Release Notes Trace (Version 2.0.6)
Thank you for choosing Tanium. This document is intended to document changes between releases of Tanium Trace.
Tanium Trace 2.0.6.58
Release Date: May 23, 2017
Enhancements
- Redesigned the Trace workbench to make better use of screen area, provide more status information on the Live Endpoints and Snapshots, and to be more similar to the other products
- Implemented a compression scheme in the Live Connection protocol that allows for faster transfer of large files, including capture of snapshots
- Added hash reputation decoration to driver event searches
Resolved Issues
- Fixed issue where Trace was not properly switching over to the new active Tanium Server in an Active/Active installation
- Changed the Windows Event Recorder pruning algorithm to be more iterative, keeping the database size under tighter control and smoothing out the I/O usage
- Changed the Windows Event Recorder pruning to include process events
- Fixed issue in the Windows Event Recorder where some event fields were being recorded with an extra erroneous character
- Added the last boot time to the Windows Event Recorder database
- Fixed issue where the maximum endpoint database size was being reset back to default on Linux
- Changed the Tanium Trace Zone Proxy and Hub services to check all certificate expiration dates at start up and to log a fatal message indicating expiration before exiting
- Changed the Tanium Trace Zone Proxy and Hub setup tools to require that a --days parameter be specified on the command-line representing the number of days until expiration to make the expiration date well known
- Changed the Live Connection protocol to allow for better flow control when transferring large files through the Tanium Trace Zone proxy
- Fixed issue where the Tanium Trace Database Health Sensor was returning results that were not bucketed
- Added the proxy plugin logs to the must-gather package
- Fixed issue where using the time span buttons in the workbench search always returned empty results
- Fixed issue where events with empty fields were not properly included in the workbench search results when negative search operators were used
- Fixed issue where the process tree visualization was not ordering child processes chronologically
- Fixed issue where hash reputation information was not being updated when it became known
- Fixed issue where reputation information was being requested even when Connect 4 was not installed
- Fixed issue where the New Ioc button caused data from an existing IOC to be populated if an existing IOC was selected
- Expanded the event filtering to include more processes on the Tanium Module Server and Tanium Server
- Started signing product RPMs for Linux installation
- Fixed issue where the Uninstaller did not work when invoked through the Windows control panel
- Fixed issue where the hash or command-line would be reported as undefined when it should have been reported as empty
- Fixed issue where the search type drop down might be undefined when returning back to the search
- Changed order of sensor parameters and parameter documentation to be more consistent
- Added support for Sysmon 6.0.2
- Fixed issue in the Trace Logon Events sensor where it did not return the expected results
Additional Information
Prior to this release, the Tanium Trace Zone Proxy setup tool generated certificates with a fixed expiration time of 365 days. When the certificates expire they log a socket hangup with code ECONNRESET. This type of error can also be the result of many other problems, so it is hard to diagnose. This release contains better error messaging for expired certificates and forces the installer to choose an expiration at the time of generation. It is recommended that all customers be aware of the certificate expiration dates to avoid proxy outages that could prevent using the Live Connection feature in Trace.
Tanium Trace 2.0.6.60
Release Date: June 6, 2017
Resolved Issues
- Fixed an issue where group configuration was not being distributed to endpoints for installations that were upgraded from a Trace release between 1.2.1 and 2.0.3.
Additional Information
The issue addressed by this hotfix was caused by conflicting files (aspJson.vbs and aspJSON.vbs) being added to the Tanium Package that distributes the group configuration changes. Customers that installed a Trace release between 1.2.1 and 2.0.3, configured their endpoints, and then upgraded to 2.0.4 or newer will be affected.
It is recommended that customers upgrade to 2.0.6.60 to resolve, but it is possible to workaround by editing the Trace Group Configuration Settings package and deleting the file 'aspJson.vbs' but leaving the 'aspJSON.vbs' file (note the difference in uppercase letters).
Tanium Trace 2.0.6.61
Release Date: June 15, 2017
Enhancements
- Added support for Sysmon 6.03