Other resources

Release Notes

Video Tutorial

Support Knowledge Base
(login required)

Patch overview

Use Patch to manage operating system patching across your enterprise at the speed and scale of Tanium. You can deploy a single patch to a computer group immediately. You can also perform more complex tasks, such as using advanced rule sets and maintenance windows to deliver groups of patches across your environment at specified times.

You can define custom workflows and schedule patches based on rules or exceptions built around patch lists, blacklists, and maintenance windows. For example, you might always apply critical Microsoft patches to all machines except for datacenter servers, or always exclude .NET patches, or install patches during non-working hours.

Patch generates in-depth reports and returns current patch applicability results from every endpoint. For any patch or patch list deployment, the following details are provided:

  • The patch details, such as severity, release date, applicable Common Vulnerabilities and Exposures (CVE), files, and links to knowledge base articles.
  • The status of the patch, split out by computer group.
  • The assigned patch lists or blacklists for the patch.

Patch scanning options

You can choose from several scan methods to determine the installed and missing patches across your network. Scan configurations define a scan method, scan frequency, and the computer groups that are being scanned, known as an enforcement. One scan configuration is applied to an endpoint. If an endpoint is included in multiple computer groups, the highest priority scan configuration is applied.

Review the following list of scanning options to decide the best method to use for each computer group.

Table 1:   Available patch scanning options
Scan method Updates included Client impact Connectivity Details
Offline CAB file
  • Security patches
  • Cumulative security and quality patches
Moderate, during scanning activity The CAB file is stored locally by the Tanium Client.
  • Requires 200+MB download of CAB file.
  • Does not include routine updates, out of band fixes, hotfixes, and enhancements that are included with WSUS or Online to Microsoft scan methods.
Online to Microsoft
  • Security patches
  • Critical routine patches
  • Cumulative security and quality patches
  • Non-security and optional updates
  • Moderate, during first scan
  • Low, subsequent
The Tanium Client must contact Microsoft directly.

Requires additional network traffic to Microsoft directly.

Windows Server Update Services (WSUS) Scan
  • Security patches
  • Critical routine patches
  • Cumulative security and quality patches
  • Non-security and optional updates
Low The Tanium Client must contact the WSUS server.
  • Must deploy and configure one or more WSUS servers.
  • Updates must be approved in WSUS prior to scanning or deployment.

If you are using Microsoft System Center Configuration Manager (SCCM) with your WSUS server, do not use Tanium for WSUS scanning with the same server.

Patch lists and blacklists

Group patches that can be applied into patch lists. Group patches that must be excluded into blacklists. These lists can be determined by any detail included in the patch information. For example, you could:

  • Create lists based on severity, prioritize the most critical and most recent updates first.
  • Focus only on CVE issues.
  • Create lists based on the month or a specific release date.

As new patches come out, you can use dynamic rules to automatically assess and populate patches to the appropriate lists. You can iteratively develop these lists by creating new versions. You can deploy any version of the list as needed.

Superseded patches

Each patch includes a column that indicates if the patch has been superseded, or effectively replaced by a newer patch. A patch is marked as superseded when a single endpoint reports that the patch is superseded. Including superseded patches in patch lists can be useful when you want to find or install a specific patch that was superseded. For example, you might need to find or install superseded patches when they are referenced in a security advisory recommendation. Superseded patches are automatically included in blacklists.

Microsoft update and servicing details

In October 2016, Microsoft changed the way they provide software patch updates, based on the operating system of the endpoint. Though these terms are subject to change, it is important to be aware of how they affect your network.

  • Windows 10 and Windows 2016
    • Feature Upgrades: Feature builds are essentially a new build of Windows 10 (for example 1511, 1607, 1703).  These upgrades are published every 3-4 months. Currently, Windows 10 build upgrades can be completed with a standard package deployed by Tanium.
    • 2017-XX Cumulative Update: Released monthly, a cumulative update supersedes any previous cumulative update for Windows 10.  Contains all security and non-security fixes for the month and all previous months.
  • Windows 7, 8.1, 2008, 2008R2, 2012, 2012R2
    • 2017-XX Security Monthly Quality Rollup:  Package is a cumulative update for current and all previous months.  Only the current month will be applicable. All previous versions are superseded.
    • 2017-XX Security Only Quality Update: Security updates for the specified month only.  Does not include updates from any previous month.  Previous monthly updates will still be applicable and needed.
    Do not deploy both the Security Monthly Quality Rollup and the Security Only Quality Update for the same month at the same time.  If both updates are targeted to an endpoint, the Windows Update Agent installs the Security Monthly Quality Rollup, and the Security Only update is ignored.  The download size increases without any benefit.

For more information, see Exclude patches with blacklists and the Microsoft articles on Simplified Servicing or the Windows Servicing Model.


Deployments compile patches, typically from lists, and then distribute Patch packages to the target computers. You can configure deployment options to set when and how patches are installed or uninstalled.

For example, you might want to restart an endpoint after patches are installed to apply the changes. If a patch comes out that would normally be blacklisted but is needed for some reason, you can override the blacklist for that specific deployment rather than making a new version the blacklist. In urgent situations, you can even override a closed maintenance window.

You can choose whether to restart the endpoint after patch installation, to inform the user about the restart, and to allow the user to postpone the restart.

Maintenance windows

Maintenance windows designate the permitted times that the targeted computer groups are open for patches to be installed or uninstalled. You can have multiple maintenance windows, even with overlapping times. Maintenance windows do not interfere with each other. For a patch deployment to take effect, the deployment and maintenance window times must be met.

Consider establishing a maintenance cycle that keeps your endpoints as up-to-date as possible. You can avoid many security risks with good operational hygiene. Some considerations might include coordinating with the Microsoft Patch Tuesday releases, on weekends, or outside the core work hours for your network.

Last updated: 2/5/2019 4:39 PM | Feedback