Release Notes Tanium Server and Tanium Client (Version 7.2.314.2962)

Thank you for choosing Tanium.  The following Release Notes document changes between releases of the Tanium Server and Tanium Client.
The previous version can be found here: Release Notes (Version 7.2.314.2831)

Tanium Server and Tanium Client v7.2.314.2962

General Availability Release Date: February 2018

Major Features

• Configurable, native encryption capabilities for network communications and sensitive files on disk
• Tanium configuration command line interface (CLI)
• Tanium objects Export/ Import API

Improvements

• Database pruning of old Question, Action and Temporary Sensor data
• Tanium Client v7.2 environment variables
• Server SSL-certificate Registration
• Offer a richer environment to Sensors running internally within the Tanium Client

Bug Fixes

• Parametrized sensors referenced by named Computer Groups are now stored in a database table named:  group_temp_sensors .
• Modified TDownloader to use OpenSSL instead of SChannel (WinSSL) to bring it to parity across platforms.
• Improved the performance of retrieving system_settings objects, which drives the console Global Settings UI.
• Fixed a problem in the update of console.json which failed to upgrade the manifestURL and impeded the upgrade of the UI version.
• Added a flag to include Computer IDs (<cid>) in mergeable question result sets, which was needed by the Trends module.
• Added support for per-column filters against the SOAP cache, enabling column-specific filtering of Sensor results.
• Fixed an error that read RBACInsufficientPrivilege  when trying to remove a Package which has already been deleted.
• Added an entry to console.json to indicate whether the hosting Tanium Server is Linux or Windows.
• Fixed an issue where the last login times would differ between Tanium Servers configured in a high availability pair.
• Added an option to the SOAP operation to fetch users (include_deleted_flag) to include deleted users in the result.
• Removed the execution of the  tanium database cleanup during the upgrade process.
• Added an option to select the display name user for users synchronized from LDAP.
• Fixed a problem where failing a PostgreSQL transaction would leave a database connection in a bad state.
• Added a Global Setting:  StateProtectedFlag (Client, Numeric= {0, 1} ) to control the encryption of state persistence files stored in Tanium clients.
• Improved the performance of SOAP snapshots where cache contention was producing significant slowdowns under load.
• Changed  TDownloader to set  TrustedCertPath on the Module Server.
• Temporary sensors used in Groups are no longer stored in the saved_questions_temp_sensors table, but in group_temp_sensors instead.
• Temporary sensors used for Package verification are now added to the actions_temp_sensors table instead.
• Added a performance enhancing index on the expiration column of the  questions table in PostgreSQL.
• Fixed a problem that displayed an error reading ParametrizedSensorMustMatchSource when parsing some sensors.
• Fixed a UTF-8 encoding problem which would break plugin execution when writing values to the application configuration CLI on the Tanium Appliance.
• Tightened RBAC rules on the  GetSolutions SOAP request.  As a result, legacy Question Authors will no longer be able to request this information.
• Added a StartTLS option for LDAP synchronization on Windows.
• Improved client API error propagation across Zone Servers, allowing the display of conditions like URLNotWhiteListed and  URLValidatedButNotYetAvailable for easier debugging.
• Exposed new SSL configuration settings for TDownloader, made possible by its migration to OpenSSL.
• Enabled support for Certificate Revocation Lists by TDownloader after its migration to OpenSSL.
• Added detection of mismatched reporting.crt and tanium.pub keys, now logged at  LogVerbosityLevel=1 on the Tanium Server.
• Added Using TLS information in the Connections section of the Tanium Server /info page.
• Changed the behavior of database cleanup to preserve all Saved Questions referenced by active Saved Actions.
• Added  SOAPCacheFilter  support for Sensor objects to enable improved paser filtering features.
• Added LDAPs support for LDAP synchronization, above and beyond StartTLS.
• Fixed a misspelling of "Successfully" in the Tanium installer.
• Included the name of objects like Saved Questions and Actions in the result of SOAP calls to enable better error messages.
• Added a configuration option for TDownloader named WindowsCertificateStore used to customize the trusted root certificates used during file downloads.
• Fixed a Zone Server crash during shutdown, associated with requestStop() .
• Improved the support in TDownloader for the Windows certificate store to also recognize intermediate certificates.
• Fixed an RBAC issue where the Write Computer Group permission would not allow users to create Manual Groups.
• Improved unnecessary exception reporting when parsing certificate collections configured into the system.
• Fixed a display problem in Question parsing where "starts with" would be incorrectly represented as "<" (less than).
• Fixed an omission in the creation of the PGDLLPath registry key needed when configuring a Tanium Server to work with a PostgreSQL database.
• Fixed a paging issue in LDAP-synchronization when configured to work with an Oracle LDAP system.
• Fixed a problem where a Zone Server would read the registry value  TaniumZoneServer\info_export_max_age_days  as often as ten times per second.
• Fixed an issue with the modules Content Alignment operation, where it would affect the reissue interval of Saved Questions.
• Added support for ASLR support on Linux binaries as a security improvement.
• Made the default for ldap_page_size=0 on Linux systems where slapd does not support result paging.
• Saved Question have changed to consider the Computer Groups of the user who edits and modifies them.
• Added support for Whitelisted URLs to the export and import API.
• Optimized the performance of the  get_saved_questions stored procedure in PostgreSQL.
• Fixed an issue where changes to a Saved Question would change its reissue and accumulation settings.
• Improved the performance of the SQL which identifies expired Question  IDs .
• Improved the performance of the new Tanium Parser.
• Fixed a problem with TDownloader where it would crash if the ./Downloads/ directory did not exist.
• Resolved a condition where a Linux Zone Server Hub would crash when it was unable to connect to its Zone Server.
• Fixed a condition where RequireIncomingEncryption=1 was not being enforced against v6.0 clients.
• Fixed a tool-tip reference in the Package editing screen where it referenced v7.1 of the Tanium client, instead of v7.2 .
• Fixed a problem in the Merge Questions dialog where the "Merge" button was not visible at low screen resolutions.
• Fixed a missing scroll bar in the computer group selector within the Action Group edit page.
• Improved the rendering performance of the Question drill-down UI.
• Fixed the display of very long parameter strings in the Action Status screen.
• Fixed display problems associated with negative values of the console inactivity user preferences dialog.
• Fixed erratic behavior in the user preferences dialog when the answer rows to return was set to a value less than one.
• Fixed a Null Pointer Exception on the console in the Computer Groups page.
• Fixed a display problem in the Results Grid, visible when a column label and its menu icon overlapped.
• Fixed a problem where the Managed Computer Group UI would show computers accessible by the user's inherited Computer Groups.
• Added the  Submit type to form buttons, allowing the user to press <Enter> as a way of submitting.
• Fixed the Package search in the Deploy Action dialog, which would search by Name, but not by Display Name.
• Improved the warning messages when saving edits to roles and privileges to a user.  The new messages are based on the new settings being applied.
• Improved the taniumjs library when working with linked object IDs in user objects.
• Fixed an error in advanced parsing where Sensor column comparisons were not displayed in the canonical text form.
• Fixed a problem which would break the creation of Module roles in RBAC.
• Fixed a UI issue where saving Role Assignments was possible while the "Save" button was greyed out, yet still functional.
• Reduced unnecessary messages at lower values of LogVerbosityLevel to improve log readability.
• Fixed a process management issue where the Tanium client could leave defunct processes after a network reset.
• Added the --count option to Sensor debugging.
• Changed the behavior of the Tanium client to retrieve file versions against the correct manifest for Windows 10 and Windows Server 2016.
• Created the Global Setting DisableClientLogging (Client, Numeric) to disable all logging regardless of the setting for  LogVerbosityLevel .
• Added the ssl module to the Python build used.
• Fixed a set of dependencies on libdb , libgdbm and libsqlite3 which would fail client upgrades on OpenSUSE 12 and SLES 12.
• Fixed a problem where  TaniumClient.exe config list on Windows would go into an infinite display loop.
• Added a mechanism to protect the Tanium client from a malformed or corrupt configuration database.
• Added error checking to fail gracefully on systems still running PowerShell v1 , which is not supported.
• Fixed a problem where clients would stop answering questions when using DisableClientLogging=1 .
• Removed support for the StaleCount and StaleList settings, used to list stale Sensors on the client.
• Fixed a problem by which external PowerShell execution would not work in the Sensor debugger.
• Added new settings (Client*LogRollCount,  Client*LogRollZipCount) to control the number of Sensor and Action logs kept on the client.
• Fixed a problem where the last client messages were not logged when exiting.
• Added support for ASLR support on Linux binaries as a security improvement.
• Reduced the I/O write load of the Tanium client when interacting with its client.db database.
• Fixed a problem which would not support child processes that need to break away from the Tanium client JOB_OBJECT_LIMIT_BREAKAWAY_OK , and which impacted Detect v3 .
• Fixed a bug that caused failures in the creation of a configuration log.
• Added recovery mechanisms to preserve  ServerPort for missing and malformed client configuration databases.
• Fixed a crash associated with  TaniumClient!Posix::Thread::ThreadMain .

Known Issues and Workarounds

• The installer creates an invalid trusted-module-servers.crt file, which produce SSL errors: SSLReadWriteError, SSLHandshakeFailed
  Workaround: Always choose the installer's Module Server registration option during the upgrade.
• Computer Group filtering in the Question Builder does not work properly.
  Workaround: N/A
• Sensor names are duplicated in the Question text of drilldown panels.
  Workaround: N/A

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup