Patch overview

Use Patch to manage operating system patching across your enterprise at the speed and scale of Tanium™. You can deploy a single patch to a computer group immediately. You can also perform more complex tasks, such as using advanced rule sets and maintenance windows to deliver groups of patches across your environment at specified times.

You can define custom workflows and schedule patches based on rules or exceptions built around patch lists, block lists, and maintenance windows. For example, you might always apply critical Microsoft patches to all machines except for datacenter servers, or always exclude .NET patches, or install patches during non-working hours.

Patch generates in-depth reports and returns current patch applicability results from every endpoint. For any patch or patch list deployment, the following details are provided:

  • The patch details, such as severity, release date, applicable Common Vulnerabilities and Exposures (CVE), files, and links to knowledge base articles.
  • The status of the patch, split out by computer group.
  • The assigned patch lists or block lists for the patch.

Patch scanning options

You can choose from several scan methods to determine the installed and missing patches across your network. Scan configurations define a scan method, scan frequency, and the computer groups that are being scanned, known as an enforcement. One scan configuration is applied to an endpoint. If an endpoint is included in multiple computer groups, the highest priority scan configuration is applied. For more information, see Enforcing scan configurations.

Review the following lists of scanning options to decide the best method to use for each computer group.

Table 1:   Available patch scanning options for Windows endpoints
Scan method Tanium Scan Offline CAB File1 Online Microsoft Windows Update WSUS (Windows Server Update Services)2
Platform OS Windows Windows Windows Windows
Updates included
  • Critical Updates
  • Feature Packs
  • Security Updates
  • Service Packs
  • Tools
  • Update Rollups
  • Updates
  • Security Updates
  • Service Packs
  • Update Rollups
  • Scanning: Critical Updates, Security Updates, Definition Updates, Update Rollups, Service Packs, Tools, Feature Packs, Updates, Upgrades, Drivers
  • Installing: Critical Updates, Security Updates, Update Rollups, Service Packs, Tools, Updates
  • Scanning: Critical Updates, Security Updates, Definition Updates, Update Rollups, Service Packs, Tools, Feature Packs, Updates, Upgrades, Drivers
  • Installing: Critical Updates, Security Updates, Update Rollups, Service Packs, Tools, Updates
Client impact
  • Moderate, during first scan
  • Low, subsequent
Moderate, during scanning activity
  • Moderate, during first scan
  • Low, subsequent
Low
Connectivity
  • A client database file is stored locally by the Tanium Client.
  • With the direct download option for isolated endpoints, the endpoint contacts Microsoft directly.
  • The CAB file is stored locally by the Tanium Client.
  • With the direct download option for isolated endpoints, the endpoint contacts Microsoft directly.
  • The Tanium Client must contact Microsoft directly.
  • With the direct download option for isolated endpoints, the endpoint contacts Microsoft directly.
  • The Tanium Client must contact the WSUS server.
  • With the direct download option for isolated endpoints, the endpoint contacts the location that is defined by the WSUS server directly. Depending on WSUS server configuration, the location is the WSUS server or Microsoft.
Support for direct download of patches on isolated endpoints Yes Yes Yes Yes
Details
  • The Patch service is configured to synchronize update metadata and detection rules from Microsoft Update or a Microsoft WSUS server.
  • Supports direct patch downloads from Microsoft to isolated endpoints.
  • Requires 600+MB download of CAB file.
  • Does not include non-security updates, out of band fixes, hotfixes, and enhancements that are included with WSUS or Online to Microsoft scan methods.
  • Supports direct patch downloads from Microsoft to isolated endpoints.
  • Requires additional network traffic to Microsoft directly.
  • Feature Pack and Driver updates should be blocked for installation.
  • Supports direct patch downloads from Microsoft to isolated endpoints.
  • Must deploy and configure one or more WSUS servers.
  • Updates must be approved in WSUS prior to scanning or deployment.
  • Feature Pack and Driver updates should be blocked for installation.
  • Supports direct patch downloads from Microsoft or the WSUS server to isolated endpoints.

1 Offline CAB File includes only Security Updates, Service Packs, and Update Rollups updates. Because other scan methods include more updates than Offline CAB File includes, if you change the scan configuration technique on an active deployment from Offline CAB File to another technique, additional patches might be installed on endpoints.

2 If you are using Microsoft System Center Configuration Manager (SCCM) with your WSUS server, do not use Tanium for WSUS scanning with the same server.

For more information, see Windows scan techniques.

Table 2:   Available patch scanning options for Linux endpoints
Scan method Tanium Scan Repository Scan
Platform OS
  • Red Hat
  • CentOS
  • Oracle Linux
  • Red Hat
  • CentOS
  • Oracle Linux
  • Amazon Linux
Updates included

All updates in the Yum repositories

All updates in the Yum repositories

Client impact

Moderate, during scanning activity

Moderate, during scanning activity
Connectivity

The Tanium Client stores the repository scanning logic locally.

The Tanium Client must contact the Yum repositories for scanning as well as patch downloads.

Support for direct download of patches on isolated endpoints No No
Details
  • Internal or external Yum repositories can be used.
  • Only the Tanium Server needs connectivity to the Yum repositories.
  • Must deploy and configure one or more Yum repositories.
  • Updates must be maintained in the Yum repositories.

For more information, see Tanium dependencies and Linux scan techniques.

Patch lists and block lists

A patch list contains patches that can be applied. A block list contains patches that must be excluded. Patch provides a baseline reporting patch list for each supported operating system. You can also create patch lists and block lists. These lists can be determined by any detail included in the patch information.

For example, you could

  • Create lists based on severity, prioritize the most critical and most recent updates first.
  • Focus only on CVE issues.
  • Create lists based on the month or a specific release date.

As new patches come out, you can use dynamic rules to automatically assess and populate patches to the appropriate lists. You can iteratively develop these lists by creating new versions. You can deploy any version of the list as needed. For more information, see Managing patches.

Superseded patches

Each patch includes a column that indicates if the patch has been superseded, or effectively replaced by a newer patch. A patch is marked as superseded when a single endpoint reports that the patch is superseded. Including superseded patches in patch lists can be useful when you want to find or install a specific patch that was superseded. For example, you might need to find or install superseded patches when they are referenced in a security advisory recommendation. Superseded patches are automatically included in block lists.

For more information, see Exclude patches with block lists.

Microsoft update and servicing details

Microsoft provides software patch updates in different ways depending on the operating system of the endpoint. Microsoft changes these terms occasionally, and it is important to understand how these policies affect your patching processes.

  • Windows 10, Windows Server 2016, and Windows Server 2019
    • Feature Updates: Feature builds are essentially a new build of Windows 10. These upgrades are published twice a year with a target of March and September of each year (for example 1709, 1803, 1809, 1902, 1909). Consider the following Tanium capabilities when you select a solution for Windows feature updates.
    • 2019-XX Cumulative Update: Released monthly, a cumulative update supersedes any previous cumulative update for Windows 10. Contains all security and non-security fixes for the month and all previous months.
  • Windows 7, 8.1, 2008, 2008R2, 2012, 2012R2
    • 2019-XX Security Monthly Quality Rollup: Package is a cumulative update for current and all previous months. Only the current month will be applicable. All previous versions are superseded.
    • 2019-XX Security Only Quality Update: Security updates for the specified month only. Does not include updates from any previous month. Previous monthly updates will still be applicable and needed.
    Do not deploy both the Security Monthly Quality Rollup and the Security Only Quality Update for the same month at the same time. If both updates are targeted to an endpoint, the Windows Update Agent installs the Security Monthly Quality Rollup, and the Security Only update is ignored. The download size increases without any benefit.

Deployments

Deployments compile patches, typically from lists, and then distribute Patch packages to the target computers. You can configure deployment options to set when and how patches are installed or uninstalled.

For example, you might want to restart an endpoint after patches are installed to apply the changes. If a patch comes out that would normally be blocked but is needed for some reason, you can override the block list for that specific deployment rather than making a new version the block list. In urgent situations, you can even override a closed maintenance window.

You can choose whether to restart the endpoint after patch installation, to inform the user about the restart, and to allow the user to postpone the restart. For more information, see Deploying patches.

Deployment templates can be used to save settings for a deployment that you can issue repeatedly. For more information, see Create a deployment template.

Maintenance windows

Maintenance windows designate the permitted times that the targeted computer groups are open for patches to be installed or uninstalled. You can have multiple maintenance windows, even with overlapping times. Maintenance windows do not interfere with each other. For a patch deployment to take effect, the deployment and maintenance window times must be met.

Consider establishing a maintenance cycle that keeps your endpoints as up-to-date as possible. You can avoid many security risks with good operational hygiene. Some considerations might include coordinating with the Microsoft Patch Tuesday releases, on weekends, or outside the core work hours for your network.

For more information, see Setting maintenance windows.

Repository snapshots

A Yum repository snapshot captures point-in-time metadata that determine patch versions and their dependencies, and provide control over dependencies for Linux endpoint patches. Using a repository snapshot can help ensure that your production systems are installing the same patches as your testing systems, which reduces deployments of untested patches on production systems.

Repository snapshots are not recommended for the official CentOS mirrors. Those mirrors might not have all of the required dependencies that a snapshot lists after a certain amount of time. For best results with CentOS, create and maintain a metadata source repository and manage packages. Snapshots are not supported for Amazon Linux.

For more information, see Manage Linux repository snapshots.

Integration with other Tanium products

Patch integrates with other Tanium products to provide additional features and reporting.

Tanium™ Comply

From Comply vulnerability report results, you can open Patch to view details about the patch that resolves a reported vulnerability. You can also quickly install the patch to endpoints directly from the patch details page. For more information, see vulnerability report results in Tanium Comply User Guide: Working with reports.

Tanium™ End-User Notifications

With the Tanium End-User Notifications solution, you can create a notification message with your deployment to notify the user that the system is going to restart, and give the user the option to postpone the restart. For more information, see Tanium End-User Notifications User Guide.

Tanium™ Endpoint Configuration

With the Tanium Endpoint Configuration solution, you can enable approvals for endpoint configuration changes. For more information, see Tanium Endpoint Configuration User Guide.

Tanium™ Trends

Patch has built in integration with Trends for additional reporting of patch data. The Patch board shows information about missing patches, service-level-agreement (SLA) based compliance reports, time between a patch release and its installation, endpoint status, and scan errors. The following sections and panels are in the Patch board:

  • Summary
    • Patch Coverage
    • Endpoints Missing Critical or Important Patches Released Over 30 Days Ago
    • Workstations - Mean Time to Patch
    • Servers - Mean Time to Patch
  • Missing Patches
    • Missing Critical/Important Patches per Year
    • Operating Systems Missing Critical/Important Patches
    • Missing Patches by Severity - Latest
    • Missing Patches by Severity - Last 90 Days
  • SLA Based Compliance Reporting
    • Online Endpoints - Patch Compliance
    • Historical - Patch Compliance
    • Online Endpoints - 30 Day SLA Compliance
    • Historical - 30 Day SLA Compliance
  • Endpoint Status
    • Days Since Last Patch Scan
  • Errors
    • Scan Errors - Last 7 Days

For more information, see Tanium Trends User Guide: Importing the initial gallery.