Release Notes Patch (Version 2.4)

Thank you for choosing Tanium. This article documents changes between releases of Tanium Patch.

Tanium Patch 2.4.4.0000

Release Date: 24 March 2020

Bug Fixes

• Fixed an issue where Tanium Scan for Windows (TSW) database locked up on Patch install.

Prerequisites

• Red Hat and CentOS endpoints require a minimum YUM version of yum-3.2.29-22.el6 to engage in Tanium Patch.

Known Issues and Workarounds

• If the ServerName value in the Tanium Server registry key has been changed from the default of 0.0.0.0, the Tanium Client might fail to download patches and experience higher than normal CPU usage.
• If you are using Windows XP or Windows XP x64, you might need to run a Windows agent upgrade for reliable scanning and patch deployment.
• Enabling the Linux Patch feature requires a minimum Tanium Platform version of 7.2.314.3235.
• Linux endpoints require a minimum Tanium Client Version of 7.2.314.3211 to engage in Tanium Patch.
• Leading and trailing whitespace is stripped from patch list and blacklist rule expressions on save.
• Creating a patch list or blacklist with an empty rule expression will cause initialization to fail.
• When configuring Computer Groups for Visibility, a known issue can prevent all available computer groups from being listed. The workaround is to use grid filtering to search for computer groups.
• Maintenance windows configured to repeat monthly in the operator's browser time might display incorrect summary and upcoming maintenance windows.
• Patch tools required for Windows Tanium Scan will fail to install on Tanium Client version 6.0.x.
• Planned end-of-support for Windows versions in Tanium Patch: Tanium Patch version 3 is planned for release in 2020. Version 3.x will not support Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2). Earlier versions of Tanium Patch will continue to function with older Windows versions; however, when version 3 is available, no new releases of Tanium Patch 2.x will be made.

Supported Tanium Platforms

Tanium Server 7.2, 7.3, 7.4

Support for Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2) in Tanium Patch will end with Tanium Patch version 3. Pre-3.0 versions of Tanium Patch will continue to function with these older operating systems, but no new releases with be made for Tanium Patch 2.x after Tanium Patch 3 is released. Tanium Patch 3 is expected to be released in May 2020 or later.

Tanium Patch 2.4.3.0025

Release Date: 17 March 2020

Feature Improvements

• Tanium Patch support for the Oracle Linux and Amazon Linux operating systems is now generally available.
  • Tanium Patch support for supported Linux operating systems can be enabled in the Settings section of the Tanium Patch Workbench.
  • Oracle Linux supported operating systems include: Oracle Linux 6, Oracle Linux 7.
    • Tanium Scan and Repo Scan are both supported for Oracle Linux.
    • Repository snapshots are fully supported for Oracle Linux.
  • Amazon Linux supported operating systems include: Amazon Linux 1, Amazon Linux 2.
    • Repo Scan is supported for Amazon Linux.
    • Tanium Scan and Repository snapshots are not supported for Amazon Linux.
• A new Patch Role is now available and requirements for the Tanium Patch service account have changed:
  • The new role is named Patch Service Account.
  • The Tanium Patch service account must now have the Patch Service Account role.
  • A warning banner will be displayed on the Patch Home Page if the Patch service account does not have the required permissions.
• Tanium Patch now has built in integration with Tanium Trends (Requires Tanium Trends 2.4.4 or later).
  • Shortly after importing Tanium Patch a new Trends Board, Patch Assessment, will be available for import in Tanium Trends.
  • The Patch Assessment board displays information about missing patches, SLA-based compliance reports, endpoint status, and scan errors.
  • The Tanium Patch service account requires the Patch Service Account role for the Tanium Trends integration to work properly.
• Tanium Patch will automatically create Baseline reporting Patch Lists for all supported and enabled operating systems. The baseline reporting Patch Lists are:
  • [Tanium Patch Baseline Reporting] - Windows
  • [Tanium Patch Baseline Reporting] - Red Hat
  • [Tanium Patch Baseline Reporting] - CentOS
  • [Tanium Patch Baseline Reporting] - Oracle
  • [Tanium Patch Baseline Reporting] - Amazon
• Yum Repositories will no longer be auto populated from enabled repositories in the environment.
  • This is intended to reduce unnecessary noise and make it easier to manage Yum repositories and their associated snapshots.
  • Existing auto populated Yum repositories are not removed.
• Drill down links have been added to Tanium Patch Home Page stats.
• When editing Maintenance Windows, minutes no longer need to be explicitly set and will now default to 0.
• Index Pages that list Patch Lists, Blacklists and Maintenance Windows will now wrap names by default.
• Sorting question results by 'ID' in Interact for the following sensors will now sort numerically rather than lexicographically:
  • Patch - Deployment Errors
  • Patch - Deployment Results
  • Patch - Deployment Statuses
  • Patch - Enforcement Status
• Sorting question results by 'Days Since Successful Scan' in Interact for the 'Patch - Scan Age' sensor will now sort numerically rather than lexicographically.

Bug Fixes

• The Patch workbench would not display on Internet Explorer browsers, this is fixed.
• Fixed a bug that could cause Linux Endpoints on 7.2 Tanium Client versions to return "Unknown OS" for Tanium Patch sensors.
• When utilizing Tanium Patch default configuration (available in Tanium Core Platform 7.4.2 or later), Tanium Patch could fail to collect and display Tanium Patch data on the workbench. This has been fixed.

Prerequisites

• Red Hat and CentOS endpoints require a minimum Yum version of yum-3.2.29-22.el6 to engage in Tanium Patch.

Known Issues and Workarounds

• If the ServerName value in the Tanium Server registry key has been changed from the default of 0.0.0.0, the Tanium Client might fail to download patches and experience higher than normal CPU usage.
• If you are using Windows XP or Windows XP x64, you might need to run a Windows agent upgrade for reliable scanning and patch deployment.
• Enabling the Linux Patch feature requires a minimum Tanium Platform version of 7.2.314.3235.
• Linux endpoints require a minimum Tanium Client Version of 7.2.314.3211 to engage in Tanium Patch.
• Leading and trailing whitespace is stripped from patch list and blacklist rule expressions on save.
• Creating a patch list or blacklist with an empty rule expression will cause initialization to fail.
• When configuring Computer Groups for Visibility, a known issue can prevent all available computer groups from being listed. The workaround is to use grid filtering to search for computer groups.
• Maintenance windows configured to repeat monthly in the operator's browser time might display incorrect summary and upcoming maintenance windows.
• Patch tools required for Windows Tanium Scan will fail to install on Tanium Client version 6.0.x.
• Planned end-of-support for Windows versions in Tanium Patch: Tanium Patch version 3 is planned for release in 2020. Version 3.x will not support Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2). Earlier versions of Tanium Patch will continue to function with older Windows versions; however, when version 3 is available, no new releases of Tanium Patch 2.x will be made.

Supported Tanium Platforms

Tanium Server 7.2, 7.3, 7.4

Support for Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2) in Tanium Patch will end with Tanium Patch version 3. Pre-3.0 versions of Tanium Patch will continue to function with these older operating systems, but no new releases with be made for Tanium Patch 2.x after Tanium Patch 3 is released. Tanium Patch 3 is expected to be released in May 2020 or later.

Tanium Patch 2.4.2.0018

Release Date: 3 March 2020

If you are using Patch version 2.3.x, upgrading to this version is recommended. This version is optional if you have upgraded to Patch version 2.4.1.

Feature Improvements

• Improvements have been made to the Tanium Patch default configuration (available in Tanium Core Platform 7.4.2 or later):
  • The speed at which default settings for Tanium Patch are configured has been greatly improved.
  • Patch scan configurations are now enforced to default computer groups.
  • Tanium Scan for Windows is now configured and synced as part of the default configuration.
  • The Tanium Patch action group has been tuned to target specific Windows and Linux operating systems, rather than the All Computers group.
• Two new Patch sensors have been added:
  • Patch - OS for Applicable Patches
  • Patch - Applicable Patches by Year

Bug Fixes

• Fixed two bugs that could cause upgrade installations to Tanium Patch 2.4.1 from a previous Tanium Patch version to fail:
  • In environments using Linux Patch, a database migration failure could occur on upgrade.
  • In TanOS environments Tanium Patch upgrades could fail with a timeout error.
• Fixed a typo on the Tanium Scan for Windows view. Windows Server 2008 R2 was incorrectly listed as Windows Server 2012 RS.
• Fixed a bug that could cause all inactive Patch deployment packages to be modified every hour.

Prerequisites

• Red Hat and CentOS endpoints require a minimum Yum version of yum-3.2.29-22.el6 to engage in Tanium Patch.

Known Issues and Workarounds

• If the ServerName value in the Tanium Server registry key has been changed from the default of 0.0.0.0, the Tanium Client might fail to download patches and experience higher than normal CPU usage.
• If you are using Windows XP or Windows XP x64, you might need to run a Windows agent upgrade for reliable scanning and patch deployment.
• Enabling the Red Hat/CentOS Patch feature requires a minimum Tanium Platform version of 7.2.314.3235.
• Red Hat and CentOS endpoints require a minimum Tanium Client Version of 6.0.314.1554 to engage in Tanium Patch.
• Leading and trailing whitespace is stripped from patch list and blacklist rule expressions on save.
• Creating a patch list or blacklist with an empty rule expression will cause initialization to fail.
• When configuring Computer Groups for Visibility, a known issue can prevent all available computer groups from being listed. The workaround is to use grid filtering to search for computer groups.
• Maintenance windows configured to repeat monthly in the operator's browser time might display incorrect summary and upcoming maintenance windows.
• Patch tools required for Windows Tanium Scan will fail to install on Tanium Client version 6.0.x.
• Planned end-of-support for Windows versions in Tanium Patch: Tanium Patch version 3 is planned for release in 2020. Version 3.x will not support Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2). Earlier versions of Tanium Patch will continue to function with older Windows versions; however, when version 3 is available, no new releases of Tanium Patch 2.x will be made.

Supported Tanium Platforms

Tanium Server 7.2, 7.3, 7.4

Support for Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2) in Tanium Patch will end with Tanium Patch version 3. Pre-3.0 versions of Tanium Patch will continue to function with these older operating systems, but no new releases with be made for Tanium Patch 2.x after Tanium Patch 3 is released. Tanium Patch 3 is expected to be released in May 2020 or later.

Tanium Patch 2.4.1.0031

Release Date: 25 February 2020

Feature Improvements

•  Import and automatically configure default settings and dependencies for Tanium Patch with Tanium Core Platform 7.4.2 or later.
• Tanium Scan for Windows is now Generally Available.
  • Windows Tanium Scan sync has been improved to be 10x faster.
  • The data that Windows Tanium Scan syncs to the Tanium Module Server has been improved to be 5x smaller.
  • Windows Tanium Scan will now dynamically find and use an available port, rather than pinning to port 10,000.
  • Windows Tanium Scan will no longer attempt to scan Windows XP and other unsupported operating systems.  Any Tanium Scan technique enforced to an OS that does not support Tanium Scan will be skipped, and the next highest supported scan technique will be used. For information about changes to OS support, see Known Issues and Workarounds.
• Repository snapshots are now available for Linux deployments.  For more details, see Tanium Patch documentation.
• Multi-language support is now available in the Tanium Patch Module.
  • When creating a Deployment or Deployment Template the operator can specify additional languages for notifications.
  • Supported additional languages: Japanese, German, Spanish, and French.
  • When configured, notifications will be displayed in the additionally supported language matching the endpoint's configured language.
• Product and Classification data has been added to the Patch Summary view in the Patch Workbench.
• Windows scan techniques will now retry when a retry-eligible scan error is encountered.
• Whitelist URLs that are managed by Tanium Patch now have an expiration of 180 days.
• URL http://wsus.ds.download.windowsupdate.com has been added to the list of whitelisted URLS that Tanium Patch manages.
• Linux Patch scanning performance has been improved.
• The memory footprint of the Linux Patch process has been reduced.
• On Linux Patch being enabled the Patchlist Applicability Bin count will now automatically be set to 10.
• The size of the CAB file is now displayed on the Patch Home page.

Bug Fixes

• Fixed a bug that could cause the post-install workflow to fail when using Tanium Scan.
• Fixed a bug that could cause Tanium Scan to fail with the error "Windows Update Error: -2147024883 The data is invalid".
• Fixed a bug that caused Tanium Patch sensors to return TSW-MS00-000, instead of None, when no bulletin info was available.
• Fixed a bug that could cause the formatting of the Release Date in Tanium Patch sensors to be incorrect.
• URLs are no longer returned for Patch Sensors that are targeted to Linux Endpoints.  This change fixes a bug that could cause the Patch Service to crash due to an "Out Of Memory" error.
• Fixed a bug that caused Linux Patch Scans to fail with the error "yum_helper cannot import yum"
• Fixed a bug that caused the Patch Workbench to respond slowly due to excessive job entries in the Patch Service database.
•  Fixed a bug in the Airgap Downloader utility that caused incorrect creation and modified dates on files.
• Fixed a bug that caused the Patch Homepage to briefly display incorrect data on load of the view.
• Active Directory usernames in the form DOMAIN\username can now be set as the Patch Service Account user.
• Fixed a bug that required the Patch Service to account user to have "Content Administrator" permissions.
• The Patch Workbench no longer rounds percentages between 99% and 100% to 100%.

Prerequisites

• Red Hat and CentOS endpoints require a minimum YUM version of yum-3.2.29-22.el6 to engage in Tanium Patch.

Known Issues and Workarounds

• If the ServerName value in the Tanium Server registry key has been changed from the default of 0.0.0.0, the Tanium Client might fail to download patches and experience higher than normal CPU usage.
• If you are using Windows XP or Windows XPx64, you might need to run a Windows Agent upgrade for reliable scanning and patch deployment.
• Enabling the Red Hat/CentOS Patch feature requires a minimum Tanium Platform version of 7.2.314.3235.
• Red Hat and CentOS endpoints require a minimum Tanium Client Version of 6.0.314.1554 to engage in Tanium Patch.
• Leading and trailing whitespace is stripped from Patchlist and Blacklist rule expressions on save.
• Creating a Patchlist or Blacklist with an empty rule expression will cause initialization to fail.
• When configuring Computer Groups for Visibility, a known issue can prevent all available computer groups from being listed. The workaround is to use grid filtering to search for computer groups.
• Maintenance Windows configured to repeat monthly in the operator's browser time might display incorrect summary and upcoming maintenance windows.
• Patch tools required for Windows Tanium Scan will fail to install on Tanium Client version 6.0.x.
• Planned end-of-support for Windows versions in Tanium Patch: Tanium Patch version 3 is planned for release in 2020. Version 3.x will not support Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2). Earlier versions of Tanium Patch will continue to function with older Windows versions; however, when version 3 is available, no new releases of Tanium Patch 2.x will be made.

Supported Tanium Platforms

Tanium Server 7.2, 7.3, 7.4

Support for Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2) in Tanium Patch will end with Tanium Patch version 3. Pre-3.0 versions of Tanium Patch will continue to function with these older operating systems, but no new releases with be made for Tanium Patch 2.x after Tanium Patch 3 is released. Tanium Patch 3 is expected to be released in May 2020 or later.