Documentation Home > Tanium Comply User Guide

Creating deployments

You must have the Comply Deployment Administrator role to create deployments. For more information about Comply roles, see User role requirements.

Create a new deployment

Select Deployments under Setup.
On the Manage Deployments page, click Create Deployment on the top right.
In the Details section, provide a Name.
Select Computer Groups you want to target with the deployment. You are able to select multiple computer groups in this field.
Select a Platform. Depending the Platform you select, you will see the appropriate choices for Architecture and Scan Engines. If you select CIS-CAT or JovalCM scan engines, you need to choose a JRE option. Preview on the right side of the Details section shows the deployment criteria as you define it.
Consult with your TAM before changing any Advanced Settings.
In the Schedule section, select Start at and End at and complete the date and time values to limit the report to run only during a specific time period.
Select the Distribute over and enter values to run the report over minutes or hours. This value cannot be over four hours. For more information on how Tanium deploys actions, see Tanium Platform User Guide: Using Deploy Action.
For Repeat report execution by select None if you do not want the deployment to run again. Select Interval and then define the interval in minutes, hours, or days in which you want the report to run in the Reissue every fields. Select Use Policy Saved Action to use a saved question every hour to determine if the deployment should run again when applicable endpoints are online.
Click Create & Deploy. You will see the Action progress and Installation status of your deployment.

You may receive one of the following errors if deployments do not run as expected:

Some machines included in this deployment cannot be deployed to. — Ensure that targeted endpoints have enough disk space to accommodate deployments.

Some machines included in this deployment don’t have the system utilities required to complete a scan. — Linux/macOS endpoints do not have the Unix utilities installed required for Comply to work correctly.

Using JRE encryption

Use JRE encryption to prevent access to the JRE. This will encrypt the zip file on the endpoint that contains the JRE, and a key file is distributed with reports that require the JRE to decrypt it. Once the report runs, the key file and decrypted JRE are removed. The encrypted JRE remains so it can be used the next time it is required.

Complete all of the fields in the Create Deployment window and select a JRE in the Engines field.
Select Encrypt JRE.
Click Create & Deploy. On the Reports page, any report with an encrypted JRE will show a lock next to that engine.

If a JRE encryption key is lost or overwritten, you can recreate the JRE encryption key. See Recreate JRE encryption key.

Last updated: 4/23/2019 5:48 PM | Feedback