Deploy requirements
Review the requirements before you
Core platform dependencies
Make sure that your environment meets the following requirements:
-
Tanium license that includes Deploy
-
Tanium™ Core Platform servers: 7.3.314.4250 or later
- Tanium™ Client: Any supported version of Tanium Client. For the Tanium Client versions supported for each OS, see Tanium Client Management User Guide: Client version and host system requirements.
If you use a client version that is not listed, certain product features might not be available, or stability issues can occur that can only be resolved by upgrading to one of the listed client versions.
Computer group dependencies
For earlier versions of the Tanium Server, or after upgrading from an earlier version, you must manually create the computer groups. See Tanium Console User Guide: Create a computer group.
Solution dependencies
Other Tanium solutions are required for Deploy to function (required dependencies) or for specific Deploy features to work (feature-specific dependencies). The installation method that you select determines if the Tanium Server automatically imports dependencies or if you must manually import them.
Some Deploy dependencies have their own dependencies, which you can see by clicking the links in the lists of Required dependencies and Deploy requirements. Note that the links open the user guides for the latest version of each solution, not necessarily the minimum version that Deploy requires.
Tanium recommended installation
If you select Tanium Recommended Installation when you import Deploy, the Tanium Server automatically imports all your licensed solutions at the same time. See Tanium Console User Guide: Import all modules and services.
Import specific solutions
If you select only Deploy to import, you must manually import dependencies. See Tanium Console User Guide: Import, re-import, or update specific solutions.
Required dependencies
Deploy has the following required dependencies at the specified minimum versions:
- Tanium Endpoint Configuration 1.2 or later (installed as part of Tanium Client Management 1.5 or later)
- Tanium End-User Notifications 1.6.5 or later
- Tanium Interact 2.4.74 or later (use the latest version of Interact for best results)
- Tanium Trends 3.6 or later
Tanium Server and Module Server
Deploy is installed and runs as a service on the Module Server host computer. The impact on the Module Server is minimal and depends on usage.
For more information about Tanium Server and Module Server sizing guidelines, see Tanium Core Platform Installation Guide: Host system sizing guidelines.
Endpoints
Contact Tanium Support for customized tuning to your environment. For more information, see Tanium Platform User Guide: Managing Tanium Core Platform Settings.
Windows System environment variables
The use of environment variables when you refer to file paths in Deploy is recommended over the use of explicit file paths. This method provides independence from differing paths based on operating system language or architecture, and allows the construction of a dynamic path at the time of execution.
Process Architecture | System Environment Variable | Path |
---|---|---|
32-bit process on 32-bit Windows | %PROGRAMFILES% | C:\Program Files |
%COMMONPROGRAMFILES% | C:\Program Files\Common Files | |
32-bit process on 64-bit Windows | %PROGRAMFILES% | C:\Program Files (x86) |
%PROGRAMFILESX86% | C:\Program Files (x86) | |
%COMMONPROGRAMFILES% | C:\Program Files (x86)\Common Files | |
%COMMONPROGRAMFILES(X86)% | C:\Program Files (x86)\Common Files | |
%COMMONPROGRAMW6432% | C:\Program Files\Common Files | |
%PROGRAMW6432% | C:\Program Files |
Additional environment variables that are available to the System account, such as %SystemDrive%, %SystemRoot%, %WinDir%, are also supported.
Host and network security requirements
Specific ports
Ports
The following ports are required for Deploy communication.
Source | Destination | Port | Protocol | Purpose |
---|---|---|---|---|
Module Server | Module Server (loopback) | 17463 | TCP | Internal purposes; not externally accessible |
Configure firewall policies to open ports for Tanium traffic with TCP-based rules instead of application identity-based rules. For example, on a Palo Alto Networks firewall, configure the rules with service objects or service groups instead of application objects or application groups.
For Tanium Cloud ports, see Tanium Cloud Deployment Guide: Host and network security requirements.
Security exclusions
If security software is in use in the environment to monitor and block unknown host system processes, Tanium recommends that a security administrator create exclusions to allow the Tanium processes to run without interference. The configuration of these exclusions varies depending on AV software. For a list of all security exclusions to define across Tanium, see Tanium Core Platform Deployment Reference Guide: Host system security exclusions.
For Windows endpoints, review and follow the Microsoft antivirus security exclusion recommendations for enterprise computers. For more information, see Microsoft Support: Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows (KB822158).
Target Device | Notes | Exclusion Type | Exclusion |
---|---|---|---|
Module Server | Process | <Module Server>\services\deploy-service\node.exe | |
Required when Endpoint Configuration is installed | Process | <Module Server>\services\endpoint-configuration-service\TaniumEndpointConfigService.exe | |
Windows endpoints | Required only for the Microsoft Windows 10 Upgrade packages | Folder | C:\Deploy\Tanium |
Process | <Tanium Client>\Python38\TPython.exe | ||
Folder | <Tanium Client>\Python38 | ||
Process | <Tanium Client>\Tools\Deploy\7za.exe | ||
Process | <Tanium Client>\Tools\SoftwareManagement\7za.exe | ||
Process | <Tanium Client>\TaniumCX.exe | ||
File | <Tanium Client>\extensions\TaniumSoftwareManager.dll | ||
File | <Tanium Client>\extensions\TaniumSoftwareManager.dll.sig | ||
Linux endpoints | Process | <Tanium Client>/python38/python | |
Folder | <Tanium Client>/python38 | ||
Process | <Tanium Client>/TaniumCX | ||
File | <Tanium Client>/Tools/SoftwareManagement/data/software-management.db | ||
File | <Tanium Client>/Tools/SoftwareManagement/data/software-management.db-wal | ||
File | <Tanium Client>/Tools/SoftwareManagement/data/software-management.db-shm | ||
File | <Tanium Client>/extensions/libTaniumSoftwareManager.so | ||
File | <Tanium Client>/extensions/libTaniumSoftwareManager.so.sig | ||
macOS endpoints | Process | <Tanium Client>/python38/python | |
Folder | <Tanium Client>/python38 | ||
Process | <Tanium Client>/TaniumCX | ||
File | <Tanium Client>/extensions/libTaniumSoftwareManager.dylib | ||
File | <Tanium Client>/extensions/libTaniumSoftwareManager.dylib.sig |
Target Device | Notes | Exclusion Type | Exclusion |
---|---|---|---|
Windows endpoints | Required only for the Microsoft Windows 10 Upgrade packages | Folder | C:\Deploy\Tanium |
Process | <Tanium Client>\Python38\TPython.exe | ||
Folder | <Tanium Client>\Python38 | ||
Process | <Tanium Client>\Tools\Deploy\7za.exe | ||
Process | <Tanium Client>\Tools\SoftwareManagement\7za.exe | ||
Process | <Tanium Client>\TaniumCX.exe | ||
File | <Tanium Client>\extensions\TaniumSoftwareManager.dll | ||
File | <Tanium Client>\extensions\TaniumSoftwareManager.dll.sig | ||
Linux endpoints | Process | <Tanium Client>/python38/python | |
Folder | <Tanium Client>/python38 | ||
Process | <Tanium Client>/TaniumCX | ||
File | <Tanium Client>/Tools/SoftwareManagement/data/software-management.db | ||
File | <Tanium Client>/Tools/SoftwareManagement/data/software-management.db-wal | ||
File | <Tanium Client>/Tools/SoftwareManagement/data/software-management.db-shm | ||
File | <Tanium Client>/extensions/libTaniumSoftwareManager.so | ||
File | <Tanium Client>/extensions/libTaniumSoftwareManager.so.sig | ||
macOS endpoints | Process | <Tanium Client>/python38/python | |
Folder | <Tanium Client>/python38 | ||
Process | <Tanium Client>/TaniumCX | ||
File | <Tanium Client>/extensions/libTaniumSoftwareManager.dylib | ||
File | <Tanium Client>/extensions/libTaniumSoftwareManager.dylib.sig |
Internet URLs
If security software is deployed in the environment to monitor and block unknown URLs, your security administrator must allow the following URLs on the Tanium Module Server for the Deploy service.
The Tanium Server requires access to the following websites to download binaries for the Predefined Package Gallery templates.
Software Package | Domain | Port |
---|---|---|
7-zip | crl.identrust.com | 80 |
7-zip.org | 443 | |
Adobe Acrobat DC1 | download.adobe.com | 443 |
Adobe Acrobat Reader DC | ardownload2.adobe.com | 443 |
download.adobe.com | ||
Adobe AIR | download.macromedia.com | 443 |
Adobe Digital Editions | adedownload.adobe.com | 443 |
Adobe Flash Player | fpdownload.macromedia.com | 443 |
Adobe Shockwave EOL2 | fpdownload.macromedia.com | 443 |
Apache Tomcat | dlcdn.apache.org | 443 |
Atlassian Sourcetree | product-downloads.atlassian.com | 443 |
BBEdit | s3.amazonaws.com/BBSW-download | 443 |
Box Drive | e3.boxcdn.net | 443 |
Cisco Jabber | binaries.webex.com | 443 |
Citrix Workspace (formerly Citrix Receiver) | downloadplugins.citrix.com | 443 |
DB Browser for SQLite | sqlitebrowser.org | 443 |
Docker Desktop | desktop.docker.com | 443 |
Dropbox | clientupdates.dropboxstatic.com | 443 |
Eclipse Adoptium Temurin JDK/JRE | github.com | 443 |
FileZilla | download.filezilla-project.org | 443 |
Google Android Studio | *.gvt1.com | 443 |
Google Chrome | dl.google.com | 443 |
Google Drive File Stream | dl.google.com | 443 |
iTerm2 | iterm2.com | 443 |
KeePass | sourceforge.net | 443 |
Microsoft Edge | msedge.sf.dl.delivery.mp.microsoft.com | 443 |
officecdn-microsoft-com.akamaized.net | ||
Microsoft Office 2019 | officecdn-microsoft-com.akamaized.net | 443 |
Microsoft Office 2019 with Teams | officecdn-microsoft-com.akamaized.net | 443 |
Microsoft Office Click-to-Run | download.microsoft.com | 443 |
Microsoft Power BI Desktop | download.microsoft.com | 443 |
Microsoft Skype Desktop Client | *.azureedge.net | 443 |
Microsoft SQL Server Management Studio | aka.ms | 443 |
Microsoft Visual Studio Code | code.visualstudio.com | 443 |
Microsoft Windows 10 Upgrade3 | content.tanium.com | 443 |
Mozilla Firefox | releases.mozilla.org | 443 |
NodeJS | nodejs.org | 443 |
Notepad++ | github.com | 443 |
objects.githubusercontent.com | ||
Oracle Java Runtime | javadl.oracle.com | 443 |
sdlc-esd.oracle.com | ||
Oracle MySQL Community | *.mysql.com | 443 |
PuTTY | the.earth.li | 443 |
Royal Apps GmbH Royal TS | download.royalapplications.com | 443 |
Slack | downloads.slack-edge.com | 443 |
Tableau Reader | downloads.tableau.com | 443 |
TortoiseGit | download.tortoisegit.org | 443 |
TortoiseSVN | osdn.net | 443 |
The Unarchiver | dl.devmate.com | 443 |
VideoLAN VLC Media Player | download.videolan.org | 443 |
VMware Workstation Player4 | download3.vmware.com | 443 |
WinSCP | sourceforge.net | 443 |
Wireshark | 2.na.dl.wireshark.org | 443 |
Zoom | d11yldzmag5yn.cloudfront.net | 443 |
zoom.us | ||
Zoom Outlook Plugin | zoom.us | 443 |
1 Update operation only. 2 Remove operation only. 3 Windows 10 Operating System media is not included in this package template. For more information, see Use case: Upgrading Windows. 4 Update and Remove operations only. |
User role requirements
The following tables list the role permissions required to use Deploy. To review a summary of the predefined roles, see Set up Deploy users.
For more information about role permissions and associated content sets, see Tanium Core Platform User Guide: Managing RBAC.
Permission | Deploy Administrator1,2,3 | Deploy Endpoint Configuration Approver1,2 | Deploy Operator1,2,3 | Deploy Package Administrator1,2,3 | Deploy Read Only User2,3 | Deploy Service Account1,2,3,4 | Deploy User1,2,3 |
---|---|---|---|---|---|---|---|
Deploy View the Deploy workbench |
SHOW |
SHOW |
SHOW |
SHOW |
SHOW |
SHOW |
SHOW |
Deploy API Perform Deploy operations using the API |
EXECUTE |
EXECUTE |
EXECUTE |
EXECUTE |
EXECUTE |
EXECUTE |
EXECUTE |
Deploy Deployments Create and modify deployments |
WRITE |
|
WRITE |
|
|
WRITE |
WRITE |
Deploy Endpoint Configuration APPROVE: Approve Deploy items for Endpoint Configuration REGISTER: Register with Endpoint Configuration |
|
APPROVE |
|
|
|
REGISTER |
|
Deploy Maintenance Windows Create, modify, and remove maintenance windows |
WRITE |
|
WRITE |
|
|
WRITE |
WRITE |
Deploy Module Read and write access to the Deploy module, including creating, editing, deleting, and importing software packages |
READ WRITE |
READ |
READ WRITE |
READ WRITE |
READ |
READ WRITE |
READ WRITE |
Deploy Operator Settings Write access to a subset of platform settings in the Deploy module |
WRITE |
|
WRITE |
|
|
WRITE |
|
Deploy Profiles Create, modify, and delete self service profiles |
WRITE |
|
WRITE |
|
|
WRITE |
WRITE |
Deploy Settings Write access to platform settings in the Deploy module |
WRITE |
|
|
|
|
WRITE |
|
1 This role provides module permissions for Tanium Endpoint Configuration. You can view which Endpoint Configuration permissions are granted to this role in the Tanium Console. For more information, see Tanium Endpoint Configuration User Guide: User role requirements. 2 This role provides module permissions for Tanium Interact. You can view which Interact permissions are granted to this role in the Tanium Console. For more information, see Tanium Interact User Guide: Tanium Data Service permissions. 3 This role provides module permissions for Tanium Trends. You can view which Trends permissions are granted to this role in the Tanium Console. For more information, see Tanium Trends User Guide: User role requirements. 4 |
Permission | Permission Type | Deploy Administrator1,2,3 | Deploy Endpoint Configuration Approver1,2 | Deploy Operator1,2,3 | Deploy Package Administrator1,2,3 | Deploy Read Only User1,2,3 | Deploy Service Account1,2,3 | Deploy User1,2,3 |
---|---|---|---|---|---|---|---|---|
Computer Group | Administration |
READ |
READ |
READ |
READ |
READ |
READ |
READ |
User | Administration |
READ |
|
READ |
|
|
READ |
|
User Group | Administration |
READ |
READ |
READ |
READ |
READ |
READ |
READ |
Action | Platform Content |
READ WRITE |
READ |
READ WRITE |
READ WRITE |
READ |
READ WRITE |
READ WRITE |
Approve Action | Platform Content |
SPECIAL |
|
SPECIAL |
SPECIAL |
|
SPECIAL |
SPECIAL |
Own Action | Platform Content |
READ |
READ |
READ |
READ |
READ |
READ |
READ |
Package | Platform Content |
READ WRITE |
READ |
READ WRITE |
READ WRITE |
READ |
READ WRITE |
READ WRITE |
Plugin | Platform Content |
READ EXECUTE |
READ EXECUTE |
READ EXECUTE |
READ EXECUTE |
READ EXECUTE |
READ EXECUTE |
READ EXECUTE |
Saved Question | Platform Content |
READ WRITE |
READ |
READ WRITE |
READ WRITE |
READ |
READ WRITE |
READ WRITE |
Sensor | Platform Content |
READ |
READ |
READ |
READ |
READ |
READ |
READ |
You can view which content sets are granted to any role in the Tanium Console. 1 This role provides content set permissions for Tanium Endpoint Configuration. You can view which Endpoint Configuration content sets are granted to this role in the Tanium Console. For more information, see Tanium Endpoint Configuration User Guide: User role requirements. 2 This role provides content set permissions for Tanium Interact. You can view which Interact content sets are granted to this role in the Tanium Console. For more information, see Tanium Interact User Guide: Tanium Data Service permissions. 3 This role provides content set permissions for Tanium Trends. You can view which Trends content sets are granted to this role in the Tanium Console. For more information, see Tanium Trends User Guide: User role requirements. |
For more information and descriptions of content sets and permissions, see the Tanium Core Platform User Guide: Users and user groups.
Last updated: 5/16/2022 2:18 PM | Feedback