Deploy requirements

Review the requirements before you install and use Deploy.

Core platform dependencies

Make sure that your environment meets the following requirements:

Tanium license that includes Deploy
Tanium™ Core Platform servers: 7.3.314.4250 or later
Tanium™ Client: Any supported version of Tanium Client. For the Tanium Client versions supported for each OS, see Tanium Client Management User Guide: Client version and host system requirements.
If you use a client version that is not listed, certain product features might not be available, or stability issues can occur that can only be resolved by upgrading to one of the listed client versions.

Computer group dependencies

When you first sign in to the Tanium Console after a fresh installation of Tanium Server 7.4.2 or later, the server Tanium™ Cloud automatically imports the All Computers computer group, which Deploy requires.

For earlier versions of the Tanium Server, or after upgrading from an earlier version, you must manually create the computer groups. See Tanium Console User Guide: Create a computer group.

Solution dependencies

Other Tanium solutions are required for Deploy to function (required dependencies) or for specific Deploy features to work (feature-specific dependencies). The installation method that you select determines if the Tanium Server automatically imports dependencies or if you must manually import them.

Some Deploy dependencies have their own dependencies, which you can see by clicking the links in the lists of Required dependencies and Deploy requirements. Note that the links open the user guides for the latest version of each solution, not necessarily the minimum version that Deploy requires.

Tanium recommended installation

If you select Tanium Recommended Installation when you import Deploy, the Tanium Server automatically imports all your licensed solutions at the same time. See Tanium Console User Guide: Import all modules and services.

Import specific solutions

If you select only Deploy to import, you must manually import dependencies. See Tanium Console User Guide: Import, re-import, or update specific solutions.

Required dependencies

Deploy has the following required dependencies at the specified minimum versions:

Tanium Endpoint Configuration 1.2 or later (installed as part of Tanium Client Management 1.5 or later)
Tanium End-User Notifications 1.6.5 or later
Tanium Interact 2.4.74 or later (use the latest version of Interact for best results)
Tanium Trends 3.6 or later

Tanium Server and Module Server

Deploy is installed and runs as a service on the Module Server host computer. The impact on the Module Server is minimal and depends on usage.

For more information about Tanium Server and Module Server sizing guidelines, see Tanium Core Platform Installation Guide: Host system sizing guidelines.

Endpoints

Contact Tanium Support for customized tuning to your environment. For more information, see Tanium Platform User Guide: Managing Tanium Core Platform Settings.

Supported operating systems
Operating System	Version	Notes
Windows Server	Windows Server 2008 R2 Service Pack 1 or later	Windows Server Core not supported for End-User Notifications functionality. Windows Server 2008 R2 Service Pack 1 requires Microsoft KB2758857. Windows Server 2012 R2 requires Microsoft KB2919394 or KB2919355 for End-User Self Service functionality.
Windows Workstation	Windows 7 Service Pack 1 or later	Windows 7 Service Pack 1 requires Microsoft KB2758857. Windows 8.1 requires Microsoft KB2919394 or KB2919355 for End-User Self Service functionality.
macOS	macOS 12.0 Monterey macOS 11.0 Big Sur macOS 10.15 Catalina macOS 10.14.6 Mojave macOS 10.13.6 High Sierra
Linux	AlmaLinux 8.x Amazon Linux 1 or later CentOS 6 or later Debian 8 or later openSUSE Linux 11.x Service Pack 3 or later, 12.x, 15.x Oracle Linux 6 or later Red Hat Enterprise Linux (RHEL) 6 or later Rocky Linux 8.x SUSE Linux Enterprise Desktop 11.x Service Pack 3 or later, 12.x, 15.x SUSE Linux Enterprise Server 11.x Service Pack 3 or later, 12.x, 15.x Ubuntu 14.04 or later

Windows System environment variables

The use of environment variables when you refer to file paths in Deploy is recommended over the use of explicit file paths. This method provides independence from differing paths based on operating system language or architecture, and allows the construction of a dynamic path at the time of execution.

Process Architecture	System Environment Variable	Path
32-bit process on 32-bit Windows	%PROGRAMFILES%	C:\Program Files
32-bit process on 32-bit Windows	%COMMONPROGRAMFILES%	C:\Program Files\Common Files
32-bit process on 64-bit Windows	%PROGRAMFILES%	C:\Program Files (x86)
	%PROGRAMFILESX86%	C:\Program Files (x86)
	%COMMONPROGRAMFILES%	C:\Program Files (x86)\Common Files
	%COMMONPROGRAMFILES(X86)%	C:\Program Files (x86)\Common Files
	%COMMONPROGRAMW6432%	C:\Program Files\Common Files
	%PROGRAMW6432%	C:\Program Files

Additional environment variables that are available to the System account, such as %SystemDrive%, %SystemRoot%, %WinDir%, are also supported.

Host and network security requirements

Specific ports, processes, and URLs and processes are needed to run Deploy.

Ports

The following ports are required for Deploy communication.

Source	Destination	Port	Protocol	Purpose
Module Server	Module Server (loopback)	17463	TCP	Internal purposes; not externally accessible

Configure firewall policies to open ports for Tanium traffic with TCP-based rules instead of application identity-based rules. For example, on a Palo Alto Networks firewall, configure the rules with service objects or service groups instead of application objects or application groups.

For Tanium Cloud ports, see Tanium Cloud Deployment Guide: Host and network security requirements.

Security exclusions

If security software is in use in the environment to monitor and block unknown host system processes, Tanium recommends that a security administrator create exclusions to allow the Tanium processes to run without interference. The configuration of these exclusions varies depending on AV software. For a list of all security exclusions to define across Tanium, see Tanium Core Platform Deployment Reference Guide: Host system security exclusions.

For Windows endpoints, review and follow the Microsoft antivirus security exclusion recommendations for enterprise computers. For more information, see Microsoft Support: Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows (KB822158).

Deploy security exclusions
Target Device	Notes	Exclusion Type	Exclusion
Module Server		Process	<Module Server>\services\deploy-service\node.exe
Module Server	Required when Endpoint Configuration is installed	Process	<Module Server>\services\endpoint-configuration-service\TaniumEndpointConfigService.exe
Windows endpoints	Required only for the Microsoft Windows 10 Upgrade packages	Folder	C:\Deploy\Tanium
		Process	<Tanium Client>\Python38\TPython.exe
		Folder	<Tanium Client>\Python38
		Process	<Tanium Client>\Tools\Deploy\7za.exe
		Process	<Tanium Client>\Tools\SoftwareManagement\7za.exe
		Process	<Tanium Client>\TaniumCX.exe
		File	<Tanium Client>\extensions\TaniumSoftwareManager.dll
		File	<Tanium Client>\extensions\TaniumSoftwareManager.dll.sig
Linux endpoints		Process	<Tanium Client>/python38/python
		Folder	<Tanium Client>/python38
		Process	<Tanium Client>/TaniumCX
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db-wal
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db-shm
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.so
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.so.sig
macOS endpoints		Process	<Tanium Client>/python38/python
		Folder	<Tanium Client>/python38
		Process	<Tanium Client>/TaniumCX
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.dylib
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.dylib.sig

Deploy security exclusions
Target Device	Notes	Exclusion Type	Exclusion
Windows endpoints	Required only for the Microsoft Windows 10 Upgrade packages	Folder	C:\Deploy\Tanium
		Process	<Tanium Client>\Python38\TPython.exe
		Folder	<Tanium Client>\Python38
		Process	<Tanium Client>\Tools\Deploy\7za.exe
		Process	<Tanium Client>\Tools\SoftwareManagement\7za.exe
		Process	<Tanium Client>\TaniumCX.exe
		File	<Tanium Client>\extensions\TaniumSoftwareManager.dll
		File	<Tanium Client>\extensions\TaniumSoftwareManager.dll.sig
Linux endpoints		Process	<Tanium Client>/python38/python
		Folder	<Tanium Client>/python38
		Process	<Tanium Client>/TaniumCX
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db-wal
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db-shm
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.so
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.so.sig
macOS endpoints		Process	<Tanium Client>/python38/python
		Folder	<Tanium Client>/python38
		Process	<Tanium Client>/TaniumCX
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.dylib
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.dylib.sig

Internet URLs

If security software is deployed in the environment to monitor and block unknown URLs, your security administrator must allow the following URLs on the Tanium Module Server for the Deploy service.

The Tanium Server requires access to the following websites to download binaries for the Predefined Package Gallery templates.

Software Package	Domain	Port
7-zip	crl.identrust.com	80
7-zip	7-zip.org	443
Adobe Acrobat DC¹	download.adobe.com	443
Adobe Acrobat Reader DC	ardownload2.adobe.com	443
Adobe Acrobat Reader DC	download.adobe.com	443
Adobe AIR	download.macromedia.com	443
Adobe Digital Editions	adedownload.adobe.com	443
Adobe Flash Player	fpdownload.macromedia.com	443
Adobe Shockwave EOL²	fpdownload.macromedia.com	443
Apache Tomcat	dlcdn.apache.org	443
Atlassian Sourcetree	product-downloads.atlassian.com	443
BBEdit	s3.amazonaws.com/BBSW-download	443
Box Drive	e3.boxcdn.net	443
Cisco Jabber	binaries.webex.com	443
Citrix Workspace (formerly Citrix Receiver)	downloadplugins.citrix.com	443
DB Browser for SQLite	sqlitebrowser.org	443
Docker Desktop	desktop.docker.com	443
Dropbox	clientupdates.dropboxstatic.com	443
Eclipse Adoptium Temurin JDK/JRE	github.com	443
FileZilla	download.filezilla-project.org	443
Google Android Studio	*.gvt1.com	443
Google Chrome	dl.google.com	443
Google Drive File Stream	dl.google.com	443
iTerm2	iterm2.com	443
KeePass	sourceforge.net	443
Microsoft Edge	msedge.sf.dl.delivery.mp.microsoft.com	443
Microsoft Edge	officecdn-microsoft-com.akamaized.net	443
Microsoft Office 2019	officecdn-microsoft-com.akamaized.net	443
Microsoft Office 2019 with Teams	officecdn-microsoft-com.akamaized.net	443
Microsoft Office Click-to-Run	download.microsoft.com	443
Microsoft Power BI Desktop	download.microsoft.com	443
Microsoft Skype Desktop Client	*.azureedge.net	443
Microsoft SQL Server Management Studio	aka.ms	443
Microsoft Visual Studio Code	code.visualstudio.com	443
Microsoft Windows 10 Upgrade³	content.tanium.com	443
Mozilla Firefox	releases.mozilla.org	443
NodeJS	nodejs.org	443
Notepad++	github.com	443
Notepad++	objects.githubusercontent.com	443
Oracle Java Runtime	javadl.oracle.com	443
Oracle Java Runtime	sdlc-esd.oracle.com	443
Oracle MySQL Community	*.mysql.com	443
PuTTY	the.earth.li	443
Royal Apps GmbH Royal TS	download.royalapplications.com	443
Slack	downloads.slack-edge.com	443
Tableau Reader	downloads.tableau.com	443
TortoiseGit	download.tortoisegit.org	443
TortoiseSVN	osdn.net	443
The Unarchiver	dl.devmate.com	443
VideoLAN VLC Media Player	download.videolan.org	443
VMware Workstation Player⁴	download3.vmware.com	443
WinSCP	sourceforge.net	443
Wireshark	2.na.dl.wireshark.org	443
Zoom	d11yldzmag5yn.cloudfront.net	443
Zoom	zoom.us	443
Zoom Outlook Plugin	zoom.us	443
¹ Update operation only. ² Remove operation only. ³ Windows 10 Operating System media is not included in this package template. For more information, see Use case: Upgrading Windows. ⁴ Update and Remove operations only.

User role requirements

The following tables list the role permissions required to use Deploy. To review a summary of the predefined roles, see Set up Deploy users.

For more information about role permissions and associated content sets, see Tanium Core Platform User Guide: Managing RBAC.

Deploy user role permissions
Permission	Deploy Administrator^1,2,3	Deploy Endpoint Configuration Approver^1,2	Deploy Operator^1,2,3	Deploy Package Administrator^1,2,3	Deploy Read Only User^2,3	Deploy Service Account^1,2,3,4	Deploy User^1,2,3
Deploy View the Deploy workbench	SHOW	SHOW	SHOW	SHOW	SHOW	SHOW	SHOW
Deploy API Perform Deploy operations using the API	EXECUTE	EXECUTE	EXECUTE	EXECUTE	EXECUTE	EXECUTE	EXECUTE
Deploy Deployments Create and modify deployments	WRITE		WRITE			WRITE	WRITE
Deploy Endpoint Configuration APPROVE: Approve Deploy items for Endpoint Configuration REGISTER: Register with Endpoint Configuration		APPROVE				REGISTER
Deploy Maintenance Windows Create, modify, and remove maintenance windows	WRITE		WRITE			WRITE	WRITE
Deploy Module Read and write access to the Deploy module, including creating, editing, deleting, and importing software packages	READ WRITE	READ	READ WRITE	READ WRITE	READ	READ WRITE	READ WRITE
Deploy Operator Settings Write access to a subset of platform settings in the Deploy module	WRITE		WRITE			WRITE
Deploy Profiles Create, modify, and delete self service profiles	WRITE		WRITE			WRITE	WRITE
Deploy Settings Write access to platform settings in the Deploy module	WRITE					WRITE
¹ This role provides module permissions for Tanium Endpoint Configuration. You can view which Endpoint Configuration permissions are granted to this role in the Tanium Console. For more information, see Tanium Endpoint Configuration User Guide: User role requirements. ² This role provides module permissions for Tanium Interact. You can view which Interact permissions are granted to this role in the Tanium Console. For more information, see Tanium Interact User Guide: Tanium Data Service permissions. ³ This role provides module permissions for Tanium Trends. You can view which Trends permissions are granted to this role in the Tanium Console. For more information, see Tanium Trends User Guide: User role requirements. ⁴ If you installed Tanium Client Management, Endpoint Configuration is installed, and by default, configuration changes initiated by the module service account (such as tool deployment) require approval. You can bypass approval for module-generated configuration changes by applying the Endpoint Configuration Bypass Approval permission to this role and adding the relevant content sets. For more information, see Tanium Endpoint Configuration User Guide: User role requirements.

Provided Deploy administration and platform content permissions
Permission	Permission Type	Deploy Administrator^1,2,3	Deploy Endpoint Configuration Approver^1,2	Deploy Operator^1,2,3	Deploy Package Administrator^1,2,3	Deploy Read Only User^1,2,3	Deploy Service Account^1,2,3	Deploy User^1,2,3
Computer Group	Administration	READ	READ	READ	READ	READ	READ	READ
User	Administration	READ		READ			READ
User Group	Administration	READ	READ	READ	READ	READ	READ	READ
Action	Platform Content	READ WRITE	READ	READ WRITE	READ WRITE	READ	READ WRITE	READ WRITE
Approve Action	Platform Content	SPECIAL		SPECIAL	SPECIAL		SPECIAL	SPECIAL
Own Action	Platform Content	READ	READ	READ	READ	READ	READ	READ
Package	Platform Content	READ WRITE	READ	READ WRITE	READ WRITE	READ	READ WRITE	READ WRITE
Plugin	Platform Content	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE
Saved Question	Platform Content	READ WRITE	READ	READ WRITE	READ WRITE	READ	READ WRITE	READ WRITE
Sensor	Platform Content	READ	READ	READ	READ	READ	READ	READ
You can view which content sets are granted to any role in the Tanium Console. ¹ This role provides content set permissions for Tanium Endpoint Configuration. You can view which Endpoint Configuration content sets are granted to this role in the Tanium Console. For more information, see Tanium Endpoint Configuration User Guide: User role requirements. ² This role provides content set permissions for Tanium Interact. You can view which Interact content sets are granted to this role in the Tanium Console. For more information, see Tanium Interact User Guide: Tanium Data Service permissions. ³ This role provides content set permissions for Tanium Trends. You can view which Trends content sets are granted to this role in the Tanium Console. For more information, see Tanium Trends User Guide: User role requirements.

For more information and descriptions of content sets and permissions, see the Tanium Core Platform User Guide: Users and user groups.