Tanium Cloud Release Notes Endpoint Configuration Toolset

Endpoint Configuration Toolset version 2.38

End of Support Date: September 17, 2026

Endpoint Configuration Toolset (2.38.103) Release Notes

Release Date: July 1, 2026

Deploy/Software Management

Resolved Issues:

Fixed an issue where Deploy might calculate the wrong applicability for Uninstall key applicability rules.
Updated 7za to version 26.01 for Windows, Linux, and macOS.

Patch

Resolved Issues:

Extended the UUP patch download timeout by 40 minutes when waiting for the first request from the Windows Update Agent.

Improvements:

Changed the Download immediately deployment option so that, when cleared, patch downloads on Linux endpoints wait for an open maintenance window instead of starting at the deployment start time.
Added support for Ubuntu 26.04.

comply-cx

Resolved Issues:

Fixed an issue where renaming directories after scan completion might cause an error.

core-cx

Resolved Issues:

Fixed an issue where gathering Client Extension metrics could hang sensor results on Windows.

cx-stream

Resolved Issues:

Fixed an issue where Stream could crash when shutting down while actively sending Recorder-originated data.

extras-cx

Resolved Issues:

Fixed an issue in patch where a post-install scan after the endpoint reboots would incorrectly defer its launch leg when a maintenance window was active, causing multi-hour "Pending Restart" states.
Fixed an issue where a patch deployment with distribute-over-time could randomize its start past the end of the currently-open maintenance window, causing it to park in "waiting for maintenance window" and defer to a future occurrence.

patch-cx

Resolved Issues:

Fixed an issue where maintenance window sensor results were incorrect when all targeted maintenance windows were past their end time.
Fixed an issue where "Download Complete, Waiting" deployment status strings used a different parent status than previous versions of Patch.
Fixed an issue where deployments using the Offline CAB scan failed with error code 0x80248014.

threat-response-cx

Resolved Issues:

Fixed an issue where Threat Response did not set the "index_initial_scan_complete" CX status item to "false" before the scan completed.
Fixed an issue where the Persistence Analyzer could crash if no file path was present for an entry.

Third-party dependency updates

Default Content, Incident Response, Nmap, Provision, Python, core-cx

Endpoint Configuration Toolset (2.38.84) Release Notes

Release Date: June 19, 2026

EthernetIP Entity Provider

Improvements:

Improved long-term stability and performance for entity providers.

Performance

Resolved Issues:

Added additional evidence to the Performance - Event Details sensor for CPU events.

Improvements:

Added dump file path to the Performance - Event Details sensor for system crash events.

Profinet Entity Provider

Improvements:

Improved long-term stability and performance for entity providers.

Provision

Resolved Issues:

Fixed an issue where the TaniumPXE service stopped processing network requests due to a 'CoInitialize has not been called' error.

Recorder

Improvements:

Synchronized the driver version for older toolset manifests.

comply-cx

Improvements:

Fixed an issue where RAS scans did not complete when using newer engine versions.

discover-cx

Resolved Issues:

Fixed an issue where stale network addresses might be scanned after a subnet change.

end-user-cx

Resolved Issues:

Fixed an issue on non-Windows endpoints where broken sh -c quoting caused all EUSS self-service activity adds to silently fail.

entity-cx

Resolved Issues:

Fixed an issue where entity providers might enter a restart loop.

provision-cx

Resolved Issues:

Fixed an issue where a crash occasionally occurred on startup.

swmgr-cx

Resolved Issues:

Fixed an issue where Safari was not detected on Mac endpoints.
Fixed an issue where libcurl produced false-positive SBOM detections.
Fixed an issue where native library SBOM scanning caused high CPU usage on Linux endpoints.

Improvements:

Updated Certificate Manager to report the TLS 1.3 key exchange algorithm used during certificate negotiation.

Third-party dependency updates

EthernetIP Entity Provider, Provision, entity-cx, provision-cx

Endpoint Configuration Toolset version 2.36

End of Support Date: August 24, 2026

Endpoint Configuration Toolset (2.36.110) Release Notes

Release Date: July 1, 2026

Deploy/Software Management

Resolved Issues:

Fixed an issue where Deploy might calculate the wrong applicability for Uninstall key applicability rules.
Updated 7za to version 26.01 for Windows, Linux, and macOS.

Patch

Resolved Issues:

Extended the UUP patch download timeout by 40 minutes when waiting for the first request from the Windows Update Agent.

Improvements:

Changed the Download immediately deployment option so that, when cleared, patch downloads on Linux endpoints wait for an open maintenance window instead of starting at the deployment start time.
Added support for Ubuntu 26.04.

Recorder

Improvements:

Synchronized the driver version for older toolset manifests.

comply-cx

Resolved Issues:

Fixed an issue where renaming directories after scan completion might cause an error.

Improvements:

Fixed an issue where RAS scans did not complete when using newer engine versions.

core-cx

Resolved Issues:

Fixed an issue where gathering Client Extension metrics could hang sensor results on Windows.

cx-stream

Resolved Issues:

Fixed an issue where Stream could crash when shutting down while actively sending Recorder-originated data.

discover-cx

Resolved Issues:

Fixed an issue where Discover might scan stale network addresses after a subnet change.

extras-cx

Resolved Issues:

Fixed an issue in patch where a post-install scan after the endpoint reboots would incorrectly defer its launch leg when a maintenance window was active, causing multi-hour "Pending Restart" states.
Fixed an issue where a patch deployment with distribute-over-time could randomize its start past the end of the currently-open maintenance window, causing it to park in "waiting for maintenance window" and defer to a future occurrence.

patch-cx

Resolved Issues:

Fixed an issue where maintenance window sensor results were incorrect when all targeted maintenance windows were past their end time.
Fixed an issue where "Download Complete, Waiting" deployment status strings used a different parent status than previous versions of Patch.
Fixed an issue where deployments using the Offline CAB scan failed with error code 0x80248014.

swmgr-cx

Resolved Issues:

Fixed an issue where native library SBOM scanning caused high CPU usage on Linux endpoints.

threat-response-cx

Resolved Issues:

Fixed an issue where Threat Response did not set the "index_initial_scan_complete" CX status item to "false" before the scan completed.
Fixed an issue where the Persistence Analyzer could crash if no file path was present for an entry.

Third-party dependency updates

Default Content, EthernetIP Entity Provider, Incident Response, Nmap, Profinet Entity Provider, Provision, Python, core-cx

Endpoint Configuration Toolset (2.36.82) Release Notes

Release Date: June 8, 2026

Special Note

In a future toolset release after July 1st 2026, the handling of CPU throttling for client extensions will change. Currently, the throttle enforces both a per-extension limit (nominally half the total threshold) and an aggregate limit, which can leave available capacity unused. The updated behavior will remove the per-extension cap allowing extensions to fully use CPU capacity allocated by the throttle.

This means extensions will more consistently utilize the full configured throttle. Long-running work such as indexing might complete faster when not competing with other extensions. The throttle value itself (5% of total CPU capacity) is unchanged, and the overall CPU budget remains the same.

End-User Notifications

Resolved Issues:

Fixed an issue on macOS endpoints where End-User Notifications failed to launch when invoked by the Tanium Client.

Recorder

Improvements:

Synchronized the driver version for older toolset manifests.

core-cx

Resolved Issues:

Fixed an issue on Windows 7 SP1 where Client Extensions could falsely report a monitored process as having exited during the first 60-second sampling interval, before the process had actually finished.

cx-config

Resolved Issues:

Fixed an issue where a one-time extension crash could occur.

enforce-cx

Resolved Issues:

Fixed an issue where Windows Firewall rules were unable to be applied.

extras-cx

Resolved Issues:

Fixed an issue where schedules did not fire when expected if the endpoint was offline during the scheduled period.
Fixed an issue where endpoints using a multi-day scan frequency with Distribute Over Time could miss scheduled patch scans, causing scans to run less often than configured.
Fixed an issue where overloaded endpoints might not have patch scans scheduled to run.

patch-cx

Resolved Issues:

Fixed an issue where Patch List rules using Classification were not performing a case-insensitive comparison.
Fixed an issue where patch-cx might fail to read the listening port from the Tanium Scan for the WSUS server.
Fixed an issue where Patch List Compliance returned "Compliant" instead of "No Scan Results."
Fixed an issue where "Managed WSUS Compatibility" errors could prevent patching.
Fixed an issue where the wall clock moving backward during a deployment reboot could cause an endpoint to reboot repeatedly.
Fixed an issue where a reboot-capable deployment could not restart an endpoint that was waiting for a reboot before applying patches.
Fixed an issue where a race condition could cause patch-cx to become stuck.
Fixed an issue where endpoints using CAB scan might fail to run deployments after upgrading to a new version of patch-cx.

Improvements:

Added a new "Waiting for Another Deployment" deployment status when another deployment is preventing the progression of the current deployment, usually when waiting on an endpoint to restart.

swmgr-cx

Resolved Issues:

Resolved an issue where a certificate manager audit caused the endpoint extension to restart.

Third-party dependency updates

Python, Recorder, client-deploy-cx, comply-cx, core-cx, cx-config, cx-stream, dec-cx, discover-cx, end-user-cx, enforce-cx, entity-cx, extras-cx, index-cx, integrity-monitor-cx, patch-cx, performance-cx, provision-cx, swmgr-cx, threat-response-cx

Endpoint Configuration Toolset (2.36.56) Release Notes

Release Date: June 2, 2026

comply-cx

Fixed an issue where RAS scans did not complete when using newer engine versions.

End-User Self Service

Fixed an issue where End User Self-Service items could remain stuck in a “Pending Restart” state after a reboot. Following an End User content update, the activity-tracking map was being cleared on every client restart, which prevented post-reboot completion callbacks from transitioning the affected items.

Third-party dependency updates

Comply Engines, Deploy/Software Management, Enforce, swmgr-cx

Endpoint Configuration Toolset (2.36.48) Release Notes

Release Date: May 26, 2026

Known issues:

If a Threat Response detection configuration collects Deep Instinct (DI) event data and targets endpoints where Deep Instinct is not installed or cannot be accessed, Threat Response triggers a health check for those endpoints. Configure detection profiles that collect Deep Instinct event data to target only endpoints where Deep Instinct is installed and accessible.

Benchmark

Updated endpoint tool targeting for future Tanium Client compatibility.

Certificate Manager

Updated endpoint tool targeting for future Tanium Client compatibility.

Core Content

Updated endpoint tool targeting for future Tanium Client compatibility.

Deploy/Software Management

Fixed an issue where a failed deployment would retry when the maintenance window was closed.
Updated endpoint tool targeting for future Tanium Client compatibility.

End-User Notifications

Updated endpoint tool targeting for future Tanium Client compatibility.

End-User Self Service

Updated endpoint tool targeting for future Tanium Client compatibility.

Enforce

Fixed an issue where the BitLocker enforcement status reason column was appending text 'doesnotexist' and 'notapplied'.
Fixed an issue where legacy BitLocker policies were not reporting "superseded" when BitLocker v2 policies were enforced.
Fixed an issue where firewall policy statuses were not appearing when using enforce-cx 2.19.2288.
Updated endpoint tool targeting for future Tanium Client compatibility.
Fixed an issue where results from the "Enforce - Anti-Malware Threat Details" sensor were not being retrieved.

Engage

Updated endpoint tool targeting for future Tanium Client compatibility.

EthernetIP Entity Provider

Updated endpoint tool targeting for future Tanium Client compatibility.

Impact

Updated endpoint tool targeting for future Tanium Client compatibility.

Incident Response

Added coverage for macOS periodic launch daemons in macOS Autoruns Sensors.
Fixed an issue where Live Response could fail when semicolons were found in folder names.
Added support in TaniumFileTransfer for more Azure blob destinations.
Updated endpoint tool targeting for future Tanium Client compatibility.

Patch

Updated endpoint tool targeting for future Tanium Client compatibility.
Fixed an issue where custom fields might not work when scan results contained multiple KB articles for a single patch.

Performance

Updated endpoint tool targeting for future Tanium Client compatibility.

Profinet Entity Provider

Updated endpoint tool targeting for future Tanium Client compatibility.

Python

Added CycloneDX 1.4 Software Bill of Materials (SBOM) files to the Python endpoint tool packages. This allows vulnerability scanners to identify and track software components shipped with Tanium Python, including Python itself, installed libraries, and Windows runtime dependencies.
Updated endpoint tool targeting for future Tanium Client compatibility.

Recorder

Added support for generating audit events when USB devices are connected on Windows machines.
Fixed an issue where full process ancestry could be lost for some processes during a CX restart.
Fixed an issue where intermediate match-state of signals was not retained across CX restarts.
Fixed an issue where signals could report with an incomplete process hierarchy.
Improved BPF-based DNS data to report all resolved addresses.
Added BPF functionality for future Linux OS Support.

Threat Response

Updated endpoint tool targeting for future Tanium Client compatibility.

comply-cx

Fixed a potential issue during CX startup where sensors were not responding.
Fixed an issue where the Detected Products field contained an unexpected character.
Added a dependency on IndexCX.

core-cx

Extended internal battery metrics tracking to macOS.
Increased performance and speed of the "Client Health - Health Failures" sensor.

cx-stream

Fixed an issue where the extension could crash under certain conditions.
Fixed an issue where Stream could crash when stopping an output chain.
Replaced Stream's JSON-based configuration storage with a database.
Fixed an issue where the "has_chain" Client Extension Status entries may not include all active chains.
Fixed an issue where the hostname might be reported incorrectly when using multiple Stream destinations.

cx-tsdb

Updated endpoint tool targeting for future Tanium Client compatibility.

end-user-cx

Fixed an issue where Engage survey notifications to which a user had not responded might continue to repeat after the user responded.
Fixed an issue where surveys without an end time could cause Client Extensions to crash.
Updated endpoint tool targeting for future Tanium Client compatibility.

enforce-cx

Fixed an issue where the BitLocker recovery key was incorrectly requiring rotation if the system clock was rolled back and then the drive was decrypted after it was previously encrypted.

entity-cx

Propagated log level changes to entity providers.
Improved tool installation and upgrade paths by stopping existing tools first.
Added step to remove entity data on uninstall.
Reduced frequency of log messages during installation.

integrity-monitor-cx

Removed the internal 1000-row limit on get-events mailbox.
Added support for dumping events to a text file and retrieving them via EMG.
Updated endpoint tool targeting for future Tanium Client compatibility.

patch-cx

Fixed an issue where incorrect deployment status was written to End-User Self Service activity history.
Added a new Patch environment option, scheduled_download_requires_mw (default: disabled), that defers patch downloads until an endpoint is inside an open maintenance window when a deployment is configured with download_immediately=false. Previously, such deployments began downloading as soon as the schedule became active, regardless of maintenance window state. With this option enabled, download behavior is unified with deployments that use a global maintenance window. This change also resolves an issue where patch downloads could be initiated after the deployment schedule had ended.
Updated endpoint tool targeting for future Tanium Client compatibility.
Fixed output differences in the Patch - Patch List Compliance and Patch - Applicable Patch Status by CVE sensors; results now match the prior implementation.

swmgr-cx

Added support for the Certificate Template extension to be decoded and returned in the MESA table.
Added support for reporting UEFI/SecureBoot certificates from Linux endpoints to Certificate Manager.
Fixed an issue where nulls in a column prevented further details from being displayed.
Added the is_ssl mesa column to certificate_services.
Updated endpoint tool targeting for future Tanium Client compatibility.

threat-response-cx

Added support for the "EventLogItem/Machine" IOC term.
Added a Health Check to report an inability to communicate with the Deep Instinct client.
Improved performance of Index-based scanning when Index does not have any new data since the previous scan.
Added an optimization to the Threat Response IOC hunting which will collapse multiple conditions into a single file index query, reducing the total number of queries required to evaluate intel.
Fixed an issue where Index-based scanning data might not be evaluated when the system clock is set to a future time and then set back.
Fixed an issue where the Persistence Analyzer would not search the Windows system PATH for the location of "Scheduled Task" executables.
Fixed an issue where an error was reported for IOC "FileItem/PEInfo" terms if no Portable Executable (PE) data was available for evaluation.
Updated third-party dependencies.
Fixed an issue where YARA scans could read from locations on macOS that could interfere with Tanium's internal databases.
Added a client configuration option to control the retention period of "Live Files" hunting data.

Third-party dependency updates

Recorder

Endpoint Configuration Toolset version 2.34

End of Support Date: August 4, 2026

Endpoint Configuration Toolset (2.34.160) Release Notes

Release Date: July 1, 2026

Deploy/Software Management

Resolved Issues:

Fixed an issue where Deploy might calculate the wrong applicability for Uninstall key applicability rules.
Updated 7za to version 26.01 for Windows, Linux, and macOS.

Recorder

Improvements:

Added BPF functionality for future Linux OS support.
Synchronized the driver version for older toolset manifests.

comply-cx

Resolved Issues:

Fixed an issue where renaming directories after scan completion might cause an error.

core-cx

Resolved Issues:

Fixed an issue where gathering Client Extension metrics could hang sensor results on Windows.

cx-stream

Resolved Issues:

Fixed an issue where Stream could crash when shutting down while actively sending Recorder-originated data.

discover-cx

Resolved Issues:

Fixed an issue where Discover might scan stale network addresses after a subnet change.

extras-cx

Resolved Issues:

Fixed an issue in patch where a post-install scan after the endpoint reboots would incorrectly defer its launch leg when a maintenance window was active, causing multi-hour "Pending Restart" states.
Fixed an issue where a patch deployment with distribute-over-time could randomize its start past the end of the currently-open maintenance window, causing it to park in "waiting for maintenance window" and defer to a future occurrence.

patch-cx

Resolved Issues:

Fixed an issue where maintenance window sensor results were incorrect when all targeted maintenance windows were past their end time.
Fixed an issue where "Download Complete, Waiting" deployment status strings used a different parent status than previous versions of Patch.
Fixed an issue where deployments using the Offline CAB scan failed with error code 0x80248014.

swmgr-cx

Resolved Issues:

Fixed an issue where native library SBOM scanning caused high CPU usage on Linux endpoints.

threat-response-cx

Resolved Issues:

Fixed an issue where Threat Response did not set the "index_initial_scan_complete" CX status item to "false" before the scan completed.

Third-party dependency updates

Default Content, EthernetIP Entity Provider, Incident Response, Nmap, Profinet Entity Provider, Provision, Python, core-cx

Endpoint Configuration Toolset (2.34.135) Release Notes

Release Date: June 8, 2026

Special Note

In a future toolset release after July 1st 2026, the handling of CPU throttling for client extensions will change. Currently, the throttle enforces both a per-extension limit (nominally half the total threshold) and an aggregate limit, which can leave available capacity unused. The updated behavior will remove the per-extension cap allowing extensions to fully use CPU capacity allocated by the throttle.

This means extensions will more consistently utilize the full configured throttle. Long-running work such as indexing might complete faster when not competing with other extensions. The throttle value itself (5% of total CPU capacity) is unchanged, and the overall CPU budget remains the same.

End-User Notifications

Resolved Issues:

Fixed an issue on macOS endpoints where End-User Notifications failed to launch when invoked by the Tanium Client.

Recorder

Improvements:

Synchronized the driver version for older toolset manifests.

core-cx

Resolved Issues:

Fixed an issue on Windows 7 SP1 where Client Extensions could falsely report a monitored process as having exited during the first 60-second sampling interval, before the process had actually finished.

cx-config

Resolved Issues:

Fixed an issue where a one-time extension crash could occur.

enforce-cx

Resolved Issues:

Fixed an issue where Windows Firewall rules were unable to be applied.

extras-cx

Resolved Issues:

Fixed an issue where schedules did not fire when expected if the endpoint was offline during the scheduled period.
Fixed an issue where endpoints using a multi-day scan frequency with Distribute Over Time could miss scheduled patch scans, causing scans to run less often than configured.
Fixed an issue where overloaded endpoints might not have patch scans scheduled to run.

integrity-monitor-cx

Improvements:

Updated endpoint tool targeting for future Tanium Client compatibility.

patch-cx

Resolved Issues:

Fixed an issue where incorrect deployment status was written to End-User Self Service activity history.
Fixed an issue where the Patch - Deployment Statuses sensor did not return the "No deployment statuses" result when no deployment statuses were found.
Fixed an issue where deployments in "Pending Restart, Waiting for Maintenance Window" state could reboot outside of a maintenance window upon upgrading to Patch CX.
Fixed an issue where the Patch - Patch List Compliance sensor did not correctly handle the "Patch Lists to combine (virtual list)" parameter.
Fixed an issue where the Patch - Patch List Compliance and Patch - Applicable Patch Status by CVE sensors returned results that differed from the prior implementation.
Fixed an issue where Patch List rules using Classification were not performing a case-insensitive comparison.
Fixed an issue where patch-cx might fail to read the listening port from the Tanium Scan for the WSUS server.
Fixed an issue where Patch List Compliance returned "Compliant" instead of "No Scan Results."
Fixed an issue where "Managed WSUS Compatibility" errors could prevent patching.
Fixed an issue where the wall clock moving backward during a deployment reboot could cause an endpoint to reboot repeatedly.
Fixed an issue where a reboot-capable deployment could not restart an endpoint that was waiting for a reboot before applying patches.
Fixed an issue where a race condition could cause patch-cx to become stuck.
Fixed an issue where endpoints using CAB scan might fail to run deployments after upgrading to a new version of patch-cx.

Improvements:

Added a new Patch environment option, scheduled_download_requires_mw (default: disabled), that defers patch downloads until an endpoint is inside an open maintenance window when a deployment is configured with download_immediately=false. Previously, such deployments began downloading as soon as the schedule became active, regardless of maintenance window state. With this option enabled, download behavior is unified with deployments that use a global maintenance window. This change also resolves an issue where patch downloads could be initiated after the deployment schedule had ended.
Added a new "Waiting for Another Deployment" deployment status when another deployment is preventing the progression of the current deployment, usually when waiting on an endpoint to restart.
Updated endpoint tool targeting for future Tanium Client compatibility.

Third-party dependency updates

Python, Recorder, client-deploy-cx, comply-cx, core-cx, cx-config, cx-stream, dec-cx, discover-cx, end-user-cx, enforce-cx, entity-cx, extras-cx, index-cx, integrity-monitor-cx, patch-cx, performance-cx, provision-cx, swmgr-cx, threat-response-cx

Endpoint Configuration Toolset (2.34.106) Release Notes

Release Date: June 2, 2026

comply-cx

Fixed an issue where RAS scans did not complete when using newer engine versions.

End-User Self Service

Fixed an issue where End User Self-Service items could remain stuck in a “Pending Restart” state after a reboot. Following an End User content update, the activity-tracking map was being cleared on every client restart, which prevented post-reboot completion callbacks from transitioning the affected items.

Third-party dependency updates

Comply Engines, Deploy/Software Management, swmgr-cx

Endpoint Configuration Toolset (2.34.99) Release Notes

Release Date: May 19, 2026

End-User Notifications

Fixed an issue where upgrading End-User Notifications on Windows endpoints without the Tanium Default Content tool deployed could leave the endpoint without end-user-notifications.exe.

Endpoint Configuration Toolset (2.34.98) Release Notes

Release Date: May 18, 2026

Recorder

Fixed an issue where Recorder would not properly clean up after being uninstalled via the Endpoint Configuration - Uninstall Tool package.
Updated endpoint tool targeting for future Tanium Client compatibility.
Synchronized the driver version for older toolset manifests.

client-deploy-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

cx-config

Fixed an issue where config-cx could not shut down cleanly during tool installation, causing an error message.

dec-cx

Fixed an issue where Client Extension may stop responding until reset.
Fixed an issue where Client Extension failed when attempting to access a file in system32.

discover-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

enforce-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

entity-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

index-cx

Fixed an issue where the index crashed on macOS systems.
Expanded default index exclusions to include databases within the TaniumClient directory.
Updated endpoint tool targeting for future Tanium Client compatibility.

patch-cx

Fixed an issue where endpoints with a large number of patches could crash.
Fixed an issue where deployments in "Pending Restart, Waiting for Maintenance Window" state could reboot outside of a maintenance window upon upgrading to patchcx.
Fixed an issue where the "Patch - Patch List Compliance" handling of the "Patch Lists to combine (virtual list)" parameter was incorrect.

performance-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

provision-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

swmgr-cx

Fixed an issue where a container image registry listing duplicate image labels in the catalog could cause Software Manager CX to crash while inventorying the registry.

threat-response-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

Third-party dependency updates

Core Content, Incident Response, Provision, Recorder, Threat Response, client-deploy-cx, comply-cx, core-cx, cx-config, cx-stream, dec-cx, discover-cx, end-user-cx, enforce-cx, entity-cx, extras-cx, index-cx, patch-cx, performance-cx, provision-cx, swmgr-cx, threat-response-cx

Endpoint Configuration Toolset (2.34.66) Release Notes

Release Date: May 6, 2026

Comply Engines

Updated the Tanium-provided JRE.

Deploy/Software Management

Added "Pending Ring Progression" as a status to the "Deploy - Deployments" sensor.
Fixed an issue in the Self Service Client where the activity history operation field was missing.
Fixed an issue where Deploy sensors could cause Tanium Data Service to operate inefficiently.

End-User Notifications

Reduced false-positive EUN Tool install failures that occurred when EUN or EUSS was running during the install process. The tool now better handles in-use scenarios and provides clearer logging to distinguish real failures from temporary retries.
Added code signing to all PS1 and VBS files in the EUN Tool package, including client-ui-launcher, end-user-notifications-launcher, install/remove scripts, and config files.
Fixed an issue where the EUN Launcher crashed when the user profile directory was not fully mounted (for example, in FSLogix environments).
Fixed an issue on macOS 26.3 where End User Notifications appeared with missing UI elements (Accept button, close button) and would immediately reappear after closing the Launcher app. The fix resets the notification window zoom level when each window is created, preventing previously stored zoom factors from cutting off controls.
Fixed an issue where the End User Self Service application icon in the macOS Applications folder appeared broken for standard (non-admin) users. The fix updates alias permissions to use the wheel group instead of admin, ensuring the icon displays correctly for all users.

End-User Self Service

Fixed an issue where the application name on desktop shortcuts was not using the localized version when additional languages were configured. The application name now correctly displays in the user's selected language (e.g., Japanese) instead of always showing the default English value.
Fixed an issue where long self-service deployment names would overflow or wrap awkwardly within the tile UI, interfering with the action button.
Fixed an issue where survey translations in EUSS did not display localized content (questions, responses, and titles) correctly when users had additional languages configured.
Fixed an issue where the language dropdown did not appear in the Self Service Portal when only one additional language (aside from English) was configured. The language selector now displays correctly with a single additional language (e.g., Español or Japanese alone).

Incident Response

Endpoints that have Endpoint Configuration targeting IR tools but do not have Threat Response licensed and installed will fail to install this update. Make sure that Threat Response is licensed before upgrading endpoints to this toolset version. For more information, see the Tanium Threat Response User Guide. If certain endpoints fail to upgrade IR tools, contact Tanium Support for assistance.

Nmap

Updated the nmap Windows binary to no longer require the Microsoft Visual C++ Redistributable on endpoints.

Performance

Removed legacy components from tooling.

Python

Updated endpoint tool targeting for future Tanium Client compatibility.

SSL Server Audit

Removed endpoint tool from toolset manifest.

Tanium Client

Updated the Tanium Client for ECM Upgrades to 7.8.2.1170.

comply-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

core-cx

Fixed an issue where SupportCX crashed in environments with large action logs.
Updated endpoint tool targeting for future Tanium Client compatibility.

cx-config

Updated endpoint tool targeting for future Tanium Client compatibility.

cx-stream

Fixed an issue where Stream might use Certification Authority (CA) certificates outside of system and Tanium folders on Windows machines.
Updated endpoint tool targeting for future Tanium Client compatibility.

dec-cx

Added support for operating over the new CXSocket transport.

end-user-cx

Updated Engage endpoint tools to use the CX version instead of the Python version.
Fixed an issue where surveys without an end time could cause client extensions to crash

enforce-cx

Fixed an issue where erroneous log messages were generated.
Fixed an issue where excessive CPU usage could occur in certain situations.
Fixed an issue where an unknown service in a security policy would report an enforcement error.
Fixed an issue where enforcement status did not update correctly for Windows Firewall policies.

extras-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

index-cx

Expanded index mount discovery on AIX.
Expanded index mount discovery on Solaris.

patch-cx

Fixed an issue where scan metadata was downloaded immediately instead of upon scan start.
Fixed an issue where the Install Status column of the Patch - Patch List Applicability sensors did not include the pending restart status of a patch.
Fixed an issue where the disk space required in Self Service was shown as 0 bytes.
Fixed an issue where the Patch - Deployment Statuses sensor did not return the "No deployment statuses" result when no deployment statuses were found.

performance-tsdb

Various tool improvements.

Third-party dependency updates

Comply Engines, Core Content, EthernetIP Entity Provider, Incident Response, Nmap, Npcap, Profinet Entity Provider, Python, Threat Response, comply-cx, core-cx, cx-config, cx-stream, dec-cx, end-user-cx, extras-cx, index-cx

Endpoint Configuration Toolset version 2.32

End of Support Date: June 22, 2026

Endpoint Configuration Toolset (2.32.122) Release Notes

Release Date: June 8, 2026

Special Note

In a future toolset release after July 1st 2026, the handling of CPU throttling for client extensions will change. Currently, the throttle enforces both a per-extension limit (nominally half the total threshold) and an aggregate limit, which can leave available capacity unused. The updated behavior will remove the per-extension cap allowing extensions to fully use CPU capacity allocated by the throttle.

This means extensions will more consistently utilize the full configured throttle. Long-running work such as indexing might complete faster when not competing with other extensions. The throttle value itself (5% of total CPU capacity) is unchanged, and the overall CPU budget remains the same.

Recorder

Improvements:

Synchronized the driver version for older toolset manifests.

core-cx

Resolved Issues:

Fixed an issue on Windows 7 SP1 where Client Extensions could falsely report a monitored process as having exited during the first 60-second sampling interval, before the process had actually finished.

cx-config

Resolved Issues:

Fixed an issue where a one-time extension crash could occur.

extras-cx

Resolved Issues:

Fixed an issue where schedules did not fire when expected if the endpoint was offline during the scheduled period.
Fixed an issue where endpoints using a multi-day scan frequency with Distribute Over Time could miss scheduled patch scans, causing scans to run less often than configured.
Fixed an issue where overloaded endpoints might not have patch scans scheduled to run.

integrity-monitor-cx

Improvements:

Updated endpoint tool targeting for future Tanium Client compatibility.

patch-cx

Resolved Issues:

Fixed an issue where the Patch - Patch List Compliance and Patch - Applicable Patch Status by CVE sensors returned results that differed from the prior implementation.

Third-party dependency updates

Python, Recorder, client-deploy-cx, comply-cx, core-cx, cx-config, cx-stream, dec-cx, discover-cx, end-user-cx, enforce-cx, entity-cx, extras-cx, index-cx, integrity-monitor-cx, patch-cx, performance-cx, provision-cx, swmgr-cx, threat-response-cx

Endpoint Configuration Toolset (2.32.99) Release Notes

Release Date: June 2, 2026

Third-party dependency updates

Deploy/Software Management, swmgr-cx

Endpoint Configuration Toolset (2.32.95) Release Notes

Release Date: May 18, 2026

Recorder

Fixed an issue where Recorder would not properly clean up after being uninstalled via the Endpoint Configuration - Uninstall Tool package.
Updated endpoint tool targeting for future Tanium Client compatibility.
Synchronized the driver version for older toolset manifests.

client-deploy-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

cx-config

Updated endpoint tool targeting for future Tanium Client compatibility.
Fixed an issue where config-cx could not shut down cleanly during tool installation, causing an error message.

cx-stream

Fixed an issue where Stream might use Certification Authority (CA) certificates outside of system and Tanium folders on Windows machines.
Updated endpoint tool targeting for future Tanium Client compatibility.

dec-cx

Fixed an issue where Client Extension may stop responding until reset.
Fixed an issue where Client Extension failed when attempting to access a file in system32.

discover-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

index-cx

Fixed an issue where the index crashed on macOS systems.
Expanded default index exclusions to include databases within the TaniumClient directory.

patch-cx

Fixed an issue where endpoints with a large number of patches could crash.
Fixed an issue where deployments in "Pending Restart, Waiting for Maintenance Window" state could reboot outside of a maintenance window upon upgrading to patchcx.
Fixed an issue where the "Patch - Patch List Compliance" handling of the "Patch Lists to combine (virtual list)" parameter was incorrect.

performance-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

provision-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

swmgr-cx

Fixed an issue where a container image registry listing duplicate image labels in the catalog could cause Software Manager CX to crash while inventorying the registry.

threat-response-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

Third-party dependency updates

Core Content, Incident Response, Provision, Recorder, client-deploy-cx, comply-cx, core-cx, cx-config, cx-stream, dec-cx, discover-cx, end-user-cx, enforce-cx, entity-cx, extras-cx, index-cx, patch-cx, performance-cx, provision-cx, swmgr-cx, threat-response-cx

Endpoint Configuration Toolset (2.32.63) Release Notes

Release Date: May 6, 2026

end-user-cx

Fixed an issue that might cause erroneous Engage survey notifications for users.

Third-party dependency updates

end-user-cx

Endpoint Configuration Toolset (2.32.62) Release Notes

Release Date: May 5, 2026

Comply Engines

Updated the Tanium-provided JRE.

Tanium Client

Updated the Tanium Client for ECM Upgrades to 7.8.2.1170.

Python

Updated endpoint tool targeting for future Tanium Client compatibility.

Nmap

Updated the nmap Windows binary to no longer require the Microsoft Visual C++ Redistributable on endpoints.

core-cx

Fixed an issue where SupportCX crashed in environments with large action logs.
Updated endpoint tool targeting for future Tanium Client compatibility.

Third-party dependency updates

Comply Engines, EthernetIP Entity Provider, Incident Response, Initial Content - Python, Nmap, Npcap, Profinet Entity Provider, core-content, core-cx

Endpoint Configuration Toolset (2.32.47) Release Notes

Release Date: April 14, 2026

Patch

Fixed an issue where the Monthly Relative Maintenance Window transition time was calculated incorrectly.
Fixed an issue where blocking the Patch tool did not block the patch-cx tool.
Fixed an issue where the cache became stale when overwriting files in the same location.

Patch-cx

Fixed an issue where a crash might occur when multiple UUP deployments tried to download patches simultaneously.
Improved the "Invalid URL detected" health check string to better indicate that this condition does not prevent patching
Fixed an issue where relative release date rules in patch lists were evaluated in UTC instead of endpoint local time.
Fixed an issue where the Patch - Patch List Compliance sensor results included incorrect patch list IDs when deployments contained patch lists using fixed versions.

Endpoint Configuration Toolset (2.32.44) Release Notes

Release Date: April 8, 2026

Deploy/Software Management

Updated to detect whether an endpoint is running a multi-session operating system.

Incident Response

Endpoints that have Endpoint Configuration targeting IR tools but do not have Threat Response licensed and installed will fail to install this update. Make sure that Threat Response is licensed before upgrading endpoints to this toolset version. For more information, see the Tanium Threat Response User Guide. If certain endpoints fail to upgrade IR tools, contact Tanium Support for assistance.

Performance

Include Application Path, Module Path, and Fault Offset for Windows in the Performance - Event Details sensor
Added application crash exception code to the output of the *Performance – Event Details" sensor for Windows endpoints.

Profinet Entity Provider

Fixed an issue where Linux Profinet discovery would not work with certain hostname configurations.

Python

Updated Python Interpreter to 3.12.13.
Fixed an issue that might result in erroneous errors on older macOS endpoints.

enforce-cx

Fixed an issue where applying multiple methods for a single policy item was not working correctly.
Improved policy application by not deleting the parent registry key when no child keys exist.
Fixed an issue where user policies were applied inconsistently because stale policy items were sometimes processed for users who weren't logged in.

extras-cx

Fixed an issue where endpoint local blocking and maintenance windows were treated as UTC times

threat-response-cx

Fixed an issue where a crash was possible when performing On Demand scans for file hashes.
Fixed an issue where the extensions/threatresponse folder was not removed when performing a hard uninstall of the endpoint tool.
Fixed an issue where suppressions using ancestry-based terms for processes might not have been evaluated correctly.

Third-party dependency updates

Certificate Manager
Ethernet IP Entity Provider
Incident Response Endpoint Tools
Performance
Profinet Entity Provider
Provision
Threat Response
core-cx
enforce-cx
entity-cx
performance-tsdb

Endpoint Configuration Toolset (2.32.25) Release Notes

Release Date: March 24, 2026

Asset

Removed unused dependencies.

Benchmark

Updated the manifest to uninstall the discontinued risk-cx tool from all endpoints.

Content - AD Query

Resolved an issue that caused inventory collection to fail if a group name included an en dash.
Updated primary user detection by removing the ntuser.dat logic, resulting in more accurate data.
Improved content performance by optimizing WMI queries.

Deploy/Software Management

Fixed an issue where Self Service profiles were processed inefficiently.
Fixed an issue where a software package applicability status could be wrong if an error was encountered while evaluating a WMI Query or Service Status applicability rule.
Fixed an issue where some scan error states were not reported. Scan error states are now more accurate, which might cause an increase in scan errors that were previously hidden in some environments, particularly WMI query errors caused by a missing namespace, invalid query syntax, or problems with the operating system on affected endpoints. For troubleshooting assistance, search for "WMI query error" and "Troubleshooting Deploy Coverage" in the Deploy User Guide.

Ethernet IP Entity Provider

Added support for Arm-based Linux satellites.

Impact

Removed unused dependencies.

Patch

Added additional languages for End User Self-Service and updated existing translations.

Profinet Entity Provider

Added support for Arm-based Linux satellites.

Provision

Updated third-party dependencies.

Python

Updated a third-party dependency.
Updated all vbs and ps1 files deployed by this tool to be signed.
Removed the python2 endpoint tool.

Recorder

Updated to include Driver 3.5.22, which applied a cosmetic fix for Anti-Tamper service DACLs. Functionality of Anti-Tamper was not impacted.

Screen Sharing

Added improved debugging capabilities.

comply-cx

Improved disk performance for SBOM vulnerability intel updates.
Added a configuration option to rate limit file installation.
Fixed an issue where Unknown rule results were not being collected for affected CVEs.
Improved responsiveness during file installation.
Improved responsiveness to configuration changes.
Added a working directory to support temporary scan artifacts.
Added a file that lists all files and directories within the Comply extension to endpoint must gathers.

core-cx

Fixed an issue where a fatal error occurred in a worker thread when a request on that thread timed out.
Added a setting to configure disk space warnings by absolute space remaining instead of the default of percentage of space remaining.
Reduced unnecessary logging for commands that have not been registered.
Fixed an issue where a disabled Client Extension might not report health information.
Updated to issue a health check when an extension is unable to start.
Fixed an issue with excessive logging when an extension is quarantined.
Added Client settings to reset the core-cx and client-cx databases.
Added a Client setting for the Client download retry interval.
Improved log messages when a Windows endpoint cannot load the wlanapi.dll library.
Updated a third-party dependency.
Improved data collection for endpoint must gathers.
Added CustomTags information in endpoint must gathers.
Added additional environmental information to endpoint must gathers.

end-user-cx

Fixed an issue that could cause duplicate notifications to be displayed on underprovisioned VMs.
Fixed an issue where a notification that had been accepted could be redisplayed.

extras-cx

Fixed an issue where patch deployments might not honor the distribute over time setting.
Resolved an issue where accessing domain_information_policies on an endpoint joined exclusively to an Entra domain with no domain name might cause a crash.
Updated a third-party dependency.

patch-cx

Fixed an issue where invalid WSUS URLs may fail to download if an endpoint alternates between using Tanium Scan for Windows and a local WSUS server to search for updates.
Fixed an issue where endpoints may enter a reboot loop when the post-reboot scan failed.
Fixed an issue where the Patch - Patch List Compliance sensor may return inaccurate results.
Enabled PatchCX tool by default.
Updated a third-party dependency.

swmgr-cx

Fixed an issue where SIU data was not correctly refreshed.
Enables PatchCX by default.
Improved certificate scanning compatibility.
Fixed an issue where PHP vulnerabilities were not being reported to Comply.
Updated to remove unnecessary duplication of SBOM vulnerability definitions.
Updated to reclaim disk space after certificate renewal jobs.
Fixed an issue with generating SBOMs from Java POM manifests.
Added a command to reset the SBOM database.
Fixed a migration error in Certificate Manager.
Added a Client setting to enable generating SBOMs for PHP binaries on Windows endpoints.
Added support for reporting UEFI Secure Boot certificates from Windows endpoints to Certificate Manager.
Fixed false positives for CVE-2020-1938, CVE-2025-24813, and CVE-2023-44487 in Comply SBOM.

Endpoint Configuration Toolset version 2.28

End of Support Date: May 25, 2026

Endpoint Configuration Toolset (2.28.170) Release Notes

Release Date: May 18, 2026

Recorder

Fixed an issue where Recorder would not properly clean up after being uninstalled via the Endpoint Configuration - Uninstall Tool package.
Updated endpoint tool targeting for future Tanium Client compatibility.
Synchronized the driver version for older toolset manifests.

client-deploy-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

cx-config

Updated endpoint tool targeting for future Tanium Client compatibility.
Fixed an issue where config-cx could not shut down cleanly during tool installation, causing an error message.

cx-stream

Fixed an issue where Stream might use Certification Authority (CA) certificates outside of system and Tanium folders on Windows machines.
Updated endpoint tool targeting for future Tanium Client compatibility.

dec-cx

Fixed an issue where Client Extension may stop responding until reset.
Fixed an issue where Client Extension failed when attempting to access a file in system32.

discover-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

index-cx

Fixed an issue where the index crashed on macOS systems.
Expanded default index exclusions to include databases within the TaniumClient directory.

performance-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

provision-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

risk-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

threat-response-cx

Updated endpoint tool targeting for future Tanium Client compatibility.

Third-party dependency updates

Core Content, Incident Response, Provision, Recorder, client-deploy-cx, comply-cx, core-cx, cx-config, cx-stream, dec-cx, discover-cx, end-user-cx, enforce-cx, entity-cx, extras-cx, index-cx, patch-cx, performance-cx, provision-cx, risk-cx, swmgr-cx, threat-response-cx

Endpoint Configuration Toolset (2.28.136) Release Notes

Release Date: May 6, 2026

end-user-cx

Fixed an issue that might cause erroneous Engage survey notifications for users.

Third-party dependency updates

end-user-cx

Endpoint Configuration Toolset (2.28.135) Release Notes

Release Date: May 5, 2026

Comply Engines

Updated the Tanium-provided JRE.

ECM Toolset Manifest

Updated the Tanium Client for ECM Upgrades to 7.8.2.1170.

Initial Content - Python

Updated endpoint tool targeting for future Tanium Client compatibility.

Nmap

Updated the nmap Windows binary to no longer require the Microsoft Visual C++ Redistributable on endpoints.

core-cx

Fixed an issue where SupportCX crashed in environments with large action logs.

Third-party dependency updates

Comply Engines, EthernetIP Entity Provider, Incident Response, Initial Content - Python, Nmap, Npcap, Profinet Entity Provider, core-content, core-cx

Endpoint Configuration Toolset (2.28.121) Release Notes

Release Date: April 8, 2026

Asset

Removed unused dependencies.

Deploy/Software Management

Fixed an issue where Self Service profiles were processed inefficiently.
Updated to detect whether an endpoint is running a multi-session operating system.

Impact

Removed unused dependencies.

Incident Response

Endpoints that have Endpoint Configuration targeting IR tools but do not have Threat Response licensed and installed will fail to install this update. Make sure that Threat Response is licensed before upgrading endpoints to this toolset version. For more information, see the Tanium Threat Response User Guide. If certain endpoints fail to upgrade IR tools, contact Tanium Support for assistance.

Performance

Include Application Path, Module Path, and Fault Offset for Windows in the Performance - Event Details sensor
Added application crash exception code to the output of the *Performance – Event Details" sensor for Windows endpoints.

Profinet Entity Provider

Fixed an issue where Linux Profinet discovery would not work with certain hostname configurations.

Python

Updated Python Interpreter to 3.12.13.
Removed the python2 endpoint tool.
Fixed an issue that might result in erroneous errors on older macOS endpoints.

Recorder

Updated to include Driver 3.5.22, which applied a cosmetic fix for Anti-Tamper service DACLs. Functionality of Anti-Tamper was not impacted.

end-user-cx

Fixed an issue that could cause duplicate notifications to be displayed on underprovisioned VMs.

enforce-cx

Fixed an issue where applying multiple methods for a single policy item was not working correctly.
Improved policy application by not deleting the parent registry key when no child keys exist.
Fixed an issue where user policies were applied inconsistently because stale policy items were sometimes processed for users who weren't logged in.

extras-cx

Fixed an issue where patch deployments might not honor the distribute over time setting.
Fixed an issue where endpoint local blocking and maintenance windows were treated as UTC times
Fixed an issue where accessing domain_information_policies on an endpoint joined exclusively to an Entra domain with no domain name might cause a crash.

patch-cx

Fixed an issue where endpoints may enter a reboot loop when the post-reboot scan failed.

swmgr-cx

Fixed an issue where SIU data was not correctly refreshed.

threat-response-cx

Fixed an issue where a crash was possible when performing On Demand scans for file hashes.
Fixed an issue where the extensions/threatresponse folder was not removed when performing a hard uninstall of the endpoint tool.
Fixed an issue where suppressions using ancestry-based terms for processes might not have been evaluated correctly.

Third-party dependency updates

Certificate Manager
Ethernet IP Entity Provider
Incident Response Endpoint Tools
Performance
Profinet Entity Provider
Provision
Python
Threat Response
core-cx
enforce-cx
entity-cx
extras-cx
performance-tsdb

Endpoint Configuration Toolset (2.28.89) Release Notes

Release Date: March 4, 2026

Disqualification of previous Toolset version

This toolset disqualifies Endpoint Configuration Toolset 2.28.88. The disqualified toolset included Tanium Client 7.8.2.1149 for ECM upgrades. This version of the Tanium Client had an issue that has been fixed in version 7.8.2.1152. This Toolset version contains the updates listed for Endpoint Configuration Toolset 2.28.88.

Tanium Client

Updated the Tanium Client for ECM upgrades to 7.8.2.1152. This Tanium Client version fixes an issue where a throttling error caused slowed downloads.

Endpoint Configuration Toolset (2.28.88) Release Notes

Release Date: February 24, 2026

DISQUALIFIED TOOLSET VERSION

This toolset has been disqualified. It included Tanium Client 7.8.2.1149 for ECM upgrades. This version of the Tanium Client had an issue that has been fixed in version 7.8.2.1152, which is included with Endpoint Configuration Toolset 2.28.89.

Content - Default

Improved the PowerShell Constrained Language Mode detection on the Windows implementation of the 'Tanium Client Core Health' sensor.
Improved the Windows implementation of the 'Tanium Client Core Health' sensor to report if the undesirable '__PSLockdownPolicy' environment variable is detected.

Content - Enhanced Tags

Fixed an issue where retrieving the Last Logged In User would sometimes fail.

Deploy/Software Management

Added additional languages for End User Self-Service and updated existing translations.
Updated to include software package data in the sub-status and error columns of the deployment sensors.
Reduced mailbox calls used by the Software Management tool.

End-User Notifications

Fixed incorrect "Company" file property detail for end-user-notifications.exe file.
Fixed an issue where Self-service would not appear in the macOS Tahoe launchpad.
Added End-User Notification language support for Korean, Italian, and Brazilian Portuguese.
Improved notification popup readability for screen reading applications.

End-User Self Service

Added End-User Self-Service language support for Italian, Korean and Brazilian Portuguese.

Enforce Endpoint Tools

Added support for Rocky Linux and AlmaLinux distributions in Firewall policies and Remediation Actions.
Added BitLocker support for Windows 2019 Server.

Engage

Fixed an issue where the Self-Service Console could crash with "FileExistsError."

Ethernet IP Entity Provider

Fixed an issue where a Windows satellite could not upgrade the Ethernet/IP Provider.

Profinet Entity Provider

Fixed an issue where a Windows satellite could not upgrade the Profinet Provider.

comply-cx

Added a Client setting to configure distribute over time for SBOM intel installation.
Improved download and installation debug logging.
Added a Client setting to configure which CPUs are pinned during a scan.

core-cx

Fixed an issue where a newly installed endpoint might downgrade cx-config tooling.

cx-config

Fixed an issue that caused an empty file to be produced when creating support artifacts for Tanium Support.
Fixed an issue that prevented config-cx from shutting down cleanly and caused an error message.
Added support for future functionality.

end-user-cx

Fixed an issue where the amount of time to postpone a survey would default to 2 hours.
Updated a third-party dependency.
Fixed an issue where EUSS did not open after accepting a postponed notification.

index-cx

Various bugfixes and improvements.

Map

Removed Map, cx-mapcx and pycx from Toolset Manifest.

swmgr-cx

Fixed an issue that caused excessive log entries of "attempted to record file evidence without either Mac or Windows info."
Fixed an issue where having a comply SBOM config without an Asset SBOM config would report no vulnerabilities.
Fixed an issue where CPEs reported from Windows endpoints could sometimes contain file extensions.
Fixed an issue where SBOMs failed to generate for some Ruby libraries.
Updated the PatchEnabled configuration to be set to 0 by default, which prevents the deprecated VBS-based Patch Service from launching instead of PatchCX.

Endpoint Configuration Toolset version 2.26

End of Support Date: May 6, 2026

Endpoint Configuration Toolset (2.26.163) Release Notes

Release Date: May 6, 2026

end-user-cx

Fixed an issue that might cause erroneous Engage survey notifications for users.

Third-party dependency updates

end-user-cx

Endpoint Configuration Toolset (2.26.162) Release Notes

Release Date: May 5, 2026

Comply Engines

Updated the Tanium-provided JRE.

ECM Toolset Manifest

Updated the Tanium Client for ECM Upgrades to 7.8.2.1170.

Initial Content - Python

Updated endpoint tool targeting for future Tanium Client compatibility.

Nmap

Updated the nmap Windows binary to no longer require the Microsoft Visual C++ Redistributable on endpoints.

core-cx

Fixed an issue where SupportCX crashed in environments with large action logs.

Third-party dependency updates

Comply Engines, EthernetIP Entity Provider, Incident Response, Initial Content - Python, Nmap, Npcap, Profinet Entity Provider, core-content, core-cx

Endpoint Configuration Toolset (2.26.148) Release Notes

Release Date: April 8, 2026

Asset

Removed unused dependencies.

Deploy/Software Management

Fixed an issue where Self Service profiles were processed inefficiently.

Engage

Fixed an issue where the Self-Service Console might crash with "FileExistsError."

Impact

Removed unused dependencies.

Incident Response

Endpoints that have Endpoint Configuration targeting IR tools but do not have Threat Response licensed and installed will fail to install this update. Make sure that Threat Response is licensed before upgrading endpoints to this toolset version. For more information, see the Tanium Threat Response User Guide. If certain endpoints fail to upgrade IR tools, contact Tanium Support for assistance.

Performance

Include Application Path, Module Path, and Fault Offset for Windows in the Performance - Event Details sensor
Added application crash exception code to the output of the *Performance – Event Details" sensor for Windows endpoints.

Profinet Entity Provider

Fixed an issue where Linux Profinet discovery would not work with certain hostname configurations.

Python

Updated Python Interpreter to 3.12.13.
Removed the python2 endpoint tool.
Fixed an issue that might result in erroneous errors on older macOS endpoints.

Recorder

Updated to include Driver 3.5.22, which applied a cosmetic fix for Anti-Tamper service DACLs. Functionality of Anti-Tamper was not impacted.

cx-mapcx

Removed Map, cx-mapcx and pycx from the Toolset Manifest.

end-user-cx

Fixed an issue where EUSS did not open after accepting a postponed notification.
Fixed an issue that could cause duplicate notifications to be displayed on underprovisioned VMs.
Fixed an issue where the amount of time to postpone a survey defaulted to two hours.

enforce-cx

Fixed an issue where applying multiple methods for a single policy item was not working correctly.
Improved policy application by not deleting the parent registry key when no child keys exist.
Fixed an issue where user policies were applied inconsistently because stale policy items were sometimes processed for users who weren't logged in.

extras-cx

Fixed an issue where patch deployments might not honor the distribute over time setting.
Fixed an issue where endpoint local blocking and maintenance windows were treated as UTC times
Fixed an issue where accessing domain_information_policies on an endpoint joined exclusively to an Entra domain with no domain name might cause a crash.

patch-cx

Fixed an issue where endpoints may enter a reboot loop when the post-reboot scan failed.

swmgr-cx

Fixed an issue where SIU data was not correctly refreshed.

threat-response-cx

Fixed an issue where a crash was possible when performing On Demand scans for file hashes.
Fixed an issue where suppressions using ancestry-based terms for processes might not have been evaluated correctly.
Fixed an issue where the extensions/threatresponse folder was not removed when performing a hard uninstall of the endpoint tool.

Third-party dependency updates

Certificate Manager
Engage
Ethernet IP Entity Provider
Incident Response Endpoint Tools
Performance
Profinet Entity Provider
Provision
Python
Threat Response
core-cx
end-user-cx
enforce-cx
entity-cx
extras-cx
performance-tsdb

Endpoint Configuration Toolset (2.26.115) Release Notes

Release Date: March 4, 2026

Disqualification of previous Toolset versions

This toolset disqualifies Endpoint Configuration Toolset 2.26.114 and 2.26.113. The disqualified toolsets included Tanium Client 7.8.2.1149 for ECM upgrades. This version of the Tanium Client had an issue that has been fixed in version 7.8.2.1152. This Toolset version contains the updates listed for Endpoint Configuration Toolset 2.26.114 and 2.26.113.

Tanium Client

Updated the Tanium Client for ECM upgrades to 7.8.2.1152. This Tanium Client version fixes an issue where a throttling error caused slowed downloads.

Endpoint Configuration Toolset (2.26.114) Release Notes

Release Date: February 19, 2026

DISQUALIFIED TOOLSET VERSION

This toolset has been disqualified. It included Tanium Client 7.8.2.1149 for ECM upgrades. This version of the Tanium Client had an issue that has been fixed in version 7.8.2.1152, which is included with Endpoint Configuration Toolset 2.26.115.

Nmap

Updated third-party dependencies.

Endpoint Configuration Toolset (2.26.113) Release Notes

Release Date: February 13, 2026

DISQUALIFIED TOOLSET VERSION

This toolset has been disqualified. It included Tanium Client 7.8.2.1149 for ECM upgrades. This version of the Tanium Client had an issue that has been fixed in version 7.8.2.1152, which is included with Endpoint Configuration Toolset 2.26.115.

Ethernet IP Entity Provider

Updated a third-party dependency.

Incident Response Endpoint Tools

Updated third-party dependencies.

Profinet Entity Provider

Fixed an issue that could cause inaccurate sensor output.
Updated a third-party dependency.

Python

Updated a third-party dependency.
Provided matching OpenSSL versions for Tanium Client interoperability.
Fixed an issue where some non-Windows endpoints would load incorrect python libraries.
Improved logging when migrating from python38 to python312.

Tanium Client

Updated the Tanium Client for ECM Upgrades to 7.8.2.1149.

core-cx

Updated a third-party dependency.

cx-config

Updated a third-party dependency.
Fixed an issue where tools that failed to install might report they were successfully installed based on a prior tool installation attempt.

Endpoint Configuration Toolset (2.26.105) Release Notes

Release Date: February 9, 2026

Incident Response Endpoint Tools

Updated third-party dependencies.

Npcap

Fixed an issue where the current NPCAP driver would be unnecessarily uninstalled and reinstalled.

Patch

Updated to 7zip 25.01.

Provision

Fixed an issue that caused DirectDownload of OS WIMs for recent Windows 10 and 11 releases to fail due to certificate validation errors.

Recorder

Added CO-RE BPF support for x86_64 and ARM64 Debian systems, and ARM64 SUSE systems.
Fixed an issue where Image Load events were not processed on Windows.
Fixed an issue where Recorder failed to start on Linux if the kernel release version contained a "+" character, such as with Debian BPO kernels.
Fixed an issue where Recorder was unnecessarily requiring libatomic.so in some Arm-based Linux environments.
Fixed an issue where Recorder could crash on Linux when using the multicast netlink data source.
Synchronize driver version 3.20.57 for older toolset manifests.

Screen Sharing

Updated Windows and macOS ScreenMeet clients to latest GA versions.

cx-stream

Update third-party dependencies.

discover-cx

Fixed an issue that could cause multicast network addresses to be returned during level 1 scans on IPv6 networks.

enforce-cx

Fixed an issue that resulted in erroneous log messages.
Fixed an issue where editing the name of a Windows firewall rule did not remove the rule with the old name from the endpoint.
Update third-party dependencies
Fixed an issue where changes to network selection for a Windows firewall policy were not being enforced on the endpoint.
Fixed an issue where enforcing a Windows firewall policy on a version of Windows newer than Windows 11 Build 22H2 would report an error.

performance-cx

Fixed an issue where boot and logon processing for the Performance module might cause crashes of the extension.

swmgr-cx

Fix a vulnerability in a dependency.

Endpoint Configuration Toolset (2.26.89) Release Notes

Release Date: January 28, 2026

Content - Default

Updated a third-party dependency.

Patch

Fixed an issue where endpoints could fail to reboot after a patch deployment.
Fixed an issue that could result in Patch tool installation timeout.

core-cx

Fixed an issue on Windows endpoints where a spawned process might not notify its caller that it has exited.

patch-cx

Fixed an issue that could result in an extension crash.

swmgr-cx

Fixed an issue where running an SBOM scan on a container image with large individual layers could cause high memory usage on the SBOM satellite.
Fixed an issue that could automatically mount home directories on non-Windows endpoints while enumerating browser plugins.

Endpoint Configuration Toolset (2.26.84) Release Notes

Release Date: January 13, 2026

Comply

Restored the Tanium Scan Engine to 6.5.5.1 due to observed CPU usage issues.

Content - Default

Introduced a signed PowerShell script used by the Tanium Client Core Health sensor to verify PowerShell execution health.

patch-cx

Fixed an issue where endpoints could enter a reboot loop after deployment failure.

Endpoint Configuration Toolset (2.26.81) Release Notes

Release Date: January 6, 2026

Automate Endpoint Tools

Added a new 'Automate' endpoint tool.

Comply

Updated to support Comply engine updates through Endpoint Configuration Management.

Content - Default

Updated TPowerShell.exe for improved supportability.

Deploy/Software Management

Fixed an issue where the REG_BINARY registry filter used a HEX string instead of ASCII on Windows endpoints.
Fixed an issue where macOS notifications re-triggered when the username and home directory path differed.
Fixed an issue that caused all software packages to be Not Applicable on certain x86-based Linux machines.
Fixed an issue where Arm-based Linux endpoints failed to extract 7z files used in software packages.

End-User Self Service

Fixed an issue where End User Self-Service would not load on Intel-based macOS endpoints.
Added support for PatchCX.

Ethernet IP Entity Provider

Added the Ethernet/IP provider for Tanium Endpoint Management for Operational Technology.

Incident Response Endpoint Tools

Updated a third-party dependency.

JumpGate

Updated the required version of dec-cx.

Patch

Updated all vbs and ps1 files deployed by this tool to be signed.
Improvements to Windows scan batch sizing:

 * Increased default batch size to 100.
 * Increased max batch size to 250.
 * Fixed an issue where endpoints on Windows build 17763 and earlier did not respect the batch size override value from the Patch - Set Patch Process Options [Windows] package.

Profinet Entity Provider

Added the Profinet provider for Tanium Endpoint Management for Operational Technology.

Provision

Updated TPowerShell.exe for improved supportability.
Updated third-party dependencies.
Fixed an issue where global web service POST calls were missing automatic values.
Updated to copy logs to %ProgramData%\Tanium\Provision\Logs instead of the Tanium Client logs directory after provisioning is complete.
Fixed an issue where some configurations for SMB signing on Windows file servers caused errors when capturing an OS WIM from Tanium Provision's boot environment.
Fixed an issue that prevented %RAND% in a computer name from being processed when not using ODJ.
Fixed an issue that could cause endpoint tool installations to take longer than expected after provisioning a Windows endpoint.
Added an "-EnableDebugPrompt" ADKPrep.ps1 parameter to help troubleshoot storage driver issues in WinPE mode.
Fixed an issue that caused Provision endpoint tool uninstall operations to fail.
Fixed a signature error on osd-refresh.ps1.
Fixed an issue where Windows Server operating systems deployed with Tanium Provision prompted for a reason code for prior unexpected restarts at first sign-in.
Updated to allow multiple pipe-separated values in WaitFor.
Added a Reboot option in WaitFor to trigger a reboot during the provisioning process.

Python

Updated python312 to version 3.12.12.
Updated third-party dependencies.

Recorder

Reduced the memory footprint for ingesting complex signals intel documents from Threat Response.
Synchronized the driver version for older toolset manifests.
Updated a third-party dependency.
Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue where the full directory path was not being captured for folder deletion events on Amazon Linux with the 5.10 kernel.
Improved accuracy of details for extended attributes changes in Recorder file permission events on systems using BPF.
Improved memory utilization for process tracking on machines experiencing a high event load.

Tanium Client

Updated the Tanium Client for ECM Upgrades to 7.8.2.1111.

client-deploy-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Updated a third-party dependency.

comply-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Updated to collect investigation details when scans are run in low-resource mode.
Updated a third-party dependency.
Removed unnecessary configuration status report values.
Fixed an issue with inaccurate calculation of compliance percentage.
Added support for additional tools delivered through toolset manifests.
Removed a redundant configuration file.
Added new "Comply Engines" endpoint tool.

core-cx

Updated third-party dependencies.

cx-config

Fixed an issue that prevented install or upgrade of the "End-User Notifications - Legacy Core" tool.
Fixed an issue that could cause excessive CPU usage in certain situations.
Updated a third-party dependency.

cx-stream

Updated a third-party dependency.

cx-tsdb

Fixed an issue that could cause excessive CPU usage in certain situations.
Updated a third-party dependency.

dec-cx

Fixed an issue where RemoteExec sessions might hang on idle timeout.
Fixed an issue that occurred with RemoteExec when large amounts of data were generated.
Fixed an issue that occurred with RemoteExec when spawning a shell/executable failed.
Fixed an issue that could cause excessive CPU usage in certain situations.
Updated to support custom environment variables for RemoteExec commands.
Updated to a default value of "xterm-256color" for the TERM environment variable.
Updated the default working directory for RemoteExec sessions to the root of the current drive.
Updated a third-party dependency.
Added metrics to track CXSocket usage.

discover-cx

Updated third-party dependencies.
Updated a third-party dependency.
Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.
Updated to return the active profiles as part of the endpoint must gather for debugging purposes.
Updated to support large network scanning.

end-user-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue where notifications were not appearing due to a database ID mismatch.

enforce-cx

Updated third-party dependencies.

entity-cx

Added new "entity-cx" endpoint tool.

extras-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue that caused some downloads to fail.
Updated a third-party dependency.

index-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue that prevented the Threat Response AutoRuns sensor data from being updated.
Fixed an issue where unoptimized indexes in the file signature data caused a delay in Index scan finalization.
Updated a third-party dependency.
Improved CPU usage when configured with SBOM.

integrity-monitor-cx

Updated a third-party dependency.

patch-cx

Added retries for some transient WSUS errors.
Fixed an issue where Tanium EUSS might not be installed as a dependency.
Updated a third-party dependency.
Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue where TaniumPatchEngine.exe might crash during a download.

performance-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue where a crash might occur due to a missing file.
Fixed an issue where a small set of background tasks were included in the foreground thread, which is not throttled. These tasks now correctly use the background thread and are throttled as appropriate.
Fixed an issue where in rare cases a boot event might not be recognized as having been processed due to a microsecond rounding error, causing a new boot event to be recorded for an affected endpoint every configured interval until the next reboot of the endpoint.
Added pretty_name fields for process data returned during a direct connection. Though these fields are not guaranteed to be populated, they generally provide a more human-readable name than the existing process name fields derived from executable names.
Updated a third-party dependency.
Updated to supply the currently loaded ECF profile for Performance CX in JSON format inside its EMG packages.
Improved CPU usage.
Fixed an issue where macOS latency metrics were inconsistent in poor wireless network conditions.

provision-cx

Reduced unnecessary logging on endpoints.
Fixed an issue that could cause excessive CPU usage in certain situations.
Updated a third-party dependency.

risk-cx

Updated a third-party dependency.

swmgr-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Updated a third-party dependency.

threat-response-cx

Fixed an issue where intel with very large counts of file hashes might time out during initial scans.
Updated a third-party dependency.
Fixed an issue where attempting to remove the legacy Detect endpoint tools could cause the Client Extension to experience a transient error state.
Updated the YARA scanning engine to v4.5.5.
Reduced the memory footprint for processing complex signals intel documents.
Fixed an issue where YARA intel documents provided match details for only a single token.
Fixed an issue where where multiple autoruns differing only in text case (upper/lower) might cause only one member of the set to be reported.
Fixed an issue with on-demand scans of signals intel documents where "group" was not being respected for "network.dns_query" terms.
Improved performance of scanning for complete IP addresses in IOC-based intel.
Fixed an issue where the Persistence Analyzer / AutoRuns Cache might fail to generate when evaluating Scheduled Tasks.

Endpoint Configuration Toolset version 2.24

End of Support Date: March 28, 2026

Endpoint Configuration Toolset (2.24.139) Release Notes

Release Date: February 9, 2026

Incident Response Endpoint Tools

Updated third-party dependencies.

Npcap

Fixed an issue where the current NPCAP driver would be unnecessarily uninstalled and reinstalled.

Patch

Fixed an issue where endpoints could fail to reboot after a patch deployment.
Updated to 7zip 25.01.

Provision

Updated third-party dependencies.
Fixed an issue where global web service POST calls were missing automatic values.
Fixed an issue that caused DirectDownload of OS WIMs for recent Windows 10 and 11 releases to fail due to certificate validation errors.

Python

Updated a third-party dependency.

Recorder

Synchronized the driver version for older toolset manifests.
Updated a third-party dependency.
Added CO-RE BPF support for x86_64 and ARM64 Debian systems, and ARM64 SUSE systems.
Fixed an issue where Recorder failed to start on Linux if the kernel release version contained a "+" character, such as with Debian BPO kernels.
Fixed an issue where Recorder was unnecessarily requiring libatomic.so in some Arm-based Linux environments.
Fixed an issue where Recorder could crash on Linux when using the multicast netlink data source.

Screen Sharing

Updated Windows and macOS ScreenMeet clients to latest GA versions.

client-deploy-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Updated a third-party dependency.

comply-cx

Updated a third-party dependency.

cx-config

Updated a third-party dependency.

cx-stream

Updated a third-party dependency.
Update third-party dependencies.

cx-tsdb

Updated a third-party dependency.

dec-cx

Updated a third-party dependency.
Fixed an issue that could cause excessive CPU usage in certain situations.

discover-cx

Updated a third-party dependency.

end-user-cx

Updated a third-party dependency.

enforce-cx

Updated third-party dependencies.
Fixed an issue that resulted in erroneous log messages.
Fixed an issue where editing the name of a Windows firewall rule did not remove the rule with the old name from the endpoint.
Fixed an issue where changes to network selection for a Windows firewall policy were not being enforced on the endpoint.
Fixed an issue where enforcing a Windows firewall policy on a version of Windows newer than Windows 11 Build 22H2 would report an error.

extras-cx

Updated a third-party dependency.

index-cx

Improved CPU usage when configured with SBOM.
Updated a third-party dependency.

integrity-monitor-cx

Updated a third-party dependency.

performance-cx

Updated a third-party dependency.
Fixed an issue where boot and logon processing for the Performance module might cause crashes of the extension.

provision-cx

Updated a third-party dependency.

risk-cx

Updated a third-party dependency.

swmgr-cx

Updated a third-party dependency.

threat-response-cx

Updated a third-party dependency.

Endpoint Configuration Toolset (2.24.106) Release Notes

Release Date: January 28, 2026

Content - Default

Updated a third-party dependency.

core-cx

Fixed an issue on Windows endpoints where a spawned process might not notify its caller that it has exited.

patch-cx

Fixed an issue that could result in an extension crash.

swmgr-cx

Updated a third-party dependency.
Fixed an issue where running an SBOM scan on a container image with large individual layers could cause high memory usage on the SBOM satellite.
Fixed an issue that could automatically mount home directories on non-Windows endpoints while enumerating browser plugins.

Endpoint Configuration Toolset (2.24.102) Release Notes

Release Date: January 13, 2026

Content - Default

Introduced a signed PowerShell script used by the Tanium Client Core Health sensor to verify PowerShell execution health.

patch-cx

Fixed an issue where endpoints could enter a reboot loop after deployment failure.

Endpoint Configuration Toolset (2.24.100) Release Notes

Release Date: January 6, 2026

End-User Self Service

Fixed an issue where End User Self-Service would not load on Intel-based macOS endpoints.

Endpoint Configuration Toolset (2.24.99) Release Notes

Release Date: December 17, 2025

End-User Self Service

Added support for PatchCX.

patch-cx

Added retries for some transient WSUS errors.

Endpoint Configuration Toolset (2.24.97) Release Notes

Release Date: December 4, 2025

patch-cx

Fixed an issue where patch-cx would issue a health check when End-User Self Service was not present, even when it was not needed.
Updated a third-party dependency.

Endpoint Configuration Toolset (2.24.95) Release Notes

Release Date: December 1, 2025

comply-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

cx-config

Fixed an issue preventing install or upgrade of the "End-User Notifications - Legacy Core" tool.
Fixed an issue that could cause excessive CPU usage in certain situations.

Python

Updated third-party dependencies.
Updated python312 to version 3.12.12.

core-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

extras-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

end-user-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

index-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue that prevented the Threat Response AutoRuns sensor data from being updated.
Fixed an issue where unoptimized indexes in the file signature data caused a delay in Index scan finalization.

Incident Response Endpoint Tools

Updated a third-party dependency.

patch-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

performance-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

cx-stream

Updated a third-party dependency.

swmgr-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

Tanium Client

Updated the Tanium Client for ECM Upgrades to version 7.8.1.3147.

cx-tsdb

Fixed an issue that could cause excessive CPU usage in certain situations.

Endpoint Configuration Toolset (2.24.78) Release Notes

Release Date: November 20, 2025

Asset

Updated tools to the latest available version.

Benchmark

Updated tools to the latest available version.

Tanium Client Management/Deployment

Updated targeting of tsdb-cx to all computers.

Comply

Updated tools to the latest available version.

Certificate Manager

Updated tools to the latest available version.

Content - Default

Updated TPowerShell.exe for improved supportability.

Content - Enhanced Tags

Updated tools to the latest available version.

Endpoint Configuration

Updated tools to the latest available version.

core-cx

Updated third party dependency
Updated third-party dependencies.

extras-cx

Fixed an issue that caused some downloads to fail.
Improved Windows endpoint data collection.

Direct Connect

Updated tools to the latest available version.

Deploy/Software Management

Improved performance of error logging.
Fixed an issue where a failed deployment might fail to update its status in the Self-Service Client.
Fixed an issue where the Sync Full Catalog task retried forever upon failure.
Updated 7-zip to version 25.01.
Added support for Windows 10 Enterprise multi session and Windows 11 Enterprise multi session VDI endpoints.

Enforce

Updated a third-party dependency.

enforce-cx

Fixed an issue where Health Check might incorrectly report that local group policy was disabled.
Added an option to start operating system encryption without first performing a hardware test.
Fixed an issue where a Client Extension might not shut down cleanly on AIX.
Updated third-party dependencies.

end-user-cx

Fixed an issue where notifications from EUCX were not appearing due to database ID mismatch

Integrity Monitor

Updated tools to the latest available version.

Investigate

Fixed an issue where some endpoints were not targeted for tool deployment.

JumpGate

Updated the required version of dec-cx.
Updated the targeting of the tool for the supported operating systems.

Nmap

Updated a third-party dependency.

patch-cx

Fixed an issue where TaniumPatchEngine.exe might crash during a download.

Patch

Fixed an issue where DNF variable parsing might fail in rare cases.
Fixed an issue where a Linux deployment status might report NotFound when multiple repo objects point to the same resolved URL.
Fixed an issue where blocklist matching ignored the "taniumUid" field in rules.
Updated the Patch List Applicability sensor to truncate long output 'files' in responses.
Fixed an issue where system repositories might not be discovered if they were missing the optional name attribute.
Added support for Linux repository scans that use zstandard compression.

performance-cx

Fixed an issue where a crash might occur due to a missing file.

Provision

Updated TPowerShell.exe for improved supportability.

swmgr-cx

Fixed an issue where the wrong application might be reported when multiple applications are installed to the same directory.
Fixed an issue where SBOM might report the presence of libraries and vulnerabilities for files that no longer exist on disk.
Updated third-party dependencies.
Fixed an issue where evidence for applications with no program directories was not being properly collected.

Endpoint Configuration Toolset version 2.22

End of Support Date: December 29, 2025

Endpoint Configuration Toolset (2.22.126) Release Notes

Release Date: January 6, 2026

End-User Self Service

Fixed an issue where End User Self-Service would not load on Intel-based macOS endpoints.

Endpoint Configuration Toolset (2.22.125) Release Notes

Release Date: December 17, 2025

End-User Self Service

Added support for PatchCX.

patch-cx

Added retries for some transient WSUS errors.

Endpoint Configuration Toolset (2.22.121) Release Notes

Release Date: December 1, 2025

comply-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

Content - Default

Updated TPowerShell.exe for improved supportability.

cx-config

Fixed an issue preventing install or upgrade of the "End-User Notifications - Legacy Core" tool.
Fixed an issue that could cause excessive CPU usage in certain situations.

Python

Updated third-party dependencies.
Updated python312 to version 3.12.12.

core-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Updated third-party dependencies.

Deploy/Software Management

Fixed an issue with REG_BINARY registry filter using a HEX string rather than ASCII on Windows endpoints.
Updated 7-zip to version 25.01.

enforce-cx

Updated third-party dependencies.

end-user-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue where notifications were not appearing due to a database ID mismatch.

index-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue that prevented the Threat Response AutoRuns sensor data from being updated.
Fixed an issue where unoptimized indexes in the file signature data caused a delay in Index scan finalization.

Incident Response Endpoint Tools

Updated a third-party dependency.

Nmap

Updated a third-party dependency.

patch-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Fixed an issue where TaniumPatchEngine.exe might crash during a download.

performance-cx

Fixed an issue that could cause excessive CPU usage in certain situations.

Provision

Updated TPowerShell.exe for improved supportability.

cx-stream

Updated a third-party dependency.

swmgr-cx

Fixed an issue that could cause excessive CPU usage in certain situations.
Updated third-party dependencies.

Tanium Client

Updated the Tanium Client for ECM Upgrades to version 7.8.1.3147.

cx-tsdb

Fixed an issue that could cause excessive CPU usage in certain situations.

Endpoint Configuration Toolset (2.22.94) Release Notes

Release Date: October 31, 2025

cx-config

Fixed an issue where when cx-config was processing tooling, it ignored incoming requests until the current evaluation was complete.

Deploy/Software Management

Fixed an issue where failed bundle deployments kept the Waiting or Downloading status instead of the Failed status.
Fixed an issue where deployments failed because the exit codes returned by a software package were incorrect.
Updated a third-party dependency.

patch-cx

Fixed an issue where a patch without a vendor ID referenced by a direct download deployment resulted in downloading all applicable updates.
Fixed an issue where a crash might occur during initialization.
Fixed an issue where uninstallation of a Windows patch reports success even if the patch was not successfully uninstalled.

Performance

Updated a third-party dependency.

Endpoint Configuration Toolset (2.22.89) Release Notes

Release Date: October 23, 2025

comply-cx

Fixed an issue handling low disk space event.

cx-config

Fixed an issue where new cx-config installations would not install tools when the ECF Tools Install DoT was set.

cx-extra

Fixed an issue where a schedule in a solution with an interval longer than a month might fail validation.

core-cx

Fixed an issue where the database was not vacuumed under low disk space conditions.
Updated to set existing health-reports to be pruned at upgrade to clean any duplicate entries and free disk space.
Fixed an issue that occurred when handling a low disk space event.

dec-cx

Fixed an issue that occurred with RemoteExec when large amounts of data were generated.
Fixed an issue that occurred with RemoteExec when spawning a shell/executable failed.

integrity-monitor-cx

Fixed an issue that occurred when handling a low disk space event.

index-cx

Fixed an issue that occurred when handling a low disk space event.

Incident Response Endpoint Tools

Updated a third-party dependency.

patch-cx

Fixed an issue where a completed deployment might appear twice in the end user history tab.
Fixed an issue that occurred when handling a low disk space event.

Patch

Fixed an issue where download timeout of Linux patches on an endpoint could lead to the "Patch - Deployment Errors" sensor harvest, causing the Patch service to crash.
Fixed an issue where Linux deployments with reboot disabled could report "Complete" instead of "Pending Restart" after successfully installing patches.

performance-cx

Fixed an issue with increased CPU usage across all platforms.

Provision

Fixed an issue that caused bare metal deployments to MBR/legacy-boot systems to fail.
Fixed an issue that caused provisioning with an OS bundle with WaitFor=CX to hang and never finish.
Updated third-party dependencies.

Python

Updated to Python 3.12.11.
Updated a third-party dependency.

Recorder

Fixed an issue that might prevent all network connections from being processed on macOS endpoints.

swmgr-cx

Fixed an issue parsing certain UTF16 certificate details.
Fixed an issue displaying certificates with certain Unicode characters.
Fixed an issue where the client listening port might not be excluded when a certificate audit was set to exclude Tanium ports.
Fixed an issue that occurred when parsing PEM files with TRUSTED CERTIFICATE entries.

Threat Response

Updated a third-party dependency.

threat-response-cx

Fixed an issue where YARA scans could read from files on Linux that might cause a kernel panic on some hardware.
Fixed an issue where Threat Response might have been unable to gather findings with large process ancestry.
Fixed an issue where sensor communication with all client extensions might become blocked.

cx-tsdb

Fixed an issue that occurred when handling a low disk space event.

Endpoint Configuration Toolset (2.22.73) Release Notes

Release Date: September 30, 2025

client-deploy-cx

Added dec-cx as an explicit dependency.

Tanium Client Management/Deployment

Updated tools versions to facilitate on-premises to Tanium Cloud migrations.

Comply

Updated tools versions to facilitate on-premises to Tanium Cloud migrations.

Certificate Manager

Updated third party dependency.

Endpoint Configuration

Updated tools versions to facilitate on-premises to Tanium Cloud migrations.

cx-config

Improved scaling and performance to allow an increase in endpoint change management tools and rings.
Removed the Reporting health check for "The detected toolset version is in maintenance support."
Updated tool installations to retry failed downloads more quickly.
Fixed an issue that prevented resetting a tool state after it entered the Unsupported state.
Fixed an issue where Client Extensions might not shut down cleanly on AIX endpoints.

core-cx

Updated Wifi Strength and Quality calculations to be consistent across operating systems.
Added collection of additional memory metrics on macOS endpoints.
Added the ability to collect data on whether processes are throttled for power management on Windows 11 endpoints.
Increased the frequency of scans for zombie processes on non-Windows endpoints.
Enabled collection of swap space size and usage metrics on Linux and macOS endpoints.

Direct Connect

Updated tools versions to facilitate on-premises to Tanium Cloud migrations.

Deploy/Software Management

Updated the End-User Self Service Client so that it is usable on an endpoint where an action lock is deployed.
Fixed an issue where the Software Management tool installer attempted to stop a process that was not running or not installed.
Fixed an issue where the Deploy process would log an error and restart every six hours.
Fixed an issue where the notification task icon download failed with the error "Cannot initiate Client API request: <urlopen error [WinError 10061]."
Updated tools versions to facilitate on-premises to Tanium Cloud migrations.
Updated to record "stdout" in subprocess.log when a command times out.

Discover

Updated tools versions to facilitate on-premises to Tanium Cloud migrations.

Enforce

Fixed an issue where Windows Firewall policy enforcement errors occurred due to mismatched cases in rule names.
Improved Windows Firewall policy application error logging.
Updated to return an OS error on failed application of a Linux Firewall policy.
Updated to prevent AppLocker policies from running on Windows Server Core endpoints.

End-User Notifications

Updated a third-party dependency.

End-User Self Service

Updated a third-party dependency.
Fixed an issue where modules that use End-User Self Service missed notifications of user interactions with the UI.
Fixed an issue where tiles in the End-User Self Service Client sometimes appeared at an incorrect width.

Integrity Monitor

Updated tools versions to facilitate on-premises to Tanium Cloud migrations.

Impact

Added a dependency on the "Extras" endpoint tool.

index-cx

Fixed an issue where pattern use with CSV files might not produce expected results.
Fixed an issue where a proximity group rule might match only the first instance that matches the rule criteria.
Fixed an issue where a directory exclusion might not function if it ended in $.
Added support for the concat matrix (cm) PDF operator.

Nmap

Fixed an issue where the nmap binary supplied by Tanium might fail to find the correct NSE script during a service scan for Comply.

Npcap

Updated installation logic to confirm the need for NPCAP on the endpoint.

patch-cx

Updated the "reboot_required" health check to indicate to users that patch-cx requires a reboot.

performance-tsdb

Updated third-party dependences.

Reveal

Updated tools versions to facilitate on-premises to Tanium Cloud migrations.

swmgr-cx

Fixed an issue where an empty version number in certain Linux shared libraries could cause SBOM vulnerability scanning to stop.
Fixed an issue where an error occurred if a CPE had a version of "N/A."

Tanium Client

Updated the Tanium Client version to 7.8.1.3126 for Client upgrades initiated by endpoint change management.

cx-tsdb

Improved the tracking of internal processing metrics.

Endpoint Configuration Toolset version 2.20

End of Support Date: November 25, 2025

Endpoint Configuration Toolset (2.20.88) Release Notes

Release Date: October 31, 2025

Deploy/Software Management

Fixed an issue where failed bundle deployments kept the Waiting or Downloading status instead of the Failed status.
Fixed an issue where deployments failed because the exit codes returned by a software package were incorrect.
Updated a third-party dependency.

Performance

Updated a third-party dependency.

Endpoint Configuration Toolset (2.20.86) Release Notes

Release Date: October 23, 2025

Certificate Manager

Updated a third-party dependency.

cx-extra

Fixed an issue where a schedule in a solution with an interval longer than a month might fail validation.

dec-cx

Fixed an issue that occurred with RemoteExec when large amounts of data were generated.
Fixed an issue that occurred with RemoteExec when spawning a shell/executable failed.

Incident Response Endpoint Tools

Updated a third-party dependency.

Patch

Fixed an issue where download timeout of Linux patches on an endpoint could lead to the "Patch - Deployment Errors" sensor harvest, causing the Patch service to crash.
Fixed an issue where Linux deployments with reboot disabled could report "Complete" instead of "Pending Restart" after successfully installing patches.

performance-cx

Fixed an issue with increased CPU usage across all platforms.

Provision

Fixed an issue that caused bare metal deployments to MBR/legacy-boot systems to fail.
Fixed an issue that caused provisioning with an OS bundle with WaitFor=CX to hang and never finish.
Updated third-party dependencies.

Python

Updated to Python 3.12.11.
Updated a third-party dependency.

Recorder

Fixed an issue that might prevent all network connections from being processed on macOS.

swmgr-cx

Fixed an issue parsing certain UTF16 certificate details.
Fixed an issue displaying certificates with certain Unicode characters.
Fixed an issue where the client listening port might not be excluded when a certificate audit was set to exclude Tanium ports.
Fixed an issue that occurred when parsing PEM files with TRUSTED CERTIFICATE entries.

Threat Response

Updated a third-party dependency.

threat-response-cx

Fixed an issue where YARA scans could read from files on Linux that might cause a kernel panic on some hardware.
Fixed an issue where Threat Response might have been unable to gather findings with large process ancestry.
Fixed an issue where sensor communication with all client extensions might become blocked.

Endpoint Configuration Toolset (2.20.72) Release Notes

Release Date: September 17, 2025

integrity-monitor-cx

Updated third-party dependencies.

Endpoint Configuration Toolset (2.20.71) Release Notes

Release Date: September 16, 2025

client-deploy-cx

Updated third-party dependencies.
Added an option to skip installer certificate verification when performing Windows installs.

comply-cx

Updated third-party dependencies.

cx-config

Updated third-party dependencies.

core-cx

Fixed an issue where Client Extensions download requests could lead to resource exhaustion.
Updated third-party dependencies.

dec-cx

Updated third-party dependencies.
Fixed an issue where RemoteExec sessions might hang on idle timeout.

discover-cx

Updated third-party dependencies.

enforce-cx

Updated third-party dependencies.

end-user-cx

Updated third-party dependencies.
Fixed an issue where an EUN tool upgrade could cause a postponed notification not to appear.
Improved debug logging for intra-process communications.

End-User Notifications

Fixes dropfile write being picked up before write completion
Remove "Tanium End User Notification Tools" directory when uninstalling Tanium Client
Updated a third-party dependency.

End-User Self Service

Updated a third-party dependency.

index-cx

Updated third-party dependencies.
add support for phrases in reveal keyword patterns
Fixed an issue where index CPU utilization could be higher than previous versions.
Fixed an issue where the Index database could be incorrectly identified as corrupt.

performance-cx

Updated third-party dependencies.

provision-cx

Updated third-party dependencies.

Screen Sharing

Updated Windows and macOS ScreenMeet clients to the latest public versions.
Fixed an issue where the ScreenMeet client could crash on macOS endpoints.

Recorder

Updated third-party dependencies.

risk-cx

Updated third-party dependencies.

cx-stream

Updated third-party dependencies.
Fixed an issue where the extension could crash under certain conditions.

swmgr-cx

Updated third-party dependencies.

threat-response-cx

Updated third-party dependencies.

cx-tsdb

Updated third-party dependencies.

Endpoint Configuration Toolset (2.20.56) Release Notes

Release Date: August 27, 2025

client-deploy-cx

Added increased debugging capabilities for Linux platforms.

comply-cx

Improved detection of a scan engine timeout.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.
Added monitoring for low disk space to prevent unnecessary scan and download errors.
Fixed an issue where RAS compliance scans returned a large number of errors.

core-cx

Fixed an issue where zombie process metrics might be missing on 32-bit Windows endpoints.
Updated a third-party dependency.
Fixed an issue where Client Management did not display the Client Health log for an endpoint where a non-default LogPath was configured in Client settings.
Fixed an issue where a disabled client extension might cause the Tanium Client to stop responding to questions.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

extras-cx

Fixed an issue where two-pass Nmap scans that target an empty subnet might yield incorrect results.
Added an advanced query component for Windows Event Log.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

dec-cx

Adjusted CXSocket timeouts and retries to improve responsiveness when there is a delay connecting to an endpoint or multiple attempts are required.
Improved DNS error reporting for proxy sockets.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.
Fixed an issue with occasional crashes during shutdown of Linux endpoints.
Updated to support upcoming features.

Deploy/Software Management

Fixed an issue where registry value data only reads the first line of multi-string registry value.
Fixed an issue where post-deployment notification failed after targeting changes.
Fixed an issue where endpoints returned statuses for deployments that no longer targeted them.
Fixed an issue where deployments would not complete when deployment targeting criteria changed mid-deployment.
Added support for a new "Folder Contents" software package applicability rule.
Fixed an issue where reg_binary registry values were improperly evaluated by Registry Data rules.
Fixed an issue where the command output in the subprocess log on Japanese-language Windows endpoints is garbled due to an incorrect character encoding.
Fixed an issue where the expected bundle deployment status of "Download Complete - Waiting" was not correctly reported.
Fixed an issue where Deploy scans might fail to run on Windows endpoints that have not upgraded to the Python 3.12 tool.
Fixed an issue where the Self Service Client displayed installOrUpdate instead of the actual operation.

Discover

Updated the Nmap tool to use Visual C++ Redistributable 14.42.34438.
Updated various third-party dependencies.

discover-cx

Improved SBOM Accuracy.
Fixed an issue where the scan window was not being honored on the endpoint.
Added increased debugging capabilities for Linux endpoints.

enforce-cx

Added increased debugging capabilities for Linux endpoints.

Engage

Fixed an issue where triggered surveys had incorrect "notified" counts.
Fixed an issue where file handles stayed open for some users after they signed off.

end-user-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.
Fixed an issue where multiple instances of the same user were provided to Engage on macOS endpoints.
Fixed an issue where self-service events were delivered with an invalid user.
Fixed an issue where activities with a schedule failed to be added to the self-service client.
Fixed an issue where Engage was not notified when a user signed out of the operating system.
Fixed an issue where Remediation Actions could fail to launch on Windows.
Added support for setting the self service catalog and activities using a mailbox.
Deprecated CXEND00002 & CXEND00003 health checks.

End-User Notifications

Fixed various accessibility issues in the End-User Notifications user interface.

End-User Self Service

Fixed an issue where a new survey would not load if End-User Self Service was already open.
Fixed an issue where the End-User Self Service tool might encounter an error after installation.
Added missing translations in End-User Self Service Client.

integrity-monitor-cx

Fixed an issue where a Client Extension may not shut down cleanly on AIX endpoints.
Added increased debugging capabilities for Linux endpoints.
Added an indicator when more data is available in event queries.

index-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Incident Response Endpoint Tools

Added support for STS tokens to TaniumFileTransfer.
Updated Live Response on Linux to use the latest TaniumFileTransfer binary.

Nmap

Extract the nmap tool to it's own tool package with a version independent of the nmap version contained there in.

Npcap

Upgraded Npcap to versions 1.20 and 1.75.

patch-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Patch

Added a new deployment status for misclassified UUP updates.
Updated a third-party dependency.

performance-cx

Added increased debugging capabilities for Linux endpoints.
Reduced excessive log entries.
Fixes an issue where a Client Extension may not shut down cleanly on AIX
Fixed an issue where TSDB queries might fail on Windows if the backlog queue grew too large.
Fixed an issue where the Endpoint Must-Gather for Performance failed to complete.

performance-tsdb

Upgraded core third-party libraries.

provision-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.
Fixed an issue where CPU usage was excessive on some Windows endpoints.

Provision

Fixed an issue that could cause the TaniumPXE service to stop responding with the error "bind: Only one usage of each socket address (protocol/network address/port) is normally permitted."
Updated a third-party dependency.
Fixed an issue where variable substitution in OS Bundle Key/Values was case-sensitive.
Fixed an issue with unnecessary delays when booting offline media with no connection to a Provision Endpoint.
Improved the reporting of certain types of download errors during bare-metal OS deployment.
Improved the reliability of Tanium Client downloads of OS Bundle files to Provision Endpoints.
Resolved an issue where with the with the May 2025 Cumulative update or later in Windows 11 Professional, local accounts could not be modified during Provisioning.

Recorder

Synchronized the driver version for older toolset manifests.
Added SELinux profiles for Red Hat Enterprise Linux and Oracle Enterprise Linux 10.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

cx-stream

Fixed an issue where Daily Stats did not update for Syslog TLS outside of Dry Run mode.
Added increased debugging capabilities for Linux endpoints.
Fixed an issue where Syslog TLS connections might incorrectly report a connection timeout problem.

swmgr-cx

Added support for version epochs in CPE strings.
Fixed an issue where usage reporting might omit usage of applications with background tasks, such as Firefox.
Updated a third-party dependency.
Reduced the false-negative rate for Java CVE matching.
Improved detection of CVEs, including CVE-2015-0254 in JAR files.
Fixed an issue where usage was sometimes not attributed to executables based on file metadata.
Improved Java KeyStore certificate compatibility.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

threat-response-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Tanium Client

Updated the Tanium Client for ECM Upgrades to 7.7.3.8176

cx-tsdb

Updated to turn off metrics gathering when a low disk space condition exists.
Added a health check for failed file operations.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.
Replaced underlying TSDB engine.

Endpoint Configuration Toolset version 2.18

End of Support Date: October 6, 2025

Endpoint Configuration Toolset (2.18.44) Release Notes

Release Date: September 16, 2025

client-deploy-cx

Updated third-party dependencies.
Added an option to skip installer certificate verification when performing Windows installs.

comply-cx

Updated third-party dependencies.

cx-config

Updated third-party dependencies.

core-cx

Fixed an issue where Client Extensions download requests could lead to resource exhaustion.
Updated third-party dependencies.

dec-cx

Updated third-party dependencies.

discover-cx

Updated third-party dependencies.

enforce-cx

Updated third-party dependencies.

Engage

Fixed an issue where file handles stayed open for some users after they signed off.

end-user-cx

Fixed an issue where multiple instances of the same user were provided to Engage on macOS endpoints.
Fixed an issue where Engage was not notified when a user signed out of the operating system.
Updated third-party dependencies.
Improved debug logging for intra-process communications.

integrity-monitor-cx

Updated third-party dependencies.

index-cx

Updated third-party dependencies.

Patch

Updated a third-party dependency.

performance-cx

Updated third-party dependencies.

provision-cx

Updated third-party dependencies.

Screen Sharing

Updated Windows and macOS ScreenMeet clients to the latest public versions.
Fixed an issue where the ScreenMeet client could crash on macOS endpoints.

Recorder

Updated third-party dependencies.

risk-cx

Updated third-party dependencies.

cx-stream

Updated third-party dependencies.
Fixed an issue where the extension could crash under certain conditions.

swmgr-cx

Updated a third-party dependency.
Updated third-party dependencies.

threat-response-cx

Updated third-party dependencies.

Endpoint Configuration Toolset (2.18.30) Release Notes

Release Date: August 26, 2025

provision-cx

Fixed an issue where CPU usage was excessive on some Windows endpoints.

Endpoint Configuration Toolset (2.18.29) Release Notes

Release Date: August 19, 2025

performance-cx

Fixed an issue where the Endpoint Must-Gather for Performance would fail to complete.
Fixed an issue where TSDB queries might fail on Windows if the backlog queue grew too large.

Endpoint Configuration Toolset (2.18.27) Release Notes

Release Date: August 7, 2025

Client Deployment CX

Added increased debugging capabilities for Linux platforms.

Client Extensions

Fixed an issue where a disabled client extension might cause the Tanium Client to stop responding to questions.
Updated third-party libraries to address security vulnerabilities.

CX Extras

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Comply CX

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Discover CX

Added increased debugging capabilities for Linux endpoints.

End-User CX

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Enforce CX

Added increased debugging capabilities for Linux endpoints.

Index

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Integrity Monitor CX

Added increased debugging capabilities for Linux endpoints.

Patch CX

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Patch Endpoint Tools

Fixed an issue where UUP required files were incorrectly cleaned up during deployment.

Performance CX

Added increased debugging capabilities for Linux endpoints.

Provision CX

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Recorder

Added SELinux profiles for Red Hat Enterprise Linux and Oracle Enterprise Linux 10.
Synchronized the driver version for older toolset manifests.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Software Management

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Tanium Stream

Added increased debugging capabilities for Linux endpoints.

Threat Response CX

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Endpoint Configuration Toolset (2.18.25) Release Notes

Release Date: July 29, 2025

Patch

Miscellaneous bug fixes.

Endpoint Configuration Toolset (2.18.24) Release Notes

Release Date: July 28, 2025

Deploy

Fixed an issue where Deploy scans might fail to run on Windows endpoints that have not upgraded to the Python 3.12 tool.

Endpoint Configuration Toolset (2.18.23) Release Notes

Release Date: July 17, 2025

index-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX.

end-user-cx

Fixed an issue where Remediation Actions might fail to launch on Windows.

comply-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX.

extras-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX.

core-cx

Fixed an issue where a Client Extension might not shut down cleanly on AIX.
Fixed an issue where Client Management - Health did not correctly display endpoint logs when an alternate LogPath was specified in Client Settings.

Endpoint Configuration Toolset (2.18.19) Release Notes

Release Date: July 7, 2025

Swmgr-cx

Added support for forthcoming Certificate Manager features.
Added support for version epochs in CPE strings.
Fixed an issue where usage reporting might omit usage of applications with background tasks, such as web browsers.

Provision

Fixed an issue where hardware models with special characters could not match driver package file names.
Improved the reliability of TaniumPXE bundle file downloads when using Tanium Client API Downloads.
Improved error handling and retry behavior during Refresh deployments when using Tanium Client downloads.
Fixed an issue where a Customer-PE.ps1 script did not run when using AutoPilotConfigurationFile.json.
Fixed an issue where an OS Refresh deployment might loop when using an AutopilotConfigurationFile.json file.

Comply-cx

Fixed an issue where investigation sensor responses that contain special characters caused extra result rows.
Fixed an issue where the scan engine timeout was not detected correctly.

Core-cx

Fixed an issue where zombie process metrics could be missing on Windows x86.

Nmap

Updated Nmap tool to include VCRedist 14.42.34438.

Software Management

Fixed an issue where a Maintenance Window recurring monthly by day-of week and configured with a timezone offset might start at the wrong time.
Fixed an issue where a bundle status might change from Complete to Not Applicable.
Added support for the new "Deploy - Deployments Persistent Status" sensor.
Fixed an issue where the status of an activity in End-User Self Service might become stuck due to an orphaned activity json file.
Fixed an issue where the command output in the subprocess log on Japanese-language Windows endpoints are garbled due to an incorrect character encoding.

End-user-cx

Fixed an issue where end-user extension data might cause an error in an endpoint must gather.
Added the directory for Engage notification themes to endpoint must gathers.
Updated to use the Client CX Package Executor to run Engage Remediations.

Incident Response

Updated Live Response on Linux to use the latest TaniumFileTransfer binary.
Added support for STS tokens to TaniumFileTransfer.

Endpoint Configuration Toolset version 2.16

End of Support Date: September 3, 2025

Endpoint Configuration Toolset (2.16.45) Release Notes

Release Date: August 19, 2025

performance-cx

Fixed an issue where the Endpoint Must-Gather for Performance would fail to complete.
Fixed an issue where TSDB queries might fail on Windows if the backlog queue grew too large.

Endpoint Configuration Toolset (2.16.43) Release Notes

Release Date: August 7, 2025

Client Deployment CX

Added increased debugging capabilities for Linux platforms.

Client Extensions

Fixed an issue where Client Management did not display the Client Health log for an endpoint where a non-default LogPath was configured in Client settings.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.
Fixed an issue where zombie process metrics might be missing on 32-bit Windows endpoints.
Fixed an issue where a disabled client extension might cause the Tanium Client to stop responding to questions.
Updated third-party libraries to address security vulnerabilities.

CX Extras

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Comply CX

Added increased debugging capabilities for Linux endpoints.

Discover

Updated the nmap tool to use Visual C++ Redistributable 14.42.34438.

Discover CX

Added increased debugging capabilities for Linux endpoints.

End-User CX

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Enforce CX

Added increased debugging capabilities for Linux endpoints.

Incident Response Endpoint Tools:

Updated Live Response on Linux to use the latest TaniumFileTransfer binary.
Added support for STS tokens to TaniumFileTransfer.

Index

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Integrity Monitor CX

Added increased debugging capabilities for Linux endpoints.

Patch CX

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Patch Endpoint Tools

Fixed an issue where UUP required files were incorrectly cleaned up during deployment.

Performance CX

Added increased debugging capabilities for Linux endpoints.

Provision CX

Added increased debugging capabilities for Linux endpoints.

Recorder

Added SELinux profiles for Red Hat Enterprise Linux and Oracle Enterprise Linux 10.
Synchronized the driver version for older toolset manifests.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Software Management

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Tanium Stream

Added increased debugging capabilities for Linux endpoints.

Threat Response CX

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Endpoint Configuration Toolset (2.16.41) Release Notes

Release Date: July 29, 2025

Patch

Miscellaneous bug fixes.

Endpoint Configuration Toolset (2.16.39) Release Notes

Release Date: June 23, 2025

Deploy

Fixed an issue where certain weekly and monthly recurrences with a timezone offset calculated the wrong start date.

EUCX

Fixed an issue where command line arguments did not open Self Service to the expected tab.

Investigate

Updated Endpoint Tooling dependencies & targeting.

Performance-TSDB

Updated to golang 1.23.8.
Fixed an issue where Performance-tsdb did not install correctly on Arm-based Linux machines.
Fixed an issue with high CPU usage when starting or applying updated Threat Response profiles when signals/filters use many "contains", "starts with", or "ends with" operations.
Fixed an issue where excessive memory was allocated for BPF on some systems with 512+ logical CPUs.
Adopted Tanium Driver 3.5.16.

Endpoint Configuration Toolset (2.16.34) Release Notes

Release Date: June 5, 2025

Dependency Updates

The following tools have updates to their 3rd party dependencies:

cx-config, cx-core, ClientDeployment-CX, Comply-CX, extras-cx, dec-cx, Discover-cx, Enforce-cx, EndUser-CX, IM-CX, Index-cx, Performance-cx, Recorder-cx, Risk-cx, Stream-cx, Threat Response-CX

cx-core

Fixed an issue where disk space usage was not collected properly.

Enhanced Tags

Added support for string values in double quotation marks in CSV for non-Windows endpoints.
Improved the performance of the 'Enhanced Tags - Add action' package.
Added support for 'text' file encoding as an allowed encoding for non-Windows endpoints.
Fixed an issue where refining the Computer Name sensor using Enhanced Tags FQDN did not work as expected on non-Windows endpoints.
Fixed an issue where hostnames for Solaris endpoints were not correctly reported as lowercase.
Fixed an issue where enhanced tags were not applied on Solaris 5.x.
Fixed an issue where refining the Computer Name sensor using Enhanced Tags FQDN did not work as expected on non-Windows endpoints.
Fixed an issue where the version of Enhanced Tags was reported as '00.00.000.0000.VER.0' in action logs.
Fixed an issue where Enhanced Tags incorrectly used the term "ou" as a tag value on Linux endpoints.
Fixed an issue where an invalid domain name could cause Enhanced Tags content to fail.
Fixed an issue where the MAC Address sometimes could not be retrieved from Ubuntu 22 endpoints.
Fixed an issue with unnecessary errors in the log when failing to move a tag file to the action directory on non-Windows endpoints.
Fixed an issue where adding tags with a UTF-8 BOM input file on Solaris endpoints caused the error ": iconv: illegal option -- o".
Fixed an issue where the MAC address did not convert to lowercase correctly when retrieved from Solaris endpoints.
Fixed an issue where non-Windows endpoints failed to convert SHIFT-JIS to UTF-8 but erroneously reported that conversion succeeded.
Fixed an issue where the endpoint serial number was not returned correctly in lowercase on Solaris endpoints.

extras-cx

Fixed an issue where CX Health unnecessarily reported "Failed to get OS CPE."

Deploy

Improved error handling in MSIX applicability scans.
Added an ARM64 architecture mismatch error to the "Deploy - All Software Package Applicability Details" sensor.
Updated EUSS to use cached Windows environment variables.
Fixed an issue where Windows commands used might unintentionally cause AutoRun processes to run.
Fixed an issue where uninstall packages did not check for a supported OS.
Fixed an issue where 32-bit Windows endpoints evaluated applicability incorrectly and ran deployments of 64-bit software packages.
Fixed an issue on macOS endpoints where Deploy returned incorrect information when Spotlight was disabled.
Fixed an issue where Deploy packages reported "Install Eligible" when no installation operation was available in the package.
Fixed an issue where applicability scans might fail on Windows endpoints with the PowerShell execution policy set to AllSigned.

Enforce-cx

Fixed an issue where Enforce did not correctly expand environment variables in Defender exclusions content.
Fixed an issue where when applying policies with duplicate items, the highest priority item was re-applied even when fully verified.

End User-cx

Improved database operation metrics.
Updated to have the Client CX Package Executor run Engage Remediations.
Added Notification Themes Directory step to Engage Must Gather.
Added default values for client settings EnableRedirectionGuard, EnableIPC, and EnableEunDevTools to avoid unnecessary errors in the log.

Index-cx

Added the name of the active Index Configuration Name from Tanium Client Management to the extensions0 log and added the 'Client Extensions - Status' sensor.
Updated Quick Search to indicate when Quick Search is disabled on an endpoint instead of returning no results for that endpoint.
Improved SBOM accuracy.
Fixed an issue where multiple patterns matched the same string within a proximity group rule in Reveal.
Fixed an issue where Reveal did not correctly search for plain text in non-office XML files.

Patch-cx

Introduced the patch-cx tool in a dormant state. The patch-cx tool will be used in a future update to provide performance and stability improvements.

Performance-cx

Moved Performance Windows boot and logon time logging to the %ALLUSERSAPPDATA%\Tanium\PerformanceAutoLogger\ directory.

Provision

Fixed an issue where PowerShell errors that had been caught and handled appeared in log files for Provision deployment processes.
Fixed an issue where the TaniumPXE service might fail to start after upgrading Tanium Provision on some Linux endpoints.
Fixed an issue where Windows might prompt for boot options after a Tanium Provision OS Refresh deployment.
Fixed an issue that caused excessive delays during boot of the Provision imaging environment.
Fixed an issue that caused EFI HTTP Boot clients to fail to boot to the Tanium Provision Environment.
Fixed an issue where the latest USMT version (10.1.26100.2454) could fail to restore user state.
Fixed an issue that prevented direct download of Windows 11 media newer than 22H2.
Fixed an issue that could cause the TaniumPXE service to stop responding with the error "bind: Only one usage of each socket address (protocol/network address/port) is normally permitted."

Recorder

Updated the major version of RecorderCX to align with the Recorder endpoint tool.
Fixed an issue where Windows "Other System Events" (e.g. event ID 1102) were sometimes not recorded.
Fixed an issue where unused event sources might appear as active.
Fixed an issue where the SELinux policy might block the TaniumPXE service.
Fixed an issue with elevated memory usage when using BPF on RedHat Enterprise Linux 8.10 and 9.x virtual machines with CPU Hot Plug/Hot Add functionality enabled.

Software Management

Fixed an issue where Comply SBOM-based Vulnerability scans caused excessive CPU usage.
Fixed an issue where portable apps showed usage for an incorrect product ID.
Removed redundant Windows In-Place Upgrade transcript options in Client Management Must Gather.

Threat Response-cx

Improved CPU and I/O performance when findings are queried by the Threat Response service.
Added IOC support for FileItem/PEInfo/VersionInfoList/VersionInfoItem terms.
Added support for searching IPv6 AAAA records in the Windows DNS cache.
Improved the performance of Persistence Analyzer on Windows endpoints.
Improved handling of Deep Instinct "Malware Probabilities" for files found in archives when using newer Deep Instinct clients.
Updated to YARA 4.5.2.
Fixed an issue where the Threat Response client extension might occasionally crash on startup.
Fixed an issue where the SHA1 and SHA256 hashes of empty files were being evaluated if provided by Reputation-based intel.
Corrected the alert source string from "Threat Response Database" to "Recorder" when performing Live Files hunting.
Removed the obsolete option to gather "Threat Response Profile Files" in EMGs.
Fixed an issue where on-demand scans for signals did not work when using the 'image.signature_status' or 'process.signature_status' terms.
Updated to pass file signature data through to findings when it is available in Index.
Fixed an issue where the Persistence Analyzer might cause the client extension to stop processing internal messages.
Fixed an issue where YARA memory scans might not include the full process hierarchy in an alert.
Fixed an issue where YARA intel scoped to "Live Files" might not scan files that were live before the intel was added.
Fixed an issue where using IndexCX to search for files in the Windows "system32" folder might fail.

Endpoint Configuration Toolset version 2.14

End of Support Date: August 15, 2025

Endpoint Configuration Toolset (2.14.31) Release Notes

Release Date: August 19, 2025

performance-cx

Fixed an issue where the Endpoint Must-Gather for Performance would fail to complete.
Fixed an issue where TSDB queries might fail on Windows if the backlog queue grew too large.

Endpoint Configuration Toolset (2.14.29) Release Notes

Release Date: August 7, 2025

Client Deployment CX:

Added increased debugging capabilities for Linux platforms.

Client Extensions:

Fixed an issue where Client Management did not display the Client Health log for an endpoint where a non-default LogPath was configured in Client settings.
Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.
Fixed an issue where zombie process metrics might be missing on 32-bit Windows endpoints.
Fixed an issue where a disabled client extension might cause the Tanium Client to stop responding to questions.
Updated third-party libraries to address security vulnerabilities.

CX Extras:

Added increased debugging capabilities for Linux endpoints.

Comply CX:

Added increased debugging capabilities for Linux endpoints.

Discover:

Updated the nmap tool to use Visual C++ Redistributable 14.42.34438.

Discover CX:

Added increased debugging capabilities for Linux endpoints.

Enforce CX:

Added increased debugging capabilities for Linux endpoints.

Incident Response Endpoint Tools:

Updated Live Response on Linux to use the latest TaniumFileTransfer binary.
Added support for STS tokens to TaniumFileTransfer.

Index:

Added increased debugging capabilities for Linux endpoints.

Integrity Monitor CX:

Added increased debugging capabilities for Linux endpoints.

Patch Endpoint Tools:

Fixed an issue where UUP required files were incorrectly cleaned up during deployment.

Performance CX:

Added increased debugging capabilities for Linux endpoints.

Provision CX:

Added increased debugging capabilities for Linux endpoints.

Recorder:

Added SELinux profiles for Red Hat Enterprise Linux and Oracle Enterprise Linux 10.
Added increased debugging capabilities for Linux endpoints.

Software Management:

Fixed an issue where a Client Extension might not shut down cleanly on AIX endpoints.

Tanium Stream:

Added increased debugging capabilities for Linux endpoints.

Threat Response CX:

Added increased debugging capabilities for Linux endpoints.

Endpoint Configuration Toolset (2.14.28) Release Notes

Release Date: July 29, 2025

Patch

Miscellaneous bug fixes.

Endpoint Configuration Toolset (2.14.26) Release Notes

Release Date: June 23, 2025

CX-core

Fixed an issue where WiFi Signal Quality might show an erroneous spike.

Deploy

Fixed an issue where a Maintenance Window recurring monthly by day-of week and configured with a timezone offset might start at the wrong time.
Fixed an issue where certain weekly and monthly recurrences with a timezone offset calculated the wrong start date.

Enforce

Fixed an issue where Enforce did not correctly expand environment variables in Defender exclusions content.
Fixed an issue where when applying policies with duplicate items, the highest priority item was re-applied even when fully verified.

EUCX

Fixed an issue where command line arguments did not open Self Service to the expected tab.

Index

Improved SBOM accuracy.

Investigate

Updated Endpoint Tooling dependencies & targeting.

Performance-CX

Moved Performance Windows boot and logon time logging to the %ALLUSERSAPPDATA%\Tanium\PerformanceAutoLogger\ directory.

Performance-TSDB

Updated to golang 1.23.8.
Fixed an issue where Performance-tsdb did not install correctly on Arm-based Linux machines.
Fixed an issue with high CPU usage when starting or applying updated Threat Response profiles when signals/filters use many "contains", "starts with", or "ends with" operations.
Fixed an issue with elevated memory usage when using BPF on RedHat Enterprise Linux 8.10 and 9.x virtual machines with CPU Hot Plug/Hot Add functionality enabled.
Fixed an issue where excessive memory was allocated for BPF on some systems with 512+ logical CPUs.
Adopted RecorderCX 2.16.382.

Endpoint Configuration Toolset (2.14.22) Release Notes

Release Date: May 15, 2025

cx-core

Updated Wi-Fi quality and strength metrics to be provided regardless of the presence of an SSID.
Fixed an issue where the count of zombie processes was not being collected on some macOS endpoints.
Fixed an issue where Client Extensions did not load on macOS 10.13 High Sierra endpoints.
Fixed an issue where some types of application crashes were not reported on Windows endpoints.
Updated OpenSSL to version 3.4.1
Fixed an issue where evaluating a Computer Group based on a deleted sensor caused a memory leak.
Added collection of commit charge Limit and Total metrics for Performance

cx-config

Fixed an issue where cx-config might uninstall itself.
Fixed an issue where information about Tanium Client and Toolset Manifest support status was incorrectly reported as an error in the log.

Comply-CX

Improved SBOM accuracy.
Fixed an issue where Client Extensions did not load on macOS 10.13 High Sierra.

SSL Server Audit

Updated to OpenSSL 3.2.4.

cx-extras

Added support for retrieving Administrator SIDs from Windows endpoints.
Added support for retrieving domain information from Windows endpoints.
Added support for retrieving LSA Sessions from Windows endpoints.
Added a mechanism for remotely terminating user sessions.
Added support for querying audit policies on Windows endpoints.
Fixed an issue with high CPU usage when exiting an Index blockout window.
Reduced the number of 'CXEXT00010' and 'CXEXT00011' health failures on startup.

Dec-cx

Improved SBOM accuracy.
Fixed an issue where Client Extensions did not load on macOS 10.13 High Sierra.

Deploy

Arm-based software packages are now supported on Arm-based Windows 11 or later endpoints.
Added support for the new "Deploy - Deployment Command Errors" sensor.
Added support for the Installed Applications "path" field on macOS endpoints.
Added support for the SUSE Linux Enterprise Server firewall.
Added the policy status "Missing required firewall service" for endpoints where the necessary firewall service was not installed, which previously reported "Policy is not supported on this OS."
Added detail to errors reported in the log for unexpected exceptions when enforcing policy.
Fixed an issue where an incorrect Windows Defender registry key was causing Windows updates to roll back.
Fix an issue with WMI errors that sometimes occurred when attempting to encrypt a drive.

Enforce-cx

Improve Endpoint Must Gathers to include additional event and policy data.
Added support for BitLocker v2 policies.
Improved detection of user sign-ins.
Updated to Recorder 3.18.54.
Updated to libexpat 2.6.4.

Integrity Monitor-cx

Improved SBOM accuracy.
Fixed an issue where Client Extensions did not load on macOS 10.13 High Sierra.

Patch

Improved the 'Patch Installation History - Linux' sensor to return 'No Patches Found' instead of '[no results]'
Fixed an issue where patch downloads on Windows endpoints timed out due to Windows Update Agent being unable to determine progress.
Fixed an issue where some Windows 11 endpoints could not complete UUP deployments, with the deployment status remaining 'Waiting for Required UUP Metadata.'
Fixed an issue where patches yet to be installed might incorrectly report as "Installed" on Amazon Linux 2023 endpoints.
Fixed an issue where ongoing deployments with endpoint restarts disabled maintained the deployment status of "Pending Restart" after installing patches and failed to install patches that later became applicable.
Updated to 7-Zip 24.09.
Improved the detection of installations that require restarting the endpoint.
Fixed an issue where the Patch Endpoint Tool process crashed while cleaning UUP files from completed deployments.

Performance-cx

Improved SBOM accuracy.
Fixed an issue where a failed configuration subscription caused a crash.
Fixed an issue where Client Extensions did not load on macOS 10.13 High Sierra.

Performance-TSDB

Fixed an issue where the Vendor name was blank instead of "Tanium" for the TaniumTSDB.exe binary.
Updated to golang 1.23.7.

Provision-cx

Improved SBOM accuracy.
Fixed an issue where Client Extensions did not load on macOS 10.13 High Sierra.

Provision

Fixed an issue where a deployment might fail with the error "No disk could be located."
Improved log verbosity and detail for OS refresh deployments.
Fixed an issue where long delays occurred when booting from an offline USB- or ISO-based image.
Fixed an issue where deployment screens automatically continued if the keyboard timeout or network timeout was set to 'Never.'
Fixed an issue where Provision could not perform a refresh on a system without an SMBIOS UUID.
Fixed an issue where disk partitioning might fail during OS deployment.
Added Provision Endpoint Tools version numbers to logs and deployment screens.
Fixed an issue where Provision did not connect to a user-provided Tanium PXE server (AnchorHost) address at deployment time.
Fixed an issue where Provision captured a WIM file that would fail to deploy with the error "The data present in the reparse point buffer is invalid."

Software Management

Fixed an issue where during a Comply SBOM vulnerability scan on Windows endpoints, Software Manager might be unable to move the vulnerabilities database directory because it was locked by a process.
Fixed an issue where Kubernetes sensors sometimes display SQL or API errors in Azure AKS.
Fixed an issue where swmgr-cx reported the status for registries that were not targeted.
Fixed an issue where Software Manager would unnecessarily send a Direct Connect message when an image SBOM inventory had no results.
Fixed an issue where Client Extensions did not load on macOS 10.13 High Sierra.
Fixed an issue where swmgr-cx tried to start the Deploy process even if Software Management wasn't installed.
Fixed an issue where SBOM did not detect python eggs.
Added the ability to parse Alpine Package Keeper (APK) SBOMs.
Updated to libarchive 3.7.7.

TDSB-CX

Updated TSDB-CX to run in a separate process even if Shared Process Mode is enabled.

Endpoint Configuration Toolset version 2.12

End of Support Date: July 7, 2025

Endpoint Configuration Toolset (2.12.50) Release Notes

Release Date: June 23, 2025

CX-Core

Fixed an issue where evaluating a Computer Group based on a deleted sensor caused a memory leak.
Fixed an issue where WiFi Signal Quality might show an erroneous spike.

Deploy

Fixed an issue where a Maintenance Window recurring monthly by day-of week and configured with a timezone offset might start at the wrong time.
Fixed an issue where certain weekly and monthly recurrences with a timezone offset calculated the wrong start date.

Enforce

Fixed an issue where Enforce did not correctly expand environment variables in Defender exclusions content.
Fixed an issue where when applying policies with duplicate items, the highest priority item was re-applied even when fully verified.

EUCX

Fixed an issue where command line arguments did not open Self Service to the expected tab.

Index

Improved SBOM accuracy.

Investigate

Updated Endpoint Tooling dependencies & targeting.

Performance-CX

Moved Performance Windows boot and logon time logging to the %ALLUSERSAPPDATA%\Tanium\PerformanceAutoLogger\ directory.

Performance-TSDB

Fixed an issue where Performance-tsdb did not install correctly on Arm-based Linux machines.
Fixed an issue with high CPU usage when starting or applying updated Threat Response profiles when signals/filters use many "contains", "starts with", or "ends with" operations.
Fixed an issue with elevated memory usage when using BPF on RedHat Enterprise Linux 8.10 and 9.x virtual machines with CPU Hot Plug/Hot Add functionality enabled.
Fixed an issue where excessive memory was allocated for BPF on some systems with 512+ logical CPUs.
Adopted RecorderCX 2.16.382.

Endpoint Configuration Toolset (2.12.46) Release Notes

Release Date: April 29, 2025

EUN

Fixed an issue where the Self Service Client fails to open on Arm-based macOS endpoints.

Endpoint Configuration Toolset (2.12.45) Release Notes

Release Date: April 22, 2025

Recorder

Fixed an issue where the Tanium Driver might not install or update on Windows Arm endpoints.

Endpoint Configuration Toolset (2.12.44) Release Notes

Release Date: April 16, 2025

Known Issues in this version:

On Windows 11 endpoints with an Arm CPU, the Tanium Driver might fail to update to the latest version, but the existing version will remain operational.
On Windows 11 endpoints with an Arm CPU, the Tanium Driver might fail to install during new installations of the Tanium Client or reinstallations after uninstalling.

Client Deployment-CX

Updated openssl to 1.0.2zl / 3.2.4.
Improved SBOM accuracy.

Config-CX

Updated libexpat to 2.7.0.

Default Content

Updated 7-zip to 24.09.

Enhanced Tags

Fixed an issue where remote tag files were not returned.

Core Python

Updated openssl to 1.0.2zl / 3.2.4.
Updated python to 3.12.9.
Fixed an issue where 32-bit Windows was incorrectly evaluated as 64-bit.

Dec-cx

Fixed an issue with occasional crashes during shutdown of Linux endpoints.
Adjusted CXSocket timeouts and retries to improve responsiveness when there is a delay connecting to an endpoint or multiple attempts are required.

Deploy

Fixed an issue where applicability scans might fail on endpoints with the PowerShell execution policy set to AllSigned.
Fixed an issue where 32-bit Windows endpoints evaluated applicability incorrectly and ran deployments of 64-bit software packages.
Fixed an issue where software package operations were not displayed in the Self Service Client Activity tab.

Discover

Fixed an issue where nmap installation failed on TanOS 1.8.1 or later.
Updated openssl to 3.2.4.
Fixed an issue where the RPM used for centralized scans was not digitally signed.

Discover-CX

Improved SBOM Accuracy.
Updated zlib to 1.3.1.

Tanium Driver

Fixed an issue where the Tanium Driver might not start if the Tanium Client was installed on a secondary drive.

Eun

Fixed various accessibility issues in the End-User Notifications user interface.

EUSS

Fixed an issue where a new survey would not load if End-User Self Service was already open.
Updated Core Python to 3.6.139.

Enforce-CX

Improved SBOM Accuracy.
Updated zlib to 1.3.1.
Updated curl to 8.12.

Engage

Fixed an issue where pop-up notifications could not launch if End-User Self Service was opened from a survey notification.

IR Tool

Updated OpenSSL to 3.2.4.

Map

Updated OpenSSL to 3.2.4.

Patch

Fixed an issue where incorrect older release dates were being shown in scan results for certain Linux devices.

Performance-TSDB

Fixed an issue where the corruption in the performance events portion of the TSDB database kept the TaniumTSDB service from starting..

Provision

Resolved an issue where bare-metal deployments might stop responding when starting the download phase.
Resolved an issue where bare-metal deployments to VMWare VMs might stop responding with a white screen.

Recorder

Fixed an issue where process hierarchy might be incomplete after an endpoint was rebooted.
Fixed an issue where the Windows CRL check timed out during installation of the Tanium Driver.

Risk

Updated zlib to 1.3.1.
Improved SBOM Accuracy.

SWM

Updated libexpat to 2.7.0.

Threat Response-CX

Fixed an issue where YARA could crash when scanning a file that was being modified.
Improved SBOM Accuracy.
Updated zlib to 1.3.1.

Endpoint Configuration Toolset (2.12.40) Release Notes

Release Date: April 2, 2025 Note: With this release of the Toolset Manifest, the EUCX and TSDB-CX tools will run in separate processes even when Shared Process mode is enabled.

Deploy

Fixed an issue where the rules that specify `does not match` and `does not contain` for `Installed Application Name` might be evaluated incorrectly, causing unwanted software deployment.
Improved endpoint performance when logging errors.
Updated third-party solution dependencies.

Endpoint Configuration Toolset (2.12.39) Release Notes

Release Date: April 1, 2025

Note: With this release of the Toolset Manifest, the EUCX and TSDB-CX tools will run in separate processes even when Shared Process mode is enabled.

Patch

Updated 7-Zip to version 24.09.
Fixed an issue where ongoing deployments that were configured not to restart did not attempt to install patches that became applicable after installation of the prior applicable patches, and became stuck in the deployment status of `Pending Restart`.
Fixed an issue where Windows patch downloads timed out due to Windows Update Agent being unable to retrieve progress.

cx-extras

Fixed an issue where Extras consumed high amounts of CPU when exiting an Index Blockout Window.

Endpoint Configuration Toolset (2.12.38) Release Notes

Release Date: March 26, 2025

Note: With this release of the Toolset Manifest, the EUCX and TSDB-CX tools will run in separate processes even when Shared Process mode is enabled.

General Fixes

Fixed an issue where when using the Client Extensions - Status sensor, the error "The detected client version is older than the recommended version for this toolset" might be displayed incorrectly.
Fixed an issue where when using the Client Health - Health Failures sensor, error "CXCFG00001" indicating an out-of-date toolset might be displayed incorrectly.

Endpoint Configuration Toolset (2.12.36) Release Notes

Release Date: March 18, 2025

Known Issues:

When using the Client Extensions - Status sensor, the error "The detected client version is older than the recommended version for this toolset" may be displayed in error. This message may be safely ignored.
When using the Client Health - Health Failures sensor, error "CXCFG00001" may be displayed indicating an out-of-date toolset. This message may be safely ignored.

Note: With this release of the Toolset Manifest, the EUCX and TSDB-CX tools will run in separate processes even when Shared Process mode is enabled.

cx-core

Fixed an issue where wireless network quality and strength metrics weren't showing when no SSID was reported.
Fixed an issue where Client Extensions didn't load on macOS 10.13.
Updated openssl to versions 1.0.2zl / 3.2.4.
Enabled Redirection Guard auditing for TaniumCX on Windows.
Improved the method of fetching the gRPC configuration from the Client.
Improve SBOM accuracy.
Fixed an issue where crash dumps were not captured on Windows.
Removed redundant thread information from CX logs.
Fixed a crash in SupportCX when configuration registration failed.
Added event id to the Core Disk Space health report.

Config-cx

Updated zlib to 1.3.1.
Improved SBOM accuracy.

Default Content

Fixed an issue where the Amazon Linux 2023 computer group might not have correctly returned all Amazon Linux 2023 endpoints.
Updated 7-zip to 24.07.
Fixed an issue where the user had to delete the default text before entering new text in the fields in the non-Windows version of the Modify Tanium Client Settings package.
Fixed an issue with where the Tanium Client API Downloads sensor might return the error "TSE-Error: Error making connection to Client Api" on Linux and macOS endpoints.
Updated the Operating System Generation sensor to support Windows Server 2025.
Fixed an issue where the "Is Laptop" sensor might fail to identify macOS laptops correctly.
Fixed an issue where the tooltip for the Is Virtual sensor description listed "Echo" instead of "Example."

Certificate Manager

Updated the configuration template package for at-rest certificate replacement.

cx-extras

Improved SBOM accuracy.

Comply-cx

Improved SBOM accuracy.
Fixed an issue where Client Extensions would not load on macOS 10.13.
Fixed an issue with low resource mode when an assessment includes both a benchmark and custom checks.
Fixed an issue with RAS assessments that include both Standard and High Resource CVEs.
Fixed an issue where logging was not enabled for RAS scans.
A compressed archive of recent scan results is now retained for troubleshooting.
Added diagnostic client setting to report all CVEs associated with OVAL definitions.
Reduced disk usage by compressing scan results.

Deploy

Improved performance of EUSS profile intake.
Fixed an issue where some deployments failed with catalog errors.
Fixed an issue where software packages could fail to deploy on Red Hat Enterprise Linux or CentOS 7.9.
Fixed an issue where Windows software packages with "Wait for Running Process" steps failed execution.
Fixed an issue where Deployments could fail with the error "tanium_euss.helpers.DbNotFoundError The end-user self service database does not exist" if euss.db was missing.

EUSS

Fixed an issue where the End-User Self Service tool could encounter an error after installation.

End-user-cx

Implemented a new mailbox to change how Engage launches EUSS.

Driver

Miscellaneous bug fixes.

Dec-cx

Improved SBOM accuracy.
Fixed an issue where Client Extensions would not load on macOS 10.13.
Now encode binary value fields in the Windows Registry as bytes instead of strings.
Added support for the ClientStream proxy protocol.
Added support for ClientStream.

Integrity-monitor-cx

Improved SBOM accuracy.
Added a health check alert when any labeling rules fail to load.
Improved recursive directory removal.
Data collection is now suspended when required endpoint tools are absent.
Added 'starts with' and 'ends with' operators to rule string fields.

Patch

Fixed an issue where certain errata from package maintainers could cause deployment failures on Linux.
Improved Linux package caching.
Linux endpoint tooling log improvements.
Fixed an issue where certain Linux endpoints were not rebooting after installing kernel patches.
Fixed an issue where certain Ubuntu packages had incorrect release dates.
Fixed an issue where the Endpoint Configuration - Uninstall Tool package with soft uninstall configured was not removing the appropriate Patch endpoint tooling files.

Provision

Updated the linux-phase boot image.
Fixed an issue where refresh may fail on some systems with an EFI System Partition that is too small.
When imaging a system using a Bitlocker-encrypted USB flash drive with bundle files on it, Bitlocker pre-provisioning is skipped.
Improved the display of error messages during the Preinstallation Environment phase.
Improved the verification speed for OS Bundle files during OS Bundle deployment.
Fixed an issue where the OS Bundle download progress stops logging after a Client reset.
Added automatic support of the "Windows UEFI CA 2023" secure boot CA.
Added support to allow specifying the root password for the linux-phase boot image.
Added support to allow disabling CLI access via a global setting.

Provision-cx

Improved SBOM accuracy.
Fixed an issue where Client Extensions would not load on macOS 10.13.

Performance-TSDB

Discontinued installation of binaries on Windows 7 and Windows Server 2008 even if they are targeted.

Performance-cx

Improved SBOM accuracy.
Fixed an issue where the extension crashes if configuration subscription fails.
Fixed an issue where Client Extensions would not load on macOS 10.13.
Fixed an issue where seconds in the Performance - Event Details were truncated instead of rounding.
Improved Tanium subprocess grouping in Performance when configured via AEM or Investigate.
Fixed an issue where recent Performance alerts might not have been acknowledged.
Added support for process network latency on macOS.

Performance

Removed Windows 7 and Windows Sever 2008r from Performance tool targeting.
Fixed an issue where seconds in the Performance - Event Details were truncated instead of rounding.

Swmgr-cx

Updated libarchive to 3.7.7.
Improved SBOM accuracy.
Fixed an issue where Client Extensions would not load on macOS 10.13.
Implemented the Alpine (APK) SBOM parser.
Added dpkg parsing to image SBOM.
Updated the Deploy log preview to include NUL bytes.
Fixed an issue where SBOM did not detect python eggs.
Fixed an issue where the Go parser did not include Go itself as a library.
Updated tool dependencies.
Added RPMDB parsing into image SBOM.
Fixed an issue where the software catalog was being rebuilt too frequently, causing battery drain on laptops.
Added the ability to reconcile Docker container events.
Added the ability to reconcile Kubernetes container events.
Fixed an issue where processing some CPEs with TaniumVulnerabilityMatcher was slow.
Fixed an issue where Image SBOM failed to unzip jar files.
Fixed an issue where SBOM reported a false positive for CVE-2020-36183.
Fixed an issue where SBOM library parsing failed on Windows Server 2012 and Windows Server 2019 end points.
Enabled identification of golang packages in image SBOM.
Fixed a potential crash in sqlite processing.

Screen Sharing

Fixed an issue where the ScreenMeet client might not reconnect properly if the user clicked 'Quit and reopen' when prompted to enable Screen Recording in the system settings.
Updated the Windows ScreenMeet client to 2.101.24 or later.
Fixed an issue where the session failed to start if screen recording permissions had not been granted on macOS 15 Sequoia.

Stream

Updated openssl to 3.2.3.
Improved SBOM accuracy.

Recorder

Adopted Driver 3.5.10.
Fixed an issue where Recorder might crash when processing security events on Windows.

Threat-response-cx

Fixed an issue where YARA could crash when scanning a file that was being modified.

Threat Response

Fixed an issue where Trace sensors did not check the parent command line correctly.
Added Linux support to the Trace DNS Query sensor.