Deploy requirements

Review the requirements before you install and use Deploy.

Core platform dependencies

Make sure that your environment meets the following requirements:

• Tanium license that includes Deploy

• Tanium™ Core Platform servers: 7.3.314.4250 or later

• Tanium™ Client: Any supported version of Tanium Client. For the Tanium Client versions supported for each OS, see Tanium Client Management User Guide: Client version and host system requirements.

  If you use a client version that is not listed, certain product features might not be available, or stability issues can occur that can only be resolved by upgrading to one of the listed client versions.

Computer group dependencies

When you first sign in to the Tanium Console after a fresh installation of Tanium Server 7.4.2 or later, the server Tanium™ Cloud automatically imports the All Computers computer group, which Deploy requires.

For earlier versions of the Tanium Server, or after upgrading from an earlier version, you must manually create the computer groups. See Tanium Console User Guide: Create a computer group.

Endpoints

Contact Tanium Support for customized tuning to your environment. For more information, see Tanium Platform User Guide: Managing Tanium Core Platform Settings.

Supported operating systems

Operating System	Version	Notes
Windows Server	Windows Server 2008 R2 Service Pack 1 or later	Windows Server Core not supported for End-User Notifications functionality. Windows Server 2008 R2 Service Pack 1 requires Microsoft KB2758857. Windows Server 2012 R2 requires Microsoft KB2919394 or KB2919355 for End-User Self Service functionality.
Windows Workstation	Windows 7 Service Pack 1 or later	Windows 7 Service Pack 1 requires Microsoft KB2758857. Windows 8.1 requires Microsoft KB2919394 or KB2919355 for End-User Self Service functionality.
macOS	macOS 12.0 Monterey macOS 11.0 Big Sur macOS 10.15 Catalina macOS 10.14.6 Mojave macOS 10.13.6 High Sierra
Linux	AlmaLinux 8.x Amazon Linux 1 or later CentOS 6 or later Debian 8 or later openSUSE Linux 11.x Service Pack 3 or later, 12.x, 15.x Oracle Linux 6 or later Red Hat Enterprise Linux (RHEL) 6 or later Rocky Linux 8.x SUSE Linux Enterprise Desktop 11.3, 11.4, 12.x, 15.x SUSE Linux Enterprise Server 11.3, 11.4, 12.x, 15.x Ubuntu 14.04 or later

Windows System environment variables

The use of environment variables when you refer to file paths in Deploy is recommended over the use of explicit file paths. This method provides independence from differing paths based on operating system language or architecture, and allows the construction of a dynamic path at the time of execution.

Process Architecture	System Environment Variable	Path
32-bit process on 32-bit Windows	%PROGRAMFILES%	C:\Program Files
	%COMMONPROGRAMFILES%	C:\Program Files\Common Files
32-bit process on 64-bit Windows	%PROGRAMFILES%	C:\Program Files (x86)
	%PROGRAMFILESX86%	C:\Program Files (x86)
	%COMMONPROGRAMFILES%	C:\Program Files (x86)\Common Files
	%COMMONPROGRAMFILES(X86)%	C:\Program Files (x86)\Common Files
	%COMMONPROGRAMW6432%	C:\Program Files\Common Files
	%PROGRAMW6432%	C:\Program Files

Additional environment variables that are available to the System account, such as %SystemDrive%, %SystemRoot%, %WinDir%, are also supported.

Host and network security requirements

Specific ports, processes, and URLs and processes are needed to run Deploy.

Ports

Configure firewall policies to open ports for Tanium traffic with TCP-based rules instead of application identity-based rules. For example, on a Palo Alto Networks firewall, configure the rules with service objects or service groups instead of application objects or application groups.

For Tanium Cloud ports, see Tanium Cloud Deployment Guide: Host and network security requirements.

Security exclusions

If security software is in use in the environment to monitor and block unknown host system processes, Tanium recommends that a security administrator create exclusions to allow the Tanium processes to run without interference. The configuration of these exclusions varies depending on AV software. For a list of all security exclusions to define across Tanium, see Tanium Core Platform Deployment Reference Guide: Host system security exclusions.

For Windows endpoints, review and follow the Microsoft antivirus security exclusion recommendations for enterprise computers. For more information, see Microsoft Support: Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows (KB822158).

Deploy security exclusions

Target Device	Notes	Exclusion Type	Exclusion
Module Server		Process	<Module Server>\services\deploy-service\node.exe
	Required when Endpoint Configuration is installed	Process	<Module Server>\services\endpoint-configuration-service\TaniumEndpointConfigService.exe
Windows endpoints	Required only for the Microsoft Windows 10 Upgrade packages	Folder	C:\Deploy\Tanium
		Process	<Tanium Client>\Python38\TPython.exe
		Folder	<Tanium Client>\Python38
		Process	<Tanium Client>\Tools\Deploy\7za.exe
		Process	<Tanium Client>\Tools\SoftwareManagement\7za.exe
		Process	<Tanium Client>\TaniumCX.exe
		File	<Tanium Client>\extensions\TaniumSoftwareManager.dll
		File	<Tanium Client>\extensions\TaniumSoftwareManager.dll.sig
Linux endpoints		Process	<Tanium Client>/python38/python
		Folder	<Tanium Client>/python38
		Process	<Tanium Client>/TaniumCX
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db-wal
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db-shm
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.so
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.so.sig
macOS endpoints		Process	<Tanium Client>/python38/python
		Folder	<Tanium Client>/python38
		Process	<Tanium Client>/TaniumCX
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.dylib
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.dylib.sig

Deploy security exclusions

Target Device	Notes	Exclusion Type	Exclusion
Windows endpoints	Required only for the Microsoft Windows 10 Upgrade packages	Folder	C:\Deploy\Tanium
		Process	<Tanium Client>\Python38\TPython.exe
		Folder	<Tanium Client>\Python38
		Process	<Tanium Client>\Tools\Deploy\7za.exe
		Process	<Tanium Client>\Tools\SoftwareManagement\7za.exe
		Process	<Tanium Client>\TaniumCX.exe
		File	<Tanium Client>\extensions\TaniumSoftwareManager.dll
		File	<Tanium Client>\extensions\TaniumSoftwareManager.dll.sig
Linux endpoints		Process	<Tanium Client>/python38/python
		Folder	<Tanium Client>/python38
		Process	<Tanium Client>/TaniumCX
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db-wal
		File	<Tanium Client>/Tools/SoftwareManagement/data/software-management.db-shm
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.so
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.so.sig
macOS endpoints		Process	<Tanium Client>/python38/python
		Folder	<Tanium Client>/python38
		Process	<Tanium Client>/TaniumCX
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.dylib
		File	<Tanium Client>/extensions/libTaniumSoftwareManager.dylib.sig

User role requirements

The following tables list the role permissions required to use Deploy. To review a summary of the predefined roles, see Set up Deploy users.

For more information about role permissions and associated content sets, see Tanium Core Platform User Guide: Managing RBAC.

Deploy user role permissions

Permission	Deploy Administrator1,2,3	Deploy Endpoint Configuration Approver1,2	Deploy Operator1,2,3	Deploy Package Administrator1,2,3	Deploy Read Only User2,3	Deploy Service Account1,2,3,4	Deploy User1,2,3
Deploy View the Deploy workbench	SHOW	SHOW	SHOW	SHOW	SHOW	SHOW	SHOW
Deploy API Perform Deploy operations using the API	EXECUTE	EXECUTE	EXECUTE	EXECUTE	EXECUTE	EXECUTE	EXECUTE
Deploy Deployments Create and modify deployments	WRITE		WRITE			WRITE	WRITE
Deploy Endpoint Configuration APPROVE: Approve Deploy items for Endpoint Configuration REGISTER: Register with Endpoint Configuration		APPROVE				REGISTER
Deploy Maintenance Windows Create, modify, and remove maintenance windows	WRITE		WRITE			WRITE	WRITE
Deploy Module Read and write access to the Deploy module, including creating, editing, deleting, and importing software packages	READ WRITE	READ	READ WRITE	READ WRITE	READ	READ WRITE	READ WRITE
Deploy Operator Settings Write access to a subset of platform settings in the Deploy module	WRITE		WRITE			WRITE
Deploy Profiles Create, modify, and delete self service profiles	WRITE		WRITE			WRITE	WRITE
Deploy Settings Write access to platform settings in the Deploy module	WRITE					WRITE
1 This role provides module permissions for Tanium Endpoint Configuration. You can view which Endpoint Configuration permissions are granted to this role in the Tanium Console. For more information, see Tanium Endpoint Configuration User Guide: User role requirements. 2 This role provides module permissions for Tanium Interact. You can view which Interact permissions are granted to this role in the Tanium Console. For more information, see Tanium Interact User Guide: Tanium Data Service permissions. 3 This role provides module permissions for Tanium Trends. You can view which Trends permissions are granted to this role in the Tanium Console. For more information, see Tanium Trends User Guide: User role requirements. 4 If you enabled configuration approvals in Endpoint Configuration, then by default, configuration changes initiated by the module service account (such as tool deployment) require approval. You can bypass approval for module-generated configuration changes by applying the Endpoint Configuration Bypass Approval permission to the Deploy Service Account role and adding the relevant content sets. For more information, see Tanium Endpoint Configuration User Guide: User role requirements and Tanium Endpoint Configuration User Guide: Managing approvals.

 

Provided Deploy administration and platform content permissions

Permission	Permission Type	Deploy Administrator1,2,3	Deploy Endpoint Configuration Approver1,2	Deploy Operator1,2,3	Deploy Package Administrator1,2,3	Deploy Read Only User1,2,3	Deploy Service Account1,2,3	Deploy User1,2,3
Computer Group	Administration	READ	READ	READ	READ	READ	READ	READ
User	Administration	READ		READ			READ
User Group	Administration	READ	READ	READ	READ	READ	READ	READ
Action	Platform Content	READ WRITE	READ	READ WRITE	READ WRITE	READ	READ WRITE	READ WRITE
Approve Action	Platform Content	SPECIAL		SPECIAL	SPECIAL		SPECIAL	SPECIAL
Own Action	Platform Content	READ	READ	READ	READ	READ	READ	READ
Package	Platform Content	READ WRITE	READ	READ WRITE	READ WRITE	READ	READ WRITE	READ WRITE
Plugin	Platform Content	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE
Saved Question	Platform Content	READ WRITE	READ	READ WRITE	READ WRITE	READ	READ WRITE	READ WRITE
Sensor	Platform Content	READ	READ	READ	READ	READ	READ	READ
You can view which content sets are granted to any role in the Tanium Console. 1 This role provides content set permissions for Tanium Endpoint Configuration. You can view which Endpoint Configuration content sets are granted to this role in the Tanium Console. For more information, see Tanium Endpoint Configuration User Guide: User role requirements. 2 This role provides content set permissions for Tanium Interact. You can view which Interact content sets are granted to this role in the Tanium Console. For more information, see Tanium Interact User Guide: Tanium Data Service permissions. 3 This role provides content set permissions for Tanium Trends. You can view which Trends content sets are granted to this role in the Tanium Console. For more information, see Tanium Trends User Guide: User role requirements.

For more information and descriptions of content sets and permissions, see the Tanium Core Platform User Guide: Users and user groups.