Release Notes Connect (Version 4.8)

Thank you for choosing Tanium. This document is intended to document changes between releases of Tanium Connect.

Tanium Connect Version 4.8.5

Release Date 11/13/2018

Resolved Issues

• Fix a memory leak in the main Connect process
• Fix a logging error from the session management service

Tanium Connect Version 4.8.4

Release Date 9/18/2018

Resolved Issues

• Fix invalidation of expired user sessions for connections on Tanium Server version 7.0
• Switching Connection time zones no longer loses a configured hour interval
• IE11 no longer cuts off the list of emails in the email destination summary

Tanium Connect Version 4.8.3

Release Date 9/11/2018

Resolved Issues

• Resolved a performance issue for Connection installations with millions of logged connection runs
• The Reputation Source now once again includes the VirusTotal (and other service) URIs, reputation reports can also once again be included, and reputation data headers now properly align with the values
• The SQL Server destination now fully supports and works with encrypted SQL Server connections
• The ElasticSearch destination now once again supports interpolating date formats such as {YYYY-MM} in the URL instead of strictly limiting to {YYYY-MM-DD}

Enhancements

• The schedule view charts have been redesigned to be more performant
• Connection names and runs once again link to their respective pages
• The VirusTotal logo has been updated to their new logo

Known Issues

• On Tanium 7.0 Connect can fail to invalidate expired user sessions which causes all connections for that user to fail

Tanium Connect Version 4.8.2

Release Date 8/28/2018

Resolved Issues

• The ElasticSearch format now correctly builds the ID field so records aren't incorrectly given the same ID
• Enabling/Disabling connections via bulk action now correctly updates the connection run schedule
• Connect installations with connections using the McAfee SIEM destination can now use the workbench without errors
• Connections using the Palo Alto WildFire source can now be saved without error
• The Facility and Severity fields in the Syslog format are once again properly populated with options

Enhancements

• The (deprecated) VirusTotal connection source now only displays if you still have connections configured with that source

Known Issues

• The "Include Reports" checkbox in the Reputation Source does not include reports in the output

Tanium Connect Version 4.8.1

Release Date: 8/21/2018

Resolved Issues

• Audit Log source configuration on Tanium Server 6.5 is fixed
• The Audit Log source is now fully functional on Tanium Server 7.3
• Connect filtering options are now all alphabetized
• SQL destinations now once again log any executed stored procedures
• Syslog format field names are now properly escaped throughout
• Links to edit Connections from Integrity Monitor have been fixed

Tanium Connect Version 4.8.0

Release Date: 8/14/2018

New Features

• Connect now supports Amazon AWS S3 as a destination
• Add {computer group} and {connection name} as available connection variables
• Support ElasticSearch 6.x as a destination

Enhancements

• The Connect user interface has been comprehensively rewritten to provide a more consistent experience and updated colors
• Connections that are waiting to run can now be stopped
• The socket destination has been rewritten to be more performant, error tolerant, and support more encryption protocols
• The Tanium Asset plugin has been updated to support new features provided by Tanium Asset 1.4.2
• Bulk Actions now show an error message for each individual error
• Saved Question sources now support configuring a threshold for expected rows
• In Reputation the WildFire provider has been rewritten to be more performant
• Authorization surrounding connections has been rewritten to be more robust and consistent

Resolved Issues

• New Items filter files are now correctly deleted along with their connection
• File destination now correctly uses the configured line separator in the Delimiter Separated Values format
• Connect User can now reliably create their own connections
• Connection importing has been made more reliable for many types of connection
• JSON format no longer incorrectly escapes forward slashes
• Connection headers and columns behavior is now more consistent

Known Issues and Workarounds

• The syslog format does not properly escape field names with spaces
• Connections disabled via bulk action will continue to run. Connections must be disabled from the edit page.
• The connection name filter on the schedule view is not available and will be released in an upcoming version.
• The schedule view is not as performant as the previous schedule view and improvements are underway
• Users using IE need to ensure they are on the latest version of IE possible
• The SQL Server, AWS S3, HTTP and other sources/destinations, which store passwords or private keys
  • No longer provide the user interface with the stored secure fields. User will have to provide the password to make changes that depend on the stored password, such as changing the destination table.
  • Changes that do not require the stored password, such as custom columns, do not require the User to enter the password.
  • All secure fields will be redacted in logs.
  • All secure fields will be redacted in exported connections, and need to be entered when the connection is imported.
• When using Tanium Asset as a source some destinations and formats in Connect have limited support for structured data. In most cases this is due to inherent limitations of the destination format. Unsupported combinations may result in Connection failures or undesired data on the destination.
  • SQL Server Destination using Asset Views: Either Flatten Results should be checked and customized column types should be set to Unmodified, or if Flatten Results is not set, then all of the customized column types should be set to String.
  • CEF Format: Enhanced JSON is not supported. Flatten Results is recommended.
  • CSV Format: Enhanced JSON is not supported. Flatten Results is recommended.
  • Delimited Separated Values Format: Enhanced JSON is not supported. Flatten Results is recommended.
  • ElasticSearch Format: Full support. Enhanced JSON without Flatten Results is recommended.
  • HTML Format: Full support. Flatten Results without Enhanced JSON is recommended.
  • JSON Format: Full support. Enhanced JSON without Flatten Results is recommended.
  • LEEF Format: Enhanced JSON is not supported. Flatten Results is optional.
  • Syslog Format: Enhanced JSON is not supported. Flatten Results is optional.

Additional Information

Connect 4.8.0 no longer supports upgrading from Connect 3. To upgrade from Connect 3 you must first upgrade to Connect 4.7.4.

• Connect Documentation

Supported Tanium Platforms

Tanium Server 6.5, 7.0, 7.1, 7.2

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup