Patch requirements

Review the requirements before you install and use Patch.

Core platform dependencies

Make sure that your environment meets the following requirements:

• Tanium license that includes Patch

• Tanium™ Core Platform servers: 7.4.3.1204 or later

  To support smart card authentication, including common access cards (CAC), see Tanium Core Platform Deployment Reference Guide: Smart card authentication.

• Tanium™ Client: Any supported version of Tanium Client. For the Tanium Client versions supported for each OS, see Tanium Client Management User Guide: Client version and host system requirements.

  If you use a client version that is not listed, certain product features might not be available, or stability issues can occur that can only be resolved by upgrading to one of the listed client versions.

Computer group dependencies

When you first sign in to the Tanium Console after a fresh installation of Tanium Server, the server Tanium™ Cloud automatically imports the computer groups that Patch requires for managing Windows and Linux endpoints:

• All Alma Linux 8
• All Amazon
• All Debian
• All Debian 8
• All Debian 9
• All Debian 10
• All Debian 11
• All CentOS 6
• All CentOS 7
• All CentOS 8
• All OpenSUSE 15
• All Oracle 6
• All Oracle 7
• All Oracle 8
• All Red Hat 6
• All Red Hat 7
• All Red Hat 8
• All Red Hat 9
• All Rocky Linux 8
• All SLES 11
• All SLES 12
• All SLES 15
• All SUSE
• All Ubuntu 14.04 - amd64
• All Ubuntu 14.04 - i386
• All Ubuntu 14.04 - arm64
• All Ubuntu 16.04 - amd64
• All Ubuntu 16.04 - i386
• All Ubuntu 16.04 - arm64
• All Ubuntu 18.04 - amd64
• All Ubuntu 18.04 - i386
• All Ubuntu 18.04 - arm64
• All Ubuntu 20.04 - amd64
• All Ubuntu 20.04 - i386
• All Ubuntu 20.04 - arm64
• All Ubuntu 22.04 - amd64
• All Ubuntu 22.04 - i386
• All Ubuntu 22.04 - arm64
• All Windows
• All Windows Servers
• Patch Supported Systems

For earlier versions of the Tanium Server, or after upgrading from an earlier version, you must manually create the computer groups. See Tanium Console User Guide: Create a computer group.

Solution dependencies

Client extensions

Tanium Endpoint Configuration installs client extensions for Patch on Windows and Linux endpoints. Client Extensions perform tasks that are common to certain Tanium solutions. The Tanium Client uses code signatures to verify the integrity of each client extension prior to loading the extension on the endpoint. Each client extension has recommended security exclusions to allow the Tanium processes to run without interference. See Security exclusions for more information. The following client extensions perform Patch functions:

• Config CX - Provides installation and configuration of extensions on endpoints. Tanium Client Management installs this client extension.

• Core CX - Provides a management framework API for all other client extensions and exposes operating system metrics. Tanium Client Management installs this client extension.

• Software Manager CX - Provides a catalog of all installed software on an endpoint. Tanium Asset or Tanium Patch installs this client extension.

Endpoints

Supported operating systems

The following endpoint operating systems are supported with Patch. Specific version requirements depend on the version of Patch and components that you are using. For more information about Tanium Client versions, see Tanium Client Management User Guide: Client version and host system requirements.

Resource requirements

• The utilities that Patch uses for scanning use increased RAM for up to several minutes during endpoint scans. If an endpoint must also run other processes that use significant RAM during Patch scans, it might require more RAM than the minimum 2 GB. For more information, see Tanium Client Management User Guide: Hardware requirements.

• On the Tanium Console Administration > Configuration > Settings > Advanced Settings page, set the Tanium Client cache limit (ClientCacheLimitInMB) to 2048MB. For more information, see Configure advanced settings and Tanium Platform User Guide: Managing Core Platform Settings.

• If VDI is used in your environment, see the Tanium Client Management User Guide: Preparing the Tanium Client on a virtual desktop infrastructure (VDI) instance.

Third-party software

Patch requires that Windows endpoints have Windows Update Agent version 6.1.0022.4 or later installed. Enhanced functionality is available on Windows 7 systems with version 7.6.7601.19161 and later. See Microsoft KB3138612. If you are controlling all patch deployments through Tanium, disable the Windows Update Agent automatic functions at the domain level.

Host and network security requirements

Specific ports, processes, and URLs are needed to run Patch.

Ports

For Tanium Cloud ports, see Tanium Cloud Deployment Guide: Host and network security requirements.

Configure firewall policies to open ports for Tanium traffic with TCP-based rules instead of application identity-based rules. For example, on a Palo Alto Networks firewall, configure the rules with service objects or service groups instead of application objects or application groups.

Security exclusions

If security software is in use in the environment to monitor and block unknown host system processes, Tanium recommends that a security administrator create exclusions to allow the Tanium processes to run without interference. The configuration of these exclusions varies depending on AV software. For a list of all security exclusions to define across Tanium, see Tanium Core Platform Deployment Reference Guide: Host system security exclusions.

The Tanium Client uses the Windows Update offline scan file, Wsusscn2.cab, to assess computers for installed or missing operating system and application security patches. If your endpoint security solutions scan archive files, refer to the Microsoft KB for information on how to configure those tools to interact appropriately with the Wsusscn2.cab file.

For Windows endpoints, review and follow the Microsoft antivirus security exclusion recommendations for enterprise computers. For more information, see Microsoft Support: Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows (KB822158).

Internet URLs

If security software is deployed in the environment to monitor and block unknown URLs, your security administrator must allow access to Internet URLs on the Tanium Server, Tanium Module Server, or endpoints, depending on the operating system of the endpoints and your Patch configuration. The complete list might vary based on your environment.

• Windows endpoints:

  • The Tanium Server needs access to the URLs if Patch is scanning Windows endpoints. See Windows scan techniques.

  • The Tanium Module Server needs access to www.microsoft.com when Patch uses the Tanium Scan technique. See Windows scan techniques.
  • The Windows endpoints need access to the URLs if you are using direct patch downloads. See Enable direct patch downloads from Microsoft.
• Linux endpoints:
  • The Tanium Server needs access to the URLs used by a scan configuration that uses the Tanium Scan technique. See Linux scan techniques.
  • The Linux endpoints need access to the URLs used by a scan configuration that uses the Repository Scan technique. See Linux scan techniques.

  For a complete list of URLs needed in your environment, in Interact ask the question Get Patch - Repositories from all machines with Is Linux equals True. Review the URLs listed in the Base URL column.

• macOS endpoints: The Tanium Server and macOS endpoints need access to the URLs if Patch is scanning endpoints. See Enforcing scan configurations for Windows and Linux endpoints.

If security software is deployed in the environment to monitor and block unknown URLs, your security administrator must allow access to Internet URLs on Windows and Linux endpoints, depending on your Patch configuration:

• Windows:

  The Windows endpoints need access to the URLs if you are using direct patch downloads. See Enable direct patch downloads from Microsoft.
• Linux: The Linux endpoints need access to the URLs used by a scan configuration that uses the Repository Scan technique. See Linux scan techniques.

User role requirements

The following tables list the role permissions required to use Patch. To review a summary of the predefined roles, see Set up Patch users.

Do not assign the Patch Service Account and Patch Service Account - All Content Sets roles to users. These roles are for internal purposes only.

For more information about role permissions and associated content sets, see Tanium Console User Guide: Managing RBAC.

Patch user role permissions

Permission	Patch Administrator1,2,3,7	Patch Configuration Author1,2,3,7	Patch Deployment Author1,2,3,7	Patch Endpoint Configuration Approver1	Patch Operator1,2,3,7	Patch Read Only User2,3,7	Patch Super User1,2,3,6,7	Patch MDM Enforcement Author2,3,4,5,6,7	Patch MDM Enforcement Viewer2,3,4,5,6,7
Linux Patch Access to the Linux Patch content	USER	USER	USER		USER	USER	USER
Patch INITIALIZE: Set up Patch activities for the granted content sets SHOW: View the Patch workbench	INITIALIZE SHOW	SHOW	SHOW		INITIALIZE SHOW	SHOW	INITIALIZE4 SHOW	SHOW	SHOW
Patch Block List Create, modify, and delete block lists for the granted content sets	4,5 READ WRITE EXECUTE DELETE	4 READ WRITE DELETE	4 READ		4 READ WRITE EXECUTE DELETE	4 READ	4 READ WRITE EXECUTE DELETE
Patch Deployment Create, modify, and delete deployments for the granted content sets	4,5 READ WRITE EXECUTE DELETE	4 READ	4 READ WRITE EXECUTE DELETE		4 READ WRITE EXECUTE DELETE	4 READ	4 READ WRITE EXECUTE DELETE
Patch Endpoint Configuration Approve changes to Patch endpoint configurations				APPROVER
Patch Maintenance Window Create, modify, and delete enforcements in maintenance windows for the granted content sets	4,5 READ WRITE EXECUTE DELETE	4 READ WRITE DELETE	4 READ		4 READ WRITE EXECUTE DELETE	4 READ	4 READ WRITE EXECUTE DELETE
Patch MDM Enforcement Create, modify, and delete MDM enforcements	READ WRITE DELETE						READ WRITE DELETE	READ WRITE DELETE	READ
Patch Operator Settings Write access to a subset of platform settings in the Patch module	WRITE				WRITE
Patch Patchlist Create, modify, and delete enforcements in patch lists for the granted content sets	4,5 READ WRITE EXECUTE DELETE	4 READ WRITE EXECUTE DELETE	4 READ		4 READ WRITE EXECUTE DELETE	4 READ	4 READ WRITE EXECUTE DELETE
Patch Profile Create, modify, and delete profiles	READ WRITE EXECUTE DELETE				WRITE EXECUTE DELETE	READ	WRITE EXECUTE DELETE
Patch Repository Create, modify, and delete repositories	READ WRITE EXECUTE DELETE	READ			READ WRITE EXECUTE DELETE	READ	READ EXECUTE
Patch Repository Snapshot Create, edit, and delete repository snapshots	READ WRITE DELETE	READ WRITE DELETE			READ WRITE DELETE	READ	READ WRITE DELETE
Patch Scan Configuration Create, modify, and delete scan configurations	READ WRITE EXECUTE DELETE	READ WRITE DELETE			READ WRITE EXECUTE DELETE	READ	READ WRITE EXECUTE DELETE
Patch Settings Write access to all Patch settings	READ WRITE	READ	READ		READ	READ	READ	READ	READ
Patch Solution Install or uninstall Patch	UPGRADE
Patch Statistics Access to the Patch statistics logs	LOGS
Windows Patch Access to the Windows Patch content	USER	USER	USER		USER	USER	USER
1 This role provides module permissions for Tanium Endpoint Configuration. You can view which Endpoint Configuration permissions are granted to this role in the Tanium Console. For more information, see Tanium Endpoint Configuration User Guide: User role requirements. 2 This role provides module permissions for Tanium Interact. You can view which Interact permissions are granted to this role in the Tanium Console. For more information, see Tanium Interact User Guide: Tanium Data Service permissions. 3 This role provides module permissions for Tanium Trends. You can view which Trends permissions are granted to this role in the Tanium Console. For more information, see Tanium Trends User Guide: User role requirements. 4 Grants access to content in the Patch Content Set content set. 5 Grants access to content in the Patch Service Objects content set. 6 This role provides module permissions for Tanium Mac Device Enrollment. You can view which Mac Device Enrollment permissions are granted to this role in the Tanium Console. For more information, see Tanium Mac Device Enrollment User Guide: User role requirements. 7 This role provides module permissions for Tanium Reporting. You can view which Reporting permissions are granted to this role in the Tanium Console. For more information, see Tanium Reporting User Guide: User role requirements.

Provided Patch administration and platform content permissions

Permission	Permission Type	Patch Administrator1,2,4	Patch Configuration Author1,2,3,4	Patch Deployment Author1,2,3,4	Patch Endpoint Configuration Approver	Patch Operator1,2,4	Patch Read Only User1,2,4	Patch Super User1,2,4	Patch MDM Enforcement Author2,3,4	Patch MDM Enforcement Viewer2,3,4
Action Group	Administration	READ	READ	READ		READ	READ	READ	READ	READ
Allowed Urls	Administration	READ WRITE
Action	Platform Content	READ WRITE	WRITE	WRITE		READ WRITE		READ WRITE
Filter Group	Platform Content	READ	READ	READ		READ	READ	READ	READ	READ
Own Action	Platform Content	READ	READ	READ		READ		READ
Package	Platform Content	READ WRITE	READ	READ		READ WRITE		READ WRITE
Plugin	Platform Content	READ EXECUTE	READ EXECUTE	READ EXECUTE		READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE
Saved Question	Platform Content	READ WRITE	READ	READ		READ WRITE	READ	READ WRITE	READ	READ
Sensor	Platform Content	READ	READ	READ		READ	READ	READ	READ	READ
To view which content set permissions are granted to a role, see Tanium Console User Guide: View effective role permissions. 1 This role provides content set permissions for Tanium Interact. You can view which Interact content sets are granted to this role in the Tanium Console. For more information, see Tanium Interact User Guide: Tanium Data Service permissions. 2 This role provides content set permissions for Tanium Trends. You can view which Trends content sets are granted to this role in the Tanium Console. For more information, see Tanium Trends User Guide: User role requirements. 3 This role provides content set permissions for Mobile Device Management. You can view which Mobile Device Management content sets are granted to this role in the Tanium Console. For more information, see Tanium Mac Device Enrollment User Guide: User role requirements. 4 This role provides module permissions for Tanium Reporting. You can view which Reporting permissions are granted to this role in the Tanium Console. For more information, see Tanium Reporting User Guide: User role requirements.

For more information and descriptions of content sets and permissions, see the Tanium Core Platform User Guide: Users and user groups.

Mac and macOS are trademarks of Apple Inc., and registered in the U.S. and other countries and regions.