Release Notes Core Content (Version 1.8)

Thank you for choosing Tanium. This article documents changes between releases of Core Content.

Core Content replaces the deprecated Initial Content Tanium Solutions.

Important

Any Scheduled Actions associated with these packages will need to have targeting updated after each update to the Core Content package. The default action group targeting will change to No Computers. A new Antivirus content set has been introduced for sensors and packages that are related to antivirus technologies including Sophos and McAfee.
A new Microsoft Defender content set has been introduced for sensors and packages that are related to Microsoft’s endpoint protection. The older Core Content - Forefront solution is now deprecated.

Core Content 1.8.5

Release Date: December 20, 2022

Important

• The Core Content packages are now delivered via ECF. Please review this community article for migration instructions. This change means the packages no longer need to be recreated or updated after each solution update and the Distribute Tanium Standard Utilities - [Mac] and Distribute Tanium Standard Utilities - [Linux] packages are no longer necessary. Only one sensor is known to be affected: Last Logged in User.

Improvements

• Added non-windows versions of Path Permissions Sensor
• Improved handling of default value types for Registry Value Data sensor
• Rewrite network sensors in Powershell to improve performance Affected Sensors: Listen Ports, IP Connection, Open Port, Recently Closed Connections, Established Ports by Application
• Optimize use of RegKeyExists for better performance Affected Sensors: Kaspersky Client Versions, Kaspersky DAT Days Old, Kaspersky DAT Version, UAC Status Affected Packages: Reboot Windows Machine, USB Write Protect - Set to Off, USB Write Protect - Set to On,
• Improve reporting on Amazon EC2 instances running on XEN for the Model Sensor
• Mac Service Details Sensor now handles the case of plist file not present
• Installed Applications Sensors no longer truncates applications due to child registry key entry matching parent name
• Use sysfs in preference to DMIDecode in finding the serial number for the Linux Computer Serial Number Sensor

Fixes

• Linux Service Details Sensor no longer returns enabled when the service is disabled
• Core Content no longer calls rpmdb_stat to reduce risk of locking Affected Sensors: RPM Database Details, Installed Application Exists, Installed RPMs, Installed Applications, Installed Application Version, Reboot Required Affected Packages: Repair RPM Database
• Exclusion Sensors now report when no exclusions exist Affected Sensors: Microsoft Defender Extension Exclusions Sensor, Microsoft Defender IP Address Exclusions, Microsoft Defender Path Exclusions, Microsoft Defender Process Exclusions
• The Linux sensor for CPU Details now reports the CPU type for ARM
• Corrected string comparisons for Model Sensor
• Service Details Sensor no longer returns incorrect values for Service Status column
• Registry Value Data Sensor no longer reports 64-bit on a 32-bit system
• Installed Application Sensor on Linux now works even when RPM and other package management systems are installed
• Browser sensors no longer return invalid data for extension data that is missing elements Affected Sensors: Chrome Extensions, Chrome Extensions Summary, Edge Extensions, Edge Extensions Summary, Firefox Extensions Summary, Firefox Extensions
• Service - Set Start Mode package now decodes the UTF8 start parameter
• Registry Value Data sensor now outputs the correct data for binary values
• Service stop now handles service names with brackets