Navigating a Path to More Perfect Tanium Patch Management
When a $30 billion transportation company with 10,000 endpoints and hundreds of servers adopted Tanium, they realized that improving their Tanium patch management capabilities, efficiency, and overall compliance levels could have a significant impact on their ROI. Tanium introduced them to Chuco, and we got moving — fast.
Getting Ready to Go Fast
We started first by listening closely and then carefully charting our course. We always want to develop and validate a clear understanding of each client’s specific goals and objectives.
Of course, everyone wants to achieve “successful outcomes.” But “success” means different things to different people. Making assumptions and skipping validation is like embarking on a critical journey without an accurate map — a sure way to encounter dead-ends, detours, and even disaster.
In this case, we identified the client’s top priorities and concerns. These included a pressing need to address server patch management specifically, and a general vision to improve three key areas over time: compliance, “stakeholder sensitive” reporting, and custom notifications.
When we plan with clients, we jointly explore not only the specific technical and process outcomes we’re setting out to achieve, but also the engagement model best suited to deliver those results.
In this case, early client discussions made it clear that there was plenty to do in the short term, and a far-reaching runway of opportunity in the long term. That realization was important, as it shaped how the client chose to structure its relationship with Chuco.
Specifically, rather than hire us for a one-off project, our client saw the value in our managed services approach. We offer several options and the flexibility to engage at a level of sustained involvement suited to diverse needs and budget levels.
The advantage of a managed services approach is that Chuco engagement, availability, and activity is consistent and dependable:
A managed model means we are consistently engaged, evaluating, adjusting, and extending Tanium for the organizations we serve. And in the case of our transportation client, this model really accelerated our pace and progress. Let’s look at three key milestones on that journey.
Before Tanium entered the picture, our client had patch processes in place, but they weren’t able to get them where they really needed to be.
For one, relying on native Microsoft tools (System Center Configuration Manager / Endpoint Manager) left them unable to address an extensive Linux server landscape. Nearly 400 Red Hat Enterprise Linux servers were 100% non-compliant, most missing over 100 patches.
With Tanium offering unified command and control over Tanium patch management across environments, the trick and challenge is configuring updates to address an organization’s specific needs and constraints. For context on how Tanium’s Patch module handles this, it provides granular scheduling and rollback capabilities that make this level of control possible.
In this case, we created a centralized server patch management regime for both Windows and Linux systems, navigating the limits of defined maintenance windows and other dependencies, working with application custodians on the client’s IT team.
Those constraints include updating dependent servers in the right order.
Consider a solution comprising multiple application servers, database servers and web servers: To keep production services up and avoid surprises during patch/reboot operations, it’s prudent to patch in a deliberate order, incorporating QA validation along the way, rather than take all application servers offline at the same time.
Today, our client has achieved its compliance objectives. And we continue to provide ongoing patch support as part of our managed services engagement — across its hybrid server environment and Microsoft workstations — to keep things safely and consistently on track.
With compliance under closer control, the client wanted greater visibility. And while Tanium provides solid native reporting capabilities, using these requires building multiple queries using the Console, and performing a number of manual steps.
To meet this organization’s more advanced needs, we developed a custom solution, taking advantage of Tanium API access, to build, run, and deliver tailor-made reports automatically. Most importantly, these are designed to provide the right levels of technical detail, rolled-up summaries, and delivery format best suited to three specific internal audiences:
As part of our managed services support, we are on deck to add, expand, and adapt these summaries as the client’s needs evolve. The net result is they can focus their time on understanding, evaluating, and acting on the insight these reports provide — rather than on building, running and processing them.
With patching under control and reporting providing operational teams and management with faster and deeper insight into the state of their internal landscape, the client’s third wish was to get key technical updates and progress reports delivered to their inboxes.
To enable greater efficiency for operational teams, we developed a system that delivers both scheduled and event-driven updates via email.
Our client wanted to address two key scenarios. The first is pre-patch notifications. These let server custodians know in advance that updates are coming. Think: “In two days, Server A is going to receive these 18 patches and Server B is getting these 23 patches.”
For our client, this visibility increases awareness, and avoids internal surprises (like updates mistakenly scheduled outside of proper maintenance windows).
Similarly, this system also sends post-patching email summaries. These are important as they remind server and application owners to address any tasks they need to execute after servers and applications are updated, including validating system integrity and executing any manual changes specific patches may prompt.
With the average custodian managing 30–50 servers, these automated notifications have been a big hit.
The key takeaways here are three-fold:
If you’d like to learn more about how we help companies get the most from their Tanium investments, we would love to connect. With years of hands-on experience, our team of Tanium experts has developed a deep understanding of the platform and unique perspectives that drive real results.
Whether you’re just starting to work with Tanium, or looking to push things to the next level, we are ready to assist in a way that suits you — whether you’re looking for experienced guidance, help executing a specific project, or having us join as a virtual member of your internal Tanium team with our managed services model.
Your team has the skills — what they don’t always have is the bandwidth, Tanium-specific depth, and capacity to deliver consistent results at scale. Here’s how Chuco’s managed services for Tanium patching close that gap.
You can’t secure what you can’t see — but what happens when the tools providing that visibility are the ones failing? We took that question to Tanium Atlas.
You can’t secure what you can’t see — but what happens when the tools providing that visibility are the ones failing? We took that question to Tanium Atlas.
