Release Notes Discover (Version 3.0)

Tanium Discover 3.0.0.0435

Release Date: October 15, 2019

Note: This release changes the columns in the grid export and Connect integrations (event and plugin). Please verify your integrations if using Connect or grid export.

New Features

• Use locations to group interfaces by their IP address within a physical or geographical hierarchy.
  • Discover administrators can restrict the visibility of interfaces to users based on the locations.
  • Use locations as label conditions and export to Tanium™ Connect.
• Manage scanning with profiles.
  • Specify inclusions and exclusions of networks. Note that scanning on isolated endpoints is still off by default, but indicated by a checked exclusion.
  • Define scheduling windows to prevent scanning at certain times.
• Run reports on scan execution with the Discover Scan Metrics sensor, which reports duration and success/fail for each profile scan.
• View manageability status, location, labels on the Summary dashboard page.

Changes to included components

• Update Npcap and Nmap.
  • Upgrade Npcap from 0.99-r4 to version 0.9982.
  • Download and install Nmap and Npcap only when absolutely required (endpoint receives profile action and has a non-empty scan range).
  • Use the newest version of Npcap installed on an endpoint, even if that version was not installed by Discover.
  • Update Mac binary for Nmap is now digitally signed.
• Upgrade Organizationally Unique Identifier (OUI) list to latest version to improve device manufacturer identification from MAC address.

Improvements

• Improve import efficiency.
• Improve time to initial Discovery and simplify usage of scheduled actions.
  • Distribution of tools happens as part of initial configuration. There is a single Discover action group whose default target is No Computers.
  • Each profile has an Execute Scan action, instead of the previous series of actions: Execute Scan, Distribute Scanner Tool, Distribute Config.
• Execute Scan actions have targeting that includes Discover version.
• Streamline wizard-driven configuration with 3 required steps. Separate wizard for optional configuration.
• Improve handling of exporting interface data with large datasets.
• Suggest best practice values for the Distribute over Time setting, with an upper limit of 4 hours.

Other Issues Addressed

• Content
  • Definitions of the Discover roles have changed. Compare their privileges with any manually created roles.
  • Changed names of saved questions:
    • from Managed Assets to Discover - Managed Interfaces
    • from Unmanaged Assets to Discover - Unmanaged Interfaces
  • Disallow other content from being assigned to Discover Content Set.
• Import process
  • Import does not overwrite a populated hostname with an empty value.
• Export and Integration
  • CSV export of interfaces now uses more readable column names (e.g., "Labels" instead of "Tags", "Last Seen" instead of "updatedAt").
  • No longer use OS temp directory of Tanium Module Server as a workspace for interface exports or label uploads.
  • Consistent use of color-coding on graphs in Trends boards.
  • Update column names in Tanium Discover Source to match names of Connect events.
  • Improve robustness of Connect plugin execution when an import is running concurrently.
• Data accuracy
  • Interface counts were not correctly handling interfaces that were manually marked unmanageable or manageable.
  • Improve OS generation detection for Windows versions.
• RBAC fixes
  • Allow a user with Discover Read Only role to export interfaces.
  • Allow a user with Discover Administrator role to mark interfaces unmanageable.
• Endpoint execution
  • Windows XP and Windows 2003 will fall back to ping, if nmap is the selected method.
  • Discover Scan Range sensor returns correct data on systems with non-English locale.

Security Update

• This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Support Portal, or by contacting your TAM.

Functionality Deprecated or Removed

• Discover Client Deploy is no longer available for configuration in 3.0.
• Using Connect to perform Block/Unblock with a NAC solution is no longer available. Use Network Quarantine Service to perform Quarantine/Unquarantine.
• Removed Discover sensors:
  • Configuration Exists
  • Has Configuration Hash
  • ARP Scanner Exists
  • ARP Scanner Version
  • Connected Scanner Exists
  • Connected Scanner Version
  • Script Scanner Exists
  • Script Scanner Version
  • Nmap Scanner Exists
  • Nmap Scanner Version

Known Limitations

• Upgrade requires Discover 2.10.0 or later to be installed (see user guide).
• Action groups created by Discover 2.x are not deleted on upgrade (see user guide).
• When migrating an ARP or Connected method to a Discover 3.0 profile, the Host Name Resolution option is always enabled.