Release Notes Initial Content (Version 7.1.19)

Thank you for choosing Tanium. This document is intended to document changes between releases of Tanium Initial Content.

Tanium Initial Content 7.1.19

Release Date: Feb 6, 2020

• Initial Content - Cloud: 7.1.19.0001

The previous version can be found here: Release Notes Initial Content (Version 7.1.18)

Enhancements

Tanium Initial Content Cloud

• Updated the Cloud Instance Tags sensor to no longer require DescribeInstances IAM permission granted to the instance itself. Only the DescribeTags IAM permission is required. The sensor also now takes parameters for filtering tag keys. See 'Additional Information' below for details.

Bug Fixes

Tanium Initial Content Cloud

• Fixed an issue in the Cloud EC2 Instance IAM Role sensor that prevented a role from being reported.

Additional Information

• The Cloud Instance Tags sensor has changed from a sensor that took no parameters to a sensor that takes parameters at the time questions are issued. You may need to recreate saved questions that are based on this sensor. To continue to retrieve all tags, which is how it worked before, simply pass no parameters. Otherwise, tags returned can be filtered using exact string matches on tag keys, as well as a * and ? character to match multiple or single characters, respectively. See the sensor input parameter help box for details.

• This release adds support for the 7.4 version of the Tanium Client, including updates to the python runtime version and supporting libraries.

Announcements

• The next Initial Content release will be a reorganization.
  • Initial Content - Base, the solution that installs by default on all new servers, will be renamed to "Default Content".
  • The following Initial Content prefixed solutions will all be combined into a solution called Core Content:
    • Initial Content - AD
    • Initial Content - File System
    • Initial Content - Hardware
    • Initial Content - Network
    • Initial Content - Operating System
    • Initial Content - Registry
    • Initial Content - Security
    • Initial Content - Software
    • Initial Content - Tags
    • Initial Content - Cloud
  • The old solutions that these replace will be removed from the list of installable solutions.
  • The following solutions will remain separately released, but renamed:
    • Initial Content - MSSQL -> Core MSSQL Content
    • Initial Content - ADQuery -> Core ADQuery Content

Known Issues and Workarounds

• All Initial Content - Cloud sensors that run on OpenStack Nova instances will falsely report Amazon EC2 as the platform. This is because of the default Amazon EC2 metadata service compatibility. This will be disambiguated in an upcoming release.
• The Cloud Instance Tags sensor does not yet support Google Cloud Platform.
• The Cloud Instance Tags sensor requires AWS IAM configured so that instances themselves have an IAM role assigned that has a policy which allows instances to read tags on themselves. A naive policy to be applied to instances might look like this:

{

   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "ec2:DescribeTags",
           ],
           "Resource": "*"
       }
   ]

}

IAM policy creation is beyond the scope of the document, but it is important to expect failure of the Cloud Instance Tags sensor until policy is configured on the account. You may find the EC2 Instance IAM Role sensor to be helpful to determine which EC2 instances can read tags.

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup