability Management page template in Atlas, a multi-panel page that helps new users get started with vulnerability management in Comply.
• Removed the 14-day limit on automatic assessment creation. For new customers, Comply now continues to automatically create assessments for endpoints in the Comply action group instead of turning this off after 14 days.
• Added Comply Custom Settings panel to Atlas to view Comply Custom Settings in a list, change their priority order, and edit a Custom Setting.

Fixes

• Fixed an issue where editing a Custom Setting that targets a deleted computer group caused the page to fail to load.
• Resolved an issue on Solaris endpoints where a Comply assessment action could run the scan before receiving the correct intel.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Features

• Endpoint Must Gather from chat: You can now ask Atlas to collect an Endpoint Must Gather from an endpoint. Atlas picks the gather steps that fit the problem you describe, starts the collection, and adds a status panel to the page that shows progress and offers the ZIP for download when it's done. The collection keeps going in the background, so you don't need to keep the page open while it runs. Requires the Direct Connect must-gather privileges.

Improvements

• Atlas no longer opens every reply by restating your request. It now opens with what it's about to do, and skips that line when the request is simple or has only one reasonable reading.
• Reordering panels within a row now keeps each panel's width, so the widths move with the panels.
• When the Atlas Agent adds several panels of the same width, whether they share a row no longer depends on the order they were added.
• Closing a panel no longer ends the Direct Connect session for other panels connected to the same endpoint.
• Empty KPI tiles in Risk Summary, Compliance Summary and the other Endpoint Details summaries now say why there's no number, instead of showing N/A or a count that was really an error.
• When a sensor returns the same error from every endpoint, Atlas is now more likely to treat it as a problem with its query rather than reporting the sensor as broken across your fleet.
• Atlas is less likely to report that a result was cut off when it actually returned every matching row.
• Skills Workspace has a clearer Skill actions menu, and enabling or disabling a skill now lives in that menu.
• Typing a prompt on a New page no longer causes a brief hitch every few words.
• Command palette endpoint rows no longer repeat the same details on a second line when you hover over them.

Resolved Issues

• Fixed an issue where dragging or arranging a panel reset the widths of every row on the page, not just the row that changed.
• Fixed an issue where a dropped Direct Connect session could report that you didn't have permission to start a session and remove the Connect button.
• Fixed an issue where conversations could fail with "something went wrong" on every message after the page scope changed to a persona with different privileges.
• Fixed an issue where Risk Summary and Compliance Summary tiles cut off numbers and labels on a narrow panel.
• Fixed an issue where prompts sent with Queue were skipped when pressing Up to recall earlier prompts.
• Fixed an issue where Core Identity on Endpoint Details showed a Deploy button that couldn't be used yet.
• Fixed an issue where the info icon on the Deleted folder had a button-style hover background.

Security update

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Community site, or by contacting support.

Improvements

• Improved performance of software package list page.
• Improved how quickly content set name changes appear. A renamed content set now shows its new name within 60 seconds.
• Through the Deploy API, an Atlas automatic deployment configuration can now use a single rule that keeps all eligible software from the Deploy software gallery up to date, with Deploy adding and removing titles as the gallery changes.
• Compressed the software catalog collection, reducing the download size of the software catalog on endpoints.
• Added support for macOS to the Deploy - Self Service Profiles sensor.
• Updated automatic deployments to only be created for applicable software packages.
• Added antibody-software.com, diskanalyzer.com, dl3.xmind.app, fastdl.mongodb.org, updates.liquidfiles.com, bdefs.threattrack.com, downloads.printercloud.com, swupdate.lens.poly.com, dl.eviware.com, desktop.miro.com, downloads.pdf-xchange.com, www.eposaudio.com, download01.logi.com, and downloads.thousandeyes.com to egress allow list.
• Added software package gallery setting to allow for auto importing only when the package is applicable in the environment.
• Added software package applicability counts when retrieving automatic deployment configurations.
• Added an optional parameter to the software package gallery routes that returns applicability counts for each package.
• Updated error message to 400 instead of 500 when creating or updating an automatic deployment configuration without a deploymentPlanId.
• Added a not-applicable status to the automatic deployment configuration views for packages with no applicable endpoints in the target. The status appears as "No applicable endpoints in target" and can be filtered on.

Resolved issues

• Fixed an issue where Atlas could not create Deploy deployments because the deployment-creation route was missing from the Atlas route tree.
• Fixed an issue in the Create Software Package form where inspecting certain MSI installers would fail.
• Fixed an issue where some Windows sensors would emit garbled output if the output had non-ASCII characters.
• Fixed an issue where the Initialization status stayed "Not Initialized" after saving Deploy settings.
• Fixed an issue where adding an operating system with a duplicate name or a missing platform displayed "Request failed with status code 409" or "400" instead of the server's validation message.
• Fixed an issue where per-organization catalog and configuration manifests were not published when multiple organizations were enabled.
• Fixed an issue where widgets on the Overview page briefly displayed "Unable to Load Chart Data" while the page loaded.
• Fixed an issue where the Atlas Deployments grid showed numeric computer group IDs instead of group names when more than 20 groups were involved.
• Fixed an issue where deployments created by the API would restart the endpoint if the restart flag was not explicitly set to false.
• Fixed an issue where the row-count status bar in the Atlas Deploy and Patch grids stayed blank if the first block of rows took more than one second to load.

API Version

2.51.233

New Features

• Introduces Performance profile management in Atlas, letting operators browse and prioritize profiles, review and approve Atlas-proposed profile edits and new profile, and inspect saved profiles in a compact read-only view.

Improvements

• Added a Getting Started template for Performance that guides new users through endpoint health setup and monitoring in Atlas.
• Alert details in Atlas now open in a side drawer instead of adding a new panel to the page, and the drawer can be promoted to a panel when operators want to keep it.
• Added an Application Monitor List panel in Atlas that displays configured application monitors.
• Third-party dependency security updates: Upgraded various third-party libraries to new versions.

Improvements

• Upgraded various third-party libraries to newer versions.

Fixes

• Fixed an issue where the Rules page failed to load for all users if any rule had no actions configured.
• Fixed an issue where a deleted rule's or rule set's name could not be reused.
• Fixed an issue where a pattern's name could not be reused after the pattern was renamed or deleted.
• Fixed an issue where Save As generated a rule name containing commas, which failed name validation.
• Fixed an issue where the Cancel button on the Settings tab did not close the panel.
• Fixed an issue where clearing a numeric field in Reveal settings caused the entire save to fail with a generic error.
• Updated the helper text for Content Feed Update Interval Hours to say that clearing the value disables automatic updates so you can upload content manually.
• Fixed incorrect wording in an error message on the Create Pattern page.

Known Issues

• The Affected Files list might occasionally not appear correctly without first refreshing the browser.

Resolved Issues

• Fixed an issue where patch lists and block lists with a Severity not equal to condition stopped applying on endpoints running Patch CX earlier than 1.11.462, 1.13.963, 1.14.765, 1.15.647, or 1.16.1230. Deployments that used these lists reported Not Applicable, with no error. Patch sends these conditions in a form that earlier Patch CX versions can process. After you upgrade Patch, it republishes the affected patch lists, block lists, and deployments. Ring deployments that were already running aren't republished. If a ring deployment uses a patch list with a Severity not equal to condition and its endpoints run an earlier Patch CX version, recreate the ring deployment, or upgrade Patch CX on those endpoints to the fixed version for its release line or later (1.11.462, 1.13.963, 1.14.765, 1.15.647, or 1.16.1230).

Improvements

• Markdown panels that the Atlas Agent adds are now sized to fit their text, up to a limit, the first time someone who can edit the page views them.
• A panel that the Atlas Agent adds to a row now matches the height of the panels already in it, instead of leaving a ragged edge.
• Result tables now take their name from the panel title, so screen readers can tell several tables on one page apart.
• Panel titles now sit above the headings inside the panel in the page's heading structure, so navigating by heading reflects how the page is laid out.
• Users with the Atlas Audit Reader role can now open the Audit page in the Atlas console, with user names shown instead of IDs.
• When the Atlas Agent adds or changes panels while you are looking at another part of the page, those panels now highlight and the page scrolls to the topmost one, once per reply.
• Endpoint Details panels no longer repeat the same heading as a label, a header, and a table title.

Resolved Issues

• Fixed an issue where an endpoint with no applicable patches showed one applicable patch in Core Identity and in Patch and Software Summary.
• Fixed an issue where exporting a page to PDF could print some panels as empty frames, each on its own page.
• Fixed an issue where Export transcript failed with a generic error in a browser tab that had been open while Atlas was updated.
• Fixed an issue where clicking the Activity icon while already on Activity returned you to the previous screen.
• Fixed an issue where a background agent run that handed off a long task could be stopped partway through as if it had stalled.

Dependency updates

• Dependency updates.

Improvements

• Windows Enforce security sensors now use TSL in TSL enabled environments. This is a modernization to the underlying implementation of Windows security sensors (Anti-Malware, Host Firewall, USB Device, AppLocker, and related sensors) with no change in reported data or behavior.
• Removed the retired Mac Device Management pages from Enforce; visiting an old bookmarked link now redirects to the Overview with a notice instead of showing a broken device list.

Resolved Issues

• Enforce no longer stops delivering all policy enforcements when one enforcement's stored targeting cannot be used. Such an enforcement is held back with its already-delivered configuration left in place, reported in the service log and through the new unusableTargetingReason field on the enforcement, and picked up automatically once the targeting is corrected. Environments where the sync had been blocked will see every change made during the block delivered in one step after upgrading, and deletions of removed enforcements resume.
• Fixed a policy validation gap that allowed the BitLocker Drive Encryption registry key to be added as an extra ADMX setting when its path was typed with different capitalization.
• Fixed an issue that prevented FileVault recovery keys from syncing for some newly-enrolled Mac devices.
• Fixed an issue where enforcement creation and updates failed after the legacy mobile device management service was uninstalled.
• Improved Enforce server reliability by removing its dependency on the legacy (v1) MDM service, so an unreachable MDM no longer prevents the server from starting or serving enforcement lists.
• Security Update.

Fixes

Fixed issues:

• Fixed an issue where a Remote Authenticated Scan (RAS) assessment using the Unix vulnerability source with no operating system selected and all CVEs included could cause the Comply Service to restart repeatedly.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Features

• Import and export skills as ZIP files: In Browse Skills, select one or more skills and choose Export selected, or use Export ZIP from a skill's menu. To import, choose Import, drop a ZIP onto the upload card or click it to pick a file, and choose where the skills should go. Atlas previews every skill in the archive before anything is created, showing any problems, flagging names that are already taken, and letting you rename a skill or leave it out. The selected skills are imported together, so an import either fully succeeds or creates nothing.

Improvements

• When you ask which users hold a role, such as Administrator, Atlas is now more likely to account for user groups that hold the role, not just people assigned it directly.
• The persona drop-downs for page scope, new pages and your default page scope, and the persona switcher in Settings, now list only personas that can use Atlas.
• Panels on a page created from a template are once again based on the access of the persona you signed in to Atlas with, rather than the page's scope, so the panels you see stay consistent if the page scope differs from your own or changes later.
• Background agent spend emails now include links to the AI Credit Usage or My Usage page.
• Deleting a published skill now warns that other users will lose access and that workflows relying on it may break, and requires acknowledgment before deleting.
• On Endpoint Details pages, Install and Deploy buttons now sit below the table, and Core Identity treats missing risk counts the same way as the other panels on the page.

Resolved Issues

• Fixed an issue where the Activity panel on Endpoint Details could show no Deploy or Patch history and no scheduled activity, and where Patch rows showed a number instead of the deployment name.
• Fixed an issue where a background agent could not pause itself after completing its work, and kept running on its schedule.
• Fixed an issue where peeking an endpoint from a results table did not offer View full device profile or Add to new page on the Core Identity card.
• Fixed an issue where new Endpoint Details pages included an Installed applications button in Core Identity.
• Fixed an issue where recovering a page from Deleted left the address bar on the previously open page, so refreshing or sharing the link opened the wrong page.
• Fixed an issue where clicking a page in the Pages sidebar did not highlight it until the page finished loading.

Fixed the Software Packages export so it no longer fetches the entire catalog in one request, and added feedback when an export is busy or fails.

Fixed the Applicable Software Packages panel in Single Endpoint View so it shows an error instead of appearing empty when data can't be loaded.

Fixed an issue where updating a software package or software package bundle (PUT /software-packages, PUT /software-package-bundles) reset any optional field omitted from the request to its default value, which could unintentionally clear existing data such as a bundle's package list; omitted fields are now preserved.

Monthly and yearly maintenance windows that start in the evening in time zones behind UTC now show the correct day in the Tanium Console.

Fixed an issue where updating a software package with the legacy requires32BitSystem / requires64BitSystem system requirements failed validation after upgrading to 2.49.

Fixed an issue where the Deploy - Installed Applications Details sensor did not work on macOS endpoints without python3 installed.

Fixed an issue where filtering the Deployments list by search text could show an incorrect total, resulting in extra blank rows in the list.

Fixed the Upload Package Files form showing the wrong package when opened from a failed sync on a Tanium Automate deployment.

Fixed an issue where an upgrade could leave a built-in operating system under a temporary name, preventing built-in operating systems from being kept up to date.

Fixed an issue where a job could hang indefinitely due to a network outage. The job will now time out after 20 seconds and fail as expected.

Fixed an issue where Debian and Ubuntu endpoints did not answer the Deploy - Software Packages Applicability sensor.

Fixed an issue where Mac, RHEL-based Linux, and SUSE-based Linux endpoints did not include the final row when answering the Deploy - Software Packages Applicability sensor.

Fixed an issue where Deploy - Software Packages Applicability sensor did not produce output if no minimum software package ID parameter was supplied.

Fixed an issue where certain macOS applications were not reported by the Deploy - Installed Applications Details sensor.

Fixed an issue where the Deploy - Installed Applications Details sensor did not report Windows system components that Deploy can detect with installed application rules.

Fixed an issue where the Deploy - Installed Applications Details sensor did not report applications installed within the /Users folder on macOS.

The deprecated maintenance-window delete API now returns a conflict instead of a server error when the window still has targets.

Fixed an issue where the Software Packages page gathered applicability counts for the entire software catalog on every request, causing load times to grow with catalog size.

Fixed a rare issue where Installed Application Details could not report the install location for specific applications.

Features

• Export a conversation: You can now save an Atlas conversation as a single HTML file with Export transcript in the chat header. The file opens in any browser and includes the full transcript, including the request and response of each tool call.

Improvements

• Deleting several pages at once is much faster, and any background agents on those pages are now handled in a single dialog instead of one dialog per page.
• Clicking a page in a long Pages sidebar list responds faster.
• A page recovered from Deleted now appears in its proper place in the Pages sidebar instead of dropping in at the bottom and then jumping.
• Panel headers and footers have a new design. Long titles wrap to two lines and then truncate instead of getting cut off, header actions appear on hover or focus, and the main footer action comes first.
• The endpoint details drawer has a lighter shadow, on its left edge only.
• The Background Agents panel has a date picker next to the Owner toggle. Choose Current month, Last 7 days, Last 14 days or a custom range, and the Credits column and the list of agents follow it. The panel now opens on the current month instead of lifetime totals.
• Endpoint search in the command palette now shows each endpoint's IP address, platform, user and status, along with the computer name.
• A new Atlas Audit Reader role gives read-only access through the API to all users' Atlas audit data, including conversations, transcripts and usage, without full administrator access.
• Atlas is less likely to treat an endpoint's last check-in time as the age of its cached data, or to report old inventory as the endpoint's current state.
• When filtering on a numeric sensor, Atlas is more likely to leave out endpoints that returned errors or no results, which could otherwise be counted as matches.
• If a Python script Atlas runs hits its memory limit, Atlas now knows the script failed and can see how far it got.

Resolved Issues

• Fixed an issue where selecting several pages with Cmd, Ctrl or Shift could leave the page area stuck on a loading spinner.
• Fixed an issue where going Back to a page that had since been deleted did not show the "Couldn't find that page" message.
• Fixed an issue where panels whose content fits showed a scrollbar and scrolled by a few pixels, and where the scrollbar in Suggested Prompts covered the prompt text.
• Fixed an issue where Atlas could finish a response without answering, sometimes leaving only the suggested follow-up prompts.
• Fixed an issue where a response could hang after Atlas had finished, or fail when the connection to the AI model dropped partway through.
• Fixed an issue where chat messages could briefly draw on top of each other, or the chat could jump to its scroll position, when a page opened.
• Fixed an issue where a panel's refresh button could get stuck loading.
• Fixed an issue where the Web Searches setting appeared in environments where web search is not available.
• Fixed an issue where donut charts in Tanium dashboard panels were invisible when the panel was short.