Release Notes Tanium Server and Tanium Client (Version 7.4.2.2033)

Thank you for choosing Tanium. The following Release Notes document changes between releases of the Tanium Server and Tanium Client.
This platform release includes the release of both a Windows and Linux Tanium Server and Tanium Client binaries for all supported platforms, with the exception of AIX.
The previous version can be found here: Release Notes (Version 7.4.1.1954)

Tanium Server for Windows and Linux v7.4.2.2033

General Availability Release Date: February 25, 2020.

Special Notes

• Due to security issues against this release of Tanium Server, Tanium strongly recommends upgrading to at least v7.4.5.1240 if you are using this version.
• Python v3.8 may require additional anti-virus exclusions in certain environments.
• If deploying on a Tanium Appliance, you must upgrade to TanOS v1.5.5 or greater before installing Tanium Server v7.4.

Major Features

• After you install the Tanium Server, the Tanium Solutions page initially displays an Install with Recommended Configurations button, in addition to a tile for each module. To initiate the workflow for importing, and optionally configuring, all your licensed modules in a single operation, you can click that button instead of using the tiles. This feature also allows the import process to automatically advance through each import without having to review all content being imported. In addition, the user has the ability to enable or disable the recommended configurations for each module. For more details, see the Managing Tanium Solutions documentation page.
• When you first log into the Tanium Console after a fresh installation of the Tanium Server, the server automatically imports Default Computer Groups. They all function as both management groups and filter groups, and are assigned to the Default Filter Groups content set. The default groups are commonly used computer groups. For the full listing of the default groups, see the Managing Computer Groups documentation page on Default Computer Groups.
• The Tanium Client now offers support to register to Tanium over a proxy-server connection.

Improvements

• The Tanium Server will now use Python v3.8.1.
• Tanium Platform components now use SQLite v3.31.1.
• The Tanium Platform components now use bZip2 v1.0.8.
• The Tanium Server now offers new and improved memory allocation /metrics and /info measurements when configured with UseTBBAllocatorStats=1.
• Querying the Tanium Server API for Filter Groups now returns their Content Set name as well as its id, as it does with other objects.
• The Tanium Downloader (TDownloader) will now honor the Global Setting max_concurrent_downloads=0 as a value which will stop all file download activity in the system.
• Improved the verification of database objects that require upgrades by ensuring that an old object hash will not be ignored when it matches another from an older version of the product.
• The Tanium Platform code will now use KillOnClose for all spawned processes.
• The audit_name column for the groups_audit table was changed to allow any number of characters.
• Improved the clean-up and release of thread-local caches.
• The Tanium Client will now populate a LastRegistrationTime in UTC in its status information, as a means to show the last time it connected to and registered with a Tanium Server.

Bug Fixes

• Fixed a condition by which establishing mutual trust between Tanium Servers in an Active-Active configuration would fail if these operations were performed too quickly, returning PKI bundle contains a different number of roots than expected.
• Fixed an issue with the Tanium Server API where a call to /api/v2/solutions always returned an empty delete_xml_url field, even when a solution had defined one.
• The Tanium Server now returns <SYSTEM> instead of unknown as the owner of Root Keys created during installation.
• Added a verification to avoid loading expired Tanium license files.
• Fixed an issue with the Tanium Server API by which empty (zero byte) files would fail to upload as contents to a Package.
• Fixed an issue in the Tanium Client installer by which providing a list of server names to communicate with would not populate the ServerNameList setting.
• Fixed an issue where revoking trust in a Tanium Server in an Active-Active environment would revoke trust on its keys but not mark them that way in the tanium database, causing the Console user interface to show a trust which no longer existed.
• The Whitelisted URL audit columns have been increased in width to accommodate some extremely long URLs used for files in the Patch solution module.
• The Tanium Server API now offers audit information for action type objects.
• Fixed an issue which resulted in incorrect row counts during GetResultInfo for sorted results.
• Fixed an issue on the Tanium Client where it would ignore the Global Setting for SOAPuseSessionFlag when received by the client after its initial registration.
• Fixed an issue with the SAML authentication subsystem in which when an IDP's idp_sso_service_url contained a question-mark character (?) it would be appended to a SAML request URL with the question-mark instead of an ampersand (&).
• Fixed an issue in the Tanium Module Server installer where the server process would run as LocalSystem despite having specified a different account in the installer dialog.
• Fixed an issue in the resolution of implied module privileges, specifically when assigning the Trends Service Account privilege the implied trends integration service account would not be assigned along with it.
• Fixed a problem with the Tanium Server API where removing a user from a Persona would seem to succeed, but listing the users associated with it after the removal would still return the user previously removed.
• Fixed an issue with the Tanium Server installer which would produce the messages user postgres does not exist and Postgres update failed when installing in non-TanOS environments where the PostgreSQL database does not reside on the same server.
• Fixed an issue when importing solutions with parametrized Sensors where they would show as new Sensors, having failed to detect that older versions exist in the system.
• Fixed a problem with the configuration of Trusted Hosts Lists where IPv6 address values containing two colon characters (e.g. [::1] ) would get mangled when saved.
• Both Package and Whitelisted URL columns have been increased in width to accommodate some extremely long URLs used for files in the Patch solution module, thus avoiding the log error: ERROR: value too long for type character varying(256) accompanied by a failure to create Patch packages for the Linux platforms.
• Fixed a behavior in the Tanium Server API where it would allow duplication of Computer Group names. This is no longer allowed.
• Introduced improvements to user_owned_object_ids to identify each with its associated Persona. This is an improvement which will aid in managing inactive user content in the Tanium console.
• The Tanium Server now keeps track of invalidated JSON Web Tokens after a user logs off, so they cannot be reused.
• Fixed an issue with the Tanium Server API by which empty (zero byte) files would fail to upload as contents to a Package.
• Fixed an issue when the estimated number of answering endpoints is zero, which would cause the Tanium console to not render a results grid while waiting for results.
• Fixed an issue with the Tanium Server /info page where the value for UnloadAfterMinutes was incorrect by a factor of 3,600.
• Fixed an issue by which policy-based Scheduled Actions might not fire when the associated Question was a non-counting question and the number of targeted endpoints was less than policy_min_count which defaulted to two.
• Fixed a problem with the Tanium Server importing solutions where Packages were either missing and/ or its files could be assigned to another package with the same name.
• Fixed a condition in the Tanium Server where it could leak memory when Question results were requested before all their necessary strings were not yet loaded from disk.
• Fixed an issue in the Tanium Client related to the working directory of Package commands executed using: TaniumClient runscript InternalPython FILENAME.py.
• Fixed a condition on Linux Tanium Servers by which TDownloader processes could become zombies.
• Fixed a condition in the Tanium Server by which the min_string_clean_interval setting was not honored correctly, causing Sensor string caches to be unloaded repeatedly from memory.
• Fixed an issue with the Tanium Server export/ import API by which when importing Scheduled Actions with a parametrized Package, the name of the package would get polluted with values from the parameters.

Known Issues and Workarounds

• There are conditions under which the Tanium Zone Server can fall into a tight logging loop which logs: Failed to get queued I/O completions.
  

Workaround: N/A.

• The Tanium Server /info page may display a Zone Server Hub count of zero.
  

Workaround: N/A.

• The Tanium Server /info page does not provide any feedback under a failed authentication.
  

Workaround: N/A.

• Large manual Computer Groups fail to be recognized by the Tanium Server upon creation.
  Workaround: There is no workaround for this behavior. Avoid current Tanium Server v7.4 if your make use of very large manual Computer Groups until a fix is released. If you must create such large groups please plan accordingly, since you may very well require a Tanium Server restart after having created them. NOTE that this behavior does not affect existing Computer Groups or Question and Action targeting, only the Console display of such groups.

Additional Information

• This version of Tanium Server shipped with Console (Version 1.4.2.0038).

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup