Release Notes Integrity Monitor (Version 1.2.2)

Thank you for choosing Tanium. This document is intended to document the release of Tanium Integrity Monitor.

Tanium Integrity Monitor 1.2.2.0012

Release Date: January 9, 2018

Feature Improvements

• New label history experience.
  • Single grid view of entire label history.
  • Simple and complex filtering.
  • Bookmark and share filtered views of label history.
  • Updates REST api to support filtering.
• New add and edit path modal experience.

Resolved Issues

• Fixes an issue when attempting to import a watchlist without selecting a file first would cause an error.
• Adds validation of path exclusions to ensure absolute paths are not provided.
• Fixes an issue where charts on home page could be misaligned on some resolutions.
• Fixes an issue where home page summary text and stats could be hard to read on some resolutions.
• Updates Linux recorder to version 0.4.32.2.
  • Adds a CPU maximum threshold that disables the Linux recorder when high CPU is measured over a sustained period (default 25% of 1 core).
  • Fixes an issue in the Linux recorder where pruning under high event volume could cause a crash.
  • Fixes an issue where an unnecessary Linux audit rule was left in place after the associated file events had been filtered.
  • Fixes an issue in the Linux event recorder where some strings for security events where not being pruned.
  • Fixes an issue in the Linux event recorder where, in some cases, the CPU threshold was not properly defaulted.
  • Adds a log message in the Linux event recorder version at start up.
  • Fixes an issue in the Linux event recorder where the CPU was running higher than needed during pruning.
  • Improves the performance of the Linux event recorder.
  • Fixes an issue where the Linux event recorder did not close the handle to the database during pruning.
  • Fixes an issue where the Linux event recorder would stop running within 5 minutes after startup.
• Updates Windows recorder to version 1.0.27.82.
  • Fixes an issue where new device volumes were not immediately mapped to drive letters.

Additional Information

Known Issues and Workarounds

• For Window endpoints only, Tanium Integrity Monitor events can be turned off if Tanium Trace file events are turned off.
• When deleting a monitor using the all events connection with Tanium Connect v4.0.7, the remaining all events connection will not show the delete option in the workbench. Workaround is to delete the remaining all events connection using delete connection Tanium Connect API.
• For Linux endpoints only, when upgrading from Integrity Monitor v1.1.1 or older to this release, the deploy monitors action could encounter the fixed issue where the linux recorder stops in some cases. The issue will resolve once the latest tools are deployed to the endpoint. To avoid this issue, deploy the Integrity Monitor tools manually before deploying monitors.
• The Endpoints Recording count always reports 0 when not viewing with Tanium Administrator permissions.

Requirements

• Tanium Platform 7.0.314.6422 and above.
  • For older 7.0 builds please consult your Technical Account Manager for assistance.
• Tanium Platform 7.1.314.3071 and above for RBAC support.
• Tanium Connect 4.0 and above.
• Legacy Windows support requires Tanium Index 1.6.0 and above.
• Monitoring permission change events.
  • Windows NT 6.1 (Windows 7 / Windows Server 2008 R2) or above requires enabling System Audit Policies.
  • Windows NT 6.0 (Windows Server 2008 / Windows Vista) or below requires setting Tanium Index config setting ScanFilePermissions=on.

Product Documentation and Resources

Integrity Monitor Documentation

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup