Technical Advisory: Change to Trace Sensors in 1.2.8 Release

Summary
In the Trace 1.2.8 release, the Trace Sensor parameters were changed to provide better support for recurring Saved Questions and improve performance of all types of Trace Sensor execution. Saved Questions that reference these Sensors created prior to 1.2.8 used absolute start and end dates, which limited their effectiveness. They also defaulted to query a full year of events, which could be unnecessarily CPU-intensive.

The Trace Sensors provided with the 1.2.8 release have a time range parameter that is relative to the time the sensor executes. Saved Questions referencing Trace Sensors created prior to this release will not provide the desired data after upgrading and could produce either no results or an error message based on the Sensor and parameters.

Please plan accordingly before upgrading by referencing the Knowledge Base article on Changes to Trace Sensor Parameters in 1.2.8

Affected Customers
Customers that created Saved Questions using the Trace Sensors in versions 1.2.7 and earlier, such as questions that archive data using Tanium Connect.

Solution
After upgrading to Trace 1.2.8, recreate Saved Questions created prior to Trace 1.2.8 so they are compatible and take advantage of the significant optimizations.

Have more questions? Submit a request