Release Notes Connect (Version 4.5)

Thank you for choosing Tanium. This document is intended to document changes between releases of Tanium Connect.

Tanium Connect Version 4.5.0

Release Date: 2/6/2018

Please note that 4.5 is available on 7.x Tanium Servers. 6.5 support is coming shortly.

Security Update

• This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Support Portal, or by contacting your TAM.

Enhancements

• Ability to select hidden columns when using a saved question source.
• Saved question connections now default to use a timeout of 10 minutes rather than rely on % complete.
• Connect and Reputation log levels can be configured in the UI.
• The output directory on the appliance is now pointing to `opt/mounts/connect` allowing users to access the output files.
• Connection configuration updates no longer require re-entering unchanged sensitive data like passwords and usernames.
• Server logs and connection run logs contain more information to aid in debugging. The logs are also structured so that the timestamp, log level, and message all align, making the logs more readable.
• In addition to log format improvements, the log messages have also been improved to be more understandable and helpful in debugging.
• Connection Run Id can be added to a connection's columns.
• {connection name} and {connection run id} can be used in email subjects and filenames.
• Reputation Palo Alto Networks WildFire service provider can be configured to limit the batchsize and the number of batches to run per minute.
• Connections to IP addresses on an internal network require admin privileges to prevent network scanning.
• Reputation Whitelist/Blacklist. With this major new addition to the Reputation service, users can use a new API or Workbench tab to whitelist and/or blacklist specific hashes. The whitelisting/blacklisting is aware of reputation groups so that if one hash in an md5, sha1, sha256 group is whitelisted or blacklisted, then it affects the overall group's reputation.
• Both individual hashes, and groups of hashes and files can be uploaded into the Reputation Whitelist/Blacklist.
• Reputation modal - update "Reports Available" to "Reputation Details". Previously, the reputation details modal would only list reputations from external services. That led to confusing behavior for hashes that had been whitelisted or blacklisted since their overall reputation would be affected but without any corresponding reputation data shown in the modal. Now, the whitelist/blacklist information for hashes are included.
• Reputation configuration now allows users to specify minimum free disk required for the service to run. This setting defaults to 85%.

Resolved Issues

• Change in Reputation Source toggles to opposite enable state on Save. This fixes a regression in the Reputation sources tab that was incorrectly toggling the enable/disable buttons. Now, the enabling/disabling of Reputation sources is a proper checkbox in their configuration.
• Reputation Settings page settings cannot be saved. This fixes an issue with the Reputation settings data. The data format for one of the fields was changing when first updated, which caused subsequent updates to fail.
• Ensure consistent reputation determination. Reputation determination is now consistent across all the equivalent hashes (MD5, SHA1, SHA256).
• SQL column definition changes on insert. This fix ensures that Connect handles updates to a column definition properly.
• Hide Detect Intel Provider Destination from unsupported sources. This fix prevents users from improperly configuring a connection. The Detect Intel Provider can only be configured with the Palo Alto source.

Tanium Connect Version 4.5.1

Release Date: 2/13/2018

Please note that 4.5.1 supports Tanium Server 6.5 and all 7.x Tanium Servers.

Enhancements

• Reputation Service logging has been improved.

Resolved Issues

• Connect UI failures experienced with Tanium Server 6.5 have been resolved.
• The whitelist/blacklist grid in the Reputation Service was not working properly in Firefox. This issue has been resolved.
• Some Trends connections were throwing errors while processing connections that included `other row` information. This issue has been resolved.

Tanium Connect Version 4.5.2

Release Date: 2/20/2018

Resolved Issues

• Reputation now better handles Virustotal responses. An issue was reported when Virustotal began returning a previously unseen response. This caused hash processing to retry the same hashes. This issue has been fixed.
• In order to select 'includeHeaders', columns must be configured. Connect only enables the option to include headers in CSV format if the columns are configured.
• Connect and Reputation continue to improve logging and error handling to provide useful debugging data.
• The option to `use cached data` on a saved question source has been removed. This option was not working as expected. Research into the issue confirmed that even with the option enabled, Connect was re-asking the saved question. The behavior of connections using this option will not be adversely affected; behavior will remain unchanged as the option was not working.

Additional Information

See 4.0.0 release notes if you have not yet upgraded to Connect 4.

Known Issues and Workarounds

• Authentication success and failure tracking is available with Tanium Server 6.6 or later at this time.

Product Documentation and Resources

• Connect Documentation
• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup