Tanium Cloud Release Notes Platform

Tanium Cloud Release Date: July 22, 2026

New Features

Added support for Oauth v2.1 as an authentication and authorization mechanism for future integrations.

Improvements

Improved the error returned by the Tanium Server SCIM API when a request contains a malformed string attribute (e.g. a nested object for displayName); the response now identifies the offending field instead of a generic type-conversion error.
The Tanium Server users API now offers the system_user_flag to identify user accounts used by solution modules.

Bug Fixes

Corrected a defect in the Tanium Server SCIM API where a user with an empty external_scim_id could not be updated (returned 404) and appeared to be deleted successfully via DELETE without actually being removed; SCIM operations now correctly recognize such users as belonging to their SCIM server.
The Tanium Server now rejects global maintenance window create or update requests that would leave all_types_flag set to false with an empty or missing types list, which previously produced an invalid combination.
Entity replication on the Tanium Server now detects a peer server restart instead of continuing to use a stale, higher sequence number, so replication no longer stalls until the sequence number catches up; this uses the same random-epoch mechanism already relied on for TDS harvest.
Resolved a regression in the Tanium Server where taas_user_login was no longer included in the pre-authentication console.json response, which could redirect some cloud deployments to the logged-out page instead of the correct authentication flow.
Fixed an omission in the Tanium Server where deleting a content set role did not also mark its role memberships as deleted.
The Tanium Server API no longer permits a content set to be created or updated with an empty or whitespace-only name; such requests are now rejected with a validation error.
Resolved an inconsistency in the Tanium Server API where a content set's deletion could be blocked by anonymous (unnamed) filter group rows that were invisible to GET /api/v2/filter_groups and the Console preview.
Corrected a mismatch in the Tanium Server packages API where a package could be created with an omitted, zero or negative expire_seconds (download timeout) value.

Tanium Cloud Release Date: July 15, 2026

New Features

Added an Extended Action Status built-in sensor to the Tanium Server that reports the status, sub-status, and exit code for an action on each computer. The action reporting API gains optional sub-status and exit code fields so services can supply these values.

Improvements

The GET api/v2/site_throttles API now returns each site's ordinal ID alongside its throttle configuration, so it can be correlated with the site's corresponding bandwidth panels in Grafana.

Bug Fixes

The Tanium Server now returns an error when an action or package target filter references a sensor by source_name without supplying its parameters, instead of silently targeting all endpoints.
Fixed a race condition in the Zone Server's bandwidth metrics which could crash the Zone Server.
Fixed an issue in Tanium Windows binaries where the version resource did not include an OriginalFilename entry, causing AppLocker publisher rules to fail to build for signed binaries such as TaniumClient.exe and TaniumCX.exe.
Fixed an issue in the Tanium Server where site bandwidth throttles could overshoot their configured limits.

Tanium Cloud Release Date: June 30, 2026

New Features

Adds the writable daylight_saving_time_enabled and read-only effective_timezone properties to Tanium Server global maintenance window objects. daylight_saving_time_enabled controls whether daylight saving time is honored for the window, and effective_timezone reports the timezone actually in effect once that setting is applied.
Adds an Extended Action Status built-in sensor to the Tanium Server that reports the status, sub-status, and exit code for an action on each computer. The action reporting API gains optional sub-status and exit code fields so services can supply these values.
Adds a multi-row Supported Action Classes sensor to the Tanium Server for Entity Exchange entity data.

Improvements

Tanium Server now ships with PostgreSQL v16.14.1.
Tanium Platform components now ship with OpenSSL v3.5.7.
The Tanium Server now applies stricter validation to the calendar and timezone properties of a global maintenance window, requiring timezone when endpoint-local time is not used and rejecting a calendar that does not specify exactly one valid type.
Adds endpoint_local_time_flag and schedule type as filterable and sortable fields on the Tanium Server global maintenance window API.

Bug Fixes

Fixes an issue in the Tanium Server where the database connections required for the API connection cache were undercounted, which could exhaust the available database connections when the server was under load.

Tanium Cloud Release Date: June 9, 2026

New Features

The Tanium Server now includes support for storing and maintaining Global Maintenance Windows definitions.
Adds a parse route to the Tanium Server API through which a caller can parse question text into a usable JSON format without actually issuing the question.
Adds a managed_flag field to derived packages in the Tanium Server, allowing callers to mark a derived package as lifecycle-managed and exempt it from automatic platform cleanup.
The Tanium Server now automatically sets the action status to failed for endpoints that do not match a package's supported action classes.
The Tanium Server now enforces a configurable maximum session duration, terminating sessions that exceed the limit regardless of user activity; the default is 24 hours.
Adds a multi-row Supported Action Classes sensor to the Tanium Server for Entity Exchange entity data.
Adds a supported_action_classes field to Tanium Server packages, allowing packages to declare which entity action classes they support.
The Tanium Server now supports "all endpoints[group a, group b]" question syntax, allowing complex group-scoped targeting for entity-type scopes without requiring the $group() function.
The Tanium Server question parser now supports the from all entities syntax, allowing questions to target entities from all registered provider types rather than only Tanium Client machines.
The Tanium Server now supports comma-delimited group names in question syntax, allowing a single question to target multiple computer groups expanded as an OR condition.
Adds a setting to the Tanium Server to lock user sessions to the originating IP address, preventing session tokens from being used from a different network location.
Adds API endpoints to the Tanium Server for managing entity providers in the Entity Exchange framework.
Adds support for multiple namespaces in the Tanium Client entity database, allowing entity providers to specify the ComputerIDv2 namespace when storing computer IDs.
Adds the mechanisms needed in the Tanium Server to register and then query gRPC API endpoints available.
Removes support for the aggregate_by_value_flag option which was not used in the Tanium Server SOAP API.
Tanium Platform components now ship with the boost v1.87 libraries.
Tanium Platform components now ship with protobuf v3.25.5.

Improvements

The Tanium Server now parallelizes the chunking of downloaded files, improving responsiveness when processing very large files.
Adds an option to include row_count_machines data in Tanium Server action results when retrieving multiple actions.
The Tanium Server package file API now supports filtering by file_status/cached_flag in cache filters.
The Tanium Server now allows combined sensor queries up to 1 million bytes for clients version 7.4 and later, removing a limit that was only required for older 7.2 clients.
Improves the handling of ZIP files to avoid an InvalidDate error when reading malformed metadata inside a ZIP archive.
Adds a stateful incremental unzip interface to the Tanium platform, allowing unzip operations to be stepped through manually for more efficient work distribution.
The Tanium Server now logs the specific cause when the consoleSettingsThread fails to finalize decryption, improving diagnostic visibility for this recurring error condition.
Improves Tanium Server database connection pool handling by reserving dedicated connections for API worker threads and allowing background threads to wait for an available connection rather than failing immediately.
Improves performance of the Tanium Server user cache query.
The Tanium Server now logs cache refresh durations with reduced precision (three decimal places in milliseconds), making timing entries easier to read.
The Tanium Server now applies CX Socket bandwidth throttles to module messages sent to leaders, and module messages sent during registration no longer count against registration traffic.
Changes the behavior of the Tanium Server to read configurations from its internal settings cache.
The Tanium Server now checks for missing package files only once at startup rather than every 10 seconds, significantly reducing CPU usage of the package-refresh thread.
Improves the performance of the Tanium Server requests to the Manual Group creation API.
The Tanium Server now keeps track of the user identity that stopped an issued action.
Adds the concept of a module message snapshot to propagate NATS information across active-active Tanium Servers and their Zone Servers.
Adds a NATS message consumer on the Tanium Server for incoming Tanium Client messages.
Adds support for the new NATS protocol through which publish/ subscribe messages will be shared between solution modules and Tanium Clients over existing Tanium Server communications.
Ensures that certificate serial numbers fit in a 20-byte field.
Introduces an improvement in the way the Tanium Server calculates the estimated number of on-line endpoints in real-time.
Improves the error messages returned by the Tanium Server's users/by-name route instead of the more terse "XML Parse Error" it used to return.
Adds a communications message for a Zone Server to acquire a batch of new computer IDs from the Tanium Server, to be assigned to new Tanium Clients.

Bug Fixes

Fixes an issue where replacing a single file in a package would result in new IDs for all files in that package.
Fixes an issue in the Tanium Server where reported_entity_count was not populated correctly in single-action API responses.
Fixes an issue in the Tanium Server where the x25519 and x448 key exchange algorithms remained active when FIPS mode was enabled, contrary to FIPS requirements.
Fixes an issue in the Tanium Server where all rows in saved question results were assigned an age of 0, causing incorrect bucketing when filtering results by recency.
Fixes an issue in the Tanium Server where the supported_action_classes package property required an XML-style JSON structure; it now uses a standard JSON array.
Fixes an issue in the Tanium Server where question result info fields such as tested, passed, mr_tested, and mr_passed did not include entity counts.
Fixes an issue in the Tanium Server where certain request handler validation errors returned a 500 Internal Server Error instead of a 400 Bad Request with an actionable message.
Fixes an issue in the Tanium Server where reinstalling a module created a new service account instead of reactivating the previously deleted one, causing the old account to appear as deleted in the UI.
Fixes an issue in the Tanium Server where test sessions created via MakeSOAPRequest all shared the same session ID and were not persisted to the sessions database.
Fixes an issue in the Tanium Server package file API where the status field in cache filters could be applied recursively as an infinite sub-field path.
Fixes an issue in the Tanium Server where creating a temporary sensor required the Define Question privilege even when the sensor was used solely to create a computer or filter group.
Fixes an issue in the Tanium Server where action groups could be created with more than 255 subgroups and only fail later during processing; the 255-subgroup limit is now enforced at creation time.
Fixes an issue in the Tanium Server where actions could be created with expiration times exceeding 30 days, causing them to be silently dropped after the action history retention window. Such action expiration lengths are no longer allowed.
Fixes an issue in the Tanium Server where integer fields in API and import XML payloads would silently convert invalid values such as decimal numbers to 0 instead of returning an error.
Fixes an issue in the Tanium Client where entity sensor data reported by operational technology providers was not delivered to the Tanium Server and therefore not included in question results.
Fixes an issue in the Tanium Server where VerifyPackageFileSource rejected loopback addresses other than 127.0.0.1, such as 127.0.1.1 used by Ubuntu for hostname resolution.
Fixes regression in the Tanium Server where licensed_days_left would no longer return negative values for expired licenses; the field now reflects how many days the license has been expired.
Corrects the CPE identifier for the xz library in Tanium platform SBOMs which should read: tuukani::xz.
The Tanium Server now omits serializing questions which have not been issued yet to avoid showing expiration times in the year 2000.

Tanium Cloud Release Date: May 28, 2026

Improvements

Tanium Platform components now ship with v8.20 of libcurl.
Removes unused module components from the Python builds distributed with Platform software components.
The Tanium Server will now split download bandwidth across Zone Servers according to the number of connections being serviced by each one of them instead of equally across all of them.

Bug Fixes

Fixes an issue in the Tanium Server where site bandwidth throttles could overshoot their configured limits.
Fixes an issue with the throttle scheduling of file download chunks which could cause exceedingly long queue delays on the order of days.

Tanium Cloud Release Date: May 22, 2026

Improvements

Added a new capability to define a custom URL to replace the default logged out page.

Tanium Cloud Release Date: May 20, 2026

Improvements

The Tanium Server now parallelizes the chunking of downloaded files, improving responsiveness when processing very large files.
Tanium Platform components now ship with pysan1 v0.6.3.
Tanium Platform components now ship with SQLite v3.53.0.
Tanium Platform components now ship with xz library v5.8.3 and has removed unnecessary dependencies on it.
Tanium Platform components now ship with libexpat v2.8.0.

Bug Fixes

Fixes a behavior in the Tanium Downloader where a file configured for updates would not be re-downloaded if the distribution server did not report a last-modification time.
Fixes an issue in the Tanium Server ring set API by which it failed to sort results correctly.
Fixes an issue in the Tanium Server ring set API in the Tanium Server where an update request would not save its updated metadata.
Fixes an issue in the Tanium Server sensor API where source_name was missing from responses, preventing identification of the original sensor for a parametrized copy.
Fixes an issue where replacing a single file in a package would result in new IDs for all files in that package.

Tanium Cloud Release Date: April 23, 2026

Improvements

Tanium Platform components now ship with OpenSSL v3.5.6.
Updates the version of python-six shipped with Platform to v1.17.0.
Updates Platform components to use the newer xmltodict v1.0.4 Python library.

Bug Fixes

Fixes an issue in the Tanium Server where a saved action would be visible in an API listing request but would return an HTTP-403 when trying to retrieve it individually.

Tanium Cloud Release Date: April 6, 2026

New Features

The Tanium Server offers improved load balancing capabilities across its deployed Zone Servers.
Tanium Server API filters for collection items now support the collection_and_filter boolean setting to indicate that all of the filters requested must match, instead of just any one of them.
Introduces a mechanism by which a Zone Server restart can force a rebalance of endpoints, making their rebalancing faster than waiting for the client reset cycles.

Improvements

The Tanium Server improves the performance with which it maintains information about action statuses as a SQLite database, along with adding metrics that monitor this subsystem.
Allows the configuration of the Tanium Server action status cache database to improve performance.
The Tanium Server will now skip updating an action status timestamp in its cache if reports of its current status have not changed from previous state.
The Tanium Downloader will now use a SQLite database to keep track of the last modification times for downloaded files, avoiding the large number of individual files that it used before for this purpose.
Setting values needed during the allocation of computer ID values are now cached in memory for increased performance.
The Tanium Server now offers a way to apply filters to saved action objects.
The Tanium Server will now split download bandwidth across Zone Servers according to the number of connections being serviced by each one of them instead of equally across all of them.
Fixes an issue in the Tanium Server downloader seen sometimes in its logs with the message: "Unexpected number of tokens when splitting with '_' char".

Bug Fixes

Fixes an issue that prevented configured throttle connection limits from being enforced at all.
Fixes an issue in how the Tanium Server and Zone Server complete their registration cycles.
The Tanium Server now uses PKI identities to track the Zone Servers in a deployment instead of their IP addresses.
Fixes a problem with the handling of new hash values which would not coordinate properly across Tanium Servers, causing uploaded files to be unusable in the system.
Fixes an inconsistency in the Tanium Server API where the start_time set for an action would not be reflected correctly in the server's response.
Resolved issue with existing guards protecting from excessively large group filters that would incur in the logged failed assertion: "assertion 'group.m_filterOps.size() <= QueryMessage::MaxOpsPerGroup' failed".
Fixes a problem in the handling of the client identity cache in the Tanium Server which would impair the operation of the Tanium Server, making it appear unusable in asking question and handling client communications.
Ensures that all filesystem API calls on Linux are made using 64-bit integer values.
Fixes an issue in the Tanium Server where recurring policy-based scheduled actions were not given enough time to complete as their question-based creation time drifted closer to their expiration time.

Tanium Cloud Release Date: March 19, 2026

New Features

Added instrumentation to the handling of sensor results and action results handling within the Tanium Server.

Improvements

Tanium Platform components now ship with zlib v1.3.2.
The Tanium Server has improved performance in handing and storing actions statuses. This improves some issues with missing results in very large deployments.

Tanium Cloud Release Date: March 2, 2026

Bug Fixes

Fixes a few health and networking metrics used for monitoring the Tanium Server.

Tanium Cloud Release Date: February 24, 2026

Bug Fixes

Fixes an issue with some metrics being duplicated when scraped from the Tanium Server.

Tanium Cloud Release Date: February 17, 2026

Improvements

The Tanium Server now persists and reloads the information for the first time that each Tanium Client ever registered, to preserve information used in the Client Status page in Console.
Adds the ability to specify RBAC privilege filters in requests to the Tanium Server users API.

Bug Fixes

Fixes a regression in the Tanium Server actions API where the word "Never" used to be accepted as valuable start and end times for a recurrent action.
Fixes an issue with the background process that checks package files, where would not stop in coordination with the rest of the Tanium Server tasks, which could lead to changes that were not properly reflected in the server's database.
Fixes the visibility of the allowed number of tracking site throttles that can be configured in the Tanium Server, which should solve configuration problems for customers that already have one hundred or more site definitions.

Tanium Cloud Release Date: February 5, 2026

Improvements

Platform components now ship with OpenSSL v3.5.5.
Tanium Platform components now ship wit libexpat v2.7.4.

Tanium Cloud Release Date: February 4, 2026

Improvements

Implemented sticky console sessions to prevent rare but possible UI data display issues.
Improved the Zone Server registration process to properly handle horizontal scaling.

Tanium Cloud Release Date: January 17, 2026

Bug Fixes

Fixes an issue that prevented some actions with future times from being issued.

Tanium Cloud Release Date: January 6, 2026

New Features

The Tanium Server now adds the X-Tanium-Server-Host and X-Tanium-Server-GUID headers to its API responses which can help when troubleshooting systems deployed in an active-active configuration.
As of this version the Tanium Server removes its built-in default bandwidth throttles. There is no change for existing environments, new environments will be built without a default global throttle.

Improvements

Changes the Tanium Server action scheduler subsystem to operate from its in-memory cached information which improves its performance and scalability, and reduces overall load on the database.

Bug Fixes

Fixes a problem in the Tanium Server where interruptions in service from its database could cause package files pending download to never be processed when the database service is restored.
Fixes an omission in the Tanium Server where it would not specify a backoff time to be used by Tanium Clients when CDN signals to them it has too many download connections. This would cause the Tanium Client to retry immediately.

Tanium Cloud Release Date: December 8, 2025

Improvements

- Added the ability to perform Question Performance testing.

Tanium Cloud Release Date: December 4, 2025

Improvements

- Increases the timeout for the OAuth2 proxy. - Extends Zone Server legacy download bandwidth throttle to all regions.

Bug Fixes

- Fixes an issue where the DEC map was incorrect when an instance had more than two Zone Servers.

Tanium Cloud Release Date: December 3, 2025

New Features

The Tanium Server now registers, stores and reports the total number of decompressed bytes received for every question issued by the system.
The Tanium Server now support the "strict_syntax" question parser flag to offer more regimented rules to the query text allowed. This is beneficial for integrations that issue questions in text form without the need for natural language parsing.
The Tanium Server will now force a change in ComputerID on all of the clients detected in a collision. This strategy will yield more reliable/ correct historical data when referenced by this identifier.
Ensures that left-hand-side filters work on questions issued by the Tanium Server when combined with entity expansion results.
Implements a feature where the Tanium Server will broadcast to leader Tanium Clients that a Zone Server has come online. This gives clients an opportunity to randomly switch to a different server and quickly rebalance workloads across a deployment.
The Tanium Server now offers an audit log for sensor preview executions when authoring code in Console. This will allow keeping track of these events to scrutinize such activities by content authors.
The Tanium Server will now recognize an "X-Tanium-Integration" header in API requests to report metrics of activity against the system.
Implements bandwidth metrics for throttled sites configured in the Tanium Server.

Improvements

The Tanium Server action API now allows filtering results by their associated metadata field values.
Ensures that SAML requests from the Tanium Server all follow the same URL character-encoding scheme.
Changes the Tanium Server action scheduler subsystem to operate from its in-memory cached information which improves its performance and scalability, and reduces overall load on the database.
The Tanium Server adds a recurring_action_flag field to action objects that identifies whether they are one-time or recurring.
Implements tracking of overall download connection counts per configured site throttle in support of the new throttle metrics feature.
Adds logic to the Tanium Server metrics on connection and bandwidth throttle limits to reflect the hierarchical settings of overall limits over site limits.
Adds throttle bandwidth limit information to the Tanium Server instrumentation, matching the information provided by throttle connection limits.
Adds the user ID to authentication failure audit records generated by the Tanium Server.
Adds per-site throttle connection count metrics to the Tanium Server.

Bug Fixes

Fixes a code mixup by which the Tanium Server would run its packages cleaner twice.
Fixes an omission in the Tanium Server question parser where the reserved word "entities" was not quoted when it does not refer to a Tanium Entity.
Fixes an issue in PKI management that kept in-memory references to old and revoked certificates.
Fixes an omission in the Tanium Server packages API where the recently added description field was not serialized on output.
Fixes a refactoring omission that causes the Tanium Downloader to ignore its proxy settings.
Fixes a failing ringSetDefinition assertion in the Tanium Server question API which would impair question evaluation of some targets after ring-set definitions were deleted.

Tanium Cloud Release Date: November 3, 2025

Highlights

- Implements direct download throttles for US based tenants.

Tanium Cloud Release Date: October 22, 2025

Bug Fixes

Fixes a problem where pre-v7.8 Tanium Clients will attempt but fail to download files from CDN outside US regions. This fix is implemented as a server-side change to avoid the need to upgrade all non-US clients.
Fixes an issue in the Tanium Server where it would fail to interpret download file sizes as 64-bit integers, impacting the handling of files larger than 4 gigabytes.

Tanium Cloud Release Date: October 21, 2025

New Features

Tanium Platform components now ship with Python v3.12.12.
Adds a new RBAC privilege to the Tanium Server to control access for entity providers.

Bug Fixes

Tanium Platform components now ship with OpenSSL v3.5.4.
Tanium Platform components now ship with libExpat v2.7.3.
Fixes an issue in the Tanium Server where it would fail to interpret download file sizes as 64-bit integers, impacting the handling of files larger than 4 gigabytes.
Fixes the Tanium Server RBAC preview-privileges API which would return an incomplete list of provided privileges.
Fixes a problem in the Tanium Client handling of version compatibility levels which would keep some client versions from peering and increased the leader count in some deployments.
Fixes an issue that prevented a Content Set from being deleted if a Preview Sensor had used that Content Set.

Tanium Cloud Release Date: October 8, 2025

Bug Fixes

Fixes an issue in the Tanium Client handling of version compatibility levels which would keep some Client versions from peering and increased the leader count in some deployments.
Fixes an issue that prevented a Content Set from being deleted if a Preview Sensor had used that Content Set.
Fixes an issue that resulted in the RBAC Preview API only returning the first providing privilege.
Fixes an issue that sometimes caused version 7.8 clients to stop responding when downloading files larger than 4GB.

Tanium Cloud Release Date: October 1, 2025

New Features

Adds an external_flag to the user groups API on the Tanium Server to allow the console to display when a user group is created locally or by an LDAP or SCIM integration.

Bug Fixes

Removes the DNS subject alternative name from issued certificates to avoid the problem of non-ASCII hostnames causing these certificates to be deemed as invalid by security tools.
Fixes the Tanium Server preview_content_set_role_detailed API which would incorrectly return "implied_by"="unknown" for implied permissions created by installed module solutions.

Tanium Cloud Release Date: September 19, 2025

Bug Fixes

Fixes an issue in the Tanium Server which could result in the bypass action approval permission being removed from customized service account.

Tanium Cloud Release Date: September 16, 2025

Bug Fixes

Fixes an issue in the Tanium Server where asking entity questions with a filter, such as all entities with Entity Type equals Mobile Device, might return no results.

Tanium Cloud Release Date: September 10, 2025

Highlights

Initial support to allow Endpoint Expansion Operational Technologies integrations.

New Features

Implements the allowed_entity_provider_endpoints API in the Tanium Server which will be used to manage which CIDv2 endpoints are allowed to act as operational technology entity providers.
Adds a "depth" optional option to the Tanium Server group API that allows the caller to define how many levels of sub-groups should be returned in the response.
The Tanium Server now implements an API through which solution modules can update sensor result information on behalf of operational technology entities, allowing solutions like Comply to calculate and update vulnerability information for OT entities.
Adds the enable_ai_ask_bar and enable_ai_ask_agents server global settings to control AI capabilities.

Improvements

The Tanium Server now offers detailed logging for errors encountered when decompressing incoming messages instead of just logging: "Failed to decompress report batch".
Extends the Tanium Server user_group and user API routes to allow the assignment or removal of an individual user to a group.
Refactors the way in which the Tanium Server refreshes its active/ active servers list to avoid doing input-output operations on an asynchronous processing thread.
Modifies the database recorded contents for audit_type=5 records created by the Tanium Server.

Bug Fixes

Fixes a problem with the encrypted_message_queue_batch_received_size_total metric emitted by Platform which displayed more than one "type" label.
Fixes an issue with status syncing between Tanium Server and Tanium Zone Server occurring more often than required.
Fixes the handling of metadata for actions created by the Tanium Server.
Fixes an issue in the Tanium Server where the removal of download files which are no longer referenced could take a long time, stalling the normal cleanup of the download catalog.
Fixes an unhandled exception in the Tanium Server when decompressing incoming messages, making sure they are properly tallied as communication failures.

Tanium Cloud Release Date: September 9, 2025

Bug Fixes

Fixes an issue with resource scaling and override permanence for adjusted resources.

Tanium Cloud Release Date: August 28, 2025

Bug Fixes

Fixes an issue with status syncing between Tanium Server and Tanium Zone Server occurring more often than required.

Tanium Cloud Release Date: August 25, 2025

Bug Fixes

Adds a mechanism to the Tanium Server which allows it to repair problems with package files which were considered to be cached on the server but their data was incorrect and could not be downloaded by clients.
Fixes an issue in the Tanium Server where trying to make modifications to SCIM-defined groups would fail with "InsufficientPrivilegesException: Cannot update scim controlled properties" if the group had previously deleted users.

Tanium Cloud Release Date: August 15, 2025

Bug Fixes

Fixes the number of threads that the Tanium Server created to upload files to CPMS which did not honor the cpms_upload_threads setting.
Fixes an issue that could result in duplicate SUS users existing in the users table.
Fixes an issue that could result in action ring configurations being removed from actions when action approval is enabled.
Fixes an issue with database upgrades when files in packages have invalid hash values.
Fixes an issue where the Tanium Module Server's list of Tanium Servers could become empty.

Tanium Cloud Release Date: August 8, 2025

Bug Fixes

Fixes an issue which could have prevented modifications to computer group assignments on user groups in some cases.
Fixes an issue that could result in slower package file processing and CDN distribution.

Tanium Cloud Release Date: August 6, 2025

Bug Fixes

Fixes an issue with seeding files if file processing is interrupted by a service restart.

Tanium Cloud Release Date: July 29, 2025

Bug Fixes

Fixes an issue on database upgrade that could result in an invalid download identifier.

Tanium Cloud Release Date: July 28, 2025

Improvements

Improves performance of provider entity questions when no entity provider is configured.

Tanium Cloud Release Date: July 24, 2025

Bug Fixes

This release includes updates for internal code dependencies to improve the general stability.

Tanium Cloud Release Date: July 22, 2025

Improvements

Platform components now ship with OpenSSL v3.5.1.

Bug Fixes

Fixes a GroupNotFound error in the Tanium Server question API when filter or target groups used group IDs with a value of zero.

Tanium Cloud Release Date: July 17, 2025

Bug Fixes

Fixes a file handle leak in the Tanium Server associated with its file chunk handler.

Tanium Cloud Release Date: July 15, 2025

Highlights

The Tanium Server now implements CDN / CPMS protocol version 2, allowing for global usage of CDN Downloads for all customers.
The Tanium Server now implements many of the functions of the System User Service, allowing migration of modules from usage of SUS to native Platform functionality.
The Tanium Server now implements foundational improvements for upcoming support of additional endpoint types.
Tanium will no longer allow changes to user memberships of groups managed by an Identity Provider via the SCIM protocol. All user membership to SCIM-managed groups should be performed at the Identity Provider.

New Features

Adds the ability to request batches of user IDs from the Tanium Server users API.
The Tanium Server will now keep an audit record of changes to sensor implementations.
The Tanium Server session/current API will now return the time of expiration for the API token being used for the request.
Upon installation the Tanium Module Server will generate new System User Service root keys if none exist yet.
The Tanium Server users API will not allow modifications of system user accounts.
The Tanium Server now disallows changing the names of the "Reserved", "Default" and "Default Filter Groups" content sets.
The Tanium Server now supports proxying http2 requests to the Module Server gRPC API.
The Tanium Server API will route gRPC requests according to the package name in the service requested and directly handle requests labeled with tanium_server.
Adds support for ZIP file splitting and recombination to the TaniumExtractor command line utility.

Improvements

Modifies the Tanium Server action API to ensure that timestamped fields display a UTC timezone format.
The maximum backoff value for the Tanium Server to retry repeated file downloads has been changed from 12 hours to 4 hours in order to improve the chances of a successful downloads for URLs which fail often.
The Tanium Server now allows SCIM-sourced users and groups to be matched to already existing local users instead of deleting them, which had ownership consequences over existing content objects.
The Tanium Server now supports a different hashing algorithm to identify package file chunks as well as a larger size for them for increased download efficiency.
The Tanium Server output for group audit records will now include information about the type of each group reported as "Computer Group", "Filter Group" or "Managements Right Group".
The Tanium Server will no longer allow registering duplicate whitelisted URLs.
The Tanium Server changes the database persistence of non-counting questions to use the force_computer_id_flag instead of adding an empty select specification to them.
TDownloader will now log information about the certificate chosen for authentication when downloading a URL that uses this configuration. This helps troubleshoot client-side-certificate configurations.
Improves the performance of the Tanium Server download catalog cleaner which could keep Packages in a "Pending" state while it was running.
Adds a safeguard to the Tanium Server APIs to detect the incorrect uppercase use of "ID" and "NAME" elements in target_group, preventing the undesired behavior of targeting all computers.
The TDownloader utility now calculates the file hash of a downloaded file while it is streaming, which is more efficient than doing it from its contents on disk after the download.
The Tanium Server groups API now supports using the "summary" option which will return a select set of properties for each group instead of their full definition.
The Tanium Server APIs now disallow modifications to deleted objects that do not support being un-deleted.
The Tanium Server will now issue a log a message in its authentication log when an API token is used from a non-authorized IP address source as dictated by the token's configuration settings.
Adds role names to content set audit records emitted by the Tanium Server, making these records easier to interpret.
Ensures that newer Tanium Clients do not peer with older incompatible versions which cannot handle the new chunk request scheme.
The Tanium Server now queues incoming client challenge requests into batches for more efficient processing.
Ensures that platform privileges cannot be deleted, since the correct operation of the Tanium Server and solution modules depend on them.
The Tanium Server now offers an API route to retrieve persona objects by their name.
Implements deletion of users as directed by an XML uninstall manifest imported to the Tanium Server.
Ensures that mTLS API requests to the Tanium Server are only allowed to access the auth REST route and are otherwise used exclusively for gRPC module requests.
The Tanium Server APIs now return an expiration value for the session identifier which made the request.
Adds SPIFFE ids support in System User Service mTLS certificates issued by the Tanium Server.
The Tanium Server will internally look up System User Service users by their SPIFFE id.
Augments the Tanium Server users and user_groups API routes to return their SCIM-related properties.
The DELETE operation on the Tanium Server scim_servers API now accepts an "unlink_objects" field which controls whether associated user and group records should also be removed.
Implements sequence number tracking in Tanium Server active/ active synchronization messages, allowing for a non-lossy exchange of data between servers.
The Tanium Server will no longer allow HTTP PATCH requests on SCIM managed groups except by the associated scim_user_id. This is to avoid changes which are requested by any other than the SCIM provider itself.
Reinstates issuing download_identifier response data in the Tanium Server packages API, because some solution modules still use that value for package files.
Improves the handling of exceptions when the Tanium Server receives malformed certificate signing requests.
Adds question scope information to the Tanium Server export API.
The Tanium Server now includes computer IDs when emitting counting question results to allow a better user experience in Console when querying all entities.
Add the default_scope field to the Tanium Server question parser which allows parsing requests to specify if the query is applicable to "all machines" or to "all entities".
Tanium Platform components now ship with OpenSSL v3.4.1.
Tanium Platform components now ship with Python v3.12.11.
Updates the OpenSSL FIPS version used in platform components to v3.1.2.

Bug Fixes

The Tanium Server action API will now return an HTTP-400 response when the request values cannot be parsed correctly.
Fixes an omission in the Tanium Server content sets API where it would not apply requested cache filters correctly.
The Tanium Server now validates that all sensor references in a solution import either already exist or are defined within the solution itself.
Fixes the omission of a text description in the saved action audit records emitted by the Tanium Server.
Fixes missing data from the permissions array in the Tanium Server session/current API responses.
Fixes an omission in the Tanium Server question API where metadata cannot be added to saved questions.
Fixes a problem in the Tanium Server where creating actions with a parametrized package would have some missing source package verification parameters.
Fixes an omission of content membership audit records generated by the Tanium Server when changes were made as part of user management requests.
Fixes an omission of content membership audit records generated by the Tanium Server when changes were made as part of user group management requests.
Fixes a problem in the Tanium Server's instantiation of questions with parametrized sensors which would result in the error message: "IDDoesNotMatchSourceID".
Fixes the handling of unexpected exceptions in the Tanium Server scheduled actions processing which could cause that subsystem to halt its processing.
Fixes an issue where the Tanium Server would interpret question text using a "not" modifier as "All Computers".
Fixes an issue in the Tanium Server that would cause data services harvest failures while logging the message: assertion failed: no hashes for computer id.

Tanium Cloud Release Date: June 26, 2025

Improvements

Adjusted response headers to align with current security postures.

Tanium Cloud Release Date: June 23, 2025

Bug Fixes

Fixes an issue with availability when file system corruption is encountered.

Tanium Cloud Release Date: June 18, 2025

Bug Fixes

Corrected the management of DNS names on instance update.

Tanium Cloud Release Date: June 10, 2025

Improvements

Updates the privileges required to invoke the api/v2/pki_ca_bundle route of the Tanium Server API to allow user-facing components to retrieve this information.

Tanium Cloud Release Date: May 28, 2025

Improvements

Improved the internal routing of alerts.

Tanium Cloud Release Date: May 20, 2025

Bug Fixes

Fixes an issue in the Tanium Server API where trying to add a previously deleted setting results in an HTTP-500 internal server error.
Fixes an issue where the Tanium Server SCIM API returned Content-Length headers with HTTP-204 and HTTP-1xx responses, which was incorrect and caused issues with the Entra ID provider.

Tanium Cloud Release Date: May 8, 2025

Improvements

Improved the load balancing configuration for client connections.

Bug Fixes

Corrected a problem preventing some files from being available for download via CDN.

Tanium Cloud Release Date: May 1, 2025

Improvements

Updates platform components to use libexpat v2.7.0.

Bug Fixes

Fixes an issue in the Tanium Server API where a computer group which was once assigned to a ring set cannot be deleted unless the ring set is also deleted.

Tanium Cloud Release Date: March 25, 2025

Improvements

Implements improvements in the handling of license entitlements.

Bug Fixes

Fixes an issue where changes made through the Tanium Server global settings API are not reflected accurately for external systems and impact the Tanium Console.

Tanium Cloud Release Date: March 19, 2025

New Features

Tanium Platform components have removed support for HTTP h2c which has never been widely adopted.
Implements a new connection type in the Tanium Server and Zone Server to handle CXSocket communications.
Adds CXSocket streams to client registrar snapshots exchanged between the Tanium Servers and Zone Servers.
Implements the needed PKI extensions in the Tanium Server to issue the certificates that solution modules will use to communicate through CXSocket connections.
The Tanium Server now skips certificate revocation list (CRL) distribution points with non HTTP or HTTPS services, which avoids download and authentication failures that occur when LDAP CRL distribution points are configured into a certificate.
Access is now guaranteed to the filter group definitions referenced by a ring set in the Tanium Server API. This allows a user to view the full ring set configuration even when they do not have RBAC access to those groups.
Includes root and intermediary certificates in a gRPC CXSocket request for the validation of connection endpoints.
Adds a throttle for the new CXSocket feature in Platform.
Implements CXSocket end to end encryption to guarantee privacy between module solutions and client extensions over a communications socket.
The Tanium Server can now be configured to generate new root keys every 365 days and offers a 14 days delay period before revoking the old ones. Automatic rotation is disabled by default.

Improvements

Improves the Tanium Server performance in calculating snapshots of new information transmitted out to Zone Server Hubs.
Adds the new upload_file_stream_chunked file chunked uploading to the Tanium Server to support uploading large files to environments with request size limitations.
Implements the necessary Tanium Server communications to synchronize CXSocket requests.
Implements the necessary communications between the Tanium Server and Zone Servers to establish CXSocket connections.
Changes the identification of installed solutions in the Tanium Server to be keyed by ID instead of name.
Tanium Components now ship with Python v3.12.8.
The Tanium Server API now returns the Zone Server address and port used to create a CXSocket connection to a Tanium Client.
Implements the handling of CXSockets between active-active Tanium Servers, both creation and cleanup.
Enables Tanium Client to Tanium Server CXSocket connections.
Leverages protocol v315 keep alive messages in CXSocket communications as a means of detecting and dealing with idle timeouts.
Allows new connections to be initiated over an HTTP request after one of the multiplexed connections in the pool is shutdown.
Adds timeout controls to CXSocket connection requests.
Groups CXSocket connections by computer ID and socket ID to avoid interactions between connections from different clients.
Avoids recalculating hashes for Zone Server synchronization caches when their contents have not changed, reducing CPU resources on the Tanium Server and improving performance.
Tanium Platform components now ship with v5.6.4 versions of the xz library.
The Tanium Server settings API will now reject create operations on global settings that have the read-only flag set.

Bug Fixes

Fixes an omission in the Tanium Server packages API that failed to honor the exit code criteria defined in a request.
Fixes an issue with the way the Tanium Server generates question text through the build_question_text API that prevented the generated output from being parsed again. This issue occurred for some negated ("not") filter conditions.
Fixes an issue in the Tanium Server where an HTTP2 RST_STREAM on a CXSocket request shut down the entire communications channel.
Fixes an issue in the Tanium Server question parser API where the Server returned a HTTP-500 error when the size of the text to be parsed exceeded parser_max_word_count. Now the server returns a properly worded HTTP-400 response code.

Tanium Cloud Release Date: March 18, 2025

Bug Fixes

Fixes an issue in the Tanium Server where failures to acquire CPMS access tokens would block the package file download queue, resulting in files that failed to cache.

Tanium Cloud Release Date: March 12, 2025

Bug Fixes

Fixes an issue where the CDN Downloads setting might have been read-only.
Fixes a network communication issue that could cause high CPU load until a server restart.

Tanium Cloud Release Date: March 5, 2025

Bug Fixes

Fixes an issue that prevented websockets from working correctly in the console.

Tanium Cloud Release Date: February 19, 2025

Improvements

Improves the behavior of the Tanium Server ring API to disallow names that differ from each other just by leading or trailing whitespace, which makes the user interface display confusing.
Tanium Platform components now ship with Python v3.12.9.
Tanium Platform components now ship with OpenSSL v3.2.4.
Tanium Platform components now ship with curl v8.12.0.

Bug Fixes

Fixes an omission in the Tanium Server evaluation of exit_code_criteria in XML package imports.
Fixes some minor thread-safety details in the Tanium Server code.

Tanium Cloud Release Date: February 3, 2025

Bug Fixes

Fixes a problem in the Tanium Server where when a Tanium Cloud license expired it would no longer honor access calculations, producing failures in some Tanium Cloud operations.

Tanium Cloud Release Date: January 28, 2025

Improvements

Introduces a new API for Cloud customers for retrieving a Tanium Client protocol CA bundle.

Bug Fixes

Fixes an intermittent issue properly handling action status messages.

Tanium Cloud Release Date: January 15, 2025

New Features

The CDN Download option has been changed from an On/Off to an Opt-in/Opt-out/Please Choose three way option parameter.
The Tanium Server will now limit sensor descriptions to 16KB.
Tanium Server components now offer a tanium_uptime_seconds metric.
Implements a gRPC route in the Tanium Server to initiate a new CXSocket connection to an endpoint, as a component for the Tanium Platform supported forms of Direct Connect and other features.
Implements cleaning of old and no longer referenced ring set data in the Tanium Server database.

Improvements

SAML support in the Tanium Server now allows X509IssuerSerial for specifying the proper decryption certificate in message signatures, which previously would result in a "SAML authentication failed: XMLDecryptionException: XML Decryption failed. Couldn't find key to decrypt element" error.
Tanium Platform components have dropped support for RSA signatures in its messaging protocol.
The Tanium Server API now returns an proper message when requesting to preview a ring set without specifying its content set, instead of the generic "RBACInsufficientPrivilege".
The Tanium Server will now generate CSR requests with 3072-bit keys to be consistent with the key sizes used for self-signed SOAP certificates on first installation.
The the Tanium Server API will now return sensor names in requests to the sensor version API.
Reduces the cardinality of metrics issued by the Tanium Server for static file requests by bundling all such requests into a single histogram.
The Tanium Server will now include a user ID when responding with an HTTP-404 to membership updates for groups or users which no longer exist in the system.
The Tanium Server will now remove unused management rights composite groups from its database and re-create them when needed, as to reduce the amount of data returned when querying the groups API.
Adds support for the use of EncryptedKey decryption of SAML payloads in the Tanium Server, which would otherwise would fail authentication when enabling IdP token encryption with the error message: "Unknonw KeyInfo type EncryptedKey is not handled".
Changes the default value of the Tanium Server SOAPActionHistoryLimitInDays to 90 instead of 30.
Changes the retention of action statuses in the Tanium Server from 90 to 100 days.
Tanium Platform components now ship with Curl v8.11.0.
Tanium Platform components now ship with libexpat v2.6.4.

Bug Fixes

Fixes an issue in the handling of single-use requests as used for export operations where request parameters were not being passed along to streaming handlers. This would impair the new streaming versions of action and question API requests.
Fixes a condition in the Tanium Server where multiple concurrent requests to create a question could result in an HTTP-500 error accompanied by the logged error: "SQL Exception: duplicate key value violates unique constraint: select_filter_hash_index".
Fixes an issue in the Tanium Server RBAC settings where administrator users were associated with the "All Computers" group access instead of the correct "unrestricted management rights" setting.
Fixes an issue where requesting the creation of a plugin schedule could fail for newly installed Module Server plugins not yet detected by the Tanium Server. This could cause failures during automated new installations.
Changes the internal implementation of the Tanium Zone Server asynchronous work queues to force its callers to handle any exceptions generated and avoiding the uncaught error: "Thread exited with exception: Async scheduled work queue full", which would stop processing in the server.
Fixes a problem in the Tanium Server where it would not tally v7.4 endpoints when asking questions of the form: "Get number of machines".
Fixes an omission in the Tanium Server SAML requests where their signatures should be compressed using the deflate method to avoid an authorization failure with the message "The signature of the received authentication request is invalid".
Fixes an issue in the Tanium Server question parser where it would allow "any" and "all" filter expressions in the left select portion of a question's text, which do not correctly represent the way in which results are filtered.

Tanium Cloud Release Date: January 9, 2025

Bug Fixes

Fixes an issue with new Tanium environment creation for deployments.
Fixes an issue with API access to certain environments.

Tanium Cloud Release Date: November 16, 2024

Bug Fixes

Fixes an intermittent issue caching packages on the Tanium Server.
Fixes an issue where the "Numbers of Machines" question would not return a count from 7.4 Tanium Clients.
Fixes an issue where the "build_question_text" API did not handle select-side filters with parameterized sensors correctly.

Tanium Cloud Release Date: November 13, 2024

Improvements

Introduces miscellaneous improvements in support of the latest Tanium Console version.

Tanium Cloud Release Date: October 31, 2024

Bug Fixes

Fixes an intermittent issue during shutdown in the Tanium Server.
Fixes a possible interruption in service in the Tanium Zone Server associated with the message "ignoring request because too many are pending".

Tanium Cloud Release Date: October 15, 2024

Highlights

This version of the Tanium Server introduces new mechanisms to manage ComputerID assignments to compatible v7.7 clients.
The Tanium Server now supports the concept of Ring Sets to support future Autonomous Actions.

New Features

The Tanium Server now implements a cell_row_count API option that limits the maximum number of rows returned for result cells, allowing the caller to limit the amount of data returned when there is a large number of results in each cell.
The Tanium Server API now supports a description field for computer groups.
The Tanium Server will now respond with an HTTP-400: Bad Request when a question is asked using a column filter on a sensor that uses multi-character column delimiters. This is not supported.
Adds support for HMAC key derivation (HKDF) for client identity keys.
Adds support for Diffie-Hellman elliptic curve (ECDH) shared secret derivation as a means for the Tanium Server and Client to exchange client identity keys.
Adds support for AES-GCM-128 as a faster and yet sufficiently strong encryption mode.
The Tanium Server APIs will now refuse to delete a non-empty content set, whereas this was only enforced in the Tanium Console UI.
Adds export and import support in the Tanium Server API for ring sets and the new saved action ring properties.
Implements protections in the Tanium Server API to deny modification of sensors that are labeled as Tanium-provided content. This is to allow users to modify their own content but not change those provided by Tanium.
Adds support for both encrypted and non-encrypted CDN token requests to the Tanium Server.
Adds encryption support for CDN files.
The Tanium Server now implements a ring_set_instances/preview to support the preview of ring deployment plans UI in the Tanium Console.
Offers new question result processing metrics in the Tanium Server: report_message_queue_bytes, question_report_batch_received_size, question_legacy_question_reports_received and question_legacy_string_reports_received.
The self-signed certificates that Tanium components generate on installation will now only be valid for a period of one year. This is done to comply with CSPN certification requirements.

Improvements

Offers additional logging details on RBAC permissions failures when the Tanium Server rejects the deployment of a package due to a missing write action privilege.
Introduces a Tanium Server sequencing counter for active/ active pair messages about incoming Tanium Client registrations in order to support next-generation ComputerID assignments.
Adds support for 64-bit integer values in the application configuration interfaces.
The package_file Tanium Server API endpoint will now also display the cached status for the file.
Implements periodic cleanup of old and unused sensor definitions in the Tanium Server database.
Generalizes the error text returned by the Tanium Server API when attempting to create a filter or computer group with a duplicate name. Instead of reading "a computer group with that name already exists" it will simply read "a group with that name already exists".
The Tanium Server will now return an HTTP-400: Bad Request status when it fails to parse the request Tanium-Options header instead of failing with an HTTP-500 status.
Refactors the English language question parser in the Tanium Server to utilize the same back-end data models as those that underpin the API services.
Changes the behavior of the Tanium Server API when trying to change the type of a default system setting, which now returns a proper exception and message instead of an HTTP-500 error status.
Implements the migration mapping from legacy computer IDs to new ones when a Tanium Client is upgraded, allowing the Tanium Server to map the old ID to the new one along with its associated data.
Embeds the ComputerIDv2 into newly issued client certificates as a means to support for the computer ID proof workflow.
Implements the key-exchange mechanism between Tanium Server and Client which will be used for ComputerIDv2 issuance and eventually question result encryption.
Implements an additional connection state to handle ComputerIDv2 proof and issue workflows, which allows PKI synchronization before computer ID workflows begin.
Adds a new EncryptedMessage communications type which will be used the client identity key to encode its payload.
Adds support to specify ring and ring set instance when creating an action in the Tanium Server API.
The Tanium Server will now include ring group filter criteria when issuing actions for backward compatibility with older clients that are not ring-aware.
Adds the necessary privileges for RBAC control in the Tanium Server API for rings.
Extends the Tanium Server action history API to allow filtering by ring set elements.
Ensures the de-duplication and re-use of ring set definitions in the Tanium Server, given the fact that these definitions are immutable.
The Tanium Server now ensures user IDs that are not just unique but also distinct from group IDs to ensure compatibility with some SCIM providers.
The Tanium Server now saves its cached files chunk maps all into a single file, instead of multi-level map files, as to have all of this information available in a single data file.
Ensures that the Tanium Server only looks up sensor definitions once when parsing groups. This avoids repeated look-ups for the same element for groups that contain many similar references.
Randomizes the garbage collection of the different sensor caches within the Tanium Server to reduce the performance impact of processing all of them at the same time.
Randomizes the interval at which the Tanium Server serializes and persists sensor cache results to spread out the performance impact of processing all of them at the same time.
The Tanium Server will no longer deliver a ServerHash message to clients unless a sensor super-hash, epoch or client settings hashes have changed in the system, thus conserving egress bandwidth.
Improves the handling of critical sections in code through the use of SRW locks (Slim Read/ Writer locks).
Reduces the CPU processing overhead in Zone Servers when servicing file chunk requests.
Removes the creation of a new results snapshot every time the Tanium Server processes a batch of results, delaying this process until results are requested.
Refactors the use of socket address structures to allow for the storage and handling of different size AF_UNIX representations.
The Tanium Server content set privileges API will now omit privilege assignments that reference previously deleted content sets, roles or privileges, which on systems with many changes would generate rather large response results.
The Tanium Server API now disallows the creation of ring sets that do not contain any ring definitions in them.
Improves the execution performance in querying the groups and sub-groups tables in the Tanium Server database.
Improves TLS performance by reducing contention in OpenSSL objects during execution.
Improves the execution performance in calculating public key fingerprints.
Tanium components have improved their handling of operations on overly busy SQLite databases.
Benchmarks and improves the performance of the encryption and decryption of question result strings.
Improves the handling of HTTP HEAD requests which under certain conditions could cause the Tanium Server to spike its CPU utilization.
Enables the pipeline processing of incoming question results in the Tanium Server, allowing the processing separate report batches in parallel.
Tanium Platform now use 3072-bit keys to secure sensitive information shared between Tanium Servers in an active/ active configuration, such as LDAP connector passwords.
Tidies up the threaded handling of OpenSSL contexts within the Tanium Server to avoid they are left behind as orphaned objects.
Reduces the processing requirements in the Tanium Server when creating sensor result snapshots.
Improves the logging of the Tanium Server and Module Server when module connections time out by displaying the configured timeout values in the system.
Updates the application configuration API to support 64-bit integers as part of the implementation of the new Computer IDv2.
Allows Tanium components CLI "config" values to hold 64-bit numbers.
Changes the implementation of the Tanium Server /metrics route to report system status data from an already existing internal snapshot, which should reduce the request time at very large scales.
Improves the Tanium Server interaction with its database by optimizing one of its SQL queries against the generally large groups table.
Adds support for long URL paths in Tanium Server requests.
Reduces copying operations within the Tanium Server while handling long UNC file paths.
Tanium components now ship with curl v8.10.1.
Tanium components now ship with libexpat v2.6.3.
Tanium components now ship with llhttp v6.1.1.
Tanium components now ship with OpenLDAP v2.5.17.
Tanium components now ship with OpenSSL v3.2.3.
Tanium components now ship with Python v3.12.7.
Tanium components now ship with zlib v1.3.1.

Bug Fixes

Fixes an incorrect application of the cache_filters API option in the Tanium Server when the filter contained sub_filters.
The Tanium Server now trusts API tokens which are used from any one if its configured IP addresses, avoiding the need to configure this manually in all-in-one deployments.
Fixes an issue where the Tanium Server would emit a response body to incoming HEAD requests.
Fixes a problem in the Tanium Server API where action groups with visibility restricted to a user group will fail to load when the user group is deleted.
Improves the handling of user principal name (UPN) format usernames on the Tanium Server.
Fixes an omission when handling queued HTTP downloads that when cancelled were not removed from the queue until they timed out.
Fixes a problem in the Tanium Server where trying to remove the "Deny All" RBAC permission from a user group would produce the error: Only administrators can manage administrator privileges.
Fixes a defect where the Tanium Server CLI would reference Backup/pki.db instead of Backup/pki-backup.db.
Fixes an omission where the seconds_since_issued element in the Tanium Server GetResultInfo and GetResultData always had a zero value.
Fixes a condition in Tanium components communications where a process could spin and consume higher amounts of CPU when a TLS negotiation was terminated abnormally.
Fixes an issue in the Tanium Server APIs where objects assigned to a content set that was deleted would not be returned in requests expected to return all objects.
Fixes an issue where the Tanium Server would in some occasions change the order of the sensors when re-issuing a saved question.
Fixes an issue in the Tanium Server RBAC API where requesting a content set role by name would return ContentSetRoleNotFound when there exists any deleted role with the same name.
Fixes a change in the Tanium Server question results behavior where sensors with a large number of result rows will display "[no data]" instead of partial data followed by "[too many results]" which is the expected output.
Fixes an omission in the Content-Type response header for the session/login API on the Tanium Server.
Fixes a condition in the Tanium Server API where ring sets created successfully but without any ring assignments count not be read back, even though the API has changed to disallow empty ring sets.
Fixes an issue where the Tanium Server may stop processing package files and downloads when disable_client_cdn_downloads is enabled (set to '1') while running.
Improves the performance of public key parsing in the OpenSSL v3 implementation.
Fixes an issue with the Tanium Server where, in the unlikely event that two package files shared a common chunk hash, the files would fail to download to endpoints until the Tanium Server service was restarted.
Fixes an issue in the Tanium Server which would cause changes to content set roles to appear reflected in API results after a delay of almost a minute.
Fixes an issue where deleting a temporary sensor and then re-importing its exact same definition would cause RBAC failures in the newly imported copy.
Fixes a misspelling of the word "received" in log0.txt.
Fixes an internal mechanism inside the Tanium Server which delays some API responses and could lead to a "thread pool too busy" condition, impairing all incoming requests.
Fixes a condition in the Zone Server Hub process where it could crash during shutdown.
Fixes a problem in the Tanium Server SP-initiated authentication when SAML is configured with with 3072-bit RSA keys.
Fixes a "use after free" reference in gRPC requests in the Tanium Server which could result in a process crash.

Tanium Cloud Release Date: October 1, 2024

New Features

The self-signed certificates that Tanium components generate on installation will now be valid for a period of only one year. This is done to comply with CSPN certification requirements.

Improvements

Tanium components now ship with libexpat v2.6.3.
Tanium components now ship with curl v8.10.1 libraries.
Tanium components now ship with zlib v1.3.1.
Tanium components now ship with OpenSSL v3.2.3.
Tanium components have improved handling of operations on busy SQLite databases.

Bug Fixes

Fixes an internal mechanism inside the Tanium Server which delays some API responses and could lead to a "thread pool too busy" condition, impairing all incoming requests.
Fixes a problem in the Tanium Server SP-initiated authentication when SAML is configured with with 3072-bit RSA keys.

Tanium Cloud Release Date: September 12, 2024

Improvements

Tanium components now ship with OpenSSL v1.0.2zk and v3.2.3.

Tanium Cloud Release Date: September 9, 2024

Bug Fixes

Fixes an issue where the Tanium Server would in some occasions change the order of the sensors when re-issuing a saved question.

Tanium Cloud Release Date: August 6, 2024

Bug Fixes

Fixes a problem in the Tanium Server where running the "clean-downloads" CLI operation could corrupt the state of the Downloads/Cache/Catalog file if the server was up and running. This is resolved by the use of a SQLite database instead of a flat file to store this information.

Tanium Cloud Release Date: July 24, 2024

Improvements

Tanium components now ship with zlib v1.3.1.
Tanium components now ship with curl v8.8.0 libraries.
Reduces the processing requirements in the Tanium Server when creating sensor result snapshots.
Enables the pipeline processing of incoming question results in the Tanium Server, allowing the processing separate report batches in parallel.

Tanium Cloud Release Date: July 22, 2024

Improvements

Tanium components improve their handling of operations on overly busy SQLite databases.

Bug Fixes

Fixes an issue with the Tanium Server where, in the unlikely event that two package files shared a common chunk hash, the fails would fail to download to endpoints until the Tanium Server service was restarted.

Tanium Cloud Release Date: July 9, 2024

Improvements

Upgrades OpenSSL and its dependencies to v3.2.2.
Improves TLS performance by reducing contention in OpenSSL objects during execution.

Bug Fixes

Tanium Components now ship with libexpat v2.6.2.
Improves the performance of public key parsing in the OpenSSL v3 implementation.
Fixes a problem in the Tanium Client where it would fail to honor proxy configurations when specified with an https:// prefix.
Fixes an omission in the Content-Type response header for the session/login API on the Tanium Server.
Adds the missing "read server host" privilege which would otherwise cause the System User Service to create the needed API tokens for modules and services.

Tanium Cloud Release Date: June 3, 2024

New Features

Adds encryption support for CDN files.
Adds support for both encrypted and non-encrypted CDN token requests to the Tanium Server.
Adds support for encrypted CDN file downloads to the Tanium Client.

Improvements

Upgrades Python to v3.8.19 in Tanium Platform components.

Bug Fixes

N/A

Tanium Cloud Release Date: May 13, 2024

New Features

The Tanium Client sensor-history log now presents sensor execution events in an all-JSON format and includes both the what_hash and definition_id for the sensor implementation used, in order to make the report information accurate.
The Tanium Zone Server Hub now implements a backoff strategy when it fails to connect to one or more Zone Servers, which would otherwise result in repeated attempts that would consume higher CPU resources.

Improvements

The Tanium Server will no longer send superfluous peering messages to v314 protocol clients. The RecvSetNetConfig messages with a port number of zero to inhibit peering will no longer be sent, which slightly reduces bandwidth and greatly reduces confusion in those reading the logs.

Bug Fixes

Fixes an issue in the Tanium Server global setting API where a POST operation would clear its public_read_flag.
Fixes a problem in the Tanium Server where separated subnets were not evaluated correctly and would instruct clients to peer beyond their AddressMask:/24 when using intentional subnet configurations.
Fixes a behavior in the Tanium Client where when communicating through proxy servers with uncommon CONNECT response behavior would cause high CPU consumption in the TaniumClient -c process. This condition happened when the proxy server would not offer a response to the connection request, which is unexpected.
Fixes an issue in the handling of question expiration and cleanup times in the Tanium Client which would cause a small increase in CPU utilization while waiting for the appropriate cleanup time.
Fixes a condition in Tanium components communications where a process could spin and consume higher amounts of CPU when a TLS negotiation was terminated abnormally.
Fixes a problem in HSM-enabled Tanium Server configurations that would result in a running server where accessing its Console would just display an "ERR_SSL_PROTOCOL_ERROR" and the server logs would show "ossl_x509_check_private_key:unknown key type" for the SOAPServer certificate in the system.

Tanium Cloud Release Date: April 24, 2024

Special Notes

Starting with the first release of the v7.6.2 Tanium Client, the SNI value in TLS ClientHello messages will contain the name or IP address of the ServerName being targeted for connection. Tanium Client communications in environments where SNI inspection is enabled, and where bespoke SNI values were whitelisted will have to be configured to allow for targets in ServerNameList to be allowed instead.
Updates the End User License Agreement (EULA) for Tanium Platform products to its latest 2024-05 version.

New Features

Tanium components now ship with FIPS-certified OpenSSL v3.
Adds client setting ClientMinTLSVersion with default value of "1.2".
Tanium protocol communications now uses the TLS v1.3 Certificate Authorities extension instead of the SNI indicator available in previous TLS implementations. This should benefit users who find it difficult to disable or manipulate the SNI inspection of their security software.
Updates the End User License Agreement (EULA) for Tanium Platform products to its latest 2024-05 version.
Brings back support and distribution of the runasuser.exe binary utility which is needed by some pieces of custom content.
The Tanium Client will now present a small sized message when requesting file chunks, to reduce the amount of upstream traffic in systems where the limit of download connections has been reached.
The TaniumExecWrapper.exe for Windows clients is now delivered as a signed binary.
Adds further details to the memory allocation statistics generated by the UseTBBAllocatorStats on the Tanium Server, to provide more granular visibility into duties and uses where memory is being consumed which would otherwise simply be marked as "Other" in previous versions.

Improvements

Changes the tanium_sensor_runtime_seconds metric in the Tanium Client to be presented as a histogram instead of a counter, offering more granular insights into these measures.
Changes the behavior of ranked-selection of servers in the Tanium Client, where now in a setting like "ServerNameList: 1_TSa,1_TSb,2_ZSa,2_ZSb,ZSc", TSa and TSb will still be given priority over ZSa and ZSb and the non-prefixed ZSc entry will have the lowest priority.
Renames the OpenSSL v3 libraries in the AIX Tanium Client to libssl-3.so and libcrypto-3.so to allow having both v1 and v3 libraries to be deployed.
Reduces the number of places where SHA hashes of keys are calculated by using their previously calculated fingerprints instead, improving code efficiency and performance.
Adds TLS Client Authentication and Server Authentication extended key usage values to all certificates generated.
Tanium components now disable SHA-1 and SHA-224 signature schemes in the TLS protocol.
The Tanium Client will now report back partial data when a sensor result it too large.
Adds hostname verification for the HTTPS connections that the Tanium Client makes for CDN downloads.
Improves the behavior of the Tanium Client when a CDN download connection is severed mid-request by allowing an immediate retry.
Tanium components now ship with OpenSSL v3.2.1 and v3.0.9 when using FIPS support.
Reduces the access rights requested by Tanium installers on Windows in order to minimize failures due to hardening on the operating system.
The Tanium Server now allows enabling its TBB allocator statistics by adding a file named UseTBBAllocatorStats in the server's main installation directory. This is in addition to using the setting of the same name as an environment variable but is easier to persist across upgrades.

Bug Fixes

Eliminates trimming from registry MULTI_SZ values to preserve data where whitespace is significant.
Fixes the handling of legitimate h2c connection closures.
The Tanium Client now registers all temporary sensors requested for evaluation by the extensions subsystems and treats them in the same way as client-initiated evaluations, to avoid extension group failures that would be logged with "Group evaluation failed. Sensor not found. Skipping item".
Improves the Tanium Client logging in log-script-child.txt when a Python sensor is executed from a process which does not have the client as a parent process, stating "Sensor child process has invalid parent" which is something that happens in Kubernetes environments when using Intel binaries on Apple silicon.
Fixes an issue where the Tanium Client would attempt to validate the signature of library files no longer available in the system, like OpenSSL v1, and cause failures to start.
Adds a missing fips.so library to the Tanium Client installer for AIX.
Increases the size of the number of sensors allowed to queue for evaluation between the extensions subsystem and the Tanium Client, to avoid running into the condition indicated by the "[client.sensors] Error: Maximum write queue reached" error.
Modified the handling of temporary sensor evaluations requested by the extensions subsystem to the Tanium Client, to avoid an elevated number of requests observed.
The Tanium Server implements the setting PeerReceiveTimeout2=30 for v7.6 clients and above, while keeping PeerReceiveTimeout=10 for the benefit of v7.2 clients which depend on peer keep-alive messages based on this shorter duration.
Fixes an issue in the Tanium Client where it would not update its known IP address when switching from one network to another, displaying its old address in client status and failing to update its own detected configuration settings.
Older OpenSSL1 binaries are no longer saved in the Tanium Client Backup directory on client upgrade.
Fixes an issue in the serialization of temporary sensor evaluation requests made by the extension framework to the Tanium Client. This issue could cause negative targeting errors for systems like Endpoint Configuration.
Adjusts the treatment of TLS v1.3 which are expected to be single-use and would cause extra handshakes and tickets created when not managed correctly.
Fixes an incorrect user ownership and permission settings on the fips.log file deployed by the Tanium Module Server installer which would result in the error "Failed to open file "/opt/Tanium/TaniumModuleServer/fips.log": EACCES: Permission denied" when upgrading a server running in FIPS-enabled mode.

Tanium Cloud Release Date: April 17, 2024

New Features

Tanium components now ship with FIPS-certified OpenSSL v3.
Tanium protocol communications now uses the TLS v1.3 Certificate Authorities extension instead of the SNI indicator available in previous TLS implementations. This should benefit users who find it difficult to disable or manipulate the SNI inspection of their security software.
The Tanium Server now implements a cell_row_count API option that limits the maximum number of rows returned for result cells, allowing the caller to limit the amount of data returned when there is a large number of results in each cell.
Adds support for a disabled_flag setting for user accounts in the Tanium Server, which can be set manually to enable or disable a user in the system.
The Tanium Server API now offers the deduplicate_by_name_flag option for system_status and unregistered_clients requests, which will then return a list of endpoints where their Computer Name as been de-duplicated.
Adds periodic cleanup of the Tanium Server client status cache in memory which previously would only be cleaned up during shutdown and startup.
The Tanium Server reverts the pre-v7.6 behavior of forcing client registrations of v7.4 and earlier clients to 1,000 per second and implements the new max_server_hash_messages_per_second=10,000 for newer clients.
The Tanium Server now offers the tanium_client_count_history_full metric to reflect the non-duplicated thirty day client count in a deployed system.
The Tanium Server adds the metric counters tanium_dropped_question_reports_total and tanium_dropped_string_reports_total to track dropped question and string reports.
The Tanium Server now enforces a maximum value of four hours for the max_console_idle_seconds setting.
Extends the build_target_group API in the Tanium Server to allow a filters specification which offers better control to the caller on the results that will be returned by the new filter.
The Tanium Server API will no longer reply with SQLException messages to the caller but will continue to log these exceptions for troubleshooting purposes.
The Tanium Server will now allow the auto-creation of users without an assigned user group instead of returning an error. This allows for these user accounts to effectively log into the system even if they have no assigned permissions.
The TaniumKeyUtility binary now honors systems running in FIPS mode, either by detecting the system configuration or using the --fips-mode command line option.
Deprecates the parametrized group API in the Tanium Server will which no longer honor the source_id property when creating a new group.
The Tanium Server and Module Server will now honor the TLSSessionDurationSeconds global setting that specifies the maximum session duration for a TLS connection.
The Tanium Server now offers metrics that reflect the number of TLS sessions it has established against the Module Server.

Improvements

Tanium components now ship with OpenSSL v3.2.1 and v3.0.9 when using FIPS support.
Improves the Tanium Server throttling API by validating the values allowed for bandwidth limits to adhere to positive integer values.
The Tanium Server will now generate a 3,072-bit key certificate for SOAPServer.crt by default, instead of 2,048-bits as it did in previous versions.
The Tanium Server reduces the latency in CDN downloads by batching CPMS access requests together.
Reduces the latency in processing CDN download requests at the Zone Server by transmitting them in batches up to the Tanium Server.
The Tanium Server will periodically log its progress when uploading files to CDN at LogVerbosityLevel=41.
Changes the management of the Tanium Server string retry queue to operate under a LIFO policy, given that newer hashes are easier and faster to resolve than older ones.
Changes the systemd unit file TimeoutStopSec=90 for the Tanium Server to avoid it being forcibly killed during shutdown.
The Tanium Server binary now offers an export-strings command line option which will export the contents of the new format strings file into a SQLite database for inspection.
Refactors the management of sensor string files in the Tanium Server to remove them not only when they are deleted but also when they have not been used and loaded into memory for a long time, as compared with their maximum age settings.
Implements the unloading of sensors from Tanium Server memory when they are deleted or have been idle and not referenced by the internal result cache.
Ensures that the process_cache_batch_threads setting on a Tanium Server is assigned a value equal to the number of CPU cores divided by eight, but never a value larger than eight.
The Tanium Server increases the size of allowable filter specifications to avoid the error "MaximumFilterSpecRegexLengthExceeded" when working with drill-down operations in the console that contain large amounts of data.
The Tanium Server now logs all SCIM errors at LogVerbosityLevel=1 and above to make it easier to troubleshoot failures without changing logging configurations.
Reduces the number of places where SHA hashes of keys are calculated by using their previously calculated fingerprints instead, improving code efficiency and performance.
Adds TLS Client Authentication and Server Authentication extended key usage values to all certificates generated.
Tanium components now disable SHA-1 and SHA-224 signature schemes in the TLS protocol.
Improves the logging of missing sensor definitions in the Tanium Server, where SensorNotFound log messages would not specify which saved questions were responsible for referencing them.
The Tanium Server will no longer automatically fall back on its FQDN when forming a SAML assertion consumer service (ACS) URL and instead log an exception, to make it patently clear this mapping is missing from the configuration.
The WorkbenchesManager plugin in the Tanium Server has been updated to only keep the latest thirty copies of workbenches_*.json.
The Tanium Server now merges "[too many results]" records received from v7.6 and legacy clients to present a unified count across the whole system.
Fixes a problem in the Tanium Server RBAC API when creating a role with access to all content sets would return an empty content_set_role_privileges list.
Removes the duplicate "tanium" word from the Tanium Server memory allocation metric names.

Bug Fixes

Fixes the handling of legitimate h2c connection closures.
Fixes a behavior in the Tanium Server where it would fail to cancel abandoned connections in its HTTP connection pool, and didn't release them until they completed their maximum number of retries.
Ensures that the current definition of a sensor is used by the Tanium Server when receiving question results, fixing the [RCU]] errors observed against v7.4 when changes to the "Ignore case in result values" for a sensor was modified.
The Tanium Server build_question_text and build_group_text APIs now support references to existing temporary sensors, in addition to the source sensors which have always been supported.
Fixes an issue where the Tanium Server would not report the X-Forwarded-Fox address of the requestor in its http-access logs.
Fixes an issue in the Tanium Server where in order to request action status a user needed the "read saved question" privilege over the Reserved content set or would otherwise receive an "Error creating and getting question" message in response.
Fixes an omission where the sensitive_data_flag in XML content imports to the Tanium Server was not being honored as expected.
Fixes an omission in the Tanium Server user API where the serialize_authorization_flag option would not be honored correctly when also requesting include_user_details=1.
Fixes a conflict in the Tanium Server during evaluation of RBAC privileges implied by solution module configurations.
Fixes an issue in the Tanium Server treatment of LDAP filters in synchronization connectors on Linux where filters like objectClass=user would work but (objectClass=user) would not work and result in a "Bad search filter" exception thrown.
Changes the handling of connection close logic to try and ensure all send data has been read from a socket before closing it, thus allowing termination TLS alerts to be received by the far end.
Fixes a problem in the content set roles API in the Tanium Server where the created and modified time and user id fields would return incorrect default values.

Tanium Cloud Release Date: March 19, 2024

Improvements

The Tanium Server will use an improved database auto-vacuum settings.

Tanium Cloud Release Date: March 14, 2024

Bug Fixes

Fixes an issue in the Tanium Server calculation and enforcement of site throttles where the full allotted bandwidth was not delivered as configured.

Tanium Cloud Release Date: March 7, 2024

Improvements

The Tanium Server will not duplicate entries in the database's computer_specs table anymore, reducing its size and improving performance for large numbers of manual computer groups.

Bug Fixes

Fixed an issue in the Tanium Server which would fail to create an auto-provisioned user account if one with the same name had existed before and then deleted.

Tanium Cloud Release Date: February 27, 2024

New Features

Updates the wording of the Tanium Platform EULA.

Improvements

Tanium Platform components now use Curl v8.5.0 libraries.
Upgrades Tanium components to use JsonCpp v1.9.5.
Platform components now ship with SQLite v3.45.1.
Tanium Platform components now ship with OpenSSL v1.0.2zj.
Platform components are now built with libExpat v2.6.0.
API requests to the Tanium Server now use internal cache structures instead of SQL queries to improve their response timing performance.

Bug Fixes

Fixes a dependency of Python v3.8 on SQL libraries which was missing and would result in the Tanium Client logging "sqlite3 - undefined symbol: sqlite3_errstr" and causing dependent operations like patching to fail on some Linux platforms.
Fixes an issue in the Tanium Client where a CDN download would revert to legacy chunk downloads when interrupted by the client reset schedule.
Fixed a condition where Tanium Clients reporting through a NAT address in an intentional subnet configuration would peer outside their /24 subnet. This fix ensures that peering is contained within /24 IP ranges.
Fixes an issue in the Tanium Server in the handling of high-cardinality sensors with too many results where partial data under the result limit would fail to be reported to the caller.
Fixes a type name infringement in the handling of SCIM schemas in the Tanium Server which read "bool" instead of "boolean".
Fixed an incorrect handling of the "read_solutions" RBAC privilege in the Tanium Server which was evaluated as "read_solution" instead.
Fixed an issue where the LogVerbosityLevel setting was not honored in the Tanium Module Server and treated as a value of zero instead.

Tanium Cloud Release Date: January 29, 2024

Improvements

Upgrades Tanium components to use JsonCpp v1.9.5.
Improves the logging of session errors in the Tanium Server authorization log which in the past would only offer a very terse "Invalid session supplied" message.
The Tanium Server will now offer api_locked_out metrics for locked out user accounts and IP addresses, as well as requests from the Tanium Module Server.

Bug Fixes

Fixes an issue in the Tanium Server that would cause the error "HTTP-500: Saved Question metadata not found" when refreshing the status of a deployed action.
Fixes the garbage collection of old Questions results in the Tanium Server which would otherwise result in a large TS/Strings/saved-questions.dat files.
Fixes an issue in TDownloader that handled URLs with embedded spaces incorrectly.
Fixes a missing Content-Type header in the execution of POST plugin requests from the Tanium Server to the Module Server.
Fixes an issue in the Tanium Server while importing module plugin definitions.

Tanium Cloud Release Date: January 8, 2024

Special Notes

The latest Tanium Client version now supports Debian v12 on Intel and ARM processors.
The latest Tanium Client version now supports Ubuntu v22.04 on ARM processors.

Improvements

The Tanium Server will now load its result data cache in a background thread during startup, to improve the time from when it is started up to the moment when it is responsive to other tasks.
The Tanium Server no longer requires a restart when changing its disable_client_cdn_downloads setting.
Tanium Platform components now use Curl v8.5.0 libraries.
Improves the logging of RunModulePlugin API requests to the Tanium Server.

Bug Fixes

Fixes a problem in the Tanium Client by which it would not honor its ClientCacheLimitInMB setting and only allocate 100MB of storage for its downloads chunk cache.
Fixes an issue where the json_input_flag was not being recognized or honored correctly when importing content into the Tanium Server.
Fixes an issue in the Tanium Server in the lookup and handling of questions results which would result in the error: resultDataThread] Error: assertion 'current.size() == toCompare.size()' failed.
Fixes a problem in the Tanium Module Server which would not initialize its cryptographic subsystem in FIPS mode regardless of its FIPSMode setting.

Tanium Cloud Release Date: December 11, 2023

Special Notes

This release rectifies a long standing issue in the Platform enforcement of global and site throttles configured in the system. Up until now any configured bandwidth and connection limit values would effectively be doubled due to the redundant design of the Tanium Cloud infrastructure.

In order to provide a simpler management experience for this feature, starting with this version throttle values will be enforced exactly as specified in their configuration.

This change means that if you have a throttle for 1Gbps, up until now the Tanium Cloud infrastructure could deliver as much as 2Gbps of traffic. With this release the system will change to deliver the requested 1Gbps instead. The same is true about throttle connection limits: a connection limit of 1,000 connections could previously allow as many as 2,000 connections. This release changes to allow only what is configured in the user interface.

New Features

In Tanium Cloud Tanium Server will spread bandwidth throttle settings equally across Zone Servers and CDN, allowing the system to deliver the same consistent amount of bandwidth if or when their architecture is scaled.
The Tanium Server now defaults disable_client_cdn_downloads=1 to make client CDN downloads an opt-in feature instead of being enabled by default.
The Tanium Server offers a new counter metric to reflect the number of bytes that clients have downloaded from CDN: tanium_client_external_download_bytes_read.
In Tanium Cloud Tanium Server will spread maximum allowed connection settings equally across Zone Servers and CDN, allowing the system to deliver the same consistent number of connections if or when their architecture is scaled.

Improvements

Implements support in the new Tanium Server for the max_strings setting in legacy strings.
Global settings have been adjusted to allow Tanium Clients to re-play their sensor result string to hash mappings every twenty four hours instead of every week, as a means to reduce retry workloads on the Tanium Server.
The Tanium Server now applies configured download throttles with every chunk request instead of when the connection is first established. This allows immediately enforcing changes to throttle values, instead of having to wait until for the tear-down and reestablishment of existing connections.
New versions of the Tanium Server will deduplicate Client Status counts when presenting the tanium_client_count_history metric. The endpoint lists presented in Client Status will not be deduplicated, but its numeric count figure will be.

Bug Fixes

Refactors parts of the SCIM requests handling in the Tanium Server that could result in user group memberships being removed from RBAC configurations.
Fixes an issue in the Tanium Server handling of action status questions which cloud sporadically result in the SQL exception: SQLException: duplicate Key=History for action ids already exists.
Fixes a problem in the SCIM integration in the Tanium Server when paginating through users requests would return an invalid value for totalResults.

Tanium Cloud Release Date: November 21 2023

Bug Fixes

Fixes an issue where the Tanium Client is not informed to backoff under situations where the download queue is full.

Tanium Cloud Release Date: November 19 2023

New Features

Adds a metric to the Tanium Server to reflect the number of legacy FNV hash collisions detected in the system.

Improvements

The Tanium Server now uses different default values for resolution of legacy string hashes set at string_retry_hash_limit=2,000 and string_retry_pending_limit=10,000 to reduce the size of the pending set and accelerate the rate at which it is resolved.
Global settings have been adjusted to allow Tanium Clients to re-play their sensor result string to hash mappings every twenty four hours instead of every week, as a means to reduce retry workloads on the Tanium Server.

Tanium Cloud Release Date: November 16 2023

New Features

Adds the tanium_dropped_connections metric to the Tanium Server and Zone Server which reflects the number and type of connections dropped by configured global throttles.
The Tanium Zone Server will now cache CPMS download configuration replies which can be reused across subsequent requests.
The Tanium Server now implements the tanium_string_retry_pending_count metric to reflect the number of outstanding legacy client string retries.

Improvements

The Tanium Server will now delay file downloads on startup until its web services are fully operational. This allows for quicker startup times.
The Tanium Server now enforces maximum strings and maximum strings age for results received from new v7.6 clients.
The tanium_dropped_connections metric now identifies whether the connection was dropped due to a global or a site subnet limit configuration.

Bug Fixes

Fixes a misspelling in the tanium_result_retry_count metric of the Tanium Server.
Fixed an issue in the Tanium Server where the timestamp of some results received from clients would not be updated, resulting in the possibility of them being garbage collected and produced [RCU] errors.

Tanium Cloud Release Date: November 9 2023

Bug Fixes

Fixes a problem in the Tanium Client when parsing proxy PAC file configurations referenced by ProxyAutoConfigAddress and which contain more than one PROXY entry definition, resulting in the logged message "Failed to parse proxy name. Too many colons" at LogVerbosity=41 and failing to select a proxy to communicate with a Tanium Server.

Tanium Cloud Release Date: November 8 2023

New Features

The Tanium Server now offers a certificate management API to allow changing of its HTTPS certificate from a browser console.
The Tanium Server and Client now allow the tracking of successful and failed action exit codes.
The Tanium Server will now push notifications of new questions without the need for a registration from the client, making responsiveness even faster than it already was.
The Tanium Client will now use SIGTERM on long running Sensors and Actions before issuing a SIGKILL signal.
Enables file chunk downloading in non-leader endpoint clients when a linear chain ChunkRequest has not been serviced in over PeerChunkRequestTimeout. After these many seconds (default 300) a non-leader endpoint will request chunks directly from a server unless RequestChunksFromServerOnTimeout is set to the value of zero.
The Tanium Server will now reflects its isolated status where it has no peers to connect with. The Status.IsIsolated setting will help solutions decide how to operate most efficiently according to this state value.
Tanium Clients will now report its ActionLock status so it can be presented in the browser console Action Status summary user interface.
Tanium Servers will now immediately close new incoming connections when bandwidth throttle delays are larger than leader_max_schedule_delay_seconds.
Added a new permission manage zone servers to grant Zone Server management rights to non-Admin users.
Implements low, normal and high priority settings for Platform questions, where high priority questions should be reserved for interactive interface questions and low priority should be used for data pipeline harvesting questions.
Tanium components now use SetThreadDescription on Windows versions where it is available, to name different threads, which is helpful for all manner of debugging tools.
Implements a new API api/v2/upload_file_stream which accepts either an application/octet-stream or a multipart/form-data upload to improve performance in uploading large files to the Tanium Server.
Exposes the Tanium Client internal metrics through the TaniumCX get-metrics CLI command.
Tanium Client installation packages for Solaris v11 are now provided in Image Packaging System (IPS) format.
The Tanium Client now replaces its original Tanium Client -m process with TaniumCX run-framework.
Implements direct-download functionality on the Tanium Client, where the client will still be allowed to request chunks from its peers but any missing chunks must be downloaded by the interested client instead of the backward leader in a chain.
Implements support for Tanium Server configured bandwidth throttles in Tanium Client initiated direct CPMS downloads.
Implements the EnableCDNDownloads Tanium Client setting to enable CPMS-hosted downloads when in conjunction with the appropriate Tanium Server support and configuration.
The TaniumPython.dll file now contains version information on the file's metadata.
Tanium Platform components will now provide settings for LogVerbosityLevel on a per-log basis to allow for increased logging where necessary instead of increasing verbosity across the board for all logs.
Allows the Tanium Server API to manage the locked_out status of user accounts.
Adds the ability for the Tanium Client to communicate the execution result of a deployed action.
Offers a new server_health API route on the Tanium Server which returns information about disk space available on the different servers in a deployment.
The Tanium Client will now use its stable leader connection to send results reports to the server, instead of opening a new ephemeral connection as it did in legacy clients.
Adds HTTPv2 support for outgoing requests from the Tanium Server which can now be used when communicating with the Tanium Module Server and other systems.
Added the TaniumExtractor binary utility to Tanium's suite of tools in order to replace other extractors like 7z.
Adds the read_server_host micro-privilege to control access to the server_host API route used by TDS, so that service does not need to run with administrator privileges.
Allows an API Token session to invalidate the token that it is using, logging out the session that is using it and all further access with this operation.
The Tanium Client now requires a session token to be presented in API request headers and not in the SOAP request body when RequireClientAPISessionInHeaders is set. This avoids the parsing of XML when a proper session token is not presented up front.
The Tanium Client will no longer reset CX extensions according to MonitorResetIntervalInHours. Extensions will now be reset only if and when the Tanium Client performs its own reset.
Limits the size of allowable sensor results to be cached to avoid unrestricted memory growth of the Tanium Client when running poorly written sensors. The maximum allowed result size can be controlled with the SensorMaxResultSize configuration parameter.
The Tanium Server authentication system now supports Online Certificate Status Protocol (OCSP) for Common Access Card (CAC) authentication.
The Tanium Server now offers an API route to temporarily override logging levels on all server components. Posting to internal/monitoring/v1/log/levels with data that specifies {"text": "DEBUG", "duration": 60} will set the logging level to "DEBUG" on all servers for the next 60 minutes. The logging levels available are: FATAL, ERROR, WARN, INFO, DEBUG, TRACE, which correspond to LogVerbosityLevel settings 1, 11, 21, 41, 61 and 91, respectively.
Tanium component zipped logs will now contain the same older log files renamed with a date and time suffix (YYYY-MM-DD-hhmmss) which will make their names unique when unzipped.
The Tanium Server now has the capability to upload to a Content Delivery Network (CDN). This improvement supports the Improved Client Downloads initiative.
The Tanium Server no longer honors the legacy max_strings_total_mb setting but instead calculates the amount of strings memory to use every startup based on its string_memory_percentage setting, which defaults to 33.33 percent.
Adds support for filtering of groups based on its subgroups, allowing for action group queries with filters like: action.action_group.groups[].name.
Implements Tanium Client peer-to-peer bandwidth throttling no longer controlled in terms of messages per second but by the PeerBandwidthThrottleBytesPerSecond client setting.
Disallows disabling of active LDAP synchronization connectors, which will only be allowed with a connector is paused or deleted. This is to avoid synchronization operations with a connector in disabled state which would remove RBAC assignments that are no longer being provided.
Implements the ability on the Tanium Client to extract the contents of ISO images, which is necessary to support use cases in the Deploy solution module.
The Tanium Client will now execute Python sensors in a dedicated process labeled as TaniumClient --python-sensor which will avoid the common need to restart the TaniumClient -a process.
Implements the direct reporting of results for sensors that use the sensitive data flag in Tanium Client v7.6.
The Tanium Client will now persist into a database and load known actions on initial registration.
The Tanium Client will now persist and read action statuses from its action database.
Implements the migration of existing actions and their statuses into the Tanium Client's new actions.db.
Implements new Tanium Server metrics for the number of successes and failures of database connection attempts: dbconnectionpool_db_connect_success and dbconnectionpool_db_connect_failure.
Implements the Tanium Server plugins necessary to interface and operate with the System User Service, which can be controlled using the enable_system_user_compatibility setting.
Implements the StateProtectedFlag=1 feature on the new Tanium Client actions database.
Implements the tanium_authenticator_non_system_users_last_login Tanium Server metric to indicate the last time users logged into the system.
Adds a "read solutions" privilege to control access to the API solutions route.
Implements auditing information for changes to the system's bandwidth throttle settings.
Ensures the timely execution of built-in sensors like Action Statuses which now follow maxAge rules like any other non-reserved sensor.
Implements multiple and parallel chunk downloads for the Tanium Client when fetching files from CPMS.
Ensures that v7.6 Tanium Clients will not peer with earlier versions, given that their communications are not compatible.
Changes the behavior of the Zone Server Hub to resolve the DNS names for its Zone Servers each time it connects to them. This allows for better live response to Zone Server IP address changes without a service restart.
Implements Tanium Client http_downloads_* metrics for CDN downloads.
Implements a mechanism in the Tanium Client where it will back-off issuing download requests when its Tanium Server is exceeding its configured bandwidth limits and incurring on high queue delays.
The Tanium Server will now delete all users and groups associated with a SCIM provider when that provider is deleted. This is done for integrity and to avoid ending up with users and groups which can no longer be managed, not through Console nor SCIM.
Increases the default value of max_force_registrations_per_second to 10,000 now that this operation has become less costly thanks to other server to client communication improvements.
The Tanium Client now saves and flushes the contents of its question and action databases during shutdown.
The Tanium Module Server no longer uses HTTP Basic-Auth when registering with the Tanium Server, because this authentication method is now disabled on the Tanium Server bu default.
Tanium servers will now communicate their version to clients during registration, allowing new and future clients to determine if they have connected to a system of a compatible version.
Implements a property named "t" on the result rows from the Tanium Server GetResultData API to indicate whether a particular row can be used as a target filter based on its values. The include_targetable_flag has to be included in the request for this property to be emitted.
Enforces unique names for dashboard definitions in the Tanium Server which would otherwise produce solution import errors.
Removes support of legacy FNV hashes in the Tanium Server's string APIs.
Forces a Tanium Client to isolate if its server message buffer limits are exceeded, to allow it to process its own pending messages over those received from its peers.
The Tanium Server history export APIs now offer a mode query parameter to specify the format of the export to be either csv or json.
The Tanium Server question and action history export API now allows filtering which supports the ability of the console to export only selected items.
Implements backing up the original values for those temporary environment variables the Tanium Client now manages for its sub-processes. The original values are stored in variables named with the BACKUP prefix.
Implements client side handling of sensor execution priorities to complement the new question priority feature in coordination with CX requests.
Implements the Tanium Client settings SensorPenaltyThresholdMilliseconds=100 to specify which sensors are considered long-running, and SensorPenaltyMaxMilliseconds=2000 to control the stalling of the evaluation pipeline.
Adds the priority field to the Tanium Server's question API.
Implements "cx_channel_response_*" metrics that tally the number of messages and bytes exchanged across the Tanium Client to CX communications channel.
Ensures that built-in sensors skip the evaluation queue in the Tanium Client since their fast execution allows them to be preempted quickly.
Implements a priority setting for the action API on the Tanium Server.
The reserved Tanium Client internal sensor Action Statuses will now not return more than ActionStatusSensorLimit recent action statuses.
Implements metrics counters on the Tanium Server to track the number of valid and invalid API token requests received.
Ensures that the plugins/group/questions returns an HTTP-503 result code until the Tanium Server is fully ready for operation.
The windows client uninstaller will now kill the client if it does not stop within 20 minutes. This allows the upgrade to work even if the client process is hung.
The Tanium Client now implements a tanium_sensor_queue_wait_seconds histogram metric that tracks the distribution of queue wait times for the execution of every sensor.
Disables sensor execution penalties on the Tanium Client by making SensorPenaltyThresholdMilliseconds=0 the out of the box default setting value.
Sensor results in the new Platform are now forced to be encoded using SHA-256 in support of future capabilities.
Implements chunk cache use metrics in the Tanium Zone Server.
Implements a metric to track non-handled exceptions in the communication in Tanium Servers and Zone Servers.

Improvements

The Tanium Client will now immediately remove an action folder after the action finishes running
The Tanium Server will no longer perform any deduplication of client records in Client Status to avoid confusion over endpoints which answer questions but do not appear in this listing. Clients will be identified solely by their ComputerID.
The Tanium Client will now periodically vacuum its SQLite databases.
Tanium Clients will now synchronize their sensor definitions based on a unique ID field.
Implements a new schema for the Tanium Client result cache that matches the new SensorReport format.
The Tanium Server will now reuse rows in its sensor_definition database table when Sensor update operations have not changed their code implementation.
The Tanium Client will now only re-execute Sensors when their results maxAge value is reached and no longer perform maxAge/2 additional executions.
Improved database code efficiency when updating action start times.
The Tanium Server now constructs client-bound messages from the contents of its database caches which are guaranteed synchronized and consistent. This will reduce workload on the database for these operations.
The pki show --fingerprint command now accepts short-form PKI fingerprint specifications like the ones displayed in Console.
Implements the serialization of the new direct_download_flag for package file definitions in the Tanium Client.
Adds a communications message for a Zone Server to acquire a batch of new computer IDs from the Tanium Server, to be assigned to new Tanium Clients.
Defines a new namespace and version scheme used by the next generation of ComputerID assignment to endpoints.
Introduces a Tanium Server sequencing counter for active/ active pair messages about incoming Tanium Client registrations in order to support next-generation ComputerID assignments.
Implements broadcasting of registration sequences between Tanium Servers in active/ active pairs and Zone Servers in order to support the next-generation ComputerID assignments to Tanium Clients.
The Tanium Client now uses fully asynchronous communications when establishing its connections to servers and peers.
Zone Servers will now log at the lowest verbosity level when they find a local JSON throttle definition in their filesystem, and also log the result of loading said local configuration.
Drops support for loading TaniumTrace DLLs which are no longer used and necessary.
Refactors the in-memory handling of package file hashes as hash values instead of strings which can be more prone to bugs in their handling.
Modifies the pki show command line in Tanium components to work for tanium-init.dat files without the presence of a pki.db. The command now assumes that the file name parameter is a tanium-init.dat file unless its extension is .db in which case it will be read as a pki.db database.
The Tanium Server now allows for more granular scheduling of database clean up and maintenance activities by offering the clean_database_hour and clean_database_minute global settings.
Refactors the Tanium Client SSL session store to track session tickets by IP address and implements the eviction of expired records.
Implements a new metric tanium_pki_unknown_trusted_roots as a counter for the number of registration requests received with unknown keys.
Adds a new ModuleContentSigning key type to be used by the new content signing API offered by the Tanium Server.
Implements a new API that allows solution modules to have byte blobs of data signed by the Tanium Server.
Removes unnecessary hashing of individual string columns in multi-column sensor results.
The Tanium Server will now detect inactive servers in an Active/ Active configuration and update its Downloads/upload_hosts.txt file. This will avoid unnecessary attempts to download files from a Tanium Server that is not up and running.
Implements HTTP proxy client connections over the improved asynchronous communications model.
Simplifies the organization and flow of ServerName selection, resolution and proxy connections in the Tanium Client.
Improves the Tanium Server question parser to avoid creating excessive sub-groupings for multiple expressions joined with OR operators.
Adds the user id for failed authentications to authentication_audit records returned by the Tanium Server API.
Adds the ability to export saved actions by ID, necessary when attempting to export actions with duplicate names.
The Tanium Server will no longer create "Legacy-*" RBAC roles in new installations. These roles are now deprecated for new deployments.
Updates the allowed TLS cipher suite to match Mozilla's intermediate compatibility recommendation.
The Tanium Client installer now provides a more specific firewall rule just for the communications port of the TaniumClient.exe binary.
The Tanium Client now handles results in its ClientResultCache based on the immutable sensor ID that produced them.
Improves on the reported status for packages on the Tanium Server to reduce information leakage on error reports.
The Tanium Server now uses a column named error_details in its server_package_files to store error messages encountered when trying to download and cache package files.
The Tanium Client will now clearly log when the DisableTrace flag is set on an endpoint.
The Tanium Module Server will now clean its temporary directory on startup, removing files left behind which are no longer used.
Adds validation to regular expressions used in the creation of groups to avoid syntax errors which may later occur downstream at the Tanium Client with the log message: error occurred while parsing the regular expression.
Adds support for outgoing GRPC requests to the Tanium Client for CPMS integration.
Adds the ability to read Tanium Client settings from an extension process.
Implements increased resilience to corrupt plugins.json files in a Module Server configuration by doing a fallback to previous backup versions of the file.
The Tanium Server will now use one single connection when working through database upgrade steps.
The v7.6 Tanium Client is no longer sensitive to time drifts that can cause [CRU] results.
Removes unused settings for string error flags and prefixes: error_string_prefix, error_string_regex and generic_error_string_flag.
The RBAC API will no longer return a content set element for groups that are not designated as filters and not associated with a content set.
The TaniumCX binary will now verify the signatures of the third party libraries it uses before loading them.
Implements sensor and action communication pipes which CXs will use to communicate with the Tanium Client instead of using disk-based mailboxes.
The Tanium Client will now log active script begin and end messages at LogVerbosityLevel>10 to reduce log spam.
The Tanium Client can now handle several sequential download requests over the same connection instead of opening a new one. Idle download connections will be closed after thirty seconds of inactivity.
Enforces a limit of 5,000 as the maximum allowable value for string_retry_hash_limit that can be sent to the Tanium Client at one time.
Adds ability for Tanium Client created temporary files to use Windows attribute FILE_ATTRIBUTE_TEMPORARY which prevents the file being written to disk whenever possible.
Created separate db query plans in the Tanium Server for initial cache loading and incremental cache loads to reduce the number of time SQL has to compile query plans. This reduces CPU load on the SQL server as well as increasing API performance.
Updated the way message size metrics are captured to improve efficiency of processing large messages.
The Tanium Client will now uses a SHA-256 hash for the identification of contents in direct download requests.
The Tanium Client will try to cast sensor results into a number value even when the definition does not define the result value as numeric. This allows for better handling of data types even for sensors which were created incorrectly.
Reduced the LiveSnapshotAlwaysUseSeconds from 4 to 1 second to improve user experience for returned question results.
Added serialization code efficiencies in multiple Tanium Platform components, making future feature updates and REST API handling more effective.
Added a more efficient means to gather client configuration path information from the Tanium Client.
Unifies the handling of sensor results and their results cache between the Tanium Client and extension processes.
Added arguments to the Tanium Client that lightens the touch on an RPM database to support Software Manager functionality.
Combines the execution of the packages and download file cleaning operations into a single thread in the Tanium Server, thus reducing contention between them as well as database resource utilization.
Added an additional API call, /api/v2/user_groups/by-name/{name}, to get user groups by their text name.
Tanium Client will retrieve the computer name directly without caching on all operations except for sensor and client evaluations to reduce the chance of caching interference.
Tanium Client connections will now follow a 60 second timeout instead of the historic 3 seconds. This should benefit busy systems with less than ideal network connectivity.
Removed the old concept of slow peers that is deprecated by other mechanisms already in the Tanium Client.
Updated API tokens with the associated person's name along with the id with displayed with a GET for /api/v2/api_tokens.
Includes additional logging of https header names when capturing error parsing http response log entries.
The Tanium Server /metrics route will now omit per-thread metrics unless the enumerate_server_threads_for_metrics_flag setting is enabled. This reduces the cardinality of metrics in monitoring systems.
The value of info_export_interval_minutes and info_export_max_age_days global settings will now honored by zone servers.
The Tanium Server will no longer log "No PKI clock offset for fingerprint" which is an expected server condition.
The Tanium Client now persists the ids of sensor statistics requests as not to respond repeatedly to the same request across client restarts.
The Tanium Client's subsystem in charge of download requests now cleans its file buffer cache periodically to reduce the number of file descriptors it keeps open.
Implements environment-specific content security policy headers for the Tanium Server replies.
The Tanium Client will now run with a question_check_diffs_seconds=60 default.
The Tanium Client will now restore the environment of its sensor evaluation process instead of restarting it if a sensor execution has modified it.
Removes Tanium Server client registration settings which are no longer used.
Tanium Clients will now re-evaluate sensors when checking actions for targeting criteria.
Implements the cleaning of expired action logs in the new Tanium Client.
Implements the cleaning of expired action folders in the new Tanium Client.
Implements the cleanup of expired actions from the Tanium Client's actions.db database.
Implements referential integrity cascaded deletions on in action.db for stopped actions.
Implements expiration times for a Tanium's Server root keys to be 99991231235959Z as recommended by RFC-5280.
Drops the value_system_flag column from the global_settings database table, since it is no longer used.
Implements the necessary functionality for a Tanium Server to de-register a deleted package file with CPMS.
Improves the logged messages in the Tanium Server's package-download.txt log.
The content set API on the Tanium Server will no longer return deleted records.
Tanium Platform components now ship with xz v5.2.9 compression libraries.
The Tanium Server will now log errors encountered while updating users and groups during an LDAP synchronization operation, such as SQL errors.
Improves the text of audit records to include the previous and new name of objects in rename operations, offering more readable audit records for Tanium Server objects.
Enables the tracking of encryption key ids in the management of Tanium Client databases when StateProtectedFlag is enabled.
The Tanium Server's global setting audit API will now return audit text that contains the original value that was changed as well as the new value it was changed to.
The Tanium Server API will now reject the assignment of invalid RBAC privileges, where before it would allow it but strip them off whenever calculating an account's effective privileges. Now the assignment itself will no longer be allowed.
Adds the display_name field to the Tanium Server's API requests when this information is available for a user account. This will allow Console to display this information in user pages.
The Tanium Server will now log API HTTP request headers only at LogVerbosityLevel=61 and above.
Upgrades the PAM library on the Tanium Server to v1.5.2.
Tanium Platform components now ship with TBB v2021.7.
Implements server-side streaming export of question and action histories, reducing browser wait times and resources.
Improves the performance of TLS session ticket verification in all Tanium Platform components.
Implements faster client to server re-connections when there are pending downloads waiting completion.
Implements WAL-mode operation for the platform's pki.db database.
The Tanium Client installer on Windows will no longer remove and add again the Tanium Client service unless deemed necessary. It will just replace the service's binary instead.
Improves the performance and resource utilization of PKI operations by not re-verifying certificate chains immediately after they are issued.
Improves the performance of the Tanium Server system status and client count APIs which is important to deployments with a very large number of endpoints.
Implements WAL-mode operation for the platform's config.db database.
Implements periodic save and cleanup operations on the Tanium Client's SQLite databases.
Implements a quicker delivery of isolated and separated subnet information from the Tanium Server to the Tanium Client. This allows informing the endpoint if it should be isolated or the separated subnet it belongs to, along with a list of candidate peers.
Relaxes the permissions required to access the preview_content_set_role_detailed on the Tanium Server API as a prerequisite to enable customer content features.
The Tanium Server and Tanium Zone Server will now free memory in their client processing threads every client_thread_clean_memory_seconds=300 interval.
The Tanium Client now uses a timed, periodic enforcement of its StateProtectedFlag instead of doing this on every settings update event.
The Tanium Client will now execute its downloads database maintenance cleanup every hour instead of every ten minutes. This interval can be controlled using the CleanDownloadDBInterval client setting expressed in seconds.
Avoids a sensor cache lookup in the Tanium Client when resolving hashes in preparing question results.
Implements an idle timeout command line option (--idle-timeout) for TDownloader which will specify the maximum amount of time a download stream can stall before it is considered failed. The default timeout will be 60 seconds.
Improves the audit information for content set roles in the Tanium Server to return only the information of elements which were changed instead of the effective result of the changes.
The Tanium Client will now log "No valid servers are configured" if its ServerName and ServerNameList settings are not configured.
The Tanium Client will now not fail to start if it cannot access Powershell on its running endpoint. It will simply log "PowerShell not accessible" and continue to run without it. This may render content and solutions unusable but the client will not stop.
Receives incoming messages for the Tanium Client from the CX framework subsystem and honors any restart requests received.
The Tanium Server API now supports and expects a GET method request for its action and question export routes.
The Tanium Client will no longer perform an epoch reset when DatabaseEpoch changes from an empty or missing value to an actual epoch value. This prevents performing a reset on first install.
The Tanium Client will promptly refresh the return value for the Action Statuses sensor whenever an action is completed. This speeds up action status reporting on the Tanium Console.
Improves Tanium Client question processing by not emitting changing results when the changed data is omitted through a select filter. This is an optimization aimed at questions like: Get Action Statuses starts with 27477 from all machines.
The Tanium Server API now supports exporting multiple saved action IDs with the export-by-id route.
Implements support for diskless mailbox execution for Visual Basic script sensors in the Tanium Client.
Implements support for diskless mailbox execution for shell-script sensors in the Tanium Client.
The Tanium Client will now return a maximum of 10,000 result rows as controlled by the SensorMaxResultRowCount client configuration setting.
The Tanium Server now logs the reason for authentication failures at LogVerbosityLevel=0 in its auth.log.
Client download API requests now copy files into a .tmpcopy sub-folder on the destination path, to avoid the requesting agent to detect partially downloaded files.
Adds additional information in replies to requests with expired JWT tokens to inform why the request was rejected.
Honors the Tanium Client MessageBufferByteLimit setting.
Implements use of the TANIUM_TRUSTED_MESH environment variable to allow the Tanium Server API to run on clear text HTTP instead of HTTPS.
Implements the cache_ref_id in the rows returned when calling GetResultData which can be used in conjunction with a cache_id to call the build_target_group API on the Tanium Server.
The Tanium Server API now offers a build_target_group route which allows defining groups from a result cache and its reference IDs.
Removes support for ComputerID tracking in saved question which underpinned the recent results Tanium Server API feature which is not in use anymore.
Adds a guided_onboarding setting to allow tracking of onboarding activities in Tanium Cloud.
Removes the previously needed but now superfluous file_name parameter which was used in action and question history exports.
Changes the API to export both action and question histories so they will provide default CSV columns and JSON elements to be returned when none are specified beyond the export mode parameter.
Ensures that plain-text communications between the Tanium Server and modules is only possible when running in a TRUSTED_MASH_FLAG=1 configuration.
Makes module server solution registrations to be unique both in their id and name.
Changes the threshold for incorrect sensor statistics from 1GB to 1TB for bytes read, give that it is possible that a sensor would read that amount of data to produce its results.
Changes the Tanium Server history export API to return a JSON object instead of a simple array, which is best for compatibility.
Implements new Tanium Server metrics on the configuration of CPMS integration and upload successes and failures to that subsystem.
Improves the Tanium Client logging of the failure conditions for HTTP downloads.
Adds logging to the ClientAPIFileCopy subsystem in the Tanium Client to allow for easier troubleshooting.
Fixes a problem in the Tanium Client for AIX to detect when AIXSetLibPaths setup would fail on startup, resulting in the error: module libcrypto.so could not be loaded.
Loads the allowed root certificate authorities in the MacOS Tanium Client in support of CPMS-hosted downloads.
Allows questions and their results to persist beyond their expiration time and for as long as max_result_cache_grace_period_seconds if they are still being referenced by API requests.
Reduces the processing cost of content imports in the Tanium Server API by delaying signature verification until the flag for a concurrent import is confirmed.
Reduces the memory utilization on the Tanium Client by clearing its question cache after it is persisted to disk.
The Tanium Server question API now disallows the creation of saved questions from counting questions.
Enforces the execute plugin privilege when routing module service API requests.
Implements additional logging around sensor evaluation in the Tanium Client at higher LogVerbosityLevel>60 settings.
Raises the LogVerbosityLevel at which the Tanium Client issues "Sensors failed verification" in order to reduce log spam.
Improves the performance and memory footprint of the Tanium Client by making use of better SQL queries to load its initial state.
Implements WAL operation mode on the Tanium Client's manual_groups and url_requests databases, which reduces the amount of filesystem activity.
Implements improved handling of UTF-8 encoded sensor results in the Tanium Client.
Ensures that the Tanium Client internal sensor cache keeps synchronized with the verifiable contents of its sensor database.
Changes the behavior of sensor results parsing in the Tanium Client where it will ignore a configured delimiter in the sensor definition if it has no declared columns. This improves the behavior of sensors that incorrectly declare a delimiter for a single column.
Improves the messages logged by a Zone Server when publishing a snapshot to include the highest question and action IDs contained in the snapshot.
The Tanium Server and Client now offer higher sensor result limits for the benefit of data-intensive applications: SensorMaxResultSize=10,485,760 (in bytes), SensorMaxResultRowCount=100,000 and sensor_max_allowed_result_rows=100,000.
The Tanium Server will now log "Malformed session" when authentication fails due to a malformed session value.
The Tanium Client will now compress large question result reports as controlled by its EnableReportCompression and ReportCompressionThreshold which defaults to 1,024 bytes.
Adds additional logging for the state of downloads requested through the Tanium Client API.
Adds logging to the Tanium Client around start and stop operations over the CX execution framework.
Adds logging of incorrect SOAP sessions to the Tanium Client API when the value is provided in the message body, as is done when presented as a request header.
Tanium Platform components now ship with SQLite v3.42.0.
Reduces log spamming in the Tanium Client on a disabled or unavailable client extension framework.
For compliance with RFCs and compatibility with more SCIM providers the Tanium Server now treats the externalId attribute as optional in users like it does in groups.
The Tanium Server will now check the health state of its database connections before returning them to its connection pool.
Ensures that old expired and revoked certificates are cleaned up from the pki.db database.
Reduces log spam in the Tanium Server by issuing "Failed to build question" and "Failed to build action" only once.
Reduces the CPU utilization in the Tanium Server when serializing user privilege information in API requests.
The Tanium Server will no longer refresh all sensor definitions when questions and actions change, and will only refresh the definitions of sensors that have changed since their validation can be expensive.
Makes the TaniumExtractor tool more resilient to errors as to allow it to continue processing whenever possible.
Improves the performance of the Tanium Server in computing cache sizes reported in its /metrics route.
Improves the Tanium Server performance in calculating snapshots of new information transmitted out to Zone Server Hubs.
Adds support for incoming HTTP2 connections initiated with prior knowledge and an correct connection preface.
Changes the logging level for HTTP2 closed pipe log messages to a higher level, since they are not really error conditions.
The Tanium Client offers better handling of long timeouts when communicating with its client extension components, which could happen during endpoint sleep cycles.
Improves the error handling and resilience of the communications between the Tanium Client and the client extension framework when receiving oversized messages through. their communications channel.
Improves the http-access logging of data retrieval SOAP requests to the Tanium Server by logging the type and ID in the request, like: GetResultInfo:question/501.
Implements limits for the new Tanium Server question result and string hash retry caches to keep them at a reasonable size.
The Tanium Client will now send verbatim sensor result values if their length is shorter than that of the hash that would be used to represent the value itself.
Ensures that URL to chunk mappings known to the Tanium Client are not just saved periodically but also on shutdown to avoid any loss of data.
The Tanium Client now reduces ReflectionConnectMaxRetryInSeconds down to sixty seconds instead of five minutes to make its back-off interval shorter, and also resets its back-off interval after achieving a connection to a server, even if the connection does not close cleanly. This allows endpoints to be more resilient in their attempts to secure a server connection under adverse network conditions.

Bug Fixes

Fixed an issue where the Tanium Server Question Parser failed to parse computer groups names in a question filter clause when the groups were expressed in terms of parametrized Sensors.
Fixed a condition on the Tanium Client where setting local configuration values with the same name but different case would result in the error InvalidParentKey and break the TaniumClient config command line option.
Fixed an issue in the Tanium Client in interpreting Package file download network messages where it would sometimes log assertion 'hash.size() > 0 && hash.size() <= kMaxHashSize' failed when requesting a client API download and running with LogVerbosityLevel=41 or higher.
Fixes the permissions of a server's license file on disk when they are incorrect, avoiding the repeated "FailedToVerifyLicense" message in logs even when the loaded license is valid.
Fixes an OpenSSL random number generator initialization problem that would result in the error "SSLEAY_RAND_BYTES:PRNG not seeded" which is innocuous but should not happen anymore.
Fixes a condition in the Tanium Server by which policy-based saved actions would fire more often than they actually had to because they would not target any online endpoints anyway.
Fixed a bug in the Tanium Server where a LDAP user's modified time field is updated every time LDAP synchronizes.
Fixes an issue where API tokens would fail to be authenticated with IPv6 trusted addresses.
Fixes an issue where the Tanium Server API would throw an HTTP-404 error when trying to export content sets that reference objects which had been removed from the system.
Fixed a bug where the install log on the Tanium Client will continually add a new log every time a client is installed/upgraded. This is resolved by adding install-backup-[date].log rotation.
The Tanium Client will now use database locks when applying StateProtectedFlag configurations, to avoid conflicts while applying the implied encryption of contents.
Adds a missing transaction to the periodic package and package files cleaner maintenance operation in the Tanium Server.
Fixed a bug where Last Modified was not updated on a user when adding or removing groups and roles.
Fixes an HTTP-500 error returned by the user_groups API when referencing invalid user IDs.
Fixes a bug where if the Client Extension (CX) or TaniumClient process dies and there is a partially written CX message, the CX connection fails until the TaniumClient service is restarted. This supports the CX Sensor improvement initiative.
Fixes a bug where a Client Extension sensor request will hang if the TaniumClient -c process is restarted. This supports the CX Sensor improvement initiative.
Fixes a bug where a Client Extension sensor request will hang if a response is dropped. This supports the CX Sensor improvement initiative.
Fixes an issue where the Tanium Client may not rotate log files correctly.
Fixes an incorrect parsing of incoming SAML identity provider data in the Tanium Server which would trigger the error "SAML authentication failed: Invalid namespace prefix 'xmlns:xsi' for attribute" when InclusiveNamespaces were used.
Revised a memory configuration to increase performance while accessing sqlite databases on the Tanium Client.
Resolves an issue where the Tanium Server's metrics would report higher client counts than Client Status due to not filtering records with ComputerID=0.
Fixes a rare condition where a Tanium Server could miss manual groups and sensor updates for a short period of time. This condition has never been observed in the field due to its small probability of happening.
Fixes the routing of the package_file update API in the Tanium Server which would previously throw a "InvalidObjectTypeForUpdate" error for PATCH requests.
Fixes a problem where the Tanium Client would fail to execute Python code with the log message "not enclosed in Tanium Client folder" when the downloads folder is relocated.
Changes the behavior of the Tanium Server solution import API so it will not throw an exception and reply with an error when referenced saved questions are missing.
Fixes an issue in the Tanium Client where cleaning of action logs and folders would not honor the CleanActionLogsIntervalInDays global setting.
Fixes an issue with the Tanium Server groups API which results in the incomplete error HTTP-500 'Invalid group field name: ' when trying to filter the request results.
Fixes an ordering-of-operations error when importing both roles and privileges into the Tanium Server on the same operation, which could result in a ContentSetPrivilegeNotFound error.
Fixes an omission in the Tanium Server content set role API which would not account for restricted privileges during a preview request. The API will now throw InvalidCustomerPrivilegeForContentSet when an incorrect privilege is included.
Fixes a problem in the Tanium Server preview content set role API which would not return deny-type roles. Issuing a request with a deny_flag=1 will now return these roles.
Fixes an issue in the Tanium Server when importing a package without attached files and overwrite an existing package with files, the file references would not be removed.
Fixes a crash in the Tanium Server when it received a stop request while still waiting for its database connections to be available.
Fixes the mode settings on the Tanium Client's taniumclient.service file to avoid the error message: Configuration file taniumclient.service is marked executable.
Fixes a condition that produces revocation hash mismatches across active/ active Tanium Servers after importing legacy v314 protocol keys.
Fixes an issue by which content administrator users cannot read all content on the system, which impairs the role's ability.
Fixes incorrect instructions in the Zone Server RPM installer on Linux which described the need to configure the ServerName setting, which is not necessary unless installing a Zone Server Hub.
Fixes an issue in the Tanium Server audit log API for user groups where the details entry would be empty.
Fixes the error response returned by the action group Tanium Server API when searching a non-existing group by name, which would return an invalid ID number instead of the group name provided in the request.
Fixes an issue in the Tanium Server RBAC API which would return InvalidCustomerPrivilegeForContentSet when attempting to request detailed content set previews over content sets with configured restrictions.
Fixes an omission in the Tanium Client where Windows COM errors were not properly encoded as UTF-8 strings.
Fixes a problem where the Tanium Client would not honor a properly set ValidateAllLibrarySignatures=0 in its CX execution framework.
Fixes an issue on the Tanium Zone Server where the info_export_max_age_days global setting would not be honored.
Fixed a cosmetic issue in the Action Statuses sensor that showed the string "\n" in its description.
Policy-based actions in the Tanium Server will no longer consider and count error results like [CRU] and [RCU] when evaluating whether to trigger or not.
Fixes an omission where the Tanium Server would fail when configured to listen on port 65,535 which is a valid port number.
Fixes a Tanium Server issue were the TaniumServer.exe database sqlserver2postgres command would fail with the error message "Unhandled column type: real" when the data_purge_history table contains any rows.
Fixes an issue with the TaniumReceiver.exe database sqlserver2postgres feature where the generated output cannot be imported into a PostgreSQL database if the servers table in Microsoft SQL Server has negative guid values.
Fixes an issue in the handling of single-use requests as used for export operations where request parameters were not being passed along to streaming handlers. This would impair the new streaming versions of action and question API requests.
Fixes a filtering problem in the Tanium Server action API where it would return the status for multiple actions when only one of them was requested.
Fixes an issue where enforcing the uniqueness of saved question names was not filtering out entries which were already deleted in the system.
Fixes an omission where the Tanium Server RBAC API would not exclude privileges from deleted content sets.
Fixes an issue in the removal of expired PKI keys in the Tanium Client which would show as repeating duplicate "Erasing expired key" messages in pki.log.
The Tanium Server's question API will now return the exception "Counting questions cannot be merged" if requested to merge a counting question.
Fixes a problem where the Tanium Server question result data API would not respond to the export_flag parameter.
Fixes a delay when fetching the Tanium Server info page, observed when the module server service is stopped.
Fixes a condition where internal sensors could stall question results on MacOS Tanium Clients.
Ensures that built-in reserved sensors honor their configured maxAge setting.
Fixes the operation of the ActionFolderRetentionMinutes setting on the Tanium Client to keep action folders for this period of time, as long as disk space on the endpoint does not fall below minimum levels.
Reduces the logging of the SQLite "Failed to reset statement" message which is neither significant nor important.
Fixes import failures of default computer groups into a newly built Tanium Server returning an HTTP-404: SensorNotFound error.
Fixes the logout workflow in the Tanium Server for Azure environments, which would leave console sessions with an invalid JWT token and unable to log in again.
Fixes an issue in the Tanium Server which would prevent clients from downloading ECF package files from CPMS.
Fixes the Tanium Server dbconnectionpool_db_connect_failure metric which would not reflect the correct count of connection errors.
Fixes the parsing and output representation of sensors that contain square bracket characters ([]) in their name
Adds a database upgrade step to the Tanium Server install sequence which will fix incorrect legacy package file hashes which would result in errors like "Invalid package file hash value: class NotAHexDigit" and prevent logins at the console.
This change separates the processing of active-active Tanium Server and Zone Server message streams, as well as supporting concurrent client streams over the same connection. This solves a number of communications issues observed characterized by the logged errors: "unexpected exception: Can't queue callback that is connected somewhere else", "unexpected exception: Source is already connected to another callback" and "assertion 'm_downloadThrottle' failed" and will also resolve "cdn-config: ignoring request because too many are pending".
Fixes a problem in the Tanium Server by which it would not issue TLS session tickets to connected clients.
Fixes an incorrect count of endpoints presented by the Tanium Server when deploying an action to machines with the same computer name.
Fixes a problem in the Tanium Server integration with SCIM that could result in the error message: SQLException: duplicate key value violates unique constraint groups_name_hash_normal_group_unique_index.
Fixes incorrect determination of hash collisions in the Tanium Server when receiving results from case-insensitive sensors from legacy clients.
The Tanium Server question API will now return empty results for GetResultInfo and GetResultData requests on expired questions, being that such requests cannot be fulfilled anyway and would result in "Question cache not found" errors being logged for them.
Fixes a condition where the very first client connections to a Tanium server would operate without their configured throttles. Now the Tanium servers will refuse incoming client connections during startup until all throttle configurations are loaded and operational.
Fixes a problem in the Tanium Server serialization of its newly designed result cache.
Fixes an issue by which [RCU] errors would not be included and shown for counting questions issued by the Tanium Server.
Fixes an issue with the Tanium Client where it may log "assertion '!m_resetRequired && !m_challengeRequired' failed" and then stop right after completing a server challenge.
Fixes a timing condition in the Tanium Client which would make it wait for longer than necessary when stopping the CX execution framework, giving the impression that they system was idling unnecessarily.
Fixes an error in the instrumentation of the Tanium Client which would prevent the client from starting with the message: Metric result_retries_received already registered.
Fixes a behavior in the Tanium Client by which it would always deliver its sensor statistics information to its reporting server instead of forwarding them to its connected peer.
Fixes an omission in the Tanium Server where it would not process incoming server_health_update messages received from zone servers.
Modified the output of the TaniumClient quarantine list command to match that of legacy versions, because there exist content sensors and packages that depend on the format of this output.
Fixes a condition where the Tanium Server might corrupt its new string cache bitmaps.
Fixes an omission by which the Tanium Server would not reflect updates received from legacy endpoints when an [RCU] resolution was received or a legacy hash collision was detected.
Implements a re-processing of sensor string files in the Tanium Server during upgrade to avoid case insensitive string hash mismatches which would cause [RCU] errors in question results.
Fixes a mismatch between server and client in the treatment of case insensitive sensor string hashing which would result in [RCU] errors which would never resolve in question results.
Introduces controls on the Tanium Client to determine the structure and content of string hash reports.
Fixes an omission in the Tanium Server where delayed/ future string reports would not be noticed in the resolution of missing strings.
Fixes a condition in the Tanium Client where it would incorrectly send a throttle control command which would risk breaking its established connections.
Adds necessary field keys in the new Tanium Server results cache needed to implement the required behavior for letter-case folding in sensor results.
Forces the Tanium Server to re-read and interpret a sensor's string files when the case-insensitive flag in the sensor definition is changed. This is to avoid the [RCU] errors that this change can produce.
Fixes an issue in the way the Tanium Client services sensor evaluation requests from the client extension framework, where it would return a "Sensor not found" failure during sensor synchronization operations. The Tanium Client will now enqueue these requests until the synchronization is completed.
Fixes an error condition in the state handling of outgoing HTTP connections from the Tanium Client which would produce the log error: assertion 'm_state == kStateEstablished' failed.
Prevents the Tanium Server from initiating new CPMS communications work when its queues are already too busy, which would result in a number of errors and failed assertions.
The Tanium Server will now sometimes re-read and re-interpret the contents of sensor string files. This change ensures that reinterpretation is immediately serialized back to disk.
Fixes an issue in the initialization of Tanium Client throttles which would result in the log error: assertion 'm_count < kMaxThrottles' failed.
Fixes an omission in the Tanium Client mechanism which should stop its client extension framework which would cause the log error: assertion 'm_channel' failed while stopping or during a CX restart.
Fixes an issue in the Tanium Server which would calculate incorrect hashes for active-active string retries, which would result in constant hash collision errors in question results.

Known Issues

The Tanium Client will fail to parse a PAC proxy file referenced by ProxyAutoConfigAddress when more than one proxy server is defined, logging "Failed to parse proxy name. Too many colons" at LogVerbosityLevel=41.
Workaround: None. A fix for this issue is will be released with a new version of the Tanium Client post-v7.6.1.6432.

TaaS Release Date: October 17 2023

New Features

N/A.

Improvements

Tanium Platform components now ship with Curl v8.4.0.

Bug Fixes

Fixes an incorrect parsing of incoming SAML identity provider data in the Tanium Server which would trigger the error "SAML authentication failed: Invalid namespace prefix 'xmlns:xsi' for attribute" when InclusiveNamespaces were used.

TaaS Release Date: 5th April 2023

New Features

Implements API connections and request metrics on the Tanium Server to complement the new limits on maximum HTTP connections queued on the system.

Improvements

Implements timeout control over Tanium Server connections to its database to avoid the unnecessary growth of the connection pool and sockets under adverse operating conditions. The default connection timeout is 10 seconds and can be adjusted using the SQLConnectTimeoutSeconds local setting.
Implements a limit on the number of HTTP requests that can be queued in the Tanium Server at any one time, beyond which further connections will receive an HTTP-503 response. The default value for this limit is 1,000 and can be controlled through the MaxQueuedHTTPRequests configuration setting.

Bug Fixes

Resolves an issue where audit log entries are missing details on events where roles, user groups or personas modified.
Fixes a condition where a scheduled action could not be deleted if its corresponding content set and or other associated objects had been previously deleted.
Fixes a condition in the Tanium Server by which a Package file which had failed to download would not be fetched again when requesting a re-download through the Console or API.
Modifies the build of the TDownloader binary to avoid the error "SSL_read: Connection closed abruptly" which should only be triggered in debugging builds.

TaaS Release Date: 17th January 2023

Bug Fixes

Resolves an issue where Tanium strips the bypass approval privilege from a user assigned with both an Administrator role and a role with Endpoint Configuration Bypass approval privileges.
Fixes a regression by which the Tanium Server process will stop when it cannot communicate with its database, and would often happen during backup operations of the database.

TaaS Release Date: 13th December 2022

Bug Fixes

Fixes an issue where remote downloads are not reliably updating Tanium Server packages and Tanium Deploy package gallery items.

TaaS Release Date: 28th October 2022

New Features

Tanium now ships with Python v3.8.14.

Improvements

The Tanium Server in an Active/ Active deployment will now repeat file downloads when the hash contents of a downloaded file is not the same on both servers in the pair for the same URL. This is implemented to work around situations where content delivery networks on the Internet have mismatched files.
The Tanium Server Question Parser will now consider and use hidden Sensors if their spelling is an exact match when entered in the question bar.

Bug Fixes

Fixed an issue in the Tanium Server Question results API where attempting to filter on Sensor parameter names containing an underscore character (' _ ') would not return any results.
Fixes a conflict across the Tanium Server and Tanium Module Server RPM installers which would result in file conflict errors when both were installed on the same machine.
Fixed an issue in the instrumentation of the Tanium Server tanium_sensor_stats_invalid_total metric where any errors tallied were labeled with an error="negative" tag.

TaaS Release Date: 16th August 2022

Special Notes

Technology preview: The Tanium Server now offers User and User Group synchronization with SCIM providers, starting with support for Microsoft Azure.
Discuss with your TAM or Support Center if you are interested in this feature.

New Features

The Tanium Server is now offers User and User Group synchronization with SCIM for cross-domain identity management.
The Tanium Server will now enforce its server_timing_visibility setting on Server-Tming headers returned by components running on the Module Server.
The Tanium Server API now presents a CSP (Content-Security-Policy) header on API replies to satisfy security scanners.
The Tanium Server now provides new API methods and routes (api/v2/users/ID/metadata) to fetch, create, delete and modify with User metadata.
The Tanium Server /auth route will now accept only HTTP POST requests and return HTTP-405: Method not allowed otherwise. This is done to reduce the surface area of the authentication interface.
The Tanium Server now implements a mechanism for SCIM to access its API without the need of token renewals.
Tanium Platform components are now built using Curl v7.82.0 libraries.
The Tanium Server now implements a collection of tanium_ldap_* metrics to allow monitoring of LDAP synchronization and authentication operations.
The Tanium Server APIs will no longer require re-authentication when switching out from a Persona that requires it. Re-authentication will be required to enter that Persona identity but not to exit it.
Tanium Platform components now use Expat v2.4.8.
Tanium components now ship with OpenSSL v1.0.2ze.
The Tanium Server API implements a new route api/v2/preview_content_set_role_detailed that explicitly returns effective and denied privileges to avoid having to perform this calculations by the requester.
The Tanium Server now implements a metric tanium_active_user_count that tracks the number of active User accounts over the past thirty days.
The Tanium Server now implements tanium_server_challenge_* metrics which track the operation of server challenge requests and responses.
The Tanium Server Questions API now implements per-question settings that will benefit the efficiency of Sensor evaluation and data harvesting for Tanium Data Services (TDS).

Improvements

The Tanium Zone Server Hub will now relinquish communication and control of a Zone Server when it looses communication with its upstream Tanium Server. This enables proper fail-over to another Zone Server Hub when a Tanium Server is stopped.
The Tanium Server will now properly interpret and reflect the query text for Questions which use Filter Groups and filter expressions in their targeting clause.
The Tanium Module Server will now try all IPv4 and IPv6 addresses resolved when registering to a Tanium Server, which would fail before when both resolutions were provided but IPv4 traffic was disallowed.
The Tanium Server has improved the performance of its Questions API to reduce service times on requests that specify filters, benefiting response times to retrieve Question History as well as other Console interactions.
Tanium Components have dropped support for CBC -mode cipher suites: ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES256-SHA384, ECDHE-ECDSA-AES128-SHA256 and ECDHE-RSA-AES128-SHA256.
On upgrade the Tanium Server installer will now guarantee the removal of outdated AngularJS libraries possibly left behind by old solution module uninstallers.
The Tanium Server has refactored the handling of API session data within internal API request objects.
The Tanium Server Saved Action API now allows targeting anonymous filter groups by specifying them in canonical form text during object creation, obviating the need to first create a group and then create a Saved Action that references it.
Improved the multi-thread settings update guards in the Tanium Zone Server.
The Tanium Server will now interface with PostgreSQL requesting a WARNING level of logging instead of NOTICE. This can be changed using the PostgresClientMinMessages local setting.
The Tanium Zone Server setting zs_nat_address_mask and Tanium Server NATAddressMask now no longer take precedence over Intentional Subnet definitions, making it unnecessary to adjust their values when these subnets are configured.
Improved the Tanium Server SOAP API handling of cache_filter request settings which could result in a HTTP-400: CacheFilterNotYetImplementedForType error.
The Tanium Server API now adds the ability to filter requested elements by port_number.
The Tanium Server API now adds the ability to filter requested elements by id.
The Tanium Server config set-protected command line will now mask the input values provided by the user. Verification of the input can be achieved using the config get-protected command.
Improved the performance of the PKI server challenge operation.
Tanium server components will now retry failed downloads of solutions and workbenches. These Tanium contents are known to exist so retrying makes this mechanism more resilient to transient network errors.
Improved the way in which the Tanium Server evaluates Persona RBAC access to objects like Saved Actions to reduce request service times to Console pages like Roles and Personas.
Removed some old and used SQL code for RBAC control no longer in use by the Tanium Server.
The Tanium Server will now log SOAP requests with additional operation information into its http-access log.
The Tanium Server refactored access to RBAC privileges when evaluating Content Set allowed access to improve request performance.

Bug Fixes

Fixed an issue in the Tanium Downloader where concurrent access to CRL lists in its SQLite database could produce the error SQLiteDatabase: gave up on busy handler after waiting 5s and fail a download and subsequent solution installation or upgrade.
Fixed a bug in the Tanium Server api/v2/export API where it would return an HTTP-404 error when trying to export an existing Saved Action which has not been issued before, incorrectly returning the error: SavedActionNotFound.
Fixed an issue in the Tanium Server API where modifying a Computer Group using a specific Persona would return the id of the modifier but not its designated name, as is expected.
Improved the handling of duplicate named entries in the Tanium Server's database servers table which may contain duplicate names.
Fixed a bug in the Tanium Server where it could clean up old Packages which it should not and cause a PackageNotFound error when loading Action History on the Console.
Fixed an issue in the Tanium Server API where requesting api/v2/filter_groups using cache_filters would return an HTTP-400: CacheFilterNotYetImplementedForType error.
The Tanium Server will now not allow changing the type (Numeric or Text) for any Global Setting that has a default value, thus avoiding type selection mistakes in the field.
Fixed an issue with the Tanium Server which would keep it from starting up when encountering a malformed file under its SOAPUpload directory, logging InvalidUploadStateFile right before stopping.
Fixed a bug in the Tanium Server by which percent characters (%) in the password for a proxy configuration would be interpreted as a URL encoding, making it necessary to use a string like "foo%25bar" when trying to configure foo%bar as a password value.
The Tanium Installer removed misplaced END SQL commands which would result in log errors reporting No transaction in progress during database creation.
Fixed an omission in initializing the Content Set id in the processing of Computer Groups API.
Fixed the Tanium Server authentication API to report the X_Forwarded_For IP address to identify the source of the request originator.
Fixed an omission in the Tanium Server User Group API by which duplicate names could be specified.
Fixed an issue with Tanium Downloader where it would fail to detect and access SMB share directories marked read-only.
The Tanium Server API reinstated the ability to filter requests by some fields like group.type and metadata.admin_flag, name and value.
Fixed an issue with access to the Tanium Server API using an API Token which would generate the log error Invalid value for user's persona when the token was associated with a deleted Persona. Now the API will simply deny authentication as it should.
The Tanium Server API corrected an inconsistency between the /personas and /session/current responses where the first returned a setting named require_reauthentication_flag as singular where the second returned requires_reauthentication_flag as plural. Now both return this field label in the singular.
Fixed a bug in the Tanium Server api/v2/logout API where it would return an HTTP-403 response with error text reading "Forbidden".
Fixed a bug in the Tanium Server which caused Action audit reports to return empty details column values.
Fixed a bug in the Tanium Server Packages API where using the source_id, verify_expire_seconds, skip_lock_flag or process_group_flag fields for filtering would result in an HTTP-500 response along with the error: Invalid package field name.
Modified the Tanium Server and Module Server installers on Windows to avoid logging errors about missing certificates and signature verification when these elements are not yet available during installation.
Fixed a bug in the Tanium Server Personas API which would fail to correctly return the configured value for require_reauthentication_flag when calling api/v2/personas.
Fixed a condition in the Tanium Server where users that were auto-provisioned into the system were assigned unrestricted Computer Groups access instead of what their designated User Group specifies.
Fixed a problem with the database cleanup in the Tanium Server which would cause existing Saved Questions to be interpreted as Get number of machines instead of their original Sensor selections.
Fixed a bug in the Tanium Server SAML integration where XML namespaces failed to be interpreted correctly and result in the error: SAML authentication failed: XMLSignatureException.
Fixed a Tanium Server issue when retrieving Question where it wasn't possible to sort the results on rightmost columns when more than sixteen columns were returned. This fix will only apply to and work on data returned by v7.4+ clients.
Fixed an uncommon condition in the Tanium Server and Zone Server which could cause and log the error Cannot QueueRecv when recv state is not paused during periods of high server challenge request activity.
Fixed a bug in the Tanium Server which would cause policy-based Scheduled Actions to stop being issued when they were disabled and then re-enabled.
Fixed an omission in the Tanium Server installer where it would no longer create the allow_process_group_flag_edit setting, leaving it missing on new installations.
Fixed a TDownloader issue where it could fail to download files in authenticated SMB shares with the error: Unknown error fetching file: boost::filesystem::status: The user name or password is incorrect.
Fixed a bug in the Tanium Server Saved Question API where it would return QuestionNotFound if for any reason the original definition was missing. The API will now return [question definition is missing] instead, to avoid failures in Console.

TaaS Release Date: 28th June 2022

Improvements

Improved the performance of the PKI server challenge operation.

Bug Fixes

Fixed a problem with the database cleanup in the Tanium Server which would cause existing Saved Questions to be interpreted as Get number of machines instead of their original Sensor selections.
Fixed a bug in the Tanium Server SAML integration where XML namespaces failed to be interpreted correctly and result in the error: SAML authentication failed: XMLSignatureException.
Fixed an uncommon condition in the Tanium Server and Zone Server which could cause and log the error Cannot QueueRecv when recv state is not paused during periods of high server challenge request activity.

TaaS Release Date: 8th April 2022

Improvements

The Tanium Server now exposes a /internal/monitoring/v1/dashboards route slated to return Grafana dashboard definitions compatible with the /metrics it offers.
The Global Setting for max_console_idle_seconds will now be exposed in Cloud environments for customers who wish to extend their idle auto-logout period beyond the standard 1 hour.
The Tanium Module Server will now enforce a minimum use of TLS v1.2.
The Tanium Server API will now honor the X-Forwarded-For header when evaluating the IP address source of an incoming API Token request if the authenticate_api_token_with_x_forwarded_for_ip setting is in place.
Tanium Server components will now write all of their configured trusted certificates into the file specified by TrustedCertPath, thus allowing other solutions to read and use them in their communications.

Bug Fixes

Fixed a condition in handling the management of incoming Client connections without valid crypto materials and which would result in repeated log messages that read: unexpected 315 message without client certificate.
Fixed a problem in the Tanium Server API where creating a Question and specifying a non-existing named group would issue the question against All Computers.
Fixed an issue in the Tanium Server API when retrieving a Saved Action in an Action Group with the read_action_group privilege would deny access. This would cause issues in Action approval.
Fixed a bug in the Tanium Server where attempting to create an Intentional Subnet definition with a CIDR value that was previously deleted, returning the error: subnet range with cidr_string already exists.
Fixed an issue in the Tanium Server API where it was not returning an HTTP-503 response during startup and before the system was fully operational.
Fixed a logging error in the Tanium Server http-access log where the size of responses to the /auth route had incorrect sizes.
Fixed an issue in the Tanium Server upgrade where Packages which failed to download might populate a long error message in the packages table which could lead to an failure in database upgrade steps.
Fixed an omission in the Tanium Server API by which creating an Action without an explicit expire_seconds value would fail to inherit and use this setting from the Package being referenced and use a value of zero instead.
Fixed a bug in the Tanium Server where it could clean up old Packages which it should not and cause a PackageNotFound error when loading Action History on the Console.
Fixed a bug which caused the Tanium Server where policy-based Actions would not fire when based on a counting Saved Question.
Fixed an issue in the Tanium Server API where retrieving a Content Set Role wouldn't properly return its provided_on and provided_by fields.

TaaS Release Date: 15th March 2022

Security Updates

This release includes security updates. Details of the issues, including affected versions and mitigation information, can be obtained within Tanium's Support Portal or by contacting your TAM.

Improvements

Tanium software components not use OpenSSL v1.0.2zd.

Bug Fixes

Tanium software components not use OpenSSL v1.0.2zd.

TaaS Release Date: 22nd February 2022

Special Notes

Tanium Clients v7.4.4.1130+ are a prerequisite for the use of the new Intentional Subnets feature.

New Features

Changes in the Tanium Server database have been made to close gaps in schema differences between its Microsoft SQL and PostgreSQL implementations.
The Tanium Server now unifies both Import and standard API mechanisms for Actions so they both use the same implementation.
The Tanium Server now ensures transactional consistency in the creation and modification of policy-based Actions.
Made an internal improvement to the Tanium Server's RBAC computation of Users' effective group management, avoiding an unnecessary recalculation when updating users.effective_group_id.
The Tanium Server now uses its new RBAC caching model when accessing Package objects.
The Tanium Server will now allow the creation of a temporary Sensor from a parametrized source only if the requesting user has the permission to define new Questions.
Introduced internal storage efficiencies in the way RBAC Content Set privileges are stored and evaluated when serving API requests.
The Tanium Server now offers a more consistent treatment and presentation of administrator effective privileges, avoiding an HTTP-404 request error when making requests to obtain current session information.
The Tanium Server API will now allow administrator users to read and execute plugins despite of their designated Content Set, even when it is not defined.
The Tanium Server has introduced performance improvements in its RBAC evaluation which will benefit deployments with complex configurations.
The Tanium Server now allows and honors the use of a Plugin-Timeout request header which defaults to 60 seconds.
Introduced significant performance improvements in the Tanium Server's Saved Actions API.
Implemented database and SQL improvements which make Package API POST requests much faster than they were before.

Improvements

The Tanium Server now supports defining whether a Persona requires an authentication prompt to switch to it. This is offered as a layer of security over chosen Persona capabilities.
The Tanium Server is now fitted with the ability to implement gRPC support.
The Tanium Server and Console now implement the Intentional Subnets feature as a configurable mechanism to allow endpoints with different NAT addresses to peer with each other.
The Tanium Server API now implements methods to retrieve differential Question results in increasing data draws. This allows large scale questions to retrieve newly received endpoint data in increments.
The Tanium Server now implements a more efficient internal-only mechanism to retrieve large Question results.
The Tanium Server authentication token API now allows specifying an optional Persona when creating a new token. This Persona must be associated with the requesting user account identity.
The Tanium Server now uses its latest database caching implementation for RBAC related queries and services, speeding up RBAC API requests.
The Tanium Server's /metric route now offers the tanium_install_date which indicates the time the server instance was first installed, in milliseconds since the epoch.
The Tanium Server Import API now offers better error feedback when a Group definition is not found, pointing out both the missing group and the context in which it was referenced.
The Tanium Server now adds foreign key constraints to Action and Scheduled Action objects against the groups they reference.
The Tanium Server now uses its improved Packages cache to manage its queue of package files pending downloads, thus reducing load on the database when querying this information.
The Tanium Server now implements a multi-threaded model for its internal updates of incoming Question results from clients, improving the rate and scale at which large cardinality data can be gathered in very large environments. The number of threads used in a system can be controlled with the Global Setting process_cache_batch_threads which defaults to 1 (one) and offers a set of metrics to track their performance in tanium_question_writer_*.
The Tanium Server will now clean up old *_archive directories left behind during the installation of module solutions, which would take up unnecessary storage.
The Tanium Server now implements cleanup of its package_files and server_package_files records for Packages which are deleted and no longer exist.
The Tanium Server will now remove orphaned download progress files from its Downloads directory.
The Tanium KeyUtility now lists the supported hashing algorithms for its calchash command in the help text provided.
The new Tanium Server API that offers differential updates for Question results now offers a total_computer_count field, reflecting the number of distinct endpoints present in the full result set.
The Tanium Server saml_settings Global Setting now allows the use of simple XPath predicates for the selection of username fields.
The Tanium Server now uses a more precise timing control to calculate bandwidth throttle limits which were not fully consumed. This increases performance in network operations.
The Tanium Server has modified its behavior to return the next-to-last date and time for last_login when requesting information for the current session. This offers better information than returning the date and time of the current login time.
The Tanium Server will now reset the Content Set that a group is associated with when its filter_flag is updated to be false. This had no effect in the operation of the system but offers the correct semantics to this type of object.
The Tanium Server will now produce individual audit records when modifying the User Group assignments for a user, avoiding the creation of excessing and unnecessary audit information.
Improved the performance of the purge_question_data stored procedure in PostgreSQL databases.
The Tanium Server RBAC API now allows retrieving User objects by name.
The Tanium Server instrumentation now offers the tanium_database_cleaner_seconds metric to reflect the duration of its database cleanup operations.
The Tanium Server LDAP-authentication will consider both the base search from which a user was synchronized as well as its registered distinguished name when validating a given password.
The PostgreSQL installation on a Tanium Module Server will now be configured to allow as many as 256 concurrent connections instead of the previous 100.
The Tanium Server will no longer use its database pool resources to communicate with the legacy tanium_archive database or data tables.
The Tanium Server will reset database connections associated with the very common /auth API requests as a way of reducing its connection pool size.
The Tanium Server's Action History API introduces performance enhancements in calculating the RBAC visibility of large numbers of objects.
The Tanium Server and Tanium Downloader now allow the use full URI prefixes to specify download authentication certificates, which makes it possible to configure separate credentials for URLs like https://download.foo.com/server/ and https://download.foo.com/desktop/.
TDownloader will not require a domain or port to be specified in root certificates for validation. They will be honored when downloading if specified, but they will no longer be required.
Improved the performance of the procedures that periodically perform cleanup of unused temporary Sensors.
Improved the performance of the procedures that periodically perform cleanup of old Questions.

Bug Fixes

Fixed an issue in the Tanium Server's reissuing of Saved Questions where it would not honor the Persona of the User that created the question.
Fixed a bug in the Tanium Server in which the Question Parser would not quote Sensor names when they contain reserved words, like "with" in Running Processes with Hash.
The Tanium Server components installers on TanOS now ensure that binary files are owned by root:root.
The Tanium Server Client Status/ System Status API now allows for proper sorting over its public_key_value field, making this ordering possible within the Console UI.
The Tanium Server now introduces integrity constraints between Action and Saved Action objects and will clean up old Actions which do not have a Saved Action object associated with them.
Fixed a bug in the Tanium Server Package import during the validation of downloaded files where content hash values were not compared in a case-insensitive way and would fail to download even when their contents were correct.
Fixed a memory growth condition in the Tanium Server associated with the storage of old issued Saved Question references.
The Tanium Server Action Groups API now returns information about the date and user indicating when the object was last modified.
Fixed an error in the Tanium Server's database maintenance cleanup subsystem which could cause premature deletion of Saved Questions and their associated Questions when purging them by their created_time instead of their modification_time.
Fixed an issue in the Tanium Server during shutdown where the destruction order of string cache and SOAP cache objects could cause a crash while stopping.
Fixed a referential integrity problem in the handling of legacy keys Tanium Server's pki.db which would result in the logging of the error: Failed to import legacy key: FOREIGN KEY constraint failed.
Fixed a condition in the Tanium Downloader (TDownloader) by which it would not ignore expired certificate authority certificates and produced certificate has expired download errors, of late against Let's Encrypt signed certificates.
Fixed an issue in the Tanium Server which would result in [CRU] errors in the preview available while editing a Sensor.
Fixed a bug in the Tanium Server API by which users' Last Sign In date and time would not be displayed after upgrading to v7.5.2.3053 version of the platform.
Fixed a bug in the Tanium Server when deploying Sensor-sourced packages where the source question contains a parametrized sensor, resulting in the error Exception: SensorNotFound as the result of its request to saved_actions.
Fixed a bug in the Tanium Server metrics where Total_Messages_Sent were reported with values of zero.
Fixed a bug in the Tanium Server where it could fail to invalidate and refresh its internal Action History cache, resulting in stale information being presented to the user.
Fixed an issue in the Tanium Server database which could cause a deadlock in update operations on the package_files table.
Fixed a bug in the Tanium Server's API by which creating a Filter Group with the same name as an existing Computer Group would not detect their name collision but would instead create a new group and mark the existing one as deleted.
Fixed a bug in the Tanium Server's authentication token API where PATCH requests to rotate a token would result in an HTTP-404: Item not found response.
Fixed the Tanium Client installer for MacOS in that it contained Universal Binaries but the package itself required the Rosetta subsystem to be present in order to execute the installation.
Fixed the handling of the disabled_flag in the export and import which would not be handled correctly, causing imported Saved Questions to be reissued every two minutes when they should not be reissued.
Fixed an issue in the Tanium Server's API where groups created with parametrized Sensors could have their parameters listed out of order.
The Tanium Server has introduced improvements in the management of its database connection pool to avoid a connection error that logs: SOAPRBACCache - SQLException: SQL Exception FATAL: sorry, too many clients already.
Fixed a condition in which exporting a Saved Action from the Tanium Server would fail with an HTTP-404: Item not found error if there happened to exist duplicate named Saved Actions present in the database.
Fixed the matching of AuthURL values configured for TDownloader so they can be used as prefixes to download URIs.
Fixed an issue in the Tanium Server database scripts which would fail an upgrade on improperly paired Sensor records, showing the error: DETAIL: Key (sensor_id)=(0) is not present in table "sensors".
Fixed a bug in the Tanium Server Sensor API where PATCH requests would incorrectly change the sensor's result type to Text.
Fixed an edge case in the Tanium Server's Question Parser where it might fail to parse a Question text generated by the Question Builder.
Sensor names will now be limited to 256 characters to match other type definitions in the Platform.
Fixed the handling of Content Set assignments when executing Tanium Server plugins.
Fixed a problem with the Tanium installer on Linux where Module Server SQLite *.db files failed to be delivered with tanium:tanium as their owner.
Fixed a bug in the Tanium Server Content Set Role API which would cause the description to fail to be updated when being changed during an update import operation.
Fixed a bug in the Tanium Server API where retrieving all Plugin Schedules by an administrator user would result in the error Content set not found if the object referenced a non-existing Content Set.
Fixed an issue in the Tanium Server that would stop the scheduling of Actions when a malformed policy-based Scheduled Action was missing its associated Question, logging ScheduleActionsNow: Caught exception SavedQuestionNotFound and not scheduling any more Actions after that.
Fixed an issue in the Tanium Server database upgrade process which would cause it to fail, claiming already existing *_audit_all_index indices on several audit tables.
Fixed a bug in the Tanium Server by which it would incorrectly mark all keys in pki_root_keys as legacy_314_flag=1.
Fixed a condition where the Tanium Server upgrade to v7.5.2 could result in no endpoints being able to complete registrations, with the telltale server log message: No current registrar snapshot.
Fixed a bug by which the Tanium Server could retrieve group row definitions from a database in an indeterminate order and produce unexpected results for filter and select specifications.

TaaS Release Date: 30th November 2021

Improvements

XPath expression with selectors pick up the correct value for the user name from the SAML message.
Improved the performance of the purge_question_data stored procedure in PostgreSQL databases.

Bug Fixes

Fixed a bug in the Tanium Server Package import during the validation of downloaded files where content hash values were not compared in a case-insensitive way and would fail to download even when their contents were correct.
Fixed an issue in the Tanium Server during shutdown where the destruction order of string cache and SOAP cache objects could cause a crash while stopping.
Fixed a condition in the Tanium Downloader (TDownloader) by which it would not ignore expired certificate authority certificates and produced certificate has expired download errors, of late against Let's Encrypt signed certificates.
Fixed an issue in the Tanium Server which would result in [CRU] errors in the preview available while editing a Sensor.
Fixed a bug in the Tanium Server API by which users' Last Sign In date and time would not be displayed after upgrading to v7.5.2.3053 version of the platform.
Fixed a bug in the Tanium Server's API by which creating a Filter Group with the same name as an existing Computer Group would not detect their name collision but would instead create a new group and mark the existing one as deleted.
Fixed the handling of the disabled_flag in the export and import which would not be handled correctly, causing imported Saved Questions to be reissued every two minutes when they should not be reissued.
Fixed an issue in the Tanium Server's API where groups created with parametrized Sensors could have their parameters listed out of order.
Fixed an issue in the Tanium Server database scripts which would fail an upgrade on improperly paired Sensor records, showing the error: DETAIL: Key (sensor_id)=(0) is not present in table "sensors".

TaaS Release Date: 22nd October 2021

New Features

The Tanium Server will now log SAML processing errors at LogVerbosityLevel=1 to make them easier to see and correct.
The Tanium Server's Sensor's schema and APIs have been refactored to offer variable hash size selection of its result encoding hashes.
Added the ability to configure TLS signature verification algorithms to be either RSA or elliptic key, even when both algorithms prove to be equally performant.
Implemented JSON serialization support for the next-generation GetResults operation in the Tanium Server API.
Built support for data merging on the Tanium Server to support the next-generation version of Question results.
The Tanium Server now implements special support for next-generation GetResultInfo and GetResultData operations for Action statuses.
The Tanium Server now implements new high-performance disk serialization formats for Sensor results, in preparation for next-generation results reporting from endpoints.
The system that filters results in the Tanium Server now has a parallel-processing implementation.
The Tanium Server now controls the maximum parallelism allowed for concurrent memory allocation operations through the Global Setting tbb_global_max_allowed_parallelism (Server, Numeric) which defaults to the number of CPU cores on the running system or 32, whichever is smaller. This setting will help avoid contention in memory allocations in some of the largest systems in the field and should rarely -if ever- need modification.
The Tanium Server has removed support for the SOAP APIGetAnyObject operation.
The min_active_question and min_active_action tables in the Tanium Server database are no longer used and have been dropped.
The Tanium Server SOAP API will invalidate its object caches for every object included in a create, update or delete operation. This is part of the implementation of its cache-synchronization and consistency strategy.
Improved the responsiveness and speed with which ThreadGroups will terminate in the Tanium Platform.
Removed code that is no longer used in the Tanium Server API for XML input parsing and output serialization.
Added functionality to the Tanium Server export/ import API to be able to serialize and deserialize objects represented in API format.
Modified the scope of memory allocations in threads to keep proper visibility into its activity and measures.
Tanium components will now use the TBBAllocator libraries in UTF-8 mode for better compatibility with Windows systems running in this mode.
Modified process information for Tanium components to be compatible with Windows systems running in UTF-8 encoded filesystems.
Tanium components will now handle properly Windows error messages reported in UTF-8 encoding.
The Tanium Server will invalidate a Question results live cache if its contents have changed by more than 1% instead of 10% to offer a better result retrieval experience.
The Tanium Server now uses TBB Allocator instead of malloc() when parsing XML structures for better memory accountability and control.
The Tanium Server does away without the most_recent_qid column in the saved_questions table and the whole sqid_triple_to_qid table itself, and uses direct SQL to return the best matching Question id for a Saved Question.
The new Tanium Server cache implementation does away with the old Active Question Cache internal structure and provides the same information using direct SQL in a way which is more efficient and performant.
The Tanium Server will no longer automatically issue "behind the scenes Action verification Questions" under the hood since this information has been provided by the Tanium Client for over seven years now.
The Tanium Server has an improved internal representation for Sensor and Question results to support next-generation results handling.
Tanium components now use TBB v2012.2 where the MSVC v2012 runtime is no longer needed and has been removed from the installer.
The new Tanium Server object cache implementation now uses direct SQL implementation for Question add and delete operations.
Tanium Platform components now use TBB's arena and task observer construct to be able to parallelize certain operations and still control their processor affinity.
The new Tanium Server object cache implementation now uses direct SQL implementation for Action add and delete operations.
The Tanium Server has improved RegEx matching performance which is beneficial when filtering large Question result sets.
The v315 protocol now augments its AddSensor messages with Sensor definition ids which will allow schema version identification in next-generation results reporting.
The Tanium Server now offers more lightweight wrappers around SSL hash functions to improve performance on cryptographic operations.
The new caching implementation in the Tanium Server now implements proper ordering of object dependencies when choosing refresh orderings.
The Tanium Server now has the infrastructure requirements for the implementation of next-generation String reports.
Platform components now use SQLite v3.35.5.
The Tanium Server now guards exceptions thrown by libexpat in handling of XML errors, now adequately halting parsing instead of propagating as upstream errors.
The Tanium Server now uses direct SQL for Content Set API request handling.
The Tanium Server Question History API now follows the improved cache implementation used by other objects, solving some read-after-write consistency problems.
The Tanium Server SOAP API has deprecate the GetSavedQuestions operation which is no longer in use by solution modules.
Simplified several places in the Tanium Server code which updated Question expiration values.
The Tanium Server API will now return the approver_persona_id and approver_persona_name for Saved Actions that required approval.
The Tanium Server's in-memory Action History cache now implements MVCC to control and guarantee consistency with other object caches.
Validated the mainline performance of the new cache implementations in the Tanium Server.
The Tanium Server no longer uses its old internal SOAPCacheRefresher which is unnecessary under the new caching design.
The Tanium Server HTTP instrumentation for requests now includes information about the timing of filter and sort operations used during processing.
Modified the Tanium Server's garbage collection mechanism on cache refreshes, improving its performance when operating over a large number of cached objects like Groups.
Improved the performance of cache-refresh queries in the system through an improved handling of sequence column values to filter the query results.
The Tanium Server during startup will now log the type and version of the operating system it is running on.
Tanium Platform components now ship a Bill of Materials (BOM) that specifies all third party software components and versions included in the binary build.
The Tanium Server improved performance when calculating RBAC visibility to a single Sensor through its API.
The Platform Components pki show command line now offers an optional --fingerprint <fingerprint> option to display a single certificate along with all of its parents in the certification chain.
The Tanium Server Packages API now supports a summary option which will omit file details in its result, reducing the size of the response sent to the caller.
Improved the granularity and readability for insufficient RBAC privilege errors when accessing Action Groups.
Changed be behavior of the Tanium Server's to allow visibility into all of the content objects owned by a User or Persona, which would otherwise impair the management of these objects.
The Tanium Server now offers a Global Setting default_global_language which is to be used to specify the default language/ locale for Console users, instead of using their browser's local setting.
The Tanium Server will no longer honor the grouped_action_offset_seconds which is deemed unnecessary in issuing new Actions.
The console_default_global_language Global Setting default value will now be set to "default" which best matches the desired Console behavior.
Tanium Platform components now use libexpat v2.4.1.
The Tanium Platform now uses and presents an EULA update for 2021-08-23.
The Tanium Platform components will now use Python v3.8.12.
Tanium Platform components now use OpenSSL v1.0.2zb.

Improvements

The api/v2/users route now returns the number of active sessions for each user as the attribute active_session_count. This count is produced directly from the authentication system and counts all non-expired sessions for valid users, which is why it might seem high.
The Tanium Server now offers the DELETE operation for /api/v2/server_trusts route, which makes it consistent with the GET and POST operations over the same route.
The Tanium Platform now offers the ability to limit the number of allowed connections in Site Throttles.
The Tanium Downloader has now been upgraded to use Curl v7.77.0.
Added clean-downloads CLI command to the TS, to allow manual cleaning of the download cache.
The Tanium Server now offers API routes (downloader_auth_users, downloader_auth_certs and downloader_trusted_certs) which will allow to programmatically configure TDownloader authentication settings to external systems.
The Tanium Server APIs now offer deeper sorting of nested object results through the cache_sort_order and sort_order request parameters.
The Tanium Platform now implements its own PKCS#11 engine which will offer the control necessary to better support a wider range of hardware security module (HSM) vendors.
The Tanium Server will now periodically update the contents of the tanium-init.dat file in its installation directory.
Platform components now use boost v1.75 libraries.
The Tanium Server will now enforce unique case-insensitive Group names.
The Tanium Server's LDAP synchronization API allows previewing the impact of deleting an LDAP connector by offering a list of Users and Groups that will be removed if a connector were to be removed. This will allow a better user experience on the Console.
Discontinued the use of the update_min_active_question stored procedure in the tanium database in favor of a new, more efficient method that uses the expiration_time from the questions database table.
The Tanium Server installer now makes id the primary key on the select_specs table in PostgreSQL, as a performance improvement.
Error messages "Failed TLS handshake unexpected EOF" are now logged at verbosity level 20 in order to reduce log-spamming on what is a rather common condition.
The Tanium Server and Zone Server components will no longer use Main for their main running thread, so this label does not appear anymore in debugging and monitoring tools which is confusing.
The Tanium Server API will now deduct Group types by their name and depending on the context in which they are used, so the caller is not forced to specify the <type> parameter with every call.
The Tanium Server caches implementation greatly reduces network traffic to its database and CPU consumption in the database server.
The Tanium Server REST API now supports a verify_signatures route, providing parity with the SOAP API.
The Tanium Server API now offers the possibility of embedding configuration parameters like ServerPort and/ or proxy settings in an exported tanium-init.dat bundle, offering better coverage for non-default client installations.
The Tanium Zone Server will now use a unique subject name every time it creates new TLS CA certificates.
The Zone Server messaging API has been extended, now allowing a Zone Server to report which Zone Server Hub is currently connected to it, also extending the Tanium Server API to return this information upon request to the Console UI.
As part of its new in-memory cache implementation the Tanium Server will now use multi-version concurrency control (MVCC) management to ensure referential integrity across caches.
The Tanium Server REST API now offers sub-routes to api/v2/content_set_roles/:id/membership which return the User and User Groups that are assigned to the Content Set.
The Tanium Server API will now return a content_set_roles property when querying User or User Group objects to list the roles directly assigned to them.
The Tanium Server API now produces information about object creation and modification for all RBAC objects.
Fixed a bug in the Tanium Server installer where it would install a Module Server of a different and incorrect version if that installer was found in its PATH.
The Tanium Server's in-memory Packages cache now implements MVCC to control and guarantee consistency with other object caches.
The Tanium Server API will now refuse to delete Personas with existing Saved Questions, Saved Actions or Plugins.
The Tanium Server's /metrics route now provides tanium_protocol_message_* measures for the amount of data exchanged with Zone Servers through their intermediary Zone Server Hub.
Separated the cached User and Persona information from other objects as part of the Tanium Server's new cache implementation.
The Tanium Server and Zone Server will now log Failed certificate re-verification at LogVerbosityLevel=51 for expired certificates (which are perfectly normal) and at LogVerbosityLevel=11 for all other re-verification reasons. These operations are also now tallied and reported in the pki_tls_reverification_failures metric counters.
The Tanium Server's /metrics subsystem can now identify and tag multiple external sources, allowing it to present the measures for multiple Zone Servers at a time.
Added Saved Question support to the new and upcoming GetResultDataV2 Tanium Server API.
The new Tanium Server object cache implementation now uses direct SQL implementation for Package add and delete operations.
Removed no longer used and unnecessary Action verification code from the Tanium Server.
Tanium components will now use the boost libraries in UTF-8 mode for better compatibility with Windows systems running in this mode.
The Tanium Server API now offers cache_filter functionality for both dashboards and dashboard_groups eliminating the need to do client-side filtering of request results on these objects.
Cryptographic keys used by the Platform are now ensured to expire one hour later than their specified renewal window to avoid their premature and repeated reissue.
The Tanium Server's personas API route now supports an include_persona_owned_object_ids_flag=1 that will return an owned_objects_id in the result, indicating the objects owned by the Persona.
The new Tanium Server object cache implementation now uses direct SQL implementation for Groups add and delete operations.
The new Tanium Server object cache implementation now uses direct SQL implementation for meta-data add and delete operations.
The Tanium Server executable now offers the command-line option show-guid to display the server's assigned GUID without the need to open the pki.db with SQLite.
The new Tanium Server object cache implementation now uses direct SQL implementation for Sensor add and delete operations.
The Tanium Server now adds primary keys and constraints to its content_set_role_membership and content_set_user_group_role_membership tables to guarantee a single row result in joining these tables.
Modified the letter case for platform names applicable to Sensors in the Tanium Server's export API, so these names read Linux instead of LINUX.
The Tanium Server API now allows modification of the max_strings and max_string_age_minutes properties of reserved Sensors.
When exporting Saved Questions that reference deleted Sensors the Tanium Server export API will still return an HTTP-404: SensorNotFound error, but the error wording now will include the name of the offending question so it can be examined in Console and dealt with appropriately.
The Tanium Server now enforces uniqueness over Sensor hashes to avoid the risk of collisions in this realm, thus confusing two different implementations.
Implemented cache-refresh ordering controls for their new implementation in the Tanium Server, respecting the data dependencies between these objects.
All audit table row insertions have now been normalized to use the same database server based time, instead of depending on the Tanium Server's clock for timestamps.
The Tanium Server now uses database transactions when inserting all types of RBAC objects.
The Tanium Server's in-memory Saved Actions cache now implements MVCC to control and guarantee consistency with other object caches.
The Tanium Server now exposes a /internal/monitoring/v1/dashboards route slated to return Grafana dashboard definitions compatible with the /metrics it offers.
The Tanium Server now offers its own PKCS implementation to improve and exceed the performance of third party implementations when working with cryptographic HSM modules.
The Tanium Server API will no longer append the string "deleted" to Saved Actions associated with (or authorized by) deleted users. No other object does this and the content transfer API is available to enumerate these cases.
The Tanium Server Platform Settings API now favors the created_time, modified_time and last_modified_by response fields as the correct source of modification history when requesting these parameters.
The Tanium Server will now fully handle Action Groups as part of its internal Groups cache implementation, simplifying much of their management requirements.
The Tanium Server's RBAC now implements privileges to control read and write access to the TDownloader authentication settings API.
The log rotation subsystem within Tanium components no longer spam their logs with repeated "Unable to remove log file" messages. This helps to keep I/O loads down during extreme low disk space conditions.
A Tanium Zone server will now log error messages when a Zone Server Hub of the wrong version connects to it.
The Tanium Downloader (TDownloader) now supports multiple sources for its authentication credentials and certificates: Auth, DownloaderUserAuth, DownloaderCertificateAuth and DownloaderTrustedCertificate.
The Tanium Downloader now offers audit tracking for its configuration settings: downloader_auth_user, downloader_auth_cert and downloader_trusted_cert.
The Tanium Downloader now supports password protected certificate private keys for authentication.
The default out of the box setting for Console confirmation prompts is now the expedient "Yes/ No" console_confirmation_prompt_type=1. New installations can still set this value to zero if they wish to revert to old-style username/ password confirmation prompts.
Changed the behavior of the Tanium Server's API so a request for Sensors with summary=1 will return a smaller summarized object that only omits the script implementation for the Sensor, which is the largest part of the result.
The Tanium Downloader (TDownloader) authentication to sources now allows certificate pinning as a means of validation.
The Tanium Server database has dropped a series of redundant indices in Global Settings, Packages, Saved Questions and Sensor audit tables.
The process of LDAP-synchronization will no longer generate duplicate audit records when not warranted, thus reducing the number of rows in the users_audit table.
The Tanium Server now presents a /metric named tanium_metrics_time which represents the process' running clock value at the time that metrics are reported.
Added sequence indices to the databases meta-data tables to improve the performance of the SQL queries used to refresh and cache their contents.
The Tanium Downloader will now log errors in parsing download endpoint revocation list URLs at LogVerbosityLevel=1 for better visibility.
The Tanium Server will now follow Windows active directory validation rules to avoid the use of incompatible user names containing the characters /\\\[]:;|=,+*?<>.
The TDownloader authentication settings API serviced by the Tanium Server now returns display_name and description string values to better service the Console user interface.
The Tanium Server and Zone Server now accept the Local Setting PKISubjectName will allows overriding the presence of a server's FQDN in exposed crypto materials with an alternate string.
The TDownloader authentication API serviced by the Tanium Server now supports display_name, subject_name, issuer_name, start_date and expiration properties in order to allow building a more user-friendly management user interface.
The Tanium Server and Client now implement special safeguards to avoid invalid updates to Sensor stats data which have been found to poison the Sensor Runtime information stored and displayed in the Console. A new log file invalid-stats has been created to capture events when these stats are found to be incorrect and keep a /metrics counter on the server for these invalid reports: tanium_sensor_stats_invalid_total.
The Tanium Server has a more efficient and fast way of loading Question objects on startup, greatly reducing the time needed to be ready for operation.
The Tanium Server has redesigned the way in which it interacts with the soap_sessions, drops the sessions_soap_archive table and now uses the users_last_login_time table to keep track of last login times for User accounts, simplifying database interactions and improving performance.
The Server-Timing HTTP reply headers in Tanium Server API for SOAPRequestSnapshot requests now share the same underlying session instrumentation objects as all other request types.
Improved the performance in the Tanium Server when re-verifying signatures of PKI objects. This is particularly important in improving the re-utilization of SSL session tickets.
The Tanium Server database now encodes the duration_in_second column in the data_purge_history table to allow for large values which were previously lost when inserting cleanup run rows.
Improved the execution times for the Tanium Server's cleanup of the select_specs table which could take a long time to complete and impair the ability to ask new Quesions while the cleanup operation was running.
The deleted_flag column in the package_files table is now forced to be NOT NULL which makes SQL queries more efficient in their execution.
The Tanium Server cleanup operation now uses a more efficient way than previously to determine the number of cleaned rows in each database table.
The Tanium Server's Personas API will now deleted entries when using the hidden_flag=1 option, which are needed by the Console content transfer page.
The Tanium Server API for TDownloader authentication settings will now trim white-space in the request data provided, to make it more user-friendly and avoid NoCertificateFound or x509 request results.
The Tanium Server will now log idle HTTP connection timeouts to LogVerbosityLevel=61 to reduce log spamming on a condition that is mostly benign.
The Tanium Server will cache writes to the sessions_soap table in order to reduce database interactions when validating sessions for every API request. Reads from sessions_soap are not cached.
The Tanium Server now offers an API route (effective_roles) that returns the effective Content Set roles for the current authenticated session.
Changed be behavior of the Tanium Server's to allow visibility into all of the content objects owned by a User or Persona, which would otherwise impair the management of these objects.
Refactored the code responsible for Action approval to use the same handler on both Microsoft SQL Server and PostgreSQL.
Compression of request results is now handled within API processing threads instead of network communications threads, allowing networking threads to accept and process other incoming requests. The response Server-Timings will also report time spent performing this compression.

Bug Fixes

The redesign of the Tanium Server's object cache management has resolved events where solution modules like Deploy would encounter the error SavedQuestionNameNotUnique when deleting and re-creating a Saved Question.
The Tanium Server has resolved read-after-write consistency issues in the Sensor API by a redesign of its internal cache management mechanisms.
Fixed the calculation of invalid and impossibly high Sensor runtimes which would appear in the Console displays.
Fixed an issue in the Tanium Server which would prevent the archive_soap_sessions stored procedure to be executed when the archive_soap_sessions_interval_hour Global Setting does not exist in the system. This can be confirmed when the archive_soap_sessions_last_run Global Setting never change its value and by the constant growth of the archive_soap_sessions table which is detrimental to performance.
Fixed an issue in the management of the Tanium Server's internal periodic jobs which might continue executing during a shutdown and reference objects which were already destroyed, resulting in process crashes during shutdown.
Fixed a read-after-write consistency problem with the Tanium Server User API which would result in HTTP-404 (Not Found) responses when looking up a user account by id right after creating it.
Normalized the treatment of Group uniqueness between the Tanium Server's Import and request API so they are evaluated in the same way for both.
Fixed a bug in the Tanium Server Groups API which would cause manual Filter Groups to always be created in the "Default Filter Groups" Content Set.
The Tanium Server has fixed the problem of reissuing Saved Questions and Actions, as well as scheduling Plugins for deleted Personas.
The refactored handling of internal caches in the Tanium Server fixed an issue where after deleting a Package it would still be returned as existing until the server was restarted.
Fixed an issue in the Tanium Server's Global Settings API where it would return a SQL "Arithmetic overflow error" error for large numerical values which cannot be converted to a float type.
Fixed a problem in the Tanium Server API route /api/v2/server_trusts which would fail when a server name in the result could not be resolved, returning an HTTP-500 error: ResolveHostFailed.
Fixed a condition where the Tanium Server would invalidate all in-memory caches when a User account was deleted, taking an unacceptably long time to perform the operation.
Fixed an omission by which the Tanium Server Export API would not include Sensor definitions used in Saved Questions when exporting Dashboards.
Fixed a condition in the Tanium Server where users with the Write Persona privilege could create a Persona but were unable to manage it due to missing privileges over other objects, resulting in RBACInsufficientPrivilege errors.
Fixed a problem in the Tanium Server's export API which would fail to produce Content Set or privileges when exporting a Role.
Fixed an issue with the Tanium Server's audit API which would return either incorrect or null values for the creation_time field.
The Tanium Server API no longer allows the creation of new Sensors in the reserved Content Set.
Fixed a behavior where the Tanium Server's API would not allow issuing an Action for a parametrized Package while also referencing it by name instead of id.
Added safeguards in both the Tanium Server and Client to fix the presence of invalid write_bytes values.
The Tanium Server's in-memory meta-data cache now implements MVCC to control and guarantee consistency with other object caches.
The Tanium Server's in-memory Groups cache now implements MVCC to control and guarantee consistency with other object caches.
The Tanium Server's in-memory Sensors cache now implements MVCC to control and guarantee consistency with other object caches.
Separated the cached Content Set information from other objects as part of the Tanium Server's new cache implementation.
Fixed a sporadic bug in the Tanium Server API User where creating a user might return a HTTP-500: SOAPUserNotFound error.
Fixed a bug in the way the Tanium Server registers Global Settings audit records where the id referencing the setting modified was always set to zero.
Fixed a bug in the Tanium Server that would cause failed authentications for accounts that have and provided UTF-8-encoded characters in their username or password.
Fixed an issue in the Tanium Server's Question Parser where it would fail to handle some filter conditions that used the same Sensor more than once and resulting in the error: parse_job group has unexpected number of filters.
Fixed an erroneous behavior in the Tanium Server API when creating a Manual Filter Group where the filter_flag would default to false instead of true.
Fixed a bug in the Tanium Server's instrumentation to fix double-counting of tanium_snapshots_total metrics.
Fixed a problem with the handling of Packages in the Tanium Server where Client download API operations would not progress beyond URLValidatedButNotYetAvailable when requesting a file with a known URL but a different upper/ lower case.
The Tanium Server API will no longer allow the creation of Sensors with names that begin with Linux: since this prefix is used internally by Tanium. In doing so it will return a more friendly error reminding the user that the prefix is not allowed, instead of returning an HTTP-404: SensorNotFound error.
The Tanium Server will now produce complete text representations for groups of Sensors, giving the user a full view of targeting expressions like Computer Name contains "X" or All Computers which would not be displayed explicitly before and could lead to targeting mistakes.
Changed the management of cached Package files in the Tanium Server database to ensure there are no more duplicate records stored in the server_package_files table.
The Tanium Server now offers the API route GET /api/v2/unregistered_clients which returns a list of endpoint clients which failed to register, most likely due to bad PKI (invalid keys) or failed server-challenge operations. This provides similar functionality to the old v314 "valid key" Client Status. The Server will track max_track_unregistered_clients (with a default of 100) to avoid this list from consuming too many resources.
Fixed an omission in the Tanium Server's export API where Sensors were missing their what_hash value.
The Tanium Server import API will now check for the All Computers in a case-insensitive way to avoid clobbering this special Group with a new definition.
Fixed a problem in the Tanium Server's management of User to Persona assignments where the sessions/as_persona/:id API would return an Invalid Persona error when the Persona id was assigned to more than one User.
The Tanium Server's groups API will no longer allow the creation or update of Action Groups which must be created using the action_groups route, because such groups did not contain all of the elements necessary in a proper Action Group definition.
The Tanium Server now enforces non-duplicate Package names in the database using a unique index over the name_hash column of the packages table.
The Tanium Server now uses a database unique index to enforce unique, case-insensitive Saved Question names.
Fixed a bug in the Tanium Server's import API that resulted in the error Filter groups must specify a name when importing previously exported Groups which contain other groups as part of their targeting expressions.
Fixed an issue in the Tanium Server authentication audit output where the returned results did not include the User identification for failed authentication attempts.
Fixed a bug in the Tanium Server API where deleting a Saved Actions would still show it as existing until the server was restarted and would even allow updates to the previously deleted object.
The Tanium Server will no longer close long-running API connections for as long as a request service handler is still associated with them. This implementation is considered preferable to the use of HTTP keep-alives.
The Tanium Server will no longer delete Packages associated with a regular expression Whitelisted URL when the URL's Expiration or Download interval meta-data is modified, but deleting the URL or changing its regular expression will trigger this deletion.
The new cache implementations fixes a bug where a single Computer Group assigned to a new User would not be returned in its management rights, but would be shown as soon as a second group was added,
Fixed a couple of typos in log messages for TransferNotAllowedForNonIdenticalUsers errors.
Fixed an edge-case behavior in the Tanium Server API where creating a new Saved Question that references a Question associated with another, the existing saved question definition would be broken by missing a question definition. This is not a problem that happens in Console but could be done through an API.
Fixed a problem in the Tanium Server installer which would fail when upgrading from databases with duplicate Sensor definitions, resulting in the error: Cannot insert duplicate key in object dbo.sensor_what_hashes.
Fixed an unreleased condition in the new Tanium Server caches implementation where background refreshes would not advance a cache MVCC version, resulting in unnecessary growth.
Fixed a bug in the propagation of cryptographic information to Zone Servers and Clients caused when a Tanium Server in an Active/ Active pair is revoked trust and decommissioned but its messages are still broadcast, resulting in Received untrusted signed PKITime broadcast: SignedMessageException messages being logged.
Fixed a bug in the Tanium Server installer database upgrade steps which could cause a failure in some environments with the error: relation "packages_available_time_idx" already exists.
The Tanium Server REST API now considers and treats JSON null values in the same way the SOAP API would treat an omitted tag in SOAP WSDL.
Fixed an issue in the Tanium Server when exporting and later importing a Package definition where it would not preserve its original "Ignore Action Lock" setting.
Fixed a bug in the Tanium Server Question API where it would return a zero Question id as the source for a Saved Question.
Fixed an issue where the Tanium Server would fail to synchronize its license information with the Module Server during networking failures and would halt its periodic synchronization. This would result in errors displaying module solutions on the Console.
Fixed a bug on the Tanium Server and Zone server where they would accept SSL session tickets from an endpoint after their cryptographic identities were expired, resulting in large numbers of Expired certificate log errors for these connections.
Fixed a Tanium Server database upgrade step which would result in log errors: ERROR: duplicate key value violates unique constraint: select_specs_pkey1 and impair the ability of the server to issue Questions.
Fixed an issue in the PKI handshake between Zone Servers and Tanium Server which would cause a multi-minute delay for them to register and show up as ready to establish trust.
The Tanium Server Group API will again allow the creation of Action Groups to support those solution modules which use this method.
Fixed the interpretation of source_id to take precedence over hash when specifying a parametrized Sensor in a way which services Console needs, even if this behavior will ultimately be deprecated.
Fixed a condition in the creation of database audit rows which would cause the rows to skip id numbers, which gave the impression of missing audit records.
Added some missing module dependencies in the Tanium Server's Python build necessary for the PAM module used in TanOS, which resulted in log errors like: No module named 'six'.
Tanium Packages which are cloned while issuing an Action are now marked as hidden_flag=1 and not returned by default in API requests. These Packages are deemed immutable and should be excluded from most operations.
Fixed an omission in the Tanium Server API by which Dashboard requests could not be sorted by id using the cache_sort_fields option.
Fixed a serialization issue in the Tanium Server's Saved Action API that would return an incorrect data structure and identification on creation and update operations.
The Tanium Server's API will now return a non-zero source_id value even if and when the original Package id has been deleted.
The Tanium Server's Sensor API will now ignore the request value source_id=0 and determine itself whether a temporary or source Sensor is referenced by the query.
Added back content_set_roles in the Tanium Server's Users API which had been omitted.
The Tanium Server will no longer issue overlapping Actions when their reissue time is shorter than their expiration time.
Fixed a bug in the Tanium Server API where performing a GetObject request on Saved Questions would return structures with multiple Question elements in a way that violated the WSDL definition for the request.
Fixed a problem where changes to a User's management rights would not produce associated audit records in the system.
The Tanium Server's API will now return records for issued Actions associated with deleted Scheduled Actions, which it did not in the past.
The Tanium Server now does a more strict checking on allowed request headers and their values and will reject the request accordingly.
The Tanium Server now performs more stringent checks on HTTP content-length headers and will reset the request on malformed headers or mismatched content length sizes.
Fixed a problem in the Tanium Installer which would duplicate Sensor columns when upgrading from previous versions of the software.
Fixed an omission in the Tanium Server's API by which Saved Actions could not be sorted by their next_start_time value and resulted in an Invalid sort field error.
Fixed a problem with the Tanium Server Saved Questions API where it would return no results.
Fixed an error in handling filters for Question History in the Tanium Server API that would result in an HTTP-500 error with Invalid datetime for Questions with a zero expiration setting.
Fixed a problem in the Tanium Server import API which would result in the error Default Computer Groups: unresolved conflicts when importing default Computer Groups content more than once.
Fixed and improved the Tanium Server interaction with the database to make Question retrieval faster and, among other things, reduce the startup readiness time in large or long-standing systems.
Fixed a bug in the Tanium Server Packages API where a request would not return source Packages when filtering for source_id=0.
Fixed a bug in the Tanium Server installer where it would not install or upgrade a local Module Server unless the ModuleServer parameter was set to 127.0.0.1. The installer will now trigger the Module Server installer whenever instructed to do so.
Changed the behavior of the Tanium Server's API to return a Package's definition by name when there exist more than one definition but one of them has hidden_flag=0.
Fixed an issue in the Tanium Server when transferring content to a different Persona for the same User, the result returned successfully but the content was not transferred.
Fixed a problem with the Tanium Server's Saved Question API which would return an HTTP-404: PersonaNotFound when the Persona associated with a Question had been deleted.
Fixed an issue in the Tanium Server's Question API to ignore a source_id parameter if not creating a temporary Sensor. This behavior was seen adding a pair of square brackets ([]) at the end of every Sensor name in a Question.
Changed the behavior of Tanium's downloader (TDownloader) to allow spaces in URLs so they do not have to forcibly be encoded as %20 and avoid a disallowed location error when parsing them.
Fixed a problem retrieving Question results when attempting to filter them over parametrized Sensors by their whatHash.
Fixed an issue on the Tanium Server by which some Actions returned in Action History were missing their name and Package name.
Modified the handling of past Question results in a way in which they improve the reporting of Action statuses for Action History up to seven days in the past, which is the default retention period for old results.
Fixed the handling of chunked transfers for Tanium Server Plugin requests.
Fixed an inefficient SQL query in the way the Tanium Server produces audit record reports for Tanium Connect.
Fixed the handling of the tanium-options HTTP header when calling the Tanium Server REST API in asynchronous mode.
Fixed a condition possible when creating Questions through the Tanium Server API where Question filters were not verified for proper constant data types, leading to an empty page when in their results UI.
Fixed a bug where Tanium Server Dashboards would not be updated when Saved Question were overwritten during an import operation, resulting in the dashboards loosing all of their Questions.
Fixed an issue in the Tanium Server Question Parser where question options like ignoreCase were unnecessarily added and with incorrect values.
Fixed a condition in managing RBAC User Roles constraints which would result in the SQL error: duplicate key value violates unique constraint: content_set_user_group_role_membership_unique_index being logged.
Fixed a problem where the Tanium Server session/current API would not return Personas assigned to the user through a User Group. This would impede switching to these Personas from a Console session.
Fixed a problem in the Tanium Server Question Parser where it would fail to identify parametrized Sensors in the current implementation and omit the parameters passed for parsing.
Fixed a bug in where creating a Question from query_text would append with not All Computers if no filter is specified.
Fixed a bug in the Tanium Server API where trying to create a new Package would return the error ParametrizedPackageMustMatchSource.
The new Tanium Server cache implementations resolved a condition where creating a User account would sporadically return a HTTP-500: SOAPUserNotFound error but still created the requested object.
Fixed an inconsistency in the Tanium Server's Persona and Group APIs where newly created objects would return a created_time and modified_time in 2001-01-01 instead of their actual creation or modification time.
Fixed an issue in the Tanium Server Group API which would sporadically fail an Action Group lookup immediately after it was edited.
Fixed an edge-case behavior in the Tanium Server API when a user requested an object without the necessary privilege would get an HTTP-200 response but with empty data. The API will now respond with an HTTP-403: Forbidden response.
Fixed a bug in the Tanium Server where references to parametrized/ temporary Sensors were not interpreted appropriately and would break the Reveal quick search interface.
Fixed an omission in the Tanium Server User Groups API which would not return creation and modification for objects for POST, PATCH and DELETE requests.
Fixed a problem in the Tanium Server's saved_actions API which would return non-recurring Actions instead of only those with a recurring issue_seconds.
Changed the behavior of the Tanium Server's import API to not flag conflicts on value_type fields specified on input.
Fixed a WSDL inconsistency in the Tanium Server's SOAP API which would return unexpected text elements for a group, which would cause problems in Console when displaying Action verification queries.
Fixed an XML serialization bug in the Tanium Server API for Users and Content Sets where <content_set> elements were nested when they should not be.
Fixed a bug in Personas assigned through a User Group which would return a Invalid persona for user error when trying to switch over to that identity.
Fixed a bug in the handling of metadata for the TDownloader settings API which would return an HTTP-500 error when including meta-data while creating an authentication user, and logging INSERT statement conflicted with a FOREIGN KEY constraint.
Fixed a bug in the handling of CAC/ PIV certificates on the Tanium Server login and authentication API routes.
Fixed some omitted parameters and settings in the Tanium Server's Package API which would break the reissuing of previously issued Actions.
Fixed an issue where an error message would be emitted when using the pki reset command was run on a Zone Server, even though the command completed successfully.
Fixed a bug where using the Module Server option to register against a Tanium Server would create duplicate registration entries for the TMS.
Fixed a bug in the Tanium Server's database access that would produce a SQL deadlock error when moving Scheduled Actions between Action Groups.
The Tanium Server now guarantees proper handling of the n-to-n relationships between Personas and Content Sets in its database tables.
Fixed an omission where the first user created in a Tanium Server deployment would not have a creation date.
Fixed a bug in the Tanium Server API which would throw an HTTP-500 error when requesting Actions sorted by creation_time.
Fixed a bug in the Tanium Server API which would throw an HTTP-500 error when requesting Actions sorted by issue_count.
Fixed a problem which would result in old private keys never being purged out of pki.db.
Fixed a problem in the Tanium Server's global-setting get command line where large numeric values would be returned in scientific notation.
Improved the way names and identifiers are treated for Content Sets to avoid a ContentSetNotFound error when importing sets with reserved names.
The Tanium Server will now allow for Sensor expressions in Questions with empty parameter lists ([]) and handle them properly depending on the definition of the source Sensor.
Fixed a bug in the Tanium Server's API that made it impossible to transfer content from a deleted Persona to another user, returning an HTTP-404: PersonaNotFound error response.
The TDownloader authentication API serviced by the Tanium Server will not return the expiration property for the downloader_auth_users request.
Fixed an error in the Tanium Server installer upgrade steps where it would incorrectly remove entries for User role assignments.
Fixed a bug in the Tanium Server management of Separated and Isolated Subnets in the database where it was possible that some definition rows would not be skipped until the server was restarted.
Fixed an issue in the Tanium Server which would cause an Action to loose its Action Group when disabled or enabled again, ending up associated with the default Action Group.
Fixed an omission where the Tanium Server failed to remove deleted Personas effective privilege values from its caches.
Fixed an observed SQL error in the Tanium's Server access of the database Content Set data which logged: ERROR: syntax error at or near ")" at character NNN when accessing content_set* tables.
Fixed a Tanium Server communication error which would result in the constant logging of unexpected 315 message: WireMessage.signed_string_retry/30 messages.
Fixed an omission by which the Tanium Server installation and upgrade would never populate the version and date in the version_history database table and introduced the TaniumServer database add-version-history command line option to do this.
Fixed an issue in the Tanium's RBAC API by which switching a user's Persona would not reflect a change in the content_set_roles and roles properties after the switch, even though the new RBAC permissions were being enforced correctly. The information returned now matches the actual enforcement under the new Persona identity.
Fixed an issue in the reading and interpretation of the Tanium Server's console.json configuration file which would log: Error occurred running job 'consoleSettingsThread': Value is not convertible to UInt.
Fixed an omission in the Tanium Server Package API to allow requests to be sorted by command value.
Fixed a condition in the evaluation of cryptographic communications by which when decommissioning Tanium Servers and adding other new ones to a deployment would result in logging the error message Received untrusted signed trusted roots for client connections that presented credentials from now untrusted servers.
Fixed an issue with the new content installation status API on the Tanium Server where it would not return the correct status for file download progress.
Fixed a bug in the Tanium Server which would cause it to crash when attempting to serialize to disk the contents of Question results with tens or hundreds of millions of results.
Fixed a behavior in Platform components where attempting to stop a process just after it exited naturally would unnecesarilly spam logs with messages "Failed to terminate process" because the process was no longer there.

Known Issues and Workarounds

The Tanium Downloader (TDownloader) fails to download files when expired certificates are present in a server's root-CA configuration. This issue negatively effects downloading files from some sites using "Let's Encrypt" root CA, which recently expired.
- This issue can be worked around by removing the expired certificate from the server's root store.
The sensor preview functionality when creating or editing Sensors returns [CRU] errors.
- No workaround is available, but this will be addressed in a future release.
The "Last Login" value for Tanium user is cleared out after an upgrade to v7.5.2.3503.
- No workaround is available, however this is a data migration issue, and the data is still available. A future release will address this and repopulate the "Last Login" value for all users.

TaaS Release Date: 3rd August 2021

Improvements

The Tanium Server won't stop anymore with the error No encrypted_blob found if it runs into problems while loading its LDAP synchronization connector configurations.

Bug Fixes

Fixed a failure to enforce access in the Tanium Server's Group API when retrieving groups by id which might not respect Content Set restrictions.
Fixed an issue with the Tanium Server Saved Action API which would result in an HTTP-404 response when using multiple matching cache_filters in the request.
Fixed an issue in the Tanium Server's Action API by which omitting the verify_group setting would result in an indeterminate value being assigned to it.
Fixed an issue in the PKI handshake between Zone Servers and Tanium Server which would cause a multi-minute delay for them to register and show up as ready to establish trust.

TaaS Release Date: 29 June 2021

Improvements

The Tanium Platform now automatically synchronizes the Separated Subnets and Isolated Subnets configured in the Console down to Zone Servers making it unnecessary to configure these by hand using SeparatedSubnets.txt and IsolatedSubnets.txt files. In the unusual case where a ZS requires a different configuration, the central Console settings can be overridden with these local files.
The Tanium Server's tanium_http_request_duration_seconds_bucket metrics now offer extended buckets up to le="60" seconds counters that offer visibility to request durations beyond the previous 10 seconds.
Changed the behavior of the Tanium Server's /api/v2/license route to return information about the existing license even when it has expired. This is simply to provide a better UI experience to the Console user.
The Tanium Server changed the management of Package definitions returned by its API to avoid problems observed with parameters when their underlying definition is changed, which would cause problems in identifying their correspondence to the old definition.
The Tanium Server now offers live information on PKI updates against Tanium Clients through its pki_tls_cert_requests_issued, pki_tls_root_time_mismatches and pki_tls_stale_roots_skipped metrics.
The Tanium Server Audit API now includes a human readable audit_name in its output, particularly to benefit users of Connect.
The Tanium Server has improved its performance in refreshing Group caches, avoiding Console timeouts on systems with large and complex RBAC and Computer Group configurations.

Bug Fixes

Fixed an edge-case in the renewal of crypto materials between Tanium Clients and Tanium Zone Servers in which endpoint certificate expiration was managed incorrectly when one of the TSs is offline for an extended period of time, causing increased CPU utilization on the endpoint and a constant logging of: Adding certificate: keyRole: TLS in pki0.txt in the Client logs.
Fixed a bug in the Tanium Server where it would ignore the value for setting max_active_collision_questions when enable_collision_questions=1, which would cause a large barrage of new Questions created when hundreds of string collisions were detected.
Fixed a broken link presented by the Tanium Server installer where its reference to the SQLCmdLnUtils,msi pointed to a broken Internet link.
Fixed a bug with the Tanium Server Question Parser where it was failing to quote values that are reserved words. Question text should now be correctly quoted where appropriate; e.g. Computer Name contains "not".
Fixed a problem with the Tanium Server's API which would return RBACInsufficientPrivilege errors when trying to create Questions and specifying the content_set property for the source of parametrized Sensors.
Fixed a possible root cause of sporadic Tanium Server crashes on startup.
The Tanium Server's Package API now reports a source_id as a reference to the original root source from which a Package may have been derived.
Resolved an issue where deleted users might be recreated by the SAML auto-user provisioning feature.
Fixed an issue in the way the Tanium Server restores legacy keys from the pki.db of a previous system upon installation. This defect results in v314 clients failing to register when they communicating to a Zone Server on the new system. Legacy Tanium Clients will show in Client Status with Valid Key=No and the Zone Server will log the error: Failed to process server registration certificate request: The root key is revoked.
Fixed a problem in the Tanium Server installer where it would fail to update the tanium database on PostgreSQL databases with a different locale than English, claiming in the logs that the database "does not have the tanium schema".
Fixed a bug in the instrumentation of Tanium Server /metrics which resulted in some measures being incorrectly reported as of a cx_message type and also fixed some missing v314 message metrics from info.json files.

TaaS Release Date: 15 June 2021

Improvements

The Tanium Platform now automatically synchronizes the Separated Subnets and Isolated Subnets configured in the Console down to Zone Servers making it unnecessary to configure these by hand using SeparatedSubnets.txt and IsolatedSubnets.txt files. In the unusual case where a ZS requires a different configuration, the central Console settings can be overridden with these local files.
The Tanium Server's tanium_http_request_duration_seconds_bucket metrics now offer extended buckets up to le="60" seconds counters that offer visibility to request durations beyond the previous 10 seconds.
Changed the behavior of the Tanium Server's /api/v2/license route to return information about the existing license even when it has expired. This is simply to provide a better UI experience to the Console user.
The Tanium Server now exposes the prompt_estimate_threshold and action_target_estimate_min_percent in TaaS environments as configurable Platform settings so users may adjust them.
The Tanium Server changed the management of Package definitions returned by its API to avoid problems observed with parameters when their underlying definition is changed, which would cause problems in identifying their correspondence to the old definition.
The Tanium Server now offers live information on PKI updates against Tanium Clients through its pki_tls_cert_requests_issued, pki_tls_root_time_mismatches and pki_tls_stale_roots_skipped metrics.
The Tanium Server Audit API now includes a human readable audit_name in its output, particularly to benefit users of Connect.

Bug Fixes

Fixed an edge-case in the renewal of crypto materials between Tanium Clients and Tanium Zone Servers in which endpoint certificate expiration was managed incorrectly when one of the TSs is offline for an extended period of time, causing increased CPU utilization on the endpoint and a constant logging of: Adding certificate: keyRole: TLS in pki0.txt in the Client logs.
Fixed a bug in the Tanium Server where it would ignore the value for setting max_active_collision_questions when enable_collision_questions=1, which would cause a large barrage of new Questions created when hundreds of string collisions were detected.
Fixed a bug with the Tanium Server Question Parser where it was failing to quote values that are reserved words. Question text should now be correctly quoted where appropriate; e.g. Computer Name contains "not".
Fixed a problem with the Tanium Server's API which would return RBACInsufficientPrivilege errors when trying to create Questions and specifying the content_set property for the source of parametrized Sensors.
Fixed a possible root cause of sporadic Tanium Server crashes on startup.
The Tanium Server's Package API now reports a source_id as a reference to the original root source from which a Package may have been derived.
Resolved an issue where deleted users might be recreated by the SAML auto-user provisioning feature.

TaaS Release Date: 13 April 2021

New Features

Tanium components now use OpenSSL 1.0.2y.
The Tanium Server now uses OpenLDAP v2.4.58.
The Tanium Platform components now use the http-parser v2.9.4 library.
Changes in the Tanium Server database have been made to close gaps in schema differences between its Microsoft SQL and PostgreSQL implementations.
The Tanium Server will no longer provide the active Question estimate metric which duplicates the more accurate client_snapshot_question_count value.
The Tanium Server will now set the Host HTTP header in all requests proxied over to the Module Server.
Added the ability to verify single-use-request tokens before their use against the Tanium Server's single-use-request API route.

Improvements

The Tanium Server will now store a copy of its registration secret in pki.db, making a system recovery possible even when the tanium database has been lost.
The propagation of Zone Server metrics exposed in the Tanium Server's /metrics route has been improved, improving on some zero-valued measures which made it appear as if their implementation was flawed. This improvement introduces the hub_info_send_interval_minutes Global Setting with a default value of 1 minute which controls how often these measures are propagated between components.
The Tanium Server Audit API now offers text representations for a number of audit fields in order to make its output more human-readable.
The Tanium Server improvements to the storage of LDAP access information in the database.
The Tanium Server now offers an "All Computers" Action Group to support the new-style Console one-time deployment Actions.
LDAP Connectors in the Tanium Server now support the user_group_key setting which defines the user LDAP object property to associate when retrieving LDAP group members. It defaults to distinguishedName which works with most LDAP servers (Active Directory) but can be changed for other vendors.
The Tanium Server's pki show now displays the ServerNameList setting value embedded in a tanium-init.dat initialization bundle.
The Tanium Server now provides a preview_content_set_role to support the new Console UI for managing RBAC roles.
The Tanium Server now offers the command line option pki sync-hsm which will compare the contents of pki.db and those of a keystore HSM to ensure they are both synchronized, helping clear out situations where both sets of key names differ.
The Tanium Platform has refactored its v315 protocol message metrics to streamline their processing and make them more easily extensible to new message types.
The Tanium Server Export API now allows filtering of exported contents by Content Set id 's.
The Tanium Server API will now limit the allowable size of any individual parameter in an Action to 8KB in length.
The Tanium Server has improved its Group cache management strategy to avoid multiple and unnecessary refreshes when creating and managing deeply nested group structures.
The Tanium Server will now validate that parametrized Actions have all of their parameters fulfilled by the targeting Question used for deployment.
The Tanium Server enhances the Server-Timing details for saved_question API requests.

Bug Fixes

The Tanium Server and Zone Server Hubs will now start their synchronization tasks only after they have successfully established trust and registered with each other, no longer producing the log messages that read: WireMessage.sync_message/43.
All Tanium component uninstallers on Windows (Server, Module Server and Zone Server) will now uninstall and clean out the installation directory, or error out if the registry key for the installation path (Path) is not set. Additionally, they will refuse to uninstall if the uninstaller has a different version than the actual software installed.
Fixed an issue in the Tanium Server by which removing a User from a User Group would not produce a corresponding audit record.
Fixed a non-released internal build test over SOAPGroupCache::TestManualGroups.
The Tanium Server will now enforce a maximum expiration for API tokens 365 days into the future, as specified and controlled by the Global Setting (Server, Numeric) api_token_max_expiration_in_days.
Fixed a problem in the Tanium Server's API for RBAC privileges where the content_set_roles route would fail to return the privilege assignments seen when retrieving an individual content set through its id.
Fixed a race condition within the Tanium Server's Package cache refresh logic which could result in a server thread using stale data.
The Tanium Server will now install and treat the database_connection_periodic_job_interval_seconds Global Setting as a server and not client setting. NOTE: that upgrading from earlier versions will not modify the erroneous designation if it already exists.
Fixed a bug by which a Zone Server Hub would experience a process crash when it could not resolve the DNS name for one of its Zone Servers.
The Tanium Server will now keep track of the number of cryptographic keys generated as a way to avoid a synchronization problem when naming keys for management in a Hardware Security Module (HSM).
Fixed an issue with the Tanium Server's object ownership transfer API which was not honoring the force_transfer_flag setting in the REST API.
The Tanium Server Export/ Import API will now ignore compound Group definitions with All Computers as one of their subgroups which are functionally equivalent to targeting all endpoints. Groups which seek to filter for all machines must express this explicitly by referencing only the All Computers group.
Fixed a bug with the Tanium Server API which would return an HTTP-403 error when a user called api/v2/session/management_rights for an mr_group definition that was somehow malformed in the database.
Added the missing support for handling Groups' max_age_seconds and all_values_flag in the Tanium Server's export API.
Fixed an issue in the Tanium Server API where retrieving a Content Set definition by its id was not validated against RBAC privileges.
Fixed an issue with the Tanium Server API which would cause the error PackageNotFound when querying for a Package right after creating it.
Fixed a bug in the Tanium Server which could cause a process crash when GetResultData was called with a cache filter with empty text.
Fixed an issue in the Tanium Server which would cause a process crash during the refresh of the users cache last login information if its corresponding record was deleted from the system's users table.
Fixed a Tanium Server issue in the Import API with the treatment of of the All Computers group which would lead to GroupNotFound on some imports.
Fixed an issue with the Tanium Server RBAC API where not providing a content set to the preview_content_set_role route would result in an exception being thrown: No id or name specified for content set when it should not.
Fixed a regression in the performance of the SOAP GetObject::saved_questions API request.

Known Issues and Workarounds

N/A.

TaaS Release Date: 9 February 2021

New Features

The Tanium Server will only keep a 30 day record of known endpoints in SystemStatus.txt while in the past this file was never flushed of old records, which would allow it to grow without bounds and turn specially large in environments with non-persistent and volatile clients. Deployments with a need to keep a longer record of past endpoints are suggested to use Connect and, only when strictly necessary, use the configuration parameter system_status_client_age_limit_days to extend this retention period.
The Tanium Server and Zone Server now expose a metric named app_version_info with information about the running binary version.
Introduced performance improvements to the Tanium Server in the way it references columns in result rows for SQL queries.
The Tanium Server now offers a host of measures through its /metrics route regarding the operation of protocol v315 TLS communications. All of these new measure names begin with the tanium_pki_tls prefix.
The Tanium Server now offers a Global Setting (Server, Numeric) named server_timing_visibility which when enabled will include a Server-Timing HTTP header entry in all API responses, offering visibility into the multiple internal execution timings for the request; everywhere from cache refreshes to RBAC evaluation. The possible values for this setting are 0 (zero) to disable the header, 1 (one) to include the header only in Administrator user requests, or 2 to include the header on requests made by all users.
The new Server Timing header included in HTTP responses to API calls against the Tanium Server will now also provide data on the timing of any internal cache refreshes executed while servicing the request.
The Tanium Server now provides granular controls for the assignment of thread types to ProcessorGroups when SetThreadAffinityFlag=1 . This is only applicable to Windows platforms and allows granular control when balancing workloads in extremely high-load and high-CPU count environments. These thread assignments are also now exposed on the TS/info route.
The Tanium Server now offers the default_max_string_age_minutes Global Setting as a means to set a default Max String Age for all Sensors in the system.
A Tanium Zone Server will no longer present a v314 certificate when connected to and scanned if enable_protocol_314_flag is disabled in Global Settings.
Tanium platform components now use OpenSSL v1.0.2x.
The Tanium Client v7.4 and higher now expresses a dependency on libc++ for endpoints running AIX v7.2 and above.
The Tanium Server now supports filtering Question results on columns which are declared as hidden in their Sensor definitions. This now enables better filtering in the Console results grid.
The Tanium Server's logging into action-scheduler.txt now responds to three different settings for LogVerbosityLevel=[1, 41, 91] , reserving levels 1 (one) and 41 for error reporting and 91 for every other normal operation messages.
The Tanium Platform now introduces an improved tracking of connection states which allows tightening of the security involved in handling incoming connections, including potential rogue sources.
The installer for the Tanium Server has modified its End User License Agreement (EULA).
The Tanium Server now offers a Global Setting tls_session_duration_seconds that defaults to 3,600 seconds, forcing a full TLS handshake every hour instead of reusing session tickets.

Improvements

The Tanium Server now introduces additional checks when reading and writing its SensorDiffHistory file, both reducing the amount of I/O in its reads and writes and validating the entries read from the file. This helps avoid a condition where incorrect entries could cause premature client registration failures with the message: Client registration failed: Client registration connection shutdown.
The Tanium Server will now emit tanium_client_count_history as part of its /metrics output, representing the 30 day endpoint registration count often consulted in the Client Status page.
The Tanium Server has dropped the input column from the import_jobs table in the database to reduce storage needs for its sometimes large contents.
Improved logging on the Tanium Server to offer a significant message when failing to parse a PKI bundle to read: Failed to parse PKI bundle instead of logging just a BasicException that did not identify the source of the exception thrown.
Introduced changes to the Tanium Server to improve performance and reduce overhead when receiving results from SQL queries.
Introduced handshake performance improvements during TLS session ticket reuse for the Taniunm Server and Zone Servers. These allow for validation of the cryptographic information of thousands of incoming client connections with reduced CPU resource consumption.
Introduced efficiencies in the way the Tanium Server running threads manipulate cryptographic objects using the OpenSSL libraries to reduce lock contentions and improve high-scale performance in large systems.
Introduced a performance improvement in the instantiation of SSL objects which will help to increase CPU processing efficiency in large Tanium deployments.
Values set for Max Strings and Max String Age on a _Sensor will no longer be overwritten during content imports.
Both the Tanium Server and Zone Server will now persist TLS session tickets in a file named ssl-session-ticket-keys.dat so they can be reused across restarts, thus reducing the incidence of new session negotiations on startup.
The Tanium Server API for Saved Questions now honors the context_id filter condition even when it does not have a reissue interval.
The Tanium Server and Zone Server now streamline the cryptographic verification of incoming Tanium Client connections, reducing the CPU workload required for this duty.
The Tanium Server now allows invoking a solution's uninstall more than once to allow it to be removed from both servers in an Active/ Active configuration.
The Tanium Server's SOAP and REST APIs now support fetching Local Settings audit records.
The Tanium Server API now allows administrator users to retrieve the definition of Packages with their deleted_flag=1 when referenced by id.
The Tanium Server now implements more efficient code to verify client cryptographic credentials and reduces this CPU overhead on incoming connections.
The Tanium Server will now refuse to spawn TDownloader to fetch and store a file if this would result in a low disk storage condition, as defined by the MinFreeSpaceInMB setting which defaults to 1,024MB.
Introduced performance optimizations in the way the Tanium Server and Zone Server manage endpoint client connection authorization, thus reducing the amount of CPU resources consumed by each individual connection.
Changed the way in which the Tanium Server queries URL hashes for Package files defined in the system to improve SQL performance.
The Tanium Server now uses the tls_client_reverify_interval_seconds with a default value of 300 seconds as the maximum amount of time allowed before an incoming TLS connection will be re-verified.
The Tanium Server has improved efficiencies in by using incremental loads of Question definitions from its database, resulting in faster API response times.
Tanium Zone Servers will now persist client connection information in a way that endpoint clients can re-use their session information when the server is restarted.
Reduced some thread contention associated with cryptographic operations which will benefit very large customers that need to run many dozens of client connection service threads.
The Tanium Platform servers on Windows will use a faster random number generator to accelerate cryptographic processing of incoming client connections.
The Tanium Server's database-upgrade log will now include the server version along with the Starting database upgrade message to indicate the upgrade release.
As a performance improvement the Tanium Server will no longer load old and deleted (status=2) Saved Actions from the database and into its internal cache.
The Tanium Server has improved the way it evaluates RBAC privileges for Scheduled Action visibility, resulting in API request performance improvements.
Introduced a performance improvement in the way the Tanium Server queries its database for Saved Actions and their associated Package to enforce RBAC permissions.
Added and index to the implied_privileges_working_table_idx in the Tanium Server database which improves the performance of operations on Content Set Role Privileges across the system.
Introduced an optimization in the management of Content Set Role Privileges that brings performance improvements over a range of RBAC-related operations in the Tanium Server database.

Bug Fixes

The Tanium Server SSL unexpected EOF messages which are generally harmless are now logged at LogVerbosityLevel=11 to avoid unnecessary spam entries.
Fixed an incorrect interaction of the Tanium Server with PostgreSQL databases which would sporadically cause Saved Questions to be displayed as Get Number of Machines instead of their correct definition. This fix also includes the command line option reset-sequences which will repair database contents where this condition appears,
Fixed a limitation in the Tanium Client installer on Windows by which it failed managing the permissions of the installation directory when the local Users group had been renamed, throwing the error: Unable to revoke permissions for Users group: Cannot build new access control list.
Fixed a bug with the management of the Tanium Server's internal user cache which would cause some accounts to display a Last Login time years in the past (e.g. 1999-12-31) after the periodic LDAP-synchronization made changes in the system.
Fixed an issue in the Tanium Downloader where concurrent access to CRL lists in its SQLite database could produce the error SQLiteDatabase: gave up on busy handler after waiting 5s and fail a download and subsequent solution installation or upgrade.
Resolved an issue which resulted in an incorrect SAML Reply URL being created on TanOS in some configurations.
Fixed a problem in the Tanium Client that would fail to persist the state of an Action verification across client restarts, prolonging the Action Verification phase.
Fixed a problem with the Tanium Server's /single-use-request downloads API that would fail when accessed using an authorization token instead of a session id.
Fixed a problem with the management of expired cryptographic keys on the Tanium Client which would cause peering errors when operating in an Active/ Active Tanium Server configuration.
Fixed a bug in the Tanium Server which caused Scheduled Actions to be issued under their old account ownership after they had been transferred to another user, typically when managing non-active user content from the Tanium Console.
Fixed an issue with the Tanium Server import API by which Saved Questions with associated Actions (packages) were not being linked together when importing new content.
Fixed an issue with the Tanium Client installer on Windows that prevented it from recognizing the command line setting for ServerAddress.
Fixed a bug in the Tanium Server in the handling of Saved Question metadata that would trigger the Console error duplicate key value violates unique constraint "saved_questions_meta_data_unique" when importing content.
The Tanium Server REST API has been fixed to support some missing audit types from those listed as supported in /api/v2/audit_types.
Fixed an issue with the Tanium Server installer where when installing a local PostgreSQL database instance, the Tanium Postgres service would fail to start due to missing access controls on its installation directories.
Fixed an issue with the Tanium Server's audit API where the details field for audit records could be empty, not specifying the details for an audited change.
Fixed a Tanium Server installer bug during upgrades which would result in the error message: Cannot insert the value NULL into column ‘package_id’, table ‘tanium.dbo.saved_actions’; column does not allow nulls , when upgrading from v7.4.3 to v7.4.4.
The Tanium Server REST API now normalizes access to objects audit records through the api/v2/*_audit routes.
Fixed an issue in the Tanium Server logging of action-scheduler.txt where the Action ID logged was incorrect.
The Tanium Server now displays the database reset-sequences command help when using the database --help command line option.
Fixed an issue in the Tanium Server where the use of sequence column values in some tables could produce repeated error messages reading: there is no transaction in progress.
Fixed a Tanium Server problem where users assigned the special Content Set Administrator role were not having their other privileges revoked, which is the way this role should work.
Fixed a bug in the Tanium Server that caused Isolated Subnet definitions from loading when the sequence column in their database row has a value of 0 (zero).
Removed the logging of cryptographic fingerprint values on client connection failures.
The Tanium Server installer on Windows will grant ownership and permissions to SYSTEM on the installation directory, this is to fix access settings on deployments which may have used inherited permissions in the past.

Known Issues and Workarounds

N/A.