Patch overview

You can choose from several scan methods for Windows and Linux endpoints to determine the installed and missing patches across your network. Scan configurations define a scan method, scan frequency, and the computer groups that are being scanned, known as an enforcement. One scan configuration is applied to an endpoint. If an endpoint is included in multiple computer groups, the highest priority scan configuration is applied. For more information, see Enforcing scan configurations for Windows and Linux endpoints.

Review the following lists of scanning options for Windows and Linux endpoints to decide the best method to use for each computer group.

Available Patch scan methods for Windows endpoints

For more information, see Windows scan techniques.

Available Patch scan methods for Linux endpoints

For more information, see Core platform dependencies, Linux scan techniques, and Tanium Scan incompatibility with LibZypp Services Plugins.

A patch list contains patches that can be applied to Windows and Linux endpoints. A block list contains patches that must be excluded from Windows and Linux endpoints. Patch provides a baseline reporting patch list for Windows and Linux. You can also create patch lists and block lists. These lists can be determined by any detail included in the patch information.

For example, you could

• Create lists based on severity, prioritize the most critical and most recent updates first.
• Focus only on CVE issues.
• Create lists based on the month or a specific release date.

As new patches come out, you can use dynamic rules to automatically assess and populate patches to the appropriate lists. You can iteratively develop these lists by creating new versions. You can deploy any version of the list as needed. For more information, see Managing patches for Windows and Linux endpoints.

Each patch for Windows and Linux endpoints includes a column that indicates if the patch has been superseded, or effectively replaced by a newer patch. A patch is marked as superseded when a single endpoint reports that the patch is superseded. Including superseded patches in patch lists can be useful when you want to find or install a specific patch that was superseded. For example, you might need to find or install superseded patches when they are referenced in a security advisory recommendation. Superseded patches are automatically included in block lists.

For disk space and bandwidth efficiencies, if a deployment contains both a superseded patch and the patch that supersedes it, then Patch downloads only the superseding patch (the newer patch). If a superseding patch is included in multiple deployments, Patch downloads the patch only one time. After a deployment completes, Patch removes patch files that are no longer required by any deployment on the endpoint.

For more information, see Exclude patches with block lists.

Microsoft provides software patch updates in different ways depending on the operating system of the endpoint. Microsoft changes these terms occasionally, and it is important to understand how these policies affect your patching processes.

• Windows 10, Windows Server 2016, and Windows Server 2019
  • Feature Updates: Feature builds are essentially a new build of Windows 10. These upgrades are published twice a year with a target of March and September of each year (for example 1709, 1803, 1809, 1902, 1909). Consider the following Tanium capabilities when you select a solution for Windows feature updates.
    • Tanium Deploy provides out of the box capabilities that enable efficient assessment, reporting, and deployment of Windows feature updates. For more information, see Windows 10 Upgrades and Servicing Made Easy With Tanium.
    • Tanium Core with custom sensors and custom packages
  • 2019-XX Cumulative Update: Released monthly, a cumulative update supersedes any previous cumulative update for Windows 10. Contains all security and non-security fixes for the month and all previous months.
• Windows 7, 8.1, 2008, 2008R2, 2012, 2012R2
  • 2019-XX Security Monthly Quality Rollup: Package is a cumulative update for current and all previous months. Only the current month will be applicable. All previous versions are superseded.
  • 2019-XX Security Only Quality Update: Security updates for the specified month only. Does not include updates from any previous month. Previous monthly updates will still be applicable and needed.
  Do not deploy both the Security Monthly Quality Rollup and the Security Only Quality Update for the same month at the same time. If both updates are targeted to an endpoint, the Windows Update Agent installs the Security Monthly Quality Rollup, and the Security Only update is ignored. The download size increases without any benefit.

Deployments compile patches, typically from lists, and then distribute Patch packages to the target Windows and Linux computers. You can configure deployment options to set when and how patches are installed or uninstalled, including allowing Windows endpoint users to manage patches using the Self Service Client application.

For example, you might want to restart an endpoint after patches are installed to apply the changes. If a patch comes out that would normally be blocked but is needed for some reason, you can override the block list for that specific deployment rather than making a new version the block list. In urgent situations, you can even override a closed maintenance window.

You can choose whether to restart the endpoint after patch installation, to inform the user about the restart, and to allow the user to postpone the restart. For more information, see Deploying patches for Windows and Linux endpoints.

Deployment templates can be used to save settings for a deployment that you can issue repeatedly. For more information, see Create a deployment template.

Maintenance windows for Windows and Linux endpoints designate the permitted times that the targeted computer groups are open for patches to be installed or uninstalled. You can have multiple maintenance windows, even with overlapping times. Maintenance windows do not interfere with each other. For a patch deployment to take effect, the deployment and maintenance window times must be met.

Consider establishing a maintenance cycle that keeps your endpoints as up-to-date as possible. You can avoid many security risks with good operational hygiene. Some considerations might include coordinating with the Microsoft Patch Tuesday releases, on weekends, or outside the core work hours for your network.

For more information, see Setting maintenance windows for Windows and Linux endpoints.

A repository snapshot captures point-in-time metadata that determine patch versions and their dependencies, and provide control over dependencies for Linux endpoint patches. Using a repository snapshot can help ensure that your production systems are installing the same patches as your testing systems, which reduces deployments of untested patches on production systems.

Repository snapshots are not recommended for the official CentOS mirrors. Those mirrors might not have all of the required dependencies that a snapshot lists after a certain amount of time. For best results with CentOS, create and maintain a metadata source repository and manage packages. Snapshots are not supported for Amazon Linux.

For more information, see Manage Linux repository snapshots.

Patch uses Apple MDM commands to manage updates on macOS endpoints. You create enforcements that include Install action MDM commands. Patch sends the enforcements to the Tanium Mac Device Enrollment shared service, which then communicates with the Tanium MDM Cloud, Apple Business Manager, and the endpoints. For more information on this communication flow, see Tanium Mac Device Enrollment User Guide: Mac Device Enrollment overview.

Patch scanning on macOS endpoints uses the Apple automatic check-in process to identify available updates. Each hour, the Tanium MDM Cloud issues the AvailableOSUpdates command to the endpoints included in mobile device groups in Mac Device Enrollment. The endpoints respond with the available updates and this information appears in the Patch > Mac Patching > Updates page. This process can take up to an hour. You then create enforcements to deploy the necessary updates.

For more information, see Managing macOS endpoints.

With the Self Service Client application, you can publish patches to Windows endpoints so that users can start a patch deployment early or completely control when patches are installed. For example, you might deploy the Self Service Client application to a manufacturing endpoint that can be patched only between manufacturing runs or an endpoint in an operating room that must be patched between surgeries.

Client Management self-service deployments and the Self Service Client application are used in conjunction with End-User Notification configurations in Tanium™ End-User Notifications 1.11.38 or later. The Self Service Client application is installed on endpoints targeted in the End-User Notification configuration.

For more information, see Managing End-User Self Service for Windows endpoints.

Client Management works with other Tanium products to provide additional features and reporting.

Tanium™ Comply

From Comply vulnerability report results, you can open Patch to view details about the patch that resolves a reported vulnerability. You can also quickly install the patch to endpoints directly from the patch details page. For more information, see vulnerability report results in Tanium Comply User Guide: Working with reports.

Tanium™ End-User Notifications

With the Tanium End-User Notifications solution, you can notify users about deployments to Windows endpoints and configure End-User Self Service capabilities. You can create a notification message with your deployment to notify the user that the system is going to restart, and give the user the option to postpone the restart. For more information, see Tanium End-User Notifications User Guide.

Tanium™ Endpoint Configuration

With the Tanium Endpoint Configuration solution, you can enable approvals for endpoint configuration changes. For more information, see Tanium Endpoint Configuration User Guide.

Tanium™ Enforce

With Tanium™ Enforce, you can create an MDM policy with the required settings to patch macOS endpoints. For more information, see Tanium Enforce User Guide.

Tanium™ Mac Device Enrollment

With the Tanium Mac Device Enrollment solution, you can manage patching for macOS endpoints. For more information, see Tanium Mac Device Enrollment User Guide.

Tanium™ Reporting

If you have Tanium Reporting 1.12 or later, Patch uses Tanium Reporting to create the charts on the Patch Overview page. For more information, see Tanium Reporting.

Tanium™ Trends

Client Management has built in integration with Trends for additional reporting of patch data for Windows and Linux endpoints. The Patch board shows information about missing patches, service-level-agreement (SLA) based compliance reports, time between a patch release and its installation, endpoint status, and scan errors. The following sections and panels are in the Patch board:

• Summary
  • Patch Coverage
  • Endpoints Missing Critical or Important Patches Released Over 30 Days Ago
  • Workstations - Mean Time to Patch
  • Servers - Mean Time to Patch
• Missing Patches
  • Missing Critical/Important Patches per Year
  • Operating Systems Missing Critical/Important Patches
  • Missing Patches by Severity - Latest
  • Missing Patches by Severity - Last 90 Days
• SLA Based Compliance Reporting
  • Online Endpoints - Patch Compliance
  • Historical - Patch Compliance
  • Online Endpoints - 30 Day SLA Compliance
  • Historical - 30 Day SLA Compliance
• Endpoint Status
  • Days Since Last Patch Scan
• Errors
  • Scan Errors - Last 7 Days

For more information, see Tanium Trends User Guide: Importing the initial gallery.