Tanium Cloud Impact Updates & Release Notes

Important Notes

• The Impact - Computer Domain SID sensor has been deprecated and will be removed in a future version of Impact.
• The Impact - Physical NetBIOS Computer Name sensor has been deprecated and will be removed in a future version of Impact.
• The Impact - Active User Session SIDs sensor has been deprecated and will be removed in a future version of Impact. This sensor has been replaced by the Impact - LSA Session Details sensor.

Features

• Tanium Impact now allows authorized users the ability to terminate active sessions for an endpoint or a specific user from the Tanium Impact Workbench!
  • Authorized users can now terminate sessions directly from both the sessions grid or the Impact overview page.
  • Terminate Sessions allows targeting and terminating individual active sessions or all active sessions by endpoint or by user.
  • The Impact overview page now includes a link to the Action Deployments page in Tanium Console that displays the Impact - Terminate Sessions package.
• Added the new "Impact Sessions" user role. The Impact Sessions role allows users assigned the role the ability to terminate sessions from the Impact module workbench.
  • Note: Users must have the Impact Sessions Operator role or a custom role that has the Impact Sessions Terminate permission to terminate sessions.

Improvements

• Upgraded various third-party libraries to their latest versions.
• Added a Sessions Section to the Overview Page
• Added Session Related Charts to Overview Page
• Updated RBAC Permissions for Session Termination Actions
• Updated Impact workbench to add Terminate Sessions buttons and controls when viewing computer objects.
• Added options to Terminate All Sessions when viewing computer objects.
• Updated hover text to be "Endpoint" consistently instead of "Computer".
• Resolved issues with the Login Type quick filter to improve search functionality.
• Updated thresholds on repeat execution of the Collect & Analyze button.
• Modified the position of the Terminate All Sessions button.
• Alphabetized the available options for LoginType in the workbench.
• Improved Quick Filters behavior.

Resolved Issues

• Corrected an issue with Live Sessions chart data that could cause a page crash in specific scenarios.
• Fixed specific targeting issue that prevented the Terminate Sessions action from targeting correctly in some circumstances.
• Fixed an issue with the "Show Logon ID" column displayed in current grid.
• Resolved an issue where the Terminate Sessions Package was not successfully terminating a session under specific conditions.
• Updated tab counts based on applied filters to show correct filtered counts.

Important Notes

• The next major release of Tanium Impact will not support Microsoft Windows 7 endpoints.
• The Impact - Computer Domain SID sensor has been deprecated and will be removed in a future version of Impact.
• The Impact - Physical NetBIOS Computer Name sensor has been deprecated and will be removed in a future version of Impact.
• The Impact - Active User Session SIDs sensor has been deprecated and will be removed in a future version of Impact. This sensor has been replaced by the Impact - LSA Session Details sensor.

Improvements

• Upgraded various third-party libraries to their latest versions.

Fixes

• Fixed an error in which a large number of assets could cause the console to fail to load.

Important Notes

• The next major release of Tanium Impact will not support Microsoft Windows 7 endpoints.
• The Impact - Computer Domain SID sensor has been deprecated and will be removed in a future version of Impact.
• The Impact - Physical NetBIOS Computer Name sensor has been deprecated and will be removed in a future version of Impact.
• The Impact - Active User Session SIDs sensor has been deprecated and will be removed in a future version of Impact. This sensor has been replaced by the Impact - LSA Session Details sensor.

Improvements

• Added charts to the sessions view to show Logon Types, Session Status, Authentication Packages, and the Top 10 Endpoint/User Sessions.
• Added a privilege indicator to the sessions results grid to indicate if the session uses administrator or non-administrator privileges.
• Added the ability to display Analyzed or Current data in the sessions view. Analyzed data represents session data from the most recent analysis. Current data includes results from endpoints managed by the Tanium Client that are currently online from sensor data.
• Added First Seen and Last Seen columns to the session details view for analyzed data. These values correspond to the first and last detected instances of the entity.
• Added filters to the Analyzed and Current view of the sessions details. Analyzed data represents session data from the most recent analysis. Current view data includes results from endpoints managed by the Tanium Client that are currently online from sensor data.
• Removed the Shortest Path button from the Sessions view.
• Added a setting for Session Retention Settings. You can enter between 3 and 365 days. The default session retention time period is 200 days.
• Added filters to the details pages to ensure parity with the overview page. Filters differ depending on the root asset type (endpoint, group, or user) and they are now consistent when the asset type is the same.
• Migrated the Summary charts that appear on the Impact Overview page from Tanium Trends to Tanium Reporting.
• Provided a new sensor named Impact - LSA Session Details to retrieve information regarding user sessions on the local endpoint.
• Added the Impact - Terminate Sessions package to terminate user sessions on targeted endpoints based on user-provided input.
• Added a dependency on version 1.11.745 of the Tanium Extras endpoint tool. This is provided in Toolset Manifest version 2.18.17 or later.
• Upgrades various third-party libraries to their latest versions.

Fixes

• Fixes an issue where null characters in the data collection history could cause migrations to fail.

Improvement

• Upgrades various third-party libraries to their latest versions.

Fix

• Fixed an issue that could cause the Impact workbench to crash when synchronizing data between endpoints, users, groups, all configured domains, and Impact.

Known Issues

• The default sorting order for the Groups and Endpoints tables is incorrect. As a workaround, shift-click the columns to match the default sorting order outlined in the documentation, or to set your own desired sorting order. The defaults will be fixed in a future release.

New Features

• The Users, Groups, and Endpoints tables have been combined into a new tabbed “Findings” panel.
  • New metrics scoped to each tab provide additional insights.
  • New columns available for selection.
  • You can now view Endpoint Details for Tanium Managed endpoints listed in the Endpoints table.
• A filter builder has been added to all tables.
  • All columns can be filtered on.
  • Combine multiple filters to narrow the scope of findings.
• Filters for “Direct” and “Indirect” have been added to the “Indirect / Direct Control” and “Indirect / Direct Members” views.
• Adds a Criticality Sync status bar.

Improvements

• The "Impact Lookup" bar now enables you to choose between searching for Users, Groups, or Endpoints (default is ALL), and includes additional datapoints in the result selection.
• The 1,000-row limit has been removed from each table in the Overview and the Impact Lookup bar.
• The “Indirect / Direct Control” view now makes it easier to distinguish between Direct and Indirect Control.
  • The “HOP” count in the Graph Visualization has been replaced. The first column will always be “Direct Control”. Additional columns will display “Indirect Control” followed by a number, making it easier to identify unintentional/undesired administrative privileges.
  • The “HOP” column in the Users/Groups/Endpoints tables has been replaced with a “Control” column.
• The “Indirect / Direct Members” view now makes it easier to distinguish between Direct and Indirect Membership.
  • The “HOP” count in the Graph Visualization has been replaced. The first column will always be “Direct Members”. Additional columns will display “Indirect Members” followed by a number, making it easier to identify how much (if any) group nesting Is present, and determine exactly how a User/Group/Endpoint is a member of a group.
  • The “HOP” column in the Users/Groups/Endpoints tables has been replaced with a “Membership” column.
• Upgrades various third-party libraries to their latest versions.

Fixes

• Fixes an issue where irrelevant relationships may be shown in the “Indirect / Direct Control” view when an Endpoint’s Active Directory computer account is a member of a group that grants admin privileges on another endpoint.
• Fixes an error in the help text.

Known Issues

• The default sorting order for the Groups and Endpoints tables is incorrect. As a workaround, shift-click the columns to match the default sorting order outlined in the documentation, or to set your own desired sorting order. The defaults will be fixed in a future release.