Tanium Patch overview
Tanium Patch™ (Patch) is a powerful tool for managing Windows operating system patching across your enterprise at the speed and scale of Tanium. You can deploy a single patch to a computer group immediately. You can also perform more complex tasks, such as using advanced rule sets and maintenance windows to deliver groups of patches across your environment at specified times.
Patch generates in-depth reports and returns current patch applicability results from every endpoint. For any patch or patch list deployment, the following details are provided:
- The patch details, such as severity, release date, applicable Common Vulnerabilities and Exposures (CVE), files, and links to knowledge base articles.
- The status of the patch, split out by computer group.
- The assigned patch lists or blacklists for the patch.
You can also define custom workflows and schedule patches based on rules or exceptions built around patch lists, blacklists, and maintenance windows. For example, you might always apply critical Microsoft patches to all machines except for datacenter servers, or always exclude .NET patches, or install patches during non-working hours.
Patch scanning options
You can choose from several scan methods to determine the installed and missing patches across your network. Scan configurations define a scan method, scan frequency, and the computer groups that are being scanned, known as an enforcement. One scan configuration is applied to an endpoint. If an endpoint is included in multiple computer groups, the highest priority scan configuration is applied.
Review the following list of scanning options to decide the best method to use for each computer group.
| Scan method | Updates included | Client impact | Connectivity | Details |
|---|---|---|---|---|
| Offline CAB file | Cumulative security and quality patches only | Moderate, during scanning activity | The CAB file is stored locally by the Tanium Client | Requires 200+MB download of CAB file |
| Online to Microsoft |
|
|
The Tanium Client must contact Microsoft directly |
|
| Windows Server Update Services (WSUS) Scan |
|
Low | The Tanium Client must contact the WSUS server |
|
If you are using Microsoft System Center Configuration Manager (SCCM) with your WSUS server, do not use Tanium for WSUS scanning with the same server.
Patch lists and blacklists
Group patches that can be applied into patch lists. You can also group patches that must be excluded into blacklists. These lists can be determined by any detail included in the patch information. For example, you could:
- Create lists based on severity, prioritize the most critical and most recent updates first.
- Focus only on CVE issues.
- Create lists based on the month or a specific release date.
As new patches come out, you can use dynamic rules to automatically assess and populate patches to the appropriate lists. You can iteratively develop these lists by creating new versions. You can deploy any version of the list as needed.
Microsoft update and servicing details
In October 2016, Microsoft changed the way they provide software patch updates, based on the operating system of the endpoint. Though these terms are subject to change, it is important to be aware of how they affect your network.
- Windows 10 and Windows 2016
- Feature Upgrades: Essentially a new build of Windows 10 (for example 1511, 1607, 1703). These upgrades are published every 3-4 months. Currently, Windows 10 build upgrades can be completed with a standard package deployed by Tanium.
- 2017-XX Cumulative Update: Released monthly, supersedes any previous cumulative update for Windows 10. Contains all security and non-security fixes for the month and all previous months.
- Windows 7, 8.1, 2008, 2008R2, 2012, 2012R2
- 2017-XX Security Monthly Quality Rollup: Package is a cumulative update for current and all previous months. Only the current month will be applicable. All previous versions are superseded.
- 2017-XX Security Only Quality Update: Security updates for the specified month only. Does not include updates from any previous month. Previous monthly updates will still be applicable and needed.
For more information, see Exclude patches with blacklists and the Microsoft articles on Simplified Servicing or the Windows Servicing Model.
How deployments work
Deployments compile patches, typically from lists, and then distribute Patch packages to the target computers. You can configure deployment options to set when and how patches are installed or uninstalled. For example, you might want to restart an endpoint after patches are installed to apply the changes. If a patch comes out that would normally be blacklisted but is needed for some reason, you can override the blacklist for that specific deployment rather than making a new version the blacklist. In urgent situations, you can even override a closed maintenance window.
Maintenance windows
Maintenance windows designate the permitted times that the targeted computer groups are open for patches to be installed or uninstalled. You can have multiple maintenance windows, even with overlapping times, as these windows do not interfere with each other. For a patch deployment to take effect, the deployment and maintenance window times must be met.
Consider establishing a maintenance cycle that keeps your endpoints as up-to-date as possible. You can avoid many security risks with good operational hygiene. Some considerations might include coordinating with the Microsoft Patch Tuesday releases, on weekends, or outside the core work hours for your network.
Last updated: 8/9/2017 11:48 AM | Feedback