Release Notes Tanium Server (Version 7.7.3.8167)

Thank you for choosing Tanium. The following Release Notes document changes between releases of the Tanium Server.
This platform release includes the release of both a Windows and Linux Tanium Server.
The previous version can be found here: Release Notes Tanium Server (Version 7.7.2.7418)

Tanium Server for Windows and Linux v7.7.3.8167

• Tanium Cloud availability date: March 19, 2025.
• On-premises availability date: N/A.

Special Notes

• The Tanium Server now uses Console (Version 3.13.105.0000).
• Tanium discourages new installations of this software version on Windows 2012 and 2012-R2 given its End-Of-Life on 2023-10-10.

Security Updates

• N/A.

New Features

• Tanium Platform components have removed support for HTTP h2c which has never been widely adopted.
• Implements a new connection type in the Tanium Server and Zone Server to handle CXSocket communications.
• Adds CXSocket streams to client registrar snapshots exchanged between the Tanium Servers and Zone Servers.
• Implements the needed PKI extensions in the Tanium Server to issue the certificates that solution modules will use to communicate through CXSocket connections.
• The Tanium Server now emits a metric for require_action_approval to allow which environments are configured with this setting enabled.
• Integrates CXSocket gRPC services with the CXSocket PKI to solution modules can present certificate signing requests and obtain communication certificates in return.
• The Tanium Server will now skip certificate revocation list (CRL) distribution points with non HTTP or HTTPS services, to avoid download and authentication failures seen when LDAP CRL distribution points are configured into a certificate.
• Guarantees the access to the filter group definitions referenced by a ring set in the Tanium Server API. This allows a user to view the full ring set configuration even when they do not have RBAC access to those groups.
• Includes root and intermediary certificates in a gRPC CXSocket request for the validation of connection endpoints.
• Offers a throttle for the new CXSocket feature in Platform.
• Implements CXSocket end to end encryption to guarantee privacy between module solutions and client extensions over a communications socket.
• Adds a new read-only setting named console_manifestURLDefault to the Tanium Server console.json file, so Console can detect if the system is using a customized value that differs from the original default.
• Updates the Tanium Server's manifest URL to point to the SAR-2025H1 solutions release.
• The new feature of automatic rotation of Tanium Server root keys is disabled by default.

Improvements

• Tanium Components now ship with Python v3.12.8.
• The Tanium Server can now be configured to generate new root keys every 365 days and offers a 14 days delay period before revoking the old ones.
• Changes the rate at with the "Failed to send batch to AA server" is logged in the Tanium Server in order to reduce log spam.
• The Tanium Module Server installer on Windows will now request newer versions of the Tanium RDB service to perform the upgrade of the PostgreSQL database instead of attempting a manual step by step upgrade from the installer code. This is more robust but only available in versions v2.122.0 or later of the RDB service.
• Improves the Tanium Server performance in calculating snapshots of new information transmitted out to Zone Server Hubs.
• Adds the new upload_file_stream_chunked file chunked uploading to the Tanium Server to support uploading large files to environments with request size limitations.
• Implements the service in the Tanium Server that will offer connection ports to solution modules when they request a direct connection to an endpoint.
• Implements the necessary Tanium Server communications to synchronize CXSocket requests.
• Enables the HTTP basic authentication feature on the Tanium Server for requests presented from addresses that appear in CACTrustedAddresses in order to maintain backwards compatibility now that this type of authentication is disabled by default.
• Implements the communications between Tanium Server and Zone Servers to establish CXSocket connections.
• Changes the identification of installed solutions in the Tanium Server to be keyed by ID instead of name.
• The Tanium Server API now returns the Zone Server address and port used to create a CXSocket connection to a Tanium Client.
• Implements the handling of CXSockets between active-active Tanium Servers, both creation and cleanup.
• Enables Tanium Client to Tanium Server CXSocket connections.
• Implements a new log named cx-socket in the Tanium Server where to track CXSocket operations.
• Leverages protocol v315 keep alive messages in CXSocket communications as a means of detecting and dealing with idle timeouts.
• Allows new connections to be initiated over an HTTP request after one of the multiplexed connections in the this pool is shutdown.
• Adds timeout controls to CXSocket connection requests.
• Groups CXSocket connections by computer ID and socket ID to avoid interactions between connections from different clients.
• Avoids recalculating hashes for Zone Server synchronization caches when their contents have not changed, reducing CPU resources on the Tanium Server and improving performance.
• Implements additional instrumentation metrics for the new CXSocket communications feature.
• Tanium Platform components now ship with v5.6.4 versions of the xz library.
• Adds SQL performance query hints for ring set and question queries in Tanium Servers running on a Microsoft SQLServer database.
• Changes the equivalence of the "TRACE" log level in the Tanium Server API to translate to the internal LogVerbosityLevel=61.
• The Tanium Server will now rewrite its console.json file when the global settings API is used to modify a setting with the "console_" prefix in its name. This will make the value changes immediately available to Console components.
• The Tanium Server settings API will now reject create operations on global settings which are declared as read-only flag set.
• The Tanium Server will now bucket metrics for HTTP requests to /plugin/products/NAME for any unauthenticated requests.

Bug Fixes

• Fixes a case-folding problem in the Tanium Server LDAP synchronization which impairs the pagination of large number of users.
• Fixes an issue in the Tanium Module Server installer on Windows which will fail when complex connection passwords are used, particularly those that contain quote characters.
• Fixes an omission in the Tanium Server packages API that failed to honor the exit code criteria defined in a request.
• Fixes an omission for the default_value of a setting in the Tanium Server settings API.
• Fixes a problem in the way the Tanium Server generates question text through the build_question_text API where the output generated could not be parsed again. This happened for some negated ("not") filter conditions.
• Fixes a handling issue of the receive state of a CXSocket on the Tanium Server as presented to the requestor of the connection.
• Fixes an issue in the Tanium Server where an HTTP2 RST_STREAM on a CXSocket request would shut down the entire communications channel.
• Fixes the handling order of CXSocket communications with made connections fail when the Tanium Client side of the connection was not ready.
• Fixes a CPU spinning problem on the shutdown of CXSocket connections.
• Fixes the handling of end-of-file messages across the while CXSocket communications chain.
• Fixes a race condition when establishing and validating CXSocket connections which would result in the log error: "Ignoring MR group request for unknown cx-socket".
• Fixes a race condition in the construction of the client registrar snapshots in the Tanium Server which would cause Zone Servers to close incoming client connections incorrectly.
• Fixes a problem in the Tanium Server CXSocket API where requests to AsyncGRPCClient would hang.
• Fixes a problem in the Tanium Server where CXSocket connections would spin on shutdown.
• Fixes a problem in the RPM build of Tanium Platform components which would cause an signature validation failure with messages like "Invalid file TaniumServer-7.7.3.8116-1.rhe8.x86_64.rpm contains TaniumServer-7.7.3.8116-1.x86_64.rpm". This issue was never shipped to the field.
• Fixes an issue in the Tanium Server question parser API which would return an HTTP-500 error when the size of the text to be parsed exceeded parser_max_word_count. Now the server will return a properly worded HTTP-400 response code.
• Fixes an issue in the Tanium Server handling of API requests which could result in a failure condition associated with the log message "thread pool too busy".
• Fixes an issue in the Tanium Server API where deleting the console_manifestURL setting would also remove its value from the console.json file.
• Fixes a problem where a corrupt computer-ordinals.dat file would cause a startup failure in the Tanium Server with the message: "Error loading computer-ordinals.dat: ComputerOrdinalMap: bad file version".

Known Issues and Workarounds

• N/A.

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup