Release Notes Integrity Monitor (Version 3.0)

Tanium Integrity Monitor 3.0.186

Release Date: January 24, 2023

Improvements

• Added the ability to configure a size limit for the Integrity Monitor database on endpoints.
• Added an option to set database pruning by day.
• "Integrity Monitor – Monitor Events" now returns "No Integrity Violations Found" where appropriate.
• Improved Health Check results in the Integrity Monitor workbench.

Fixes

• Fixed an issue where results from the “Integrity Monitor – Monitor Events” sensor did not display duplicate counts as expected.
• Fixed case sensitivity for Windows paths in watchlists.
• Fixed an issue where a table in the Integrity Monitor database on endpoints could become locked under certain conditions.
• Fixed an issue where using more than 1 label resulted in incorrect search results.
• Fixed the sensor type on the “Integrity Monitor – Event Count” sensor.

Endpoint Tools Versions

• Includes IMCX 1.2.861
• Includes Index 3.2.2789

Known Issues

• Windows Watchlists that were created prior to upgrading to 3.0.186 must be re-saved to activate the case sensitivity fix.

Tanium Integrity Monitor 3.0.170

Release Date: October 18, 2022

Improvements

• Low disk space warning and critical thresholds of 5% and 1% (respectively) are now recognized as provided by CX Core 2.6 (Included with TCM 1.10+).
• The default monitor prune age is now one month.
• Improved service logging.

Fixes

• Fixed an issue where the Integrity Monitor – Monitor Events and Integrity Monitor – Monitor Events Unlabeled sensor results were truncated at 65 thousand bytes.
• Windows watchlist templates for C:\Program Files and C:\Program Files (x86) now use the correct wildcard syntax.
• Fixed an issue where directly watched files would not report events under certain conditions.
• Fixed an issue where newly watched paths would not report events under certain conditions.
• Changes to existing watchlist inclusions and exclusions are now honored correctly.
• Fixed an issue that would cause the workbench upgrade to fail under certain conditions.
• Fixed an issue where a user's group management rights were not evaluated correctly when deploying monitors and watchlists.

Endpoint Tools Versions

• Tanium Integrity Monitor 1.2.845
• Tanium Recorder 2.8.1047
• Tanium Index 3.2.2784

Known Issues

• Newly created watchlists created in IM3.0 from templates for the C:\Program Files and C:\Program Files (x86) directories should have their excludes inspected to match the correct template value of "**\**".

Tanium Integrity Monitor 3.0.152

Release Date: July 12, 2022

Upgrade Notes

This is a major version release that migrates Integrity Monitor endpoint functionality to a Tanium Client Extension (CX) and introduces changes to workflow in the Integrity Monitor module. Please note that manual intervention is required after this upgrade is performed. General items that should be noted are as follows:

• On upgrades from the previous Integrity Monitor version, monitors and watchlists are not automatically deployed to endpoints. This allows monitor configurations and watchlist assignment paths to be validated to ensure they have been migrated correctly.
• Watchlist glob styles have changed. See Review path inclusions and exclusions that include wildcard characters in the Tanium Integrity Monitor User Guide for further explanation of glob and wildcard character usage in paths, inclusions, and exclusions.
• All watchlists that include registry paths now monitor at the registry key level. All changes that occur within a watched registry key trigger an event. Note that you can filter these events for storage or further processing.
• You must update any custom Integrity Monitor saved questions, reports, Connect jobs, and Trends boards to use the new Integrity Monitor sensors. For a list of the updated Sensor names and descriptions see Update sensors in saved questions in the Tanium Integrity Monitor User Guide.

For a comprehensive list of Integrity Monitor 3.0 upgrade awareness items, please see Upgrading from a version earlier than 3.0 in the Tanium Integrity Monitor User Guide.

New Features

• Introduces a simplified and improved workbench experience
• Integrity Monitor now runs as a Client Extension on the endpoint
• Integrity Monitor now uses the Index Client Extension on the endpoint
• Added support for Amazon Linux 2 - ARM64 (Gravitron)
• Added support for SPARC-based Solaris endpoints

Improvements

• Reduced endpoint resource consumption and improved stability
• Streamlined monitor configuration options
• Watchlist paths can now follow symbolic links
• Watchlists are now deployed to endpoints independently of monitors
• The limit of 55,000 events has been removed; event storage is now time-based
• New panels on the Integrity Monitor Overview page

Bug Fixes

• Fixed an issue where CreateNewFile events were incorrectly reported
• Fixed an issue where temporary files were left on AIX endpoints
• Windows Server 2022 systems are now correctly targeted in default monitor deployments
• Fixed an issue where duplicate ECF Service Now configuration items were created
• Fixed an issue where Integrity monitor replaced the Tanium Driver Status sensor with an outdated version
• TAR file creation events now have correct timestamps
• Invalid Unicode characters are now correctly filtered from watchlists
• Fixed an issue where monitors automatically deployed for Tanium Cloud customers on upgrade from the previous Integrity Monitor version
• Fixed an issue where permission and ownership details were not shown on events not generated by Recorder
• Fixed an issue where directly watched symlinked files did not create an event when moved or deleted
• Fixed an issue where new registry records could be missed
• Improved transient file handling

Known Issues

• When upgrading from an existing version of Index CX to Index CX 3.2.2761 or higher, the Index database on all endpoints is reset. Index CX performs a normal rescan to repopulate the Index database. Until the initial rescan is complete, Index data can be incomplete. This is required due to a database schema change to improve database consistency.
• The Integrity Monitor board is not properly updated in Trends during this upgrade. You must manually import the Integrity Monitor board. For more information, see Import the Integrity Monitor board in Trends in the Tanium Integrity Monitor User Guide.

Endpoint Tools Versions

• Tanium Integrity Monitor 1.2.826
• Tanium Recorder 2.8.1038
• Tanium Index 3.2.2771