Release Notes Initial Content (Version 7.1.15)

Thank you for choosing Tanium. This document is intended to document changes between releases of Tanium Initial Content.

Tanium Initial Content 7.1.15

Release Date: Nov 19, 2019

• Initial Content - Base: 7.1.15.0007
• Initial Content - Cloud: 7.1.15.0007
• Initial Content - File System: 7.1.15.0007
• Initial Content - Hardware: 7.1.15.0007
• Initial Content - MSSQL: 7.1.15.0007
• Initial Content - Network: 7.1.15.0007
• Initial Content - OS: 7.1.15.0007
• Initial Content - Registry: 7.1.15.0007
• Initial Content - Security: 7.1.15.0007
• Initial Content - Software: 7.1.15.0007

The previous version can be found here: Release Notes Initial Content (Version 7.1.14)

Enhancements:

All available Initial Content solutions, including those published for the 7.1.15 release should be ready for macOS Catalina. Please report any compatibility issues encountered.

Tanium Initial Content Base

• The Windows OS Release ID Sensor now has a max age value of 15 minutes.

Tanium Initial Content Cloud

• The Python interpreter has been updated to the standard Tanium GA release.

Tanium Initial Content Network

• The package "Hosts File - Remove Entry" package will now function properly when being asked to remove entries that have inline comments after them.

Tanium Initial Content Registry

• The Initial Content Registry sensors now all accept HKU and HKCU as shorthand for HKEY_USERS and HKEY_CURRENT_USERS. Additionally, when enumerating HKEY_CURRENT_USER it is no longer assumed that it should examine the SYSTEM account. Instead, the Sensors now return data from the HKEY_USERS keys.

Tanium Initial Content Software

• The Windows Services sensors that display service names (Services, Running Services, Stopped Services, Running Service Short Name, Stopped Service Short Name, and Service Details) modify the actual service name output to eliminate the random per-user hex string that may appear at the end of a service name on a modern Windows OS such as Windows 10. For example, sensors that used to return "BluetoothUserService_12ceb7616" would now return "BluetoothUserService (User Service)" in these cases.

Bug Fixes:

Tanium Initial Content Base

• Fixed a compatibility issue that may have affected Windows Tanium Client version 7.2 or higher and the Tanium Client Explicit Setting Sensor and corresponding package "Modify Tanium Client Setting" when the client setting being retrieved or set had a dot in its name.

Tanium Initial Content Hardware

• The CPU Details Sensor core counting is improved on Linux.

Tanium Initial Content MSSQL

• The Microsoft SQL Server Software saved question, which is used in the SQL Server Overview dashboard, contains an updated version of the Installed Applications sensor which is part of the fix of the "Uninstall MSI" package issue described below.

Tanium Initial Content Network

• The Network Adapter Details sensor is now more compatible with recent macOS versions.

Tanium Initial Content Software

• Fixed an issue introduced in the Initial Content 7.1.14 release which cased the "Uninstall MSI" package on Windows to not function properly.

Added Sensors or Sensor Implementations:

Tanium Initial Content Base

• A new sensor, Operating System Generation, provides a normalized, stackable operating system name across all supported platforms.

Tanium Initial Content Network

• The Network Adapter Details sensor now has Linux and AIX implementations.

Additional Information

Known Issues and Workarounds

• The Initial Content - Cloud's Python component will fail to install when executing on a 32-bit Windows.

• All Initial Content - Cloud sensors running on OpenStack Nova instances will falsely report Amazon EC2 as the platform. This is because of the default Amazon EC2 metadata service compatibility. This will be disambiguated in an upcoming release.
• The Cloud Instance Tags sensor does not yet support Google Cloud Platform.
• The Cloud Instance Tags sensor requires AWS IAM configured so that instances themselves have an IAM role assigned that has a policy which allows instances to read tags on themselves. A naive policy to be applied to instances might look like this:

{

   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "ec2:DescribeTags",
               "ec2:DescribeInstances",
           ],
           "Resource": "*"
       }
   ]

}

IAM Policy creation is beyond the scope of the document, but it is important to expect failure of the Cloud Instance Tags sensor until policy is configured on the account. The sensor 'EC2 Instance IAM Role' may be helpful in determining which EC2 instances can read tags.

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup