Release Notes Core Content (Version 1.9)

Thank you for choosing Tanium. This article documents changes between releases of Core Content.

Core Content replaces the deprecated Initial Content Tanium Solutions.

Important

Core Content is being migrated from VBScript to PowerShell, emphasizing the necessity for all endpoints to adhere to the minimum recommended requirements documented in our Tanium User Documentation.

A new Antivirus content set has been introduced for sensors and packages that are related to antivirus technologies including Sophos and McAfee.
A new Microsoft Defender content set has been introduced for sensors and packages that are related to Microsoft’s endpoint protection. The older Core Content - Forefront solution is now deprecated.

Core Content 1.9.102

Release Date: November 14, 2023

Fixes

• Fixed a typo with the "Physical Disk Type" sensor where SSD was reporting as SDD on Linux

Improvements

• Adds a new sensor, "AppLocker - Application Control Enabled " to provide information on AppLocker status on Windows
• Added new package "Microsoft Defender - Deploy MDE Client [Linux]" – Deploys MDE Client to Linux
• Added new package "Microsoft Defender - Deploy MDE Client [Mac]" – Deploys MDE Client to Mac
• Added new package "Microsoft Defender - Offboard MDE Client [Linux]" – Offboards MDE Client on Linux
• Added new package "Microsoft Defender - Offboard MDE Client [Windows]" – Offboards MDE Client on Windows
• Added new package "Microsoft Defender - Onboard MDE Client [Mac]" – Onboard MDE Client on Mac
• Added new package "Microsoft Defender - Onboard MDE Client [Windows]" – Onboard MDE Client on Windows

Important Notes

• Microsoft Defender package content requires binaries provided by the vendor. Additional information can be obtained through the Support Portal [1] or by contacting your TAM
• For additional information on Creating Defender Onboarding Packages refer to the following community article[2]

Core Content 1.9.96

Release Date: October 31, 2023

Fixes

• Fixed an issue where the Microsoft Defender Health Details sensor was inaccurately reporting on certain Windows endpoints

Core Content 1.9.95

Release Date: October 24, 2023

Improvements

• Miscellaneous bug fixes, performance, and supportability improvements

Core Content 1.9.91

Release Date: September 19, 2023

Fixes

• Miscellaneous bug fixes

Core Content 1.9.90

Release Date: September 12, 2023

Improvements

• Adds a new sensor Windows 11 Compatibility. This sensor is used to support the Windows 11 Compatibility Reports and Dashboards within Tanium Reporting.

Special Notes

• Sensors Username and Operating System are now written in PowerShell.

Core Content 1.9.89

Release Date: August 29, 2023

Fixes

• Miscellaneous bug fixes

Core Content 1.9.88

Release Date: August 22, 2023

Improvements

• Adds a new Windows OS Activation Status sensor.
• Adds a new Cloud Host Name sensor.
• Adds additional content for troubleshooting unhealthy or broken auditd rules for Non-Windows.
• Adds additional profile support for WMI in Event Tracing – Record Performance Data package.
• Adds standardized output in Battery Details sensor.

Fixes

• Fixed an issue with the “Use Recommended Profile Types” parameter tooltip in the Event Tracing – Record Performance Data package.
• Fixed an issue where systems with large amounts of memory exceeding 64GB would create very large trace files.
• Fixed an issue where a failure to detect the computer name would occur in the Event Tracing – Record Performance Data package.
• Fixed an issue when using skipPdbGen would cause compatibility issues with WPR when using the Event Tracing – Record Performance Data package.

Core Content 1.9.77

Release Date: July 11, 2023

Improvements

• Adds additional path detection for browser profiles on Mac when using the Browser sensors.
• Adds a default threshold value for the McAfee Agent Health sensor.
• Adds additional validation for the Video Graphics Card RAM sensor.
• Adds Client Settings support for tagging sensors on non-Windows.
• Adds additional string validation for Installed Applications on Windows.
• Adds native support for creating Endpoint Trace Logs (ETL) on Windows.

Fixes

• Fixes an issue where autofs was mounting home directories when using the Browser Sensors on Linux.
• Fixes an issue where Registry Key Value Name returns invalid data.
• Fixes an issue where sensors were creating BDB files in /var/tmp on non-Windows.
• Fixes an issue where the sensor Video Graphics Card Ram would report inaccurate data on Windows.
• Fixes an issue where sensor Network Adapter Details would return no results on Ubuntu and Debian.

Core Content 1.9.56

Release Date: May 9, 2023

Improvements

• Adds a new Is Cloud Sensor that will return True for systems running in cloud-based environments.
• Adds support for Linux and macOS to the Folder Size sensor.
• Registry Sensors now have parameter validation.
• Improves efficiency of returned data for Microsoft Defender content.
• Improves performance for cloud-based content.

Fixes

• Fixes an issue where the RAM sensor reports usable memory instead of total installed memory.
• Fixes an issue where the Microsoft Defender Content returns invalid data.
• Fixes an issue with Last Logged in User on non-Windows that would truncate usernames.

Core Content 1.9.36

Release Date: March 9, 2023

Improvements

• Core Content now uses Python 3.8.16.
• Core Content now uses OpenSSL 1.0.2zg.
• Improves performance of the Open Share Details sensor.

The content now consists of the following:

Package: Open Share Inventory to collect inventory of Shares and Permissions.

Sensor: Open Share Details to report the inventoried share details.

Sensor: Open Share Inventory Status to report the status of the inventory on the endpoint.

Note: This content is Windows only.

• Optimization of the AnyConnect VPN sensor.
• Update Registry parameters package now excludes HKEY_USERS\<SID>.
• Adds Core Content - Tools Version sensor for to Endpoint Configuration.

Fixes

• Fixes an issue where the Uptime sensor provides the wrong output for 1 day.
• Fixes an issue where the Uptime sensor returns a negative number.
• Fixes an issue where the Bitlocker Details sensor appends the Key Protector Type of each drive to the previous value, resulting in multiple values to systems with more than one drive.
• Fixes an issue where the Listen Ports sensor returns [no results] on some Windows endpoints.
• Fixes an issue where the User Details sensor may not return all user accounts on macOS devices.
• Fixes an issue where the Last Logged in User sensor times out when querying Domain Controllers.

Security Update

• This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Support Portal, or by contacting your TAM

Core Content 1.9.23

Release Date: February 21, 2023

Improvements

• The Static IP Address sensor now supports Mac, Solaris, and Linux.
• Added Disk Free Space Status Sensor for AIX, Linux, Mac, Solaris, and Windows which returns the drive name, percentage of available free space, and disk free space status (okay, reduced, low, and critical)
• Added RPM Database Locks Sensor for Linux which returns the count of RPM database lock files under the /var/lib/rpm directory
• The Installed Applications Exists and Installed Application Version sensors now have a new parameter of :queryall that can be used to locate an app listed as a hotfix, system component, or child entry of another app. Applies to Windows only. This new parameter is disregarded on other operating systems."
• Internal tooling improvements

Fixes

• Repair RPM Database package now queries as root to accurately detect the RPM DB being corrupted
• Updated RPM Database Details sensor to query the RPM db as root to now detect RPM corruption
• Cloud sensors should no longer report metadata service error that might break targeting on Get Cloud Instance Provider

Core Content 1.9.11

Release Date: January 3, 2023

Important

• Known Issue: With the cloud instance sensors, the previous returns of "Does not appear to be a cloud instance" are not returning consistently and being overwritten by "Error: Local Metadata Service Disabled". If these sensors are currently used for targeting in your environment, we suggest holding off on this import until the next release.

Improvements

• Improved Cloud sensor integration with AWS EC2 v2 metadata
• Improved script launching for 32-bit and 64-bit systems.
• Increased visibility for Mac endpoints Added Sensors: Bluetooth MAC, System Integration Protection Status, Enrolled via DEP, Authenticated Root Volume Status, Activation Lock Status, Installed Profiles, Gatekeeper Enabled, Battery Details, Bootstrap Token Details
• Performance improvements for the Kaspersky sensors
• Improved granularity of Mac model identification
• Improved the performance of the Linux Computer Serial Number sensor

Fixes

• Service Details Sensor no longer breaks when a plist file is missing from the file system
• Microsoft Defender - Remove IP Address Exclusion [Windows] no longer fails with a ParameterBindingException
• Installed Application sensor now includes child registry keys and returns more applications
• Add includes to the McAfee Status sensor