Tanium Cloud Performance Updates & Release Notes

New Features

• Introduces Performance profile management in Atlas, letting operators browse and prioritize profiles, review and approve Atlas-proposed profile edits and new profile, and inspect saved profiles in a compact read-only view.

Improvements

• Added a Getting Started template for Performance that guides new users through endpoint health setup and monitoring in Atlas.
• Alert details in Atlas now open in a side drawer instead of adding a new panel to the page, and the drawer can be promoted to a panel when operators want to keep it.
• Added an Application Monitor List panel in Atlas that displays configured application monitors.
• Third-party dependency security updates: Upgraded various third-party libraries to new versions.

New Features

• Begins rolling out TSL (Tanium Scripting Language) implementations for Performance sensors across all supported OS platforms (Windows, Linux, Mac), improving sensor execution consistency and maintainability going forward.

Improvements

• The Performance - System CPU Utilization Analysis sensor now reports CPU interrupt time, giving admins visibility into whether hardware interrupts are contributing to high CPU utilization across the fleet.
• Improved the Atlas alerts component: key columns like online status and computer name are now positioned further left, the Tanium user is displayed by name instead of a placeholder dash, and the computer group dropdown now includes a search bar.
• Introduces a Process Group List panel in Atlas, showing configured process groups with their prioritization.

Resolved Issues

• Fixed an issue where the Performance - Startup Programs Count sensor always reported the same value regardless of how many startup programs were actually configured on the endpoint.
• Fixed an issue where the Page File Used and Page File Size metrics in the Performance - System Memory Metric Analysis sensor returned no data on macOS and Linux.
• Fixed an issue where the Top IO Process Names panel ranked processes by read throughput only, so high-write processes could be missing from the ranking.

Improvements

• The Performance Trends Overview dashboard is now available as a Performance Overview page template in Atlas.
• Boot and logon page templates in Atlas now include categories, making them easier to browse and select.
• Third-party dependency security updates: Upgraded various third-party libraries to new versions.

Resolved Issues

• Fixed an issue where the Performance - System Network Metric Analysis sensor did not return usable data for Wifi Quality and Wifi Strength(dBM) metrics on MacOS.

Improvements

• The workbench now shows a persistent warning when the Tanium Performance action group targets no computers, so a profile that appears deployed but isn't actually installed anywhere is no longer silent.
• Cloud customers with the Performance Operator role can now run a sync-all of alerts, a capability previously limited to on-prem Performance Administrators.
• Extends the Top Process Metric Analysis sensor to run via TSL scripts across all supported OS platforms, improving cross-platform consistency.
• The app crashes use case in Guide's Activity Center now includes a live question for deeper endpoint-level investigation, restoring detail that classic reference links previously provided.

Resolved Issues

• Fixed an issue where the workbench accepted process match values it couldn't actually monitor, which could silently match nothing or, in rare cases, prevent metrics collection entirely.
• Fixed an issue where large file downloads over DEC could time out and abort partway through due to slow default transfer pacing and a fixed 30-second idle timeout.
• Fixed an issue where Configured and Coverage Status could report Windows 8.1 and Windows Server 2012 R2 endpoints as supported.
• Fixed an issue where the endpoint filter monitor would poll indefinitely after failing to connect to an unreachable endpoint.
• Fixed a crash on the Events page that could take down the entire Performance Workbench when the eventType URL parameter wasn't a recognized value.

Behavior Changes

• IO Total Operations values will change.

  The IO Total Operations metric in the Performance - Top Process Metric Analysis and Performance - Trends Top Process Metric Analysis sensors previously added write operations to themselves instead of adding read operations to write operations. Now that it correctly sums reads and writes, reported values will differ from prior releases on every platform: read-heavy processes were understated and will increase, and write-heavy processes were roughly doubled and will decrease. Saved reports, dashboards, and thresholds built on this metric should be reviewed.

• Files downloaded through Direct Connect are no longer zipped.

  With the Direct Connect subsystem now running on the Performance Go service, files stream directly from the endpoint to the browser rather than being archived server-side first. A downloaded file arrives in its original format with its original name, so it no longer needs to be extracted before use. Any scripts or procedures that expect a .zip archive from the File Browser should be updated.

New Features

• Operators can now open the full detail of a Performance alert directly in Atlas — status and resolution, metrics, rule configuration, and the endpoint findings summary — without navigating to the Performance workbench.

Improvements

• Performance now detects when alert data has fallen out of sync during an alert status update and queues a sync automatically.
• Direct Connect file downloads now stream through the browser's native download manager, giving accurate progress, pause, and cancel behavior for large files.
• The Direct Connect subsystem now runs on the Performance Go service, improving session handling and file download throughput.
• Atlas now surfaces the Performance module Score for general fleet-level performance questions instead of defaulting to other scoring systems.
• Atlas has a fuller picture of Performance capabilities and now favors Performance sensors for CPU, memory, and disk questions, with pointers to related areas such as application and system crashes and boot and logon times.
• When asking Atlas fleet-wide performance questions, users are now notified if Performance tooling isn't fully configured on relevant endpoints, so it's clear why performance data may be incomplete.
• Sensor metadata for Performance - System CPU Utilization Analysis now describes which parameters apply together, so a quantile value is no longer supplied for metrics that do not use one.
• Corrected the help text for the Process parameter on the Performance - Process Metric Analysis sensor, which is not case sensitive.
• Corrected API route annotations across nine Performance routes so Atlas more accurately reflects which operations are read-only, idempotent, and endpoint-impacting.

Resolved Issues

• Fixed the IO Total Operations metric in the Performance - Top Process Metric Analysis and Performance - Trends Top Process Metric Analysis sensors, which double-counted write operations and ignored read operations. See Behavior Changes above.
• Fixed the Virtual Memory metric in the Performance - Top Process Metric Analysis sensor, which returned an error instead of data on Linux and macOS endpoints. The Number parameter is now honored for this metric.
• Fixed a crash that brought down the Performance workbench when the Info icon was selected on a server where Direct Connect is not installed.
• Fixed the Performance read-only and Performance user roles, which did not grant read access to process group entries. These roles can now view process group configurations, including each group's match type (process name or command line), the regular expression used to match processes, and the replacement name applied to aggregated or split metrics.

New Features

• Introduces Mini-filter Interference Analysis for Altas, a new root-cause workflow that detects when antivirus or other minifilter drivers are degrading endpoint performance. See more in the user documentation .

Improvements

• On the Live Process Monitor panel in Direct Connect you can now toggle process display in the workbench between the raw process name (e.g., ir_agent.exe ) and a friendlier product name (e.g., Rapid7 Insight Agent ), making unfamiliar processes easier to identify.
• Dismiss All for alerts with endpoints is now available directly as a grid action rather than a separate standalone button.
• Third-party dependency security updates:

Upgraded various third-party libraries to new versions.

Resolved Issues

• Fixed a crash in the Direct Connect workbench caused by exceeding the maximum call stack size.
• Fixed inconsistent breadcrumb labels that didn't match their corresponding page titles.
• Fixed incorrect AI-generated example values for the CPU Utilization Analysis sensor, which previously showed labeled percentage strings instead of the actual numeric output Atlas returns.

Improvements

• Efficiency Mode column in Process Monitor:
  The Process Monitor view now includes an Efficiency Mode column that indicates whether Windows is applying power throttling to a process, providing additional context for CPU performance analysis.

• Disk Latency enabled by default in Direct Connect:
  Read and write disk latency metrics are now selected by default when opening a Direct Connect session, providing immediate storage performance visibility without manual configuration.

• Endpoint ID in Connect Alert payloads:
  The per-endpoint payload for Connect Alerts now includes the Endpoint ID (EID), making it easier to correlate alert data with other endpoint records downstream.

• Sort selected processes to the top in process charts:
  In process-based charts, checked processes can now be sorted to the top of the list using a dedicated sort column, improving focus during investigation.

• Third-party dependency security updates:
  Upgraded various third-party libraries to new versions.

Resolved Issues

• Workbench failed to render after upgrade:
  Fixed an issue where upgrading Performance caused the workbench to fail with "The workbench experienced an error while loading and cannot be displayed" due to a Node.js built-in module being incorrectly included in the browser bundle.

• Alert monitors incorrectly reset when editing profile rules:
  Fixed an issue where disabling a rule in a profile while all alert monitors were silenced caused all monitors for that profile to revert to their previous state instead of only disabling the targeted rule.

• Events page graph hung due to BigInt serialization error:
  Fixed an issue where the Events page center graph would hang when event data contained BigInt values, causing a serialization error in the service.

• Phantom "Detail gather cycle complete" log entries:
  Fixed an issue where alert monitors that hit the safety acknowledgment threshold emitted spurious log entries and incorrect throughput metric observations every minute.

Improvements

• The Overview page has been updated with richer data: added Models with Performance Events chart, Performance Database health metrics (enabled status and size), an Event Composition chart replacing the Event Rule Type chart, and additional event categories (Process Network Latency, Network Outage, WiFi Signal, Boot Time, Logon Time) in the Event Trends panel.
• Administrators can now enable or disable application crash and system crash collection per profile directly from the workbench.
• The Performance Trends dashboard is now accessible directly from the side navigation, and the Trends page is available as a quick link on the Overview page and Tanium Console quick access links.
• Bar chart buckets on the Performance Trends dashboard are now sorted high-to-low, and the color palette matches the previous Trends board.
• IPv4 and IPv6 addresses in the alert flyout are now displayed on separate lines instead of being concatenated together.
• Upgraded various third-party libraries to new versions.

Resolved Issues

• Fixed a crash in the Performance workbench that occurred when opening the event details flyout for system crash events.
• Deleting a rule from a profile via the API no longer leaves behind orphaned alert entries in TDS that could not be dismissed.
• Fixed missing spacing between the radio buttons and the Default Configuration's Performance Score weights in the Profile form.