Tanium Cloud Release Notes Integrity Monitor

Release Date: June 11, 2026

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: May 20, 2026

Improvements

Upgraded various third-party libraries to newer versions.

Resolved Issues

Resolved an issue with Integrity Monitor sensors on Solaris endpoints.

Release Date: May 12, 2026

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: April 16, 2026

Resolved Issues

Resolved an issue with performance of Integrity Monitor sensors leveraging the CX diskless mailbox on Linux endpoints.

Release Date: March 31, 2026

Improvements

Improvements to support future versions of Integrity Monitor endpoint tools.

Release Date: March 09, 2026

Improvements

Updated Gateway API to allows updating path style of watchlists.
Moved various Gateway APIs from Experimental to Stable.
Upgraded various third-party libraries to newer versions.

Release Date: March 12, 2026

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: December 15, 2025

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: October 2, 2025

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: August 25, 2025

Improvements

Added ability to view question results for monitor details to Integrity Monitor User and Integrity Monitor Read-Only user roles.
Added a parameter to two existing sensors (Integrity Monitor - Event Count, Integrity Monitor - Watchlist Event Count), allowing users to configure lookback period when returning events from these sensors.
Upgraded various third-party libraries to newer versions.

Fixes

Fixed an issue where a user with only Integrity Monitor Deploy Rules privilege is no longer able to access the saved question page, preventing question deletion.
Fixed an issue with monitor and watchlist approvals so that user cannot self-approve monitor and watchlist changes made in Endpoint Configuration.

Release Date: July 30, 2025

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: July 23, 2025

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: June 19, 2025

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: June 12, 2025

Fixes

Fixed an issue where the UI produced a hidden console error due to requesting an invalid resource.

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: May 8, 2025

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: March 31, 2025

Improvements

Upgraded various third-party libraries to newer versions.

Release Date: March 4, 2025

Fixes

Fixed an issue that prevented the Monitor Details page from loading within prior release.

Release Date: February 26, 2025

Improvements

This release adds GraphQL APIs to enable automation to create, modify, and deploy watchlists. It also adds the ability to create, delete, edit, and add computer groups through the API for monitors. For more information and sample mutations and queries, see Tanium User Guide: Gateway examples for Integrity Monitor.
Added additional operators “Starts with” and “Ends with” when setting rule criteria.
Added a warning if a path, inclusion, or exclusion contains a leading or trailing space.
Included a new computer group for Windows Server 2025 for watchlists and monitors.
Removed the Integrity Monitor – Tools Version sensor for customers on Tanium Server 7.6 or later. Customers should use the Client Extensions - Status sensor instead.
Upgraded various third-party libraries to newer versions.

Fixes

Fixed failure to import a watchlist that had previously been exported.
Fixed error prompting “Choose a file before importing” that arose from importing a watchlist multiple times.

Release Date: February 20, 2025

Improvements

Upgraded various third-party libraries to newer versions

Release Date: November 20, 2024

Improvements

Upgraded various third-party libraries to newer versions

Release Date: October 22, 2024

Improvements

Upgraded various third-party libraries to newer versions

Release Date: October 17, 2024

Improvements

Upgraded various third-party libraries to newer versions

Release Date: September 10, 2024

Improvements

Upgraded various third-party libraries to newer versions

Release Date: August 20, 2024

Improvements

Removed the Integrity Monitor event source from Tanium Connect. Users should use saved questions in Connect to export Integrity Monitor data to external destinations

Release Date: July 23, 2024

Improvements

Upgraded various third-party libraries to newer versions

Fixes

Fixed an issue that occurred when migrating to a new logs directory in Microsoft Azure

Release Date: April 22, 2024

Fixes

Fixed the upgrade pathing issue from 2.14 -> 3.2.39

Security Updates

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Community site, or by contacting support.

Release Date: March 15, 2024

Improvements

Third party dependency updates

Tools Versions

Includes Integrity Monitor CX binary: 1.3.4325 
Includes Index binary: 3.6.2490
Includes ExtrasCX binary: 1.3.1357 
Includes CoreCX binary: 2.9.1977 
Includes Recorder Tool (Installer): 3.15.131 
Includes Recorder binary: 2.12.1943 
Includes Driver Tool (Installer): 3.15.131 
Includes Driver binary: 3.3.30 
Includes python38 binary: 3.3.59

Release Date: March 11, 2024

Improvements

Third party dependency updates

Tools Versions

Includes Integrity Monitor CX binary: 1.3.4325 
Includes Index binary: 3.6.2490
Includes ExtrasCX binary: 1.3.1357 
Includes CoreCX binary: 2.9.1977 
Includes Recorder Tool (Installer): 3.15.131 
Includes Recorder binary: 2.12.1943 
Includes Driver Tool (Installer): 3.15.131 
Includes Driver binary: 3.3.30 
Includes python38 binary: 3.3.59

Release Date: February 7, 2024

Improvements

Adds ability to exclude empty strings within rules

Fixes

Fixed an issue where extra events could be generated for watched directories

Tools Versions

Includes Integrity Monitor CX binary: 1.3.4316 
Includes Index binary: 3.5.1744 
Includes ExtrasCX binary: 1.3.1357 
Includes CoreCX binary: 2.8.1960 
Includes Recorder Tool (Installer): 3.14.33 
Includes Recorder binary: 2.11.1587 
Includes Driver Tool (Installer): 3.14.33 
Includes Driver binary: 3.3.30 
Includes python38 binary: 3.1.43

Release Date: December 7, 2023

Improvements

Adds support for Endpoint Change Management
Improved log output
Integrity Monitor now uses System User Service
Integrity Monitor database has been upgraded to RDB

Tools Versions

Includes Integrity Monitor CX binary: 1.3.4314
Includes Index binary: 3.5.1744
Includes ExtrasCX binary: 1.3.1357
Includes CoreCX binary: 2.8.1960
Includes Recorder Tool (Installer): 3.14.33
Includes Recorder binary: 2.11.1587
Includes Driver Tool (Installer): 3.14.33
Includes Driver binary: 3.3.30
Includes python38 binary: 3.1.43

Release Date: November 27, 2023

Fixes

Fixes an issue where changing a Rule that uses the Event Time criteria could cause the Rule to not function as intended under certain circumstances.
Fixes an issue with the endpoint count on Monitors incorrectly showing 0.
Fixes an issue with the endpoint count on Rules incorrectly showing 0.
Fixes an issue where creating a Label could cause Labels and Rules to not function as intended under certain circumstances.

Tools Versions

Includes Integrity Monitor CX binary: 1.3.4314
Includes Index binary: 3.5.1744
Includes ExtrasCX binary: 1.3.1357
Includes CoreCX binary: 2.8.1960
Includes Recorder Tool (Installer): 3.14.33
Includes Recorder binary: 2.11.1587
Includes Driver Tool (Installer): 3.14.33
Includes Driver binary: 3.3.30
Includes python38 binary: 3.1.43

Release Date: October 3, 2023

Improvements

Adds support for AUID on Linux endpoints.
Adds Recorder eBPF Support for Amazon Linux 2023.
Upgraded various third-party libraries to newer versions.

Fixes

Fixes an issue with targeting Recorder BPF Support on Oracle Linux 7.9 endpoints.
Fixes an issue that could cause unexpected memory usage under certain circumstances.
Fixes an issue around processing events when AuditD is in use on Linux endpoints.
Fixes an issue with handling raw symlinks.
Fixes an issue with handling multiple hardlinks within the same directory.

Tools Versions

Includes Integrity Monitor CX binary: 1.3.4310
Includes Index binary: 3.5.1735
Includes Recorder Tool (Installer): 3.14.33
Includes Recorder binary: 2.11.1587
Includes Driver Tool (Installer): 3.14.33
Includes Driver binary: 3.3.30

Release Date: August 8, 2023

Fixes

Fixes an issue with handling multibyte characters in sensor results.

Tools Versions

Includes Integrity Monitor CX binary: 1.3.4295.0
Includes Index CX binary: 3.5.1725
Includes Recorder Tool (Installer): 3.14.26
Includes Recorder binary: 2.11.1580
Includes Driver Tool (Installer): 3.14.26
Includes Driver binary: 3.3.27
Includes Extras CX: 1.3.1357

Security Updates

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Support Portal, or by contacting your TAM.

Release Date: June 7, 2023

Fixes

Fixes an issue where duplicate delete events could be listed.
Fixes an issue with events following a write being inconsistent.
Fixes multiple issues that could cause blank fields in events.
Fixes an issue around handling file systems with unstable inodes.
Fixes an issue where extra ChangeTime events could accompany permission/owner changes when running in Index-only mode.

Tools Versions

Includes Integrity Monitor CX binary: 1.3.4286
Includes Index binary: 3.5.1688
Includes Recorder Tool (Installer): 3.14.13
Includes Recorder binary: 2.11.1571
Includes Driver Tool (Installer): 3.14.13
Includes Driver binary: 3.3.12

Release Date: March 1, 2023

Fixes

Fixed an issue where event process data would sometimes be missing for a second event pertaining to a given file within a short timeframe.
Fixed an issue where an additional event could be generated when file permissions or ownership were overwritten with the same values.

Endpoint Tools Versions

Includes IMCX 1.2.870
Includes Index 3.3.2634
Includes Recorder 3.12.15
Includes Driver 3.2.57

Security Updates

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Support Portal, or by contacting your TAM.

Known Issues

In rare instances, the Tanium Driver included in this release may cause conflicts with drivers for USB devices used for calibration in manufacturing processes, causing the USB device to stop responding. As a work-around, the Tanium Driver can be disabled to restore functionality of the USB device. A fix for this issue will be provided in the next release.

Release Date: February 2, 2023

Improvements

Adds support for Index Blockout Windows

Fixes

Fixed an issue where data sent to Trends did not update properly under certain conditions.

Endpoint Tools Versions

Includes IMCX 1.2.863
Includes Index 3.3.2631
Includes Recorder 3.11.26

Security Updates

None

Known Issues

None

Release Date: January 12, 2023

Improvements

Added the ability to configure a size limit for the Integrity Monitor database on endpoints.
Added an option to set database pruning by day.
"Integrity Monitor – Monitor Events" now returns "No Integrity Violations Found" where appropriate.
Improved Health Check results in the Integrity Monitor workbench.

Fixes

Fixed an issue where results from the “Integrity Monitor – Monitor Events” sensor did not display duplicate counts as expected.
Fixed case sensitivity for Windows paths in watchlists.
Fixed an issue where a table in the Integrity Monitor database on endpoints could become locked under certain conditions.
Fixed an issue where using more than 1 label resulted in incorrect search results.
Fixed the sensor type on the “Integrity Monitor – Event Count” sensor.

Endpoint Tools Versions

Includes IMCX 1.2.861
Includes Index 3.2.2789

Security Updates

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Support Portal, or by contacting your TAM.

Known Issues

Windows Watchlists that were created prior to upgrading to 3.0.186 must be re-saved to activate the case sensitivity fix.

Release Date: October 5, 2022

Improvements

Low disk space warning and critical thresholds of 5% and 1% (respectively) are now recognized as provided by CX Core 2.6 (Included with TCM 1.10+).
The default monitor prune age is now one month.
Improved service logging.

Fixes

Fixed an issue where the Integrity Monitor – Monitor Events and Integrity Monitor – Monitor Events Unlabeled sensor results were truncated at 65 thousand bytes.
Windows watchlist templates for C:\Program Files and C:\Program Files (x86) now use the correct wildcard syntax.
Fixed an issue where directly watched files would not report events under certain conditions.
Fixed an issue where newly watched paths would not report events under certain conditions.
Changes to existing watchlist inclusions and exclusions are now honored correctly.
Fixed an issue that would cause the workbench upgrade to fail under certain conditions.
Fixed an issue where a user's group management rights were not evaluated correctly when deploying monitors and watchlists.

Endpoint Tools Versions

Tanium Integrity Monitor 1.2.845
Tanium Recorder 2.8.1047
Tanium Index 3.2.2784

Known Issues

Newly created watchlists created in IM3.0 from templates for the C:\Program Files and C:\Program Files (x86) directories should have their excludes inspected to match the correct template value of "**\**".

Release Date: August 31, 2022

Improvements

Upgraded various third-party libraries to most recent versions

Release Date: August 8, 2022

Fixes

Fixed an issue where the monitor pruning age would be displayed incorrectly

Improvements

Upgraded various third-party libraries to newer versions.

Tanium Cloud Release Date: July 6, 2022

Upgrade Notes

This release continues the rollout of a major version release that migrates Integrity Monitor endpoint functionality to a Tanium Client Extension (CX) and introduces changes to workflow in the Integrity Monitor module. Please note that manual intervention is required after this upgrade is performed. See the June 22, 2022 upgrade notes for general items that should be noted. For a comprehensive list of Integrity Monitor 3.0 upgrade awareness items please see Tasks for the July 2022 upgrade in the Tanium Integrity Monitor User Guide.

Improvements

Added support for SPARC-based Solaris endpoints

Bug Fixes

Fixed an issue where monitors automatically deployed for Tanium Cloud customers on upgrade from the previous Integrity Monitor version
Fixed an issue where permission and ownership details were not shown on events not generated by Recorder
Fixed an issue where directly watched symlinked files did not create an event when moved or deleted
Fixed an issue where new registry records could be missed
Improved transient file handling

Known Issues

When upgrading from an existing version of Index CX to Index CX 3.2.2761 or higher, the Index database on all endpoints is reset. Index CX performs a normal rescan to repopulate the Index database. Until the initial rescan is complete, Index data can be incomplete. This is required due to a database schema change to improve database consistency.

Endpoint Tools Versions

Tanium Integrity Monitor 1.2.826
Tanium Recorder 2.8.1038
Tanium Index 3.2.2771

Tanium Cloud Release Date: June 22, 2022

Upgrade Notes

This is a major version release that migrates Integrity Monitor endpoint functionality to a Tanium Client Extension (CX) and introduces changes to workflow in the Integrity Monitor module. Please note that manual intervention is required after this upgrade is performed. General items that should be noted are as follows:

On upgrades from the previous Integrity Monitor version, monitors and watchlists are not automatically deployed to endpoints. This allows monitor configurations and watchlist assignment paths to be validated to ensure they have been migrated correctly.
Watchlist glob styles have changed. See Review path inclusions and exclusions that include wildcard characters in the Tanium Integrity Monitor User Guide for further explanation of glob and wildcard character usage in paths, inclusions, and exclusions.
All watchlists that include registry paths now monitor at the registry key level. All changes that occur within a watched registry key trigger an event. Note that you can filter these events for storage or further processing.
You must update any custom Integrity Monitor saved questions, reports, Connect jobs, and Trends boards to use the new Integrity Monitor sensors. For a list of the updated Sensor names and descriptions see Update sensors in saved questions in the Tanium Integrity Monitor User Guide.

For a comprehensive list of Integrity Monitor 3.0 upgrade awareness items please see Tasks for the June 2022 upgrade in the Tanium Integrity Monitor User Guide.

New Features

Introduces a simplified and improved workbench experience
Integrity Monitor now runs as a Client Extension on the endpoint
Integrity Monitor now uses the Index Client Extension on the endpoint
Added support for Amazon Linux 2 - ARM64 (Gravitron)

Improvements

Reduced endpoint resource consumption and improved stability
Streamlined monitor configuration options
Watchlist paths can now follow symbolic links
Watchlists are now deployed to endpoints independently of monitors
The limit of 55,000 events has been removed; event storage is now time-based
New panels on the Integrity Monitor Overview page

Bug Fixes

Fixed an issue where CreateNewFile events were incorrectly reported
Fixed an issue where temporary files were left on AIX endpoints
Windows Server 2022 systems are now correctly targeted in default monitor deployments
Fixed an issue where duplicate ECF Service Now configuration items were created
Fixed an issue where Integrity monitor replaced the Tanium Driver Status sensor with an outdated version
TAR file creation events now have correct timestamps
Invalid Unicode characters are now correctly filtered from watchlists

Security Updates

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within the Tanium Support Portal, or by contacting your TAM.

Known Issue

The Integrity Monitor board is not properly updated in Trends during this upgrade. You must manually import the Integrity Monitor board. For more information, see Import the Integrity Monitor board in Trends in the Tanium Integrity Monitor User Guide.

Endpoint Tools Versions

Tanium Integrity Monitor 1.2.815
Tanium Recorder 2.8.1038
Tanium Index 3.2.2762

Tanium Cloud Release Date: June 14, 2022

Security Updates

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within the Tanium Support Portal, or by contacting your TAM.

Tanium Cloud Release Date: April 22, 2022

Important Notes

This release includes updated versions of the endpoint components Tanium Index and Tanium Event Recorder.

Bug Fixes

Fixed an issue where charts on the Overview page returned an error under certain conditions.

Security Updates

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within the Tanium Support Portal, or by contacting your TAM.

Known Issues

On new installations, Windows folders return a “CreateNewFile” event after the initial Index scan completes.

Tanium Cloud Release Date: September 22, 2021

Important Notes

This release includes an updated version of the endpoint component Tanium Event Recorder.

Tanium Cloud Release Date: September 21, 2021

Bug Fixes

Resolves an issue with server logging.

Tanium Cloud Release Date: Aug 30, 2021

Important Notes

This release includes updated versions of the endpoint component Tanium Event Recorder.

New Features

Added an Integrity Monitor Connect source for exporting watchlist configuration data.
The monitor list pages now display the most recently deployed monitor hash values.

Bug Fixes

Resolves an issue with the monitors page showing inconsistent results for the endpoint counts.
Resolves issues with changing the service account to a user with reduced permissions.

Tanium Cloud Release Date: Aug 5, 2021

Important Notes

This release includes updated versions of the endpoint components Tanium Index and Tanium Event Recorder.

Known Issues

API documentation links are not working. This will be fixed in an upcoming release.

Tanium Cloud Release Date: July 20, 2021

Important Notes

This release includes updated versions of the endpoint components Tanium Index and Tanium Event Recorder.

Bug Fixes

Resolves an issue with the Integrity Monitor - Coverage Status sensor on non-US endpoints.

Tanium Cloud Release Date: June 24, 2021

Important Notes

This release adds the capability to use eBPF (extended Berkeley Packet Filter) as the source for the Tanium Recorder on supported RHEL/CentOS and Oracle Linux endpoints. The Tanium Recorder defaults to this mode if an endpoint has the correct requirements.

New Features

Support for the use of eBPF on RHEL 7.8+ and Oracle Linux 7.8+ endpoints with proper dependencies and kernel versions.
RHEL 7.8 - 8.1 DO require kernel-headers and kernel-devel that match the running kernel in order to be able to use eBPF.
Oracle Linux 7.8-8.2 DO require kernel-headers and kernel-devel that match the running kernel in order to be able to use eBPF.
Oracle Linux UEK kernel 7.8+ DOES require the kernel-uek-devel package.

Enhancements

Tunes the default watchlist templates for Windows to exclude obsolete files.
Adds default watchlist templates for Microsoft Exchange Server.
Adds distribute over time configuration for AIX hashing.
Displays more informative validation errors when attempting to save watchlist paths.

Bug Fixes

Resolves an issue preventing deleted computer groups from being removed from existing Monitors.
Resolves an issue with the rules engine not purging events on endpoints.
Resolves an issue with unrelated recorder issues affecting IM status messages.

Tanium Cloud Release Date: March 25, 2021

Bug Fixes

Resolves an issue with applying labels to events from Basic Monitors on AIX or Solaris.

Tanium Cloud Release Date: March 11, 2021

Improvements

Improves the ability for assistive technology, such as screen readers, to process status notifications.
Improves performance of charting components and enhanced drill-down options for the overview charts and metrics.
Includes updates to the endpoint tooling components, including making Python 2.7 optional for Tanium Clients 7.4+.

Bug Fixes

Resolves an issue with Windows endpoints that fail to install Integrity Monitor configuration when the Tanium Driver is needed.
Resolves an issue that caused endpoints to continue receiving Integrity Monitor Tools after deleting all monitors.

Known Issues

Users are unable to apply labels to events from Basic Monitors on AIX or Solaris.

Tanium Cloud Release Date: February 16, 2021

Bug Fixes

Resolves an issue where drilling down on basic monitor events would cause an error.
Resolves an issue where deleting a previously deployed monitor would not allow restoring the monitor or notify the user that deployment is needed.

Tanium Cloud Release Date: February 11, 2021

Enhancements

On 7.4 clients, Tanium Python 2 is no longer needed and will not be installed by IM.

Bug Fixes

Resolves an issue where rapid changes to a file could cause recorder events to not be shown in sensors.
Resolves an issue where some recorder permission events could result in stopping the correlation engine from starting.
Resolves an issue where installing the Tanium Driver as part of a monitor configuration after tools were previously installed caused the correlation engine to be stuck in a disabled state.

Tanium Cloud Release Date: November 18, 2020

Enhancements

ServiceNow rules are now auto deployed during module upgrade if auto deployment is enabled.
The Server Coverage chart on the Integrity Monitor Overview page is now limited to include only endpoints in the Tanium Integrity Monitor action group.

Bug Fixes

Monitor deployment now succeeds even if there are already pending approvals. The pending approvals are replaced with new approvals.

Tanium Cloud Release Date: November 4, 2020

Bug Fixes

Endpoints targeted by multiple monitors now correctly use monitor priority to determine which monitor to deploy.
The Integrity Monitor Filtered File Events Overview and Integrity Monitor Unlabeled File Events Overview sensors are no longer automatically registered for collection in Interact.

Tanium Cloud Release Date: October 23, 2020

Enhancements

This release includes a refreshed user experience, bringing more reporting, consistency, and configurability to the forefront.
This release includes a new endpoint configuration framework, replacing the actions and packages formerly used to configure endpoint tooling.

Important Notes

With this release, support is ending for Tanium Administrative Console and Workbench in Internet Explorer 11. For the best experience, use a recent version of Google Chrome, Microsoft Edge, Mozilla Firefox, or Safari to access the Tanium Console.

Bug fixes

Enhanced Rules will now correctly label by timestamp.
Count of endpoints on the monitors list pages will now update sooner and more accurately.
Watchlists with zero paths can no longer be deployed in a monitor.
Endpoints that are not using any enhanced rules will no longer report the Rules Engine is in a failed state
Uninstalling the Tanium Client will now stop the IM process.
The notification to deploy rules will be correctly shown after deleting a rule.

Known Issues

Endpoints targeted by multiple monitors attempt to use monitor priority to determine which monitor to deploy, but in some cases an incorrect priority is used. After upgrading, ensure that endpoints that are targeted by multiple monitors are using the intended monitor.
The Coverage Status chart on the Integrity Monitor Overview page includes endpoints that are not supported by Client Extensions, and these endpoints remain in the Initializing state.

Tanium Cloud Release Date: July 24, 2020

Bug Fixes

Refines targeting on several panels to ensure proper results displayed
Refines exclusions on IM templates
Fixes the Enhanced Labeling Rule Editor to display correct events

Other Enhancements

Updated Trends board with several new or updated panels:

Integrity Monitor - Coverage Status
Integrity Monitor - Expected vs Unexpected Change Events
Integrity Monitor - Expected vs Unexpected Change Events
Integrity Monitor - Event Count by Endpoint
Integrity Monitor - Endpoints by OS Platform
Integrity Monitor - Top Users - Unexpected Changes
Integrity Monitor - Events by Label
Integrity Monitor - Events by ServiceNow Change Ticket