Release Notes Integrity Monitor (Version 2.7)

Thank you for choosing Tanium. This document is intended to document the release of Tanium Integrity Monitor.

Important Notes

If you are also using Threat Response, Integrity Monitor should be upgraded to at least 2.5.2.0003 before Threat Response is upgraded to 2.4.0.0161 in order to reduce chances of missing events.

Tanium Integrity Monitor 2.7.6.0001

Release Date: July 7, 2020

Resolved Issues

• Reduces Tanium Server resource usage by the data collection for some Trends boards and ServiceNow integrations.

Dependencies

• Index: 2.5.5.0006
• Tanium Client Recorder Extension: 2.2.5.1001
  • Tanium Recorder Driver: 1.1.0.57
• Tanium Python
  • Version (2.7): 1.4.0.45
  • Version (3.8): 1.4.0.45
• Tanium Client Extensions: 2.2.0.1121

Tanium Integrity Monitor 2.7.5.0002

Release Date: June 26, 2020

Resolved Issues

• Resolves an issue where the Integrity Monitor Endpoint ID sensor would incorrectly return [no results]
• Resolves an issue where Integrity Monitor Operator and Integrity Monitor Administrator roles could not view some computer groups for monitor targeting
• Resolved an issue where Integrity Monitor Operator and Integrity Monitor Administrator roles could not deploy monitors or rules because of access denied errors on viewing the Integrity Monitor action group.

Dependencies

• Index: 2.5.5.0006
• Tanium Client Recorder Extension: 2.2.5.1001
  • Tanium Recorder Driver: 1.1.0.57
• Tanium Python
  • Version (2.7): 1.4.0.45
  • Version (3.8): 1.4.0.45
• Tanium Client Extensions: 2.2.0.1121

Tanium Integrity Monitor 2.7.3.0003

Release Date: June 16, 2020

Feature Improvements

• Adds more metrics and graphs to the Integrity Monitor Trends board integration
  • Integrity Monitor Server Coverage
    • Shows how much of the expected estate (all servers in the environment: AIX, Solaris, Linux, and Windows servers) have IM installed and functional.
  • Mean Number of Unexpected Change Events per Endpoint
    • Shows the top 10 endpoints by number of unexpected changes (not labeled as ServiceNow, Expected, Ignored, or Planned)
  • Expected vs Unexpected Change events
    • Shows the total number of events in the environment, grouped by expected and unexpected events.
• Adds an automatic refresh to the monitor details and rule details pages to get fresh data periodically while viewing the page.
• Adds an option for staggering configuration actions across monitors, allowing up to 10 minutes between each action execution.
• Adds an option for setting the distribute over time value on the Deploy Integrity Monitor - Tools actions.
  • Valid values are between 0 and 120 minutes
  • Upgrades are defaulted to the previous default of 15 minutes
  • New installs are defaulted to 0 minutes
• Adds python sensor optimizations to cut down on how long it takes sensors to execute.

Resolved Issues

• Mitigates an issue where Deploy Monitors could result in an error because of deadlocks when recreating packages.
• Resolves an issue where monitors upgraded from legacy to enhanced labeling erroneously showed the All Events Connection button.
• Resolves an issue where the Integrity Monitor Endpoint Config actions were executing more often than was needed.
• Resolves an issue where the Trends integration would not function properly if Trends was not available and the service account was changed before it became available.
• Resolves an issue where the metrics section on the homepage was not displaying properly.

Dependencies

• Index: 2.5.5.0006
• Tanium Client Recorder Extension: Upgraded from 2.2.3.1001 to 2.2.5.1001
  • Resolves an issue where paths were normalized to lower case before pushing into auditd rules
    • This fix will impact event only mode monitors by providing auditd with the correct path case. Hash only and hybrid were unaffected by this bug.
  • Tanium Recorder Driver: Upgraded from 1.1.0.52 to 1.1.0.57:
    • Resolves an issue where versions of Windows 7/2008 R2 were put into an unusable state when also running specific versions of McAfee.
• Tanium Python
  • Version (2.7): 1.4.0.45
  • Version (3.8): 1.4.0.45
• Tanium Client Extensions: 2.2.0.1121

Additional Information

Known Issues and Workarounds

• You will not receive RegistrySet events for binary values with a value of 0.
  • You will receive RegistrySet events for binary values with a non-zero value.
  • Other event types like RegistryDelete are unaffected by this issue.
  • Setting any other value type should reliably generate events.

Requirements

• Tanium Connect 4.0 and above.
• Monitoring permission change events.
  • Windows NT 6.1 (Windows 7 / Windows Server 2008 R2) or above requires enabling System Audit Policies.

Supported Tanium Platforms

Tanium Server 7.2, 7.3, 7.4

Product Documentation and Resources

Integrity Monitor Documentation

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup