IMPORTANT: This site is planned to be decommissioned in 2026. Visit the Tanium Resource Center for all Tanium release notes, user guides, and support information. To view release notes in the Resource Center, see Tanium Release Notes.
IMPORTANT: If you are using semi-annual releases for on premises, see the Release notes for 2024H1 semiannual release, Release notes for 2024H2 semiannual release, or Release notes for 2025H1 semiannual release on the Tanium Resource Center.
Effective October 15, 2024: On prem release notes on the Tanium Knowledge Base are frozen. For release notes related to 7.4 or 7.5 Server and Solutions, see the Monthly updates for Tanium Version 7.4 and 7.5 Server and Solutions on the Tanium Resource Center.
Release Notes Trace (Version 2.2.1)
Thank you for choosing Tanium. This document is intended to document changes between releases of Tanium Trace.
Tanium Trace 2.2.1.34
Release Date: December 5, 2017
Enhancements
- Adds a new version of the Trace Zone Proxy, which allows for easier configuration
- Adds process filtering based on the process path for Windows and Linux, as well as command line for Linux
- Adds a new event source for process command-line and hash for Windows 8/Windows 2012 R2 or later, which can be used instead of Sysmon
- Improves the performance of the Linux event recorder
- Adds support for Sysmon 6.2
Resolved Issues
- Fixes an issue with the Windows event recorder where signals were generating false positives on some long-running processes
- Fixes an issue where the File downloads grid under Saved Evidence did not advance to the next page correctly
- Fixes an issue where new device volumes were not immediately mapped to drive letters
- Fixes an issue where the Linux event recorder did not close the handle to the database during pruning
- Fixes an issue where the Remove Tanium Trace Tools package did not clear all of the Trace registry values
- Fixes an issue where the legacy permission to create a Live Connection was Action Author, when it should have been Action User
- Fixes an issue with the Tanium Trace Status sensor incorrectly reporting that the Tanium Client was recording events
- Adds DNS events to the Combined event view
- Allows DNS events to be saved as evidence
- Fixes an issue where the Windows DNS events sensor did not indicate whether DNS events were supported on the endpoint
- Fixes an issue on the Trace home page where the click-through on the status bars was enabled, even when the user did not have permission to access Interact
- Corrects the Detect version 3.x privileges, which were not properly checked before allowing click-through on IOCs
- Corrects the Connect privileges, which were not properly checked before resolving the reputation status for hashes
- Fixes an issue where Windows XP was returning Platform Is Supported in some cases
- Fixes an issue where the Logon Events sensor was not returning correct results for non-English operating systems
- Adds the CPU Threshold setting to the Tanium Trace Status sensor for Linux
- Adds a timeout wrapper around several executions in the packages and sensors to prevent runaway executions
- Provides a package to reset the Trace database
- Provides a sensor to check for invalid file operations
Tanium Trace 2.2.1.37
Release Date: December 12, 2017
Resolved Issues
- Fixes an issue where the Trace Zone Proxy servers could not be configured when there was a certificate missing
- Fixes an issue where command-line and hash were missing after changing from the option to always use Sysmon to the option of only using it as needed
- Fixes an issue in the Trace Logon Events sensor where it would not report any results when the maximum number of results was exceeded
Tanium Trace 2.2.1.39
Release Date: December 19, 2017
Resolved Issues
- Fixes an issue in the Windows event recorder where false positives were being fired on some Detect Signals that included network conditions
- Fixes an issue in the Windows event recorder where command-lines were not being recorded for a brief period after recorder restart
- Fixes an issue in the Windows event recorder where the combined events view was showing the parent instead of a child on child process events
Tanium Trace 2.2.1.44
Release Date: January 9, 2018
Resolved Issues
- Fixes an issue in the Windows event recorder where some command-lines were not being recorded on endpoints under heavy load
- Fixes an issue in the Windows event recorder where false positives were being fired on some Detect Signals when the same file operation was being matched in multiple signals
- Adds support for Sysmon 7.01
Tanium Trace 2.2.1.48
Release Date: January 23, 2018
Resolved Issues
- Allows filtering of newer Windows operating systems to events such as Removable Storage
- Fixes issue where some upgrades of Sysmon did not succeed
- Fixes stability issues
Tanium Trace 2.2.1.51
Release Date: January 30, 2018
Resolved Issues
- Adds detail to the Tanium Trace Status sensor about whether command-lines are being properly recorded
- Fixes an issue in the Tanium Trace Status sensor where information about the most recent process event was not being included
- Changes a setting on the Windows event recorder to allow for better command-line and hash recording when using Sysmon
Known Issues and Workarounds
- In some cases, upgrades may reset the uploaded Sysmon.zip file. After you upgrade Trace, check the Distribute Tanium Trace Tools package for the Sysmon.zip and Sysmon.zip.sha256 files. If either of these files are missing, go to the Home page and click Configure Sysmon. You should see that the previously uploaded Sysmon.zip file is shown as 'enabled' with the version number. Click OK to resubmit this existing Sysmon.zip file. After you resubmit Sysmon, you should see it in the Distribute Tanium Trace Tools package.
Tanium Trace 2.2.1.56
Release Date: February 6, 2018
Resolved Issues
- Fixes issue where, in some cases, a previously uploaded Sysmon was not added back to the Distribute Tanium Trace Tools package on upgrade