Release Notes Asset (Version 1.27)

What's New in Asset 1.27

With this release of Asset 1.27 there are a number of major foundational changes to Asset. This article details the changes and how this can affect your environment.

Asset Sensors replaced by Core Sensors

The following Asset Sensors have been replaced in the Asset Saved Questions for the corresponding Core Sensors:

Asset Sensor	Core Sensor (Content Set)
Asset AD Short Domain	AD Short Domain (Core)
Asset Chassis Type	Chassis Type (Base)
Asset Computer Serial Number	Computer Serial Number (Core)
Asset CPU Manufacturer	CPU Manufacturer (Core)
Asset Disk Total Space	Disk Total Byte Count (Core)
Asset Domain Name	Domain Name (Base)
Asset IP Address	IP Address (Reserved)
Asset Is Virtual	Is Virtual (Base)
Asset Is Windows	Is Windows (Reserved)
Asset Last Logged In User	Last Logged In User (Core)
Asset Logical Disk	Logical Disks (Core)
Asset Manufacturer	Manufacturer (Core)
Asset Model	Model (Core)
Asset Number of Fixed Drives	Number of Fixed Drives (Core)
Asset Operating System	Operating System (Reserved)
Asset Operating System Generation	Operating System Generation (Base)
Asset OS Platform	OS Platform (Reserved)
Asset Physical Disk	Physical Disk (Core)
Asset RAM	RAM (Core)
Asset Service Pack	Service Pack (Core)
Asset System UUID	System UUID (Core)
Asset Uptime	Uptime (Core)
Asset User Details	User Details (Core)

Note: In situations where the following sensors were added to Asset manually, the upgrade will cause a disabled attribute to appear from these Sensors, this is due to the move to Core Sensor content in Asset. This can result in Asset Reports and Views to show a warning because of the disabled attributes. To correct this you should manually update the attributes in the affected Asset Reports and Views to the replacements listed above.

• AD Short Domain
• Chassis Type
• Computer Serial Number
• CPU Manufacturer
• IP Address
• Is Virtual
• Is Windows
• Last Logged In User
• Operating System
• Operating System Generation
• OS Platform
• RAM
• Service Pack
• System UUID
• Uptime
• User Details

Endpoint Fingerprint to replace Computer Serial Number

Tanium Asset has always used three attributes to uniquely identify an endpoint. If two or more attributes are matched, then the record is updated. If one or none of these attributes are found; Asset will create a new record for the endpoint. To facilitate using TDS as a data source, we are aligning Asset to the TDS identifiers. The three identifiers will be changing:

• From: Computer Name, Computer ID and Computer Serial Number
• To: Computer Name, Computer ID and Endpoint Fingerprint
• Note: Computer Serial Number will still be collected by Asset. As a result of this change, you may see an increase in duplicate entries created in Asset's database. These endpoints will eventually age out based on the Asset Purge rules or can be manually deleted from Asset.

TDS / Differential Loads (Beta)

What has changed in Asset?

• In earlier releases of Asset the method to collect Endpoint Data was completed by Tanium asking a number of Saved Questions that were distributed over time for each Tanium source load. In this release Asset can move to gathering data from the Tanium Data Service cache rather than running multiple saved questions, by default with this release Asset is still using Saved Questions. If you are interested in enabling TDS/Differential Loads contact Tanium Support for guidance.

Will TDS / Differential Loads be enabled by default?

• On-premises installs have TDS Loads disabled by default.
• Tanium Cloud Customers have been using TDS as the Tanium Source for loading endpoint data since September 19th, 2023.
• For the 1.27 on-premises release, since it is disabled by default, in order to enable TDS as a source it will require an Asset > Settings > Labs Name/Value entry to enable. Once enabled, the next Tanium Source run will remove the Asset Saved Questions and prepare TDS by enabling all the Sensors collected by Asset.
• Note: Work with your TAM to test this new feature in non-production environments before enabling TDS / Differential Loads

What is Tanium Data Service (TDS)?

• For information about TDS and how it functions see: Managing Tanium Data Service
• Now when a user adds an Attribute in Asset the Asset Service will automatically register the Tanium Sensor in TDS for collection by Asset.

What is Differential Load?

• Prior to this feature whenever the Tanium source would run, all Endpoint Data would be collected and replaced in Asset regardless of any changes in the data. In essence every Tanium source load was a Full load. With this feature Asset will only update Endpoint Data when there are changes in the data collected in TDS resulting in faster Tanium source load times.
• Maintenance Loads occur each night at midnight UTC or anytime "Reset Differential Load" is enabled. During a maintenance load, all data in Tanium Asset is completely refreshed from TDS. As a result, these loads will take longer to complete than the differential loads and can impact timestamps in Asset.
• Asset Administrators can enable a Maintenance Load for the next pending Tanium source load. Asset > Settings > Advanced - this is only visible if TDS Load is Enabled

Will deleting an Endpoint from Asset change?

• Endpoints that are registered in TDS cannot be deleted from Asset either manually or via a Purge Report to prevent unnecessary data collection overhead. When the endpoint is no longer in TDS a user or the system can be deleted.
• Asset Stale Data Age functions are not changing. What will be seen is that because TDS retains data retention of 30 days if a user selects a retention period of less than 30 days and if the endpoint is still in TDS it will not be deleted from Asset
• In order to remove an endpoint from Asset you will need to first delete the endpoint from TDS at which point it will be eligible for deletion from Asset by the system automatically or manually by a user.
  • To remove Endpoint Data from TDS refer to Purge results for specific sensors
• This release adds two new attributes to Asset that can be used to determine if an endpoint can be removed from Asset:
  • Asset Is Managed: reports true if the endpoint exists in TDS. In order to remove the endpoint from Asset, this field must be false.
  • Last Seen in TDS: the last time that Asset saw the endpoint in TDS. This timestamp will align with an hourly Asset import cycle or a TDS maintenance load.

What can I expect with this new functionality?

• Depending on the amount of Endpoint Data collected you can expect a 5x to 10x performance improvement in Tanium source load times.
• The default Tanium source load occurs every hour and with this improvement Tanium source loads that typically took more than 1 hour to complete may now complete hourly.
  • Note: The number of endpoints and the amount of attributes collected will affect load times. Once differential loads are enabled, load times may fluctuate based on the amount of data changed in the environment between loads.
• Prior to this feature any new Endpoints needed to be online and reporting into Tanium at the time that the Asset General saved question is executed in order to be inventoried. With this improvement as long as the Endpoint's data is collected in TDS then Asset will inventory the Endpoint.
• Date Stamps in Asset
  • Last Seen is the date that endpoint last interacted with TDS (EID Last Seen).
  • Updated Date is the date that a change in the endpoint was recorded in Asset. With the TDS / Differential loads if no underlying data for the endpoint changes this date will remain static until a change in TDS is recorded. If the Asset Administrator selects *Reset Differential Load* then the Updated Date will get updated if the endpoint is still registered in TDS.

Software Inventory and Usage

Software Inventory and Usage (SIU) uses a shared client cx (swmgr-cx) to collect Products and Usage of those products on all endpoints where swngr-cx is installed (Windows and MAC only). The collection of SIU data would previously have started immediately as soon as swmgr-cx was installed on the endpoint. Because swmgr-cx is a shared cx with other modules collection of SIU data used to start even if the Customer did not have Asset installed and licensed.

With this release swmgr-cx (v3.0.801) will now only start collecting Product and Usage data when the following are true;

• Asset is licensed and installed.
• Part of Computer Groups defined in the Tanium Asset Action Group.

Note: As always SIU Product Usage, when active, starts collecting usage data from all Products regardless of whether they are selected for tracking in Asset.

Tanium Asset 1.27.287

Release Date: November 7th, 2023

Improvements

• SIU Tracking will now only start on endpoints that are in the Tanium Asset Action Group. If Asset is not installed and swmgr-cx is on endpoints there will be no data collection for SIU until Asset is installed and there is a defined Tanium Asset Action Group.
• Additional performance upgrades in support for Tanium Source to move from Saved Questions to TDS as the load source.
• TDS and Differential Loads available as Tanium source load. Contact your TAM for details to Enable.
• Asset Admins can perform Complete Refresh on next Tanium source load when using TDS Loads.
• Performance upgrades in support for Tanium Source to move from Saved Questions to TDS as the load source.
• Upgraded various Client Tool Libraries to most recent versions.
• Performance upgrades in support for Tanium Source to move from Saved Questions to TDS as the load source.
• Verified support for Amazon Linux 2023.
• Updated Asset specific sensors to use Core Content sensors moving forward.

Issues Addressed

• Fixed RDB Indexing Errors for long Index Names
• Ensure SBOM Tracked Components have unique Asset Attribute Names.
• Resolved issues with Total Number of Asset not updating properly
• Resolved issues with the Asset Limited Report Reader role to allow Public Report Export.
• Resolved issues with loading the Asset Overview UI where recurring Destination or Source jobs were scheduled only 1x per week.
• Resolved an issue with the Asset is Virtual Sensor reporting incorrectly for AWS Linux systems as physical.
• Resolved an issue with Purge by Report, which while the capability to add was available in some instances it would not run.
• Resolved an issue where report generation through API could cause a connection error due to timeout issues.
• Resolved an issue where there was a serial number mismatch causing duplicate records between Intune import and Asset collected endpoints.

Tools Versions

• builder: 2.5.2
• core-cx: 2.6.2902
• core-cx: 2.7.1114
• cx-build-helper: 4.0.3
• cx-build-helper: 4.3.0
• cx-config: 1.4.2867
• extras-cx: 1.3.1357
• extras-cx: 1.3.1358
• go-buildinfo: 1.1.0
• index-cx: 3.5.1727
• python2: 2.1.44
• python3: 3.2.6
• python-source-build-helper: 2.0.1
• swmgr-cx: 3.0.801
  • WARNING - index-cx is required for the proper operation of swmgr-cx and will result in inoperability of this and other modules and features if removed or disabled
  • Bold indicates version upgrades

Known Issues

• The change from Computer Serial Number to Endpoint Fingerprint in the Asset Identifier Fields can create duplicates in Assets.
• Custom Attributes when deleted will remain in a status of Deleting.
• Custom Attribute values when added cannot be removed or set to blank.
• New SBOM Tracked Libraries will now also include a partial GUID when added to Asset for Tracking
• In situations where the following sensors were added to Asset manually, the latest upgrade will cause a disabled attribute to appear from these Sensors, this is due to the move to Core Sensor content in Asset.
  • AD Short Domain
  • Chassis Type
  • CPU Manufacturer
  • IP Address
  • Is Virtual
  • Is Windows
  • Last Logged In User
  • Operating System
  • Operating System Generation
  • OS Platform
  • RAM
  • Service Pack
  • System UUID
  • Uptime
  • User Details
  • Computer Serial Number
• This can be resolved by manually updating attributes to the report or view.

Product Documentation and Resources

• Asset Documentation
• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup