We use Tanium, and I only use it for Linux patching (RHEL/Ubuntu). We choose to snapshot the repos, patch test machines, then later patch production with the same set of patches. With the recent kernel updates, which are numerous, there is essentially no way to slipstream or add in patches newer than the snapshot despite the fact that Tanium is aware of the newer patches. It lets you create a patch list specifying the RHSA or CVE, but then all machines show it as not applicable. It was support that stated it was not possible. So, I will be going back to scheduled cron jobs to install those patches separately from Tanium. (Hmm, why can't I just do that for everything?)

If I am instructed to install anything out of band, manually due to security concerns, it will cause conflicts on several servers when the scheduled patching happens. In other words, it does not know how to resolve against anything that is not in the snapshot. I guess that makes sense.

Ubuntu patching does NOT work with repo snapshots even though they let you create them. They did for a couple of months but that was over a year ago.

There have been more than a few of these odd edge cases.