Tanium Cloud Comply Updates & Release Notes

Enhancements

• Added the Quick Start: Vulnerability Management page template in Atlas, a multi-panel page that helps new users get started with vulnerability management in Comply.
• Removed the 14-day limit on automatic assessment creation. For new customers, Comply now continues to automatically create assessments for endpoints in the Comply action group instead of turning this off after 14 days.
• Added Comply Custom Settings panel to Atlas to view Comply Custom Settings in a list, change their priority order, and edit a Custom Setting.

Fixes

• Fixed an issue where editing a Custom Setting that targets a deleted computer group caused the page to fail to load.
• Resolved an issue on Solaris endpoints where a Comply assessment action could run the scan before receiving the correct intel.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Fixes

Fixed issues:

• Fixed an issue where a Remote Authenticated Scan (RAS) assessment using the Unix vulnerability source with no operating system selected and all CVEs included could cause the Comply Service to restart repeatedly.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Security Update

• This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium Resource Center, or by contacting support.

Fixes

Fixed issues:

• Removed the platform Read User privilege from the Comply Report Reviewer role.
• Fixed an issue where the Vulnerabilities Overview Atlas page template did not appear in the Page Template Gallery when browsing by category.
• Fixed an issue where manually updating the TVL displayed an error banner even though the update was still in progress and completed successfully.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.
• A Remote Authenticated Scan (RAS) assessment that uses the Unix vulnerability source, has no operating system selected, and includes all CVEs can cause the Comply Service to restart repeatedly. While this is happening, Comply may be unavailable and assessment updates may not publish. To avoid this, create the assessment with an operating system selected or with criteria that limit the CVEs included, such as years or severity. If the service is already restarting, disable the schedule on the affected assessment, then recreate it using one of these options.

Enhancements

• Added support for macOS 27 vulnerability assessments.
• New Comply environments are now provisioned with the Tanium Scan Engine (TSE) by default for vulnerability scanning.
• On-demand rescans for TSE 7.0 now allow for a distribute-over-time (DoT) action period. Default DoT is 15 minutes.

Fixes

Fixed issues:

• Fixed an issue where creating an exception with additional filter criteria (using Define a Rule) failed to save.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Security Update

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium Resource Center, or by contacting support.

Enhancements

• Added an Overall Vulnerability Page Template to the Atlas Page Template Gallery, showing findings by severity, top named vulnerabilities, most affected assets, and available remediations.
• Added an Overall Compliance Page Template to the Atlas Page Template Gallery, showing endpoint compliance status and check failure rates by benchmark.
• Updated the On-Demand Scan modal to inform users that starting an on-demand scan re-indexes the entire endpoint.

Fixes

Fixed issues:

• Fixed an issue where custom values defined in a custom compliance profile were not reflected in the expected value shown in an investigation. Investigations displayed the default benchmark value instead of the custom value.
• Fixed an issue where clicking the number in the Total Findings column on the Remediations > OS Patches > Patches tab did not navigate to the Actionable Findings tab.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.
• The Include network drives in scan option in the Create Assessment form is deprecated and will be removed for both vulnerability and compliance assessments.
• The following sensors are deprecated and will be removed in a future release. Transition to the Comply - Vulnerability Status and Comply - Compliance Status sensors.
  • Comply - CVE Findings
  • Comply - CVE Findings - Absolute First Found
  • Comply - CVE Findings - First Found
  • Comply - CVE Findings - Last Found
  • Comply - CVE Findings - Last Scan
  • Comply - Compliance Findings
  • Comply - Compliance Findings - First Found
  • Comply - Compliance Findings - Last Scan

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Security Update

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium Resource Center, or by contacting support.

Fixes

Fixed issues:

• Fixed an issue where the disabled-investigation message did not name the finding type, showing an unmanaged-endpoint message for OT device findings.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Security Update

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium Resource Center, or by contacting support.

Fixes

Fixed issues:

• Fixed an issue where the Comply - Vulnerability Findings Details and Patch - Applicable Patch Status by CVE sources were not available in the Filter Builder on the Remediations > OS Patches page.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Enhancements

• Added a TSE Readiness Managed Dashboard in Reporting to help customers monitor the rollout of the Tanium Scan Engine (TSE) 7.0 across their endpoints. TSE 7.0 continues to roll out over the next few releases, so dashboard values may appear unpopulated until it has been released to your environment.
• Renamed the "Last Run" column in the Assessments grid to "Last Issued" to clarify that it reflects the last time the scan-check action ran.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Fixes

Fixed issues:

• Fixed an issue where exporting the CVE list to CSV from the Comply Standards page could produce column headers containing invisible characters, causing headers to display as corrupted text when opening the file.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans

• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.

• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.

• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.

• Exceptions created using parameterized sensors may fail to save or operate correctly.

Enhancements

• Added support for configuring third-party remote vulnerability sources (OVAL) in Tanium Cloud. Supported providers include Oracle Linux, Red Hat Enterprise Linux, Ubuntu, Debian, SUSE, and Rocky Linux.

Fixes

Fixed issues:

• Fixed issues that could interrupt the Comply service when processing OT (operational technology) device data, including scans with missing manufacturer information and the addition of OT sensor data to user-created reports.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans

• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.

• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.

• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.

• Exceptions created using parameterized sensors may fail to save or operate correctly.

Fixes

Fixed issues:

• Fixed an issue on Ubuntu 24 endpoints where the Comply - CVE Investigation Details sensor returned a truncated Actual Value and an extra result row.
• Fixed an issue where vulnerability investigation Actual Values displayed a "View Actual Values" button instead of the value itself for short results.
• Fixed an issue that could cause the Comply service to restart repeatedly while processing OT (operational technology) vulnerability assessment results.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

New Features

Note: This section reflects changes that are currently rolling out over a few releases starting with ECM Toolset versions 2.38.113. It is possible you do not have these changes yet.

• Added Tanium Scan Engine 7.0 (TSE 7.0), a new scan engine designed to decrease the endpoint performance impact of vulnerability assessments.
• Added automatic distribution of TSE 7.0 to endpoints through Tanium Endpoint Configuration, using the same method as other Comply tools. No manual install or configuration is required.
• Added a TSE index scan config section in Configuration > Custom Settings to control how TSE 7.0 builds its index of endpoint files, including scan frequency, first-scan distribution timing, and file/directory exclusions. These settings are independent of any SBOM index scan settings.
• Added a Max Cache Age column to Compliance and Vulnerability investigation results, showing the maximum age (in seconds) of the index cache that was acceptable when the scan ran. A value of 0 means the scan required a fresh index. This column is populated for endpoints scanned by TSE 7.0.

Important notes

• TSE 7.0 currently supports vulnerability (agent-based) scans only. Compliance benchmark scans (CIS, STIG, and so on) and Remote Authenticated Scans (RAS) continue to run on prior versions of the TSE or the engine configured for those assessments.
• Scan Timeout, Comply Process Priority, and Network Drive settings do not apply to TSE 7.0. Tanium manages the scan timeout for TSE 7.0 automatically.
• Endpoints transition to TSE 7.0 gradually, based on the Comply-CX version running on each endpoint. Endpoints that have not reached the required version continue to use previous versions of TSE for vulnerability scans. A banner appears on the Comply > Overview page once the first endpoints have downloaded the required version.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Enhancements

• Added RAS compliance scanning support for Palo Alto Networks devices. Please see the Tanium Comply User Guide for more details.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Fixes

Fixed issues:

• Removed the default secondary sort (Check ID) on findings report columns to reduce report load time. To apply a secondary sort, shift-click the desired column header.
• Fixed an issue where CVE definitions without a CVSS vector string (e.g., CVEs in a "Reserved" state) displayed empty CVSS v2, v3, and v4 detail panels instead of indicating no scoring data was available. Comply now displays a message noting that no CVSS vector string is available for the definition.
• Fixed an issue where Network Unauthenticated Scan (NUS) assessments could remain stuck in a pending state even after the scan action completed.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.

Enhancements

• Added support for SUSE Linux Enterprise Server 16 vulnerability assessments.
• Added support for Ubuntu 26.04 LTS vulnerability assessments.
• Added support for Debian 13 vulnerability assessments.
• Added an ability to edit the selection of custom checks in an existing Compliance assessment.
• Added the ability to edit custom check scripts directly in the Comply workbench.
• Updated the Tanium Scan Engine, delivered via Endpoint Change Management

Fixes

Fixed issues:

• Fixed an issue where deleting a Computer Group caused the Exceptions page to break and removed the ability to remove that Computer Group from exceptions.
• Fixed an issue where downloading multiple assessment exports returned a 500 error when one of the selected exports was in SBOM format.
• Fixed an issue where the Comply Trends page displayed an error due to a deprecated sensor being referenced.
• Fixed an issue where time-based settings in Comply audit configuration were always displayed in seconds instead of the appropriate unit.
• Fixed an issue where compliance findings investigations with multi-line results displayed %0a characters instead of line breaks.
• Removed CVE year filters from Tanium-managed reports in Comply to simplify report configuration.
• Removed the Confidence Score column from the Software Packages view in Comply.

Deprecated Items

• Remote Authenticated Assessments (RAS) will no longer be supported for Windows, Linux, MacOS, AIX, and Solaris devices in a future release of Comply. Customers currently using RAS to scan endpoints running these operating systems should move to client-based assessments.

Known Issues

• AWS 2023 endpoints cannot be used as satellites for Remote Authenticated Scans
• Using the CVE Definitions Type bulk edit workflow to update more than 1,000+ assessments at once may produce an error. Assessments should continue to update in the background as expected, however it is recommended to run this bulk edit capability in batches when editing more than 1,000 assessments.
• SBOM-Based Golang scans are no longer supported on Windows 7 as Golang itself no longer supports Windows 7. Tanium Clients on Windows 7 Endpoints will not trigger scans for Golang Libraries regardless of the SBOM Profile created. Other SBOM Ecosystems are unaffected and will scan as configured in the associated profile.
• To prevent timeouts when querying the /v1/vulnerability-sources/:name/cves API route, it is recommended to use pagination parameters such as limit and offset.
• Exceptions created using parameterized sensors may fail to save or operate correctly.