Auto policy rollout

Automatically stages the policy to be rolled out after upgrade.

It rolls-outs the policy to all applicable devices and when the following conditions are met:

Device is upgraded before write out (for high availability, both the devices must be upgraded, and for dependent devices, associated receiver must be upgraded).
Device is not disabled.
Note
If the device is disabled before upgrade, the policy rollout is also disabled and user has to manually enable the rollout policy.
Device is keyed.
Policy is not staged.
The SysSettings DisableAutoPolicyRollout is false or doesn't exist. Manually insert this setting before upgrade: INSERT INTO SysSettings (Attribute, Value) values ('DisableAutoPolicyRollout', 'True').
The DeviceSettings AutoPolicyRollout is true.
Note
For dependent devices, use the GUID from the IPS table as they do not have device cluster GUIDs.

It checks the conditions for each device in every 5 minutes. To view the AutoPolicyRollout logs, enable policyDebug using ToggleDebug -f "policyDebug=1". The policies that are successfully staged are found in /var/log/messages. You can also view the Rollout time on the Rollout page.

Policies are written out using the following logic:

Note

If a datasource parsing is disabled or the datasource or child or client is not enabled, the auto policy rollout is skipped for it and you need to roll out policy as normal.

Trellix Enterprise Security Manager - Event Receiver - all except for client data sources
Trellix Application Data Monitor - all
RECELM (Trellix Enterprise Security Manager - Event Receiver and Trellix Enterprise Security Manager - Enterprise Log Manager) - all except for client data sources
Trellix ESM - ACE - only writes out to Rule Correlation data sources (not Risk sources or even device itself)
ePO - On-prem - only writes out to the device itself not its children
NSM - only writes out to the device, not its children