Tanium Release Notes

Improvements

• Upgraded various third-party libraries to newer versions.

Fixes

• Fixed an issue where the Rules page failed to load for all users if any rule had no actions configured.
• Fixed an issue where a deleted rule's or rule set's name could not be reused.
• Fixed an issue where a pattern's name could not be reused after the pattern was renamed or deleted.
• Fixed an issue where Save As generated a rule name containing commas, which failed name validation.
• Fixed an issue where the Cancel button on the Settings tab did not close the panel.
• Fixed an issue where clearing a numeric field in Reveal settings caused the entire save to fail with a generic error.
• Updated the helper text for Content Feed Update Interval Hours to say that clearing the value disables automatic updates so you can upload content manually.
• Fixed incorrect wording in an error message on the Create Pattern page.

Known Issues

• The Affected Files list might occasionally not appear correctly without first refreshing the browser.

Original source

Resolved Issues

• Fixed an issue where patch lists and block lists with a Severity not equal to condition stopped applying on endpoints running Patch CX earlier than 1.11.462, 1.13.963, 1.14.765, 1.15.647, or 1.16.1230. Deployments that used these lists reported Not Applicable, with no error. Patch sends these conditions in a form that earlier Patch CX versions can process. After you upgrade Patch, it republishes the affected patch lists, block lists, and deployments. Ring deployments that were already running aren't republished. If a ring deployment uses a patch list with a Severity not equal to condition and its endpoints run an earlier Patch CX version, recreate the ring deployment, or upgrade Patch CX on those endpoints to the fixed version for its release line or later (1.11.462, 1.13.963, 1.14.765, 1.15.647, or 1.16.1230).

Original source

Improvements

• Markdown panels that the Atlas Agent adds are now sized to fit their text, up to a limit, the first time someone who can edit the page views them.
• A panel that the Atlas Agent adds to a row now matches the height of the panels already in it, instead of leaving a ragged edge.
• Result tables now take their name from the panel title, so screen readers can tell several tables on one page apart.
• Panel titles now sit above the headings inside the panel in the page's heading structure, so navigating by heading reflects how the page is laid out.
• Users with the Atlas Audit Reader role can now open the Audit page in the Atlas console, with user names shown instead of IDs.
• When the Atlas Agent adds or changes panels while you are looking at another part of the page, those panels now highlight and the page scrolls to the topmost one, once per reply.
• Endpoint Details panels no longer repeat the same heading as a label, a header, and a table title.

Resolved Issues

• Fixed an issue where an endpoint with no applicable patches showed one applicable patch in Core Identity and in Patch and Software Summary.
• Fixed an issue where exporting a page to PDF could print some panels as empty frames, each on its own page.
• Fixed an issue where Export transcript failed with a generic error in a browser tab that had been open while Atlas was updated.
• Fixed an issue where clicking the Activity icon while already on Activity returned you to the previous screen.
• Fixed an issue where a background agent run that handed off a long task could be stopped partway through as if it had stalled.

Original source

Dependency updates

• Dependency updates.

Improvements

• Windows Enforce security sensors now use TSL in TSL enabled environments. This is a modernization to the underlying implementation of Windows security sensors (Anti-Malware, Host Firewall, USB Device, AppLocker, and related sensors) with no change in reported data or behavior.
• Removed the retired Mac Device Management pages from Enforce; visiting an old bookmarked link now redirects to the Overview with a notice instead of showing a broken device list.

Resolved Issues

• Enforce no longer stops delivering all policy enforcements when one enforcement's stored targeting cannot be used. Such an enforcement is held back with its already-delivered configuration left in place, reported in the service log and through the new unusableTargetingReason field on the enforcement, and picked up automatically once the targeting is corrected. Environments where the sync had been blocked will see every change made during the block delivered in one step after upgrading, and deletions of removed enforcements resume.
• Fixed a policy validation gap that allowed the BitLocker Drive Encryption registry key to be added as an extra ADMX setting when its path was typed with different capitalization.
• Fixed an issue that prevented FileVault recovery keys from syncing for some newly-enrolled Mac devices.
• Fixed an issue where enforcement creation and updates failed after the legacy mobile device management service was uninstalled.
• Improved Enforce server reliability by removing its dependency on the legacy (v1) MDM service, so an unreachable MDM no longer prevents the server from starting or serving enforcement lists.
• Security Update.

Original source

Enhancements

• Added a "Check every 30 minutes" option to the "Enable recurring updates" schedule for the Tanium Vulnerability Library (TVL) in Comply. To use it, go to Standards > Vulnerability, edit the Tanium Vulnerability Library source, and select the option. When selected, Comply checks for a new TVL every 30 minutes and downloads if a newer version is available.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Original source

Features

• Import and export skills as ZIP files: In Browse Skills, select one or more skills and choose Export selected, or use Export ZIP from a skill's menu. To import, choose Import, drop a ZIP onto the upload card or click it to pick a file, and choose where the skills should go. Atlas previews every skill in the archive before anything is created, showing any problems, flagging names that are already taken, and letting you rename a skill or leave it out. The selected skills are imported together, so an import either fully succeeds or creates nothing.

Improvements

• When you ask which users hold a role, such as Administrator, Atlas is now more likely to account for user groups that hold the role, not just people assigned it directly.
• The persona drop-downs for page scope, new pages and your default page scope, and the persona switcher in Settings, now list only personas that can use Atlas.
• Panels on a page created from a template are once again based on the access of the persona you signed in to Atlas with, rather than the page's scope, so the panels you see stay consistent if the page scope differs from your own or changes later.
• Background agent spend emails now include links to the AI Credit Usage or My Usage page.
• Deleting a published skill now warns that other users will lose access and that workflows relying on it may break, and requires acknowledgment before deleting.
• On Endpoint Details pages, Install and Deploy buttons now sit below the table, and Core Identity treats missing risk counts the same way as the other panels on the page.

Resolved Issues

• Fixed an issue where the Activity panel on Endpoint Details could show no Deploy or Patch history and no scheduled activity, and where Patch rows showed a number instead of the deployment name.
• Fixed an issue where a background agent could not pause itself after completing its work, and kept running on its schedule.
• Fixed an issue where peeking an endpoint from a results table did not offer View full device profile or Add to new page on the Core Identity card.
• Fixed an issue where new Endpoint Details pages included an Installed applications button in Core Identity.
• Fixed an issue where recovering a page from Deleted left the address bar on the previously open page, so refreshing or sharing the link opened the wrong page.
• Fixed an issue where clicking a page in the Pages sidebar did not highlight it until the page finished loading.

Original source

Fixed the Software Packages export so it no longer fetches the entire catalog in one request, and added feedback when an export is busy or fails.

Fixed the Applicable Software Packages panel in Single Endpoint View so it shows an error instead of appearing empty when data can't be loaded.

Fixed an issue where updating a software package or software package bundle (PUT /software-packages, PUT /software-package-bundles) reset any optional field omitted from the request to its default value, which could unintentionally clear existing data such as a bundle's package list; omitted fields are now preserved.

Monthly and yearly maintenance windows that start in the evening in time zones behind UTC now show the correct day in the Tanium Console.

Fixed an issue where updating a software package with the legacy requires32BitSystem / requires64BitSystem system requirements failed validation after upgrading to 2.49.

Fixed an issue where the Deploy - Installed Applications Details sensor did not work on macOS endpoints without python3 installed.

Fixed an issue where filtering the Deployments list by search text could show an incorrect total, resulting in extra blank rows in the list.

Fixed the Upload Package Files form showing the wrong package when opened from a failed sync on a Tanium Automate deployment.

Fixed an issue where an upgrade could leave a built-in operating system under a temporary name, preventing built-in operating systems from being kept up to date.

Fixed an issue where a job could hang indefinitely due to a network outage. The job will now time out after 20 seconds and fail as expected.

Fixed an issue where Debian and Ubuntu endpoints did not answer the Deploy - Software Packages Applicability sensor.

Fixed an issue where Mac, RHEL-based Linux, and SUSE-based Linux endpoints did not include the final row when answering the Deploy - Software Packages Applicability sensor.

Fixed an issue where Deploy - Software Packages Applicability sensor did not produce output if no minimum software package ID parameter was supplied.

Fixed an issue where certain macOS applications were not reported by the Deploy - Installed Applications Details sensor.

Fixed an issue where the Deploy - Installed Applications Details sensor did not report Windows system components that Deploy can detect with installed application rules.

Fixed an issue where the Deploy - Installed Applications Details sensor did not report applications installed within the /Users folder on macOS.

The deprecated maintenance-window delete API now returns a conflict instead of a server error when the window still has targets.

Fixed an issue where the Software Packages page gathered applicability counts for the entire software catalog on every request, causing load times to grow with catalog size.

Fixed a rare issue where Installed Application Details could not report the install location for specific applications.

Original source

Features

• Export a conversation: You can now save an Atlas conversation as a single HTML file with Export transcript in the chat header. The file opens in any browser and includes the full transcript, including the request and response of each tool call.

Improvements

• Deleting several pages at once is much faster, and any background agents on those pages are now handled in a single dialog instead of one dialog per page.
• Clicking a page in a long Pages sidebar list responds faster.
• A page recovered from Deleted now appears in its proper place in the Pages sidebar instead of dropping in at the bottom and then jumping.
• Panel headers and footers have a new design. Long titles wrap to two lines and then truncate instead of getting cut off, header actions appear on hover or focus, and the main footer action comes first.
• The endpoint details drawer has a lighter shadow, on its left edge only.
• The Background Agents panel has a date picker next to the Owner toggle. Choose Current month, Last 7 days, Last 14 days or a custom range, and the Credits column and the list of agents follow it. The panel now opens on the current month instead of lifetime totals.
• Endpoint search in the command palette now shows each endpoint's IP address, platform, user and status, along with the computer name.
• A new Atlas Audit Reader role gives read-only access through the API to all users' Atlas audit data, including conversations, transcripts and usage, without full administrator access.
• Atlas is less likely to treat an endpoint's last check-in time as the age of its cached data, or to report old inventory as the endpoint's current state.
• When filtering on a numeric sensor, Atlas is more likely to leave out endpoints that returned errors or no results, which could otherwise be counted as matches.
• If a Python script Atlas runs hits its memory limit, Atlas now knows the script failed and can see how far it got.

Resolved Issues

• Fixed an issue where selecting several pages with Cmd, Ctrl or Shift could leave the page area stuck on a loading spinner.
• Fixed an issue where going Back to a page that had since been deleted did not show the "Couldn't find that page" message.
• Fixed an issue where panels whose content fits showed a scrollbar and scrolled by a few pixels, and where the scrollbar in Suggested Prompts covered the prompt text.
• Fixed an issue where Atlas could finish a response without answering, sometimes leaving only the suggested follow-up prompts.
• Fixed an issue where a response could hang after Atlas had finished, or fail when the connection to the AI model dropped partway through.
• Fixed an issue where chat messages could briefly draw on top of each other, or the chat could jump to its scroll position, when a page opened.
• Fixed an issue where a panel's refresh button could get stuck loading.
• Fixed an issue where the Web Searches setting appeared in environments where web search is not available.
• Fixed an issue where donut charts in Tanium dashboard panels were invisible when the panel was short.

Original source

Deploy API write requests that set the Tanium-API-Strict-Mode header, including those made by Atlas, no longer fail with an empty-body validation error. The following routes were impacted and are now fixed:

POST /v1/software-packages
PUT /v3/software-packages/{id}
POST /v2/software-package-bundles
PUT /v2/software-package-bundles/{id}
POST /v1/software-package-gallery/bulk-import
POST /v1/software-package-gallery/update-import-settings
POST /v2/maintenance-windows
PUT /v2/maintenance-windows/{id}
POST /v1/deployment-templates
PUT /v1/deployment-templates/{id}
POST /v1/default-deployment-template
PUT /v1/automatic-deployments/{id}
POST /v1/profiles
PUT /v1/profiles/{id}
PATCH /v1/profiles/{id}/software
POST /v1/operating-systems
POST /v1/tempfiles

Original source

Security Update

• This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium Resource Center, or by contacting support.

Fixes

Fixed issues:

• Removed the platform Read User privilege from the Comply Report Reviewer role.
• Fixed an issue where the Vulnerabilities Overview Atlas page template did not appear in the Page Template Gallery when browsing by category.
• Fixed an issue where manually updating the TVL displayed an error banner even though the update was still in progress and completed successfully.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.
• A Remote Authenticated Scan (RAS) assessment that uses the Unix vulnerability source, has no operating system selected, and includes all CVEs can cause the Comply Service to restart repeatedly. While this is happening, Comply may be unavailable and assessment updates may not publish. To avoid this, create the assessment with an operating system selected or with criteria that limit the CVEs included, such as years or severity. If the service is already restarting, disable the schedule on the affected assessment, then recreate it using one of these options.

Original source

Features

• Background agent spend notifications: Atlas now lets you know when background agents are using a large share of your AI credits, with no setup needed. Administrators are notified when background agents across the environment reach 25% and then 75% of the monthly credit allocation. Owners are notified when their background agents together reach 25% of their personal credit cap, or 15% of the environment's allocation if they don't have a cap. Each notification arrives in Activity Center and by email, and opening it shows which background agents are spending the most. You can change or turn off these thresholds in Configure threshold warnings, on the AI Credit Usage page for administrators or the My Usage page for owners.

Improvements

• Fleet queries that will never finish now give up sooner instead of holding your conversation for up to ten minutes.
• A fleet query that Tanium rejects now comes back right away, so Atlas can fix it and try again.
• The home screen's prompt bar and starter prompts have a refreshed design.
• The command palette footer now has a / Switch Mode hint, so slash shortcuts like /e for endpoint search are easier to find.
• When you duplicate a page, the original page's chat now notes that a copy was made from it. Anyone who opens the original page later sees the note too.
• When you delete a page, background agents that are already paused or disabled now default to Delete in the confirmation dialog, rather than Disable.
• Artifacts in chat can no longer be renamed.

Resolved Issues

• Fixed an issue where sensor searches could come back empty, even for an exact sensor name, causing Atlas to report that a sensor did not exist.
• Fixed an issue where asking for the same sensor twice with different parameters in one query silently dropped one of the answers.
• Fixed an issue where Shift-clicking pages in the sidebar to select a range opened the clicked page in a new browser tab.
• Fixed an issue where panels could stay on "Atlas is still starting up" until the page was refreshed, if Atlas was opened while the service was starting.
• Fixed an issue where resizing the browser window froze the chat for several seconds and made the sidebar stutter.
• Fixed an issue where some panels showed their heading twice, which made navigating by heading with a screen reader confusing.

Original source

LATEST · SEPTEMBER 2026

Explore what's new across the Tanium platform this month, organized by solution area.

⚑ Action recommended this month 2

A couple of this month's changes have a suggested next step. Details appear inline on each item below.

• Tanium Atlas — Atlas Web Searches: if you want Atlas to use web search, an admin needs to enable it in Atlas Settings, accept the disclosure, assign the Atlas Web Searcher role, and configure the Internet Access Policy allow/block list. (Core Platform & AI Services) · Jump to details →
• Tanium Provision — New Admin Controls for PXE Authentication: review and configure the new Provisioning Password and Technician Access Password settings in the Provision admin interface. (Endpoint Management) · Jump to details →

PLATFORM & ATLAS

Core Platform & AI Services →
32 updates, including 24 for Tanium Atlas

SOLUTION AREA

Endpoint Management →
9 updates

SOLUTION AREA

Exposure Management →
2 updates

SOLUTION AREA

Security Operations →
5 updates

SOLUTION AREA

Integrations →
1 update

NEW THIS MONTH

Lifecycle & EOSS/EOL Notices →
8 items newly noticed this month — see the full lifecycle tracker for every item that has yet to reach EOSS/EOL

Core Platform & AI Services

32 updates, including 24 for Tanium Atlas

Tanium Atlas

SEPTEMBER 17, 2026
Guided Skill Authoring with /skill-creator

What it is:
The new /skill-creator command interviews you step-by-step to build a custom Atlas skill — what it's for, when it triggers, what inputs it needs. The draft opens in the Skill Workspace for you to review before saving, and can include supporting files/scripts for logic you want deterministic rather than left to the model.

Why it matters:
Guided skill authoring makes custom automation more accessible.

SEPTEMBER 15, 2026
Atlas Web Searches

What it is:
Atlas can now search the web and read results, so questions needing outside sources (a CVE write-up, vendor advisory, patch note) aren't limited to your environment's data; answers cite what they used. An admin must enable Web Searches in Atlas Settings and grant users the Atlas Web Searcher role. Reachable sites are governed by an admin-maintained Internet Access Policy allow/block list; blocked domains are named in the response.

Why it matters:
Extends Atlas beyond internal Tanium data to real-time external context, but opens a new data-egress path — admins have to deliberately opt in and govern it via role and allow-list controls rather than it being on by default.

⚑ Suggested action:
If you want Atlas to use web search, an admin needs to enable it in Atlas Settings, accept the disclosure, assign the Atlas Web Searcher role, and configure the Internet Access Policy allow/block list.

SEPTEMBER 10, 2026
Sharing Skills with Your Content Set

What it is:
Skills can be shared by being published to a content set. Skills are private until published to a content set, after which everyone with access can run them immediately.

Why it matters:
Sharing skills supports teams sharing custom Atlas workflows instead of everyone building their own.

SEPTEMBER 10, 2026
Write Your Own Atlas Skills

What it is:
You can now author custom Atlas skills. A skill is a set of Markdown instructions Atlas follows when invoked. Skills can include .csv, .json, .yaml, .toml, .py, and .txt files alongside SKILL.md.

Why it matters:
Lets teams codify their own repeatable workflows into Atlas, including deterministic logic via Python scripts, instead of being limited to Tanium's built-in skill set.

SEPTEMBER 23, 2026
Template Favorites

What it is:
Template favorites: Allows you to favorite templates, adding them to the “Favorites” category.

Why it matters:
Makes it easier for you to find templates you commonly use.

SEPTEMBER 21, 2026
Save Any Page to the Template Gallery

What it is:
Save to Gallery: Any page you have built can now be saved to the template gallery.

Why it matters:
Saving a page to the gallery lets others in your environment reuse pages you have created.

SEPTEMBER 21, 2026
Charts Over Time in Atlas

What it is:
Atlas can chart a series of values over time, as a line or an area.

Why it matters:
Additional charts support tracking metrics over time.

SEPTEMBER 17, 2026
Detail Views Open in a Side Drawer

What it is:
Panels can now open a detail view in a right-side drawer instead of stacking it inline or opening a dialog.

Why it matters:
Keeps the underlying table/panel visible while inspecting details and lets you turn a drilled-in view into a standing panel without losing your place.

SEPTEMBER 15, 2026
Smarter Routing for Deploy Requests

What it is:
Atlas now routes a deployment request based on completeness: a vague or partial request opens a pre-filled deploy panel for you to review and submit; a fully specified request (package, target, parameters) goes straight to an inline approval card. A person reviews before anything runs either way.

Why it matters:
Cuts a step for well-specified requests while still requiring human approval, and avoids Atlas guessing at ambiguous ones without giving you a chance to adjust them.

SEPTEMBER 10, 2026
Background Agents in the Chat Rail

What it is:
The chat rail header now has a Chat/Agents toggle that allows you to toggle between background agent information and your conversation.

Why it matters:
Gives visibility into what background agents are doing and their AI credit usage without losing your in-progress chat.

SEPTEMBER 4, 2026
Atlas Avoids Authoring Sensors That Execute Arbitrary Binaries

What it is:
Atlas now avoids writing sensors that execute arbitrary binaries and flags any such sensor as maximum risk.

Why it matters:
Tightens the security posture of AI-authored content by steering away from an unrestricted execution pattern before it reaches your environment.

SEPTEMBER 4, 2026
Unsafe Standing-Grant Calls Refused in Unattended Sessions

What it is:
In an unattended session, a call covered by a standing grant that Atlas judges unsafe is now refused outright.

Why it matters:
Prevents unsafe actions from running when no human is available during unattended or scheduled runs.

Tanium Atlas MCP Server

SEPTEMBER 17, 2026
OAuth Client Registration for the Atlas MCP Server

What it is:
Tanium now supports registering OAuth clients in Atlas to connect to the Atlas MCP Server or directly to Tanium's REST/GraphQL APIs. At registration, clients choose a grant type: Authorization Code (a person signs in and approves; tokens carry the combined roles of that person and the client) or Client Credentials (machine-to-machine, no person signs in; the client authenticates with its own secret and acts as whoever registered it).

Why it matters:
Gives you a standards-based, auditable way for external tools and automations to call Tanium — with explicit control over whether access is tied to a real user or runs unattended as a service.

SEPTEMBER 1, 2026
MCP Tool Calls Table on the Atlas Audit Page

What it is:
The Audit page in the Atlas UI now includes an MCP Tool Calls table showing tool names, callers, results, and Atlas AI credit usage per call.

Why it matters:
Gives admins visibility into what MCP-connected clients are doing and how much AI credit they consume.

QUALITY-OF-LIFE IMPROVEMENTS

• Tanium Atlas — Favorite templates from a card's menu and find them under the new Favorites filter in the template gallery.
• Tanium Atlas — Duplicate a page: Duplicate a page from the page header or the sidebar menu.
• Tanium Atlas — Page Scope selectors are hidden for users who have no personas assigned.
• Tanium Atlas — Computer names, computer IDs and IP addresses in a results table are clickable, opening that endpoint's core identity in the drawer along the right edge of the page.
• Tanium Atlas — Atlas now lists every keyboard shortcut it supports, grouped by category.
• Tanium Atlas — The chat welcome screen added a Browse Templates button that opens the gallery directly.
• Tanium Atlas — Atlas now checks the skill currently open in the Skill Workspace, including unsaved edits, before answering questions or proposing changes.
• Tanium Atlas — Browse Skills in the command palette now has a Create Skill control with two paths: Create New opens a blank skill in the editor; Create with Atlas opens a chat pre-loaded with a skill-creation prompt.
• Tanium Atlas — Atlas now searches its entire available tool set before concluding a capability doesn't exist, rather than stopping after checking only part of it.
• Tanium Atlas — Page rows in the Pages sidebar now behave as real links — right-click, Cmd/Ctrl+click, and middle-click work as expected.
• Tanium Atlas — Typing “/” into an empty command palette now opens the full list of available modes, navigable with arrow keys.
• Tanium Atlas — New “Add from gallery” option in the page header menu and on any page's sidebar row opens the template gallery already scoped to that page.
• Tanium Atlas MCP Server — AI credit usage initiated via MCP is now attributed to the authenticated caller in the Conversations table on the Audit page.
• Tanium Emerging Issues Content — Added Sideloaded/Unpacked and Developer mode detections to the Guardian Spotlight – Browser Extensions dashboard.
• Tanium Endpoint Configuration Toolset — Added OS diagnostics collection for AIX and Solaris to Must Gather.
• Tanium Endpoint Configuration Toolset — Added a health check for missing/broken Windows performance counters.
• Tanium Endpoint Configuration Toolset — Added battery metrics for Linux endpoints.
• Tanium Endpoint Configuration Toolset — Added netstat output to Must Gather.

Endpoint Management

9 updates

Tanium Patch

SEPTEMBER 15, 2026
Patch Deployment Pre-Notifications Now Available to All Environments

What it is:
Deployment pre-notifications are available on any environment where Patch CX has finished rolling out through all Endpoint Configuration upgrade rings.

Why it matters:
End-user notice ahead of a patch deployment allows better communication around patching activity.

Tanium Provision

SEPTEMBER 7, 2026
Per-Deployment Token Encryption for Imaging

What it is:
Each imaging deployment now gets its own password to encrypt its provisioning tokens.

Why it matters:
Per-deployment encryption passwords limit the blast radius if one deployment's token password is compromised.

SEPTEMBER 7, 2026
New Admin Controls for PXE Authentication

What it is:
New admin settings let you set passwords and rules controlling PXE authentication and unattended imaging behavior.

Why it matters:
Configurable passwords and global settings let admins control who can PXE-boot and provision devices unattended.

⚑ Suggested action:
Review and configure the new Provisioning Password and Technician Access Password settings in the Provision admin interface to take advantage of the hardened PXE authentication.

QUALITY-OF-LIFE IMPROVEMENTS

• Tanium Provision — Added support for SDelete 2.0.6 in Provision retirement actions.
• Tanium Provision — The imaging pipeline now limits how many HTTP requests it will accept in a given time window.
• Tanium Provision — TaniumPXE and the endpoint being provisioned now cryptographically verify each other's identity before imaging starts using signed JWT tokens.
• Tanium Provision — Domain-join requests made during imaging can now only be used once and are tracked.
• Tanium Patch — After upgrading, Tanium Scan for Windows performs a one-time full metadata resync for WSUS sources to recover any patch metadata missed by earlier syncs.
• Tanium Performance — Cloud customers with the Performance Operator role can now run a sync-all of alerts, previously limited to on-prem Performance Administrators.

Exposure Management

2 updates

QUALITY-OF-LIFE IMPROVEMENTS

• Tanium Comply — On-demand rescans for TSE 7.0 now allow for a distribute-over-time (DoT) action period.
• Tanium Comply — Added support for macOS 27 vulnerability assessments.

Security Operations

5 updates

Tanium Threat Response

SEPTEMBER 23, 2026
New Generic Event Log Search Sensor

What it is:
Added a new Generic Event Log Search sensor.

Why it matters:
This sensor enables you to search Windows event logs by event ID, search term, lookback period, and event log source.

SEPTEMBER 23, 2026
Regex-Based File and Directory Filters for Index Configurations

What it is:
Index configurations now support File and Directory Filters by Regular Expression.

Why it matters:
You can exclude specific files or directories from Threat Response Index hashing and scanning using regular expressions.

QUALITY-OF-LIFE IMPROVEMENTS

• Tanium Threat Response — TAXII intel sources now accept a username-only or password-only credential.
• Tanium Threat Response — Threat Response Saved Evidence now shows the endpoint hostname for events saved from a snapshot connection.
• Tanium Threat Response — Artifact enrichment now uses a send-to-chat action instead of the Enrich button.

Integrations

1 update

QUALITY-OF-LIFE IMPROVEMENTS

• Tanium Patch Management for IT Operations — Added support for attaching Tanium Patch Lists directly to a Patch Request when using the ServiceNow Patch Management for IT Operations integration.

Lifecycle & EOSS/EOL Notices

8 items newly noticed this month. Sorted soonest to reach EOSS/EOL first.

EOSS — 2026-NOV-16
EOSS for IBM AIX 7.2 TL5, RHEL 5 / CentOS 5, and macOS X

Recommended action:
Move to a newer, currently supported OS version.
Read the TRC article ↗

EOL — 2026-DEC-31
Asset — Push Destination: Flexera

Recommended action:
Migrate to the Integrations Gallery.
Read the TRC article ↗

EOSS — 2026-DEC-31
Tanium Ask

Recommended action:
Use Tanium Atlas — all Ask functionality is available there.
Read the TRC article ↗

EOSS — 2026-DEC-31
Tanium Comply — Vulnerability Scanning Changes

Covers four Comply items reaching EOSS together: Network Drives (no replacement), Scan Timeout, Process Priority, and Shipping JREs (superseded by the new scan engine architecture; CIS-CAT engine users can upload their own JRE).

Recommended action:
Review the article for the specific change affecting each setting.
Read the TRC article ↗

EOSS — 2026-DEC-31
Tanium Trends (Cloud)

Recommended action:
Move to Reporting, then on to Tanium Atlas.
Read the TRC article ↗

EOSS — 2027-MAY-18
Core Content — Forefront Support

Recommended action:
Move to Core Content 1.6+, which supports Microsoft Defender content.
Read the TRC article ↗

EOSS — 2027-NOV-17
Tanium Client 7.7

Recommended action:
Upgrade to Tanium Client 7.8+.
Read the TRC article ↗

EOL — 2028-SEP-30
Tanium Server on Windows

Recommended action:
Tanium Cloud is recommended. If that's not possible, a cloud or virtual appliance; physical appliances are not recommended given a 12-month lead time and supply constraints.
Read the TRC article ↗

This list covers only what's newly noticed this month. For the complete, always-current list of every item that hasn't yet reached EOSS/EOL — plus what's already been deactivated — see the Tanium Product Lifecycle tracker →

Resources

Register for Titans LIVE!: Monthly Tanium Product Updates

PUBLIC

Original source