The following polls occur between the Endpoint Security (HX) server and the Endpoint Security Agent (HX) installed on your host endpoints. You can configure how frequently each poll occurs using the Web UI and the API. See the Endpoint Security Agent (HX) Administration Guide for more information on configuring agent policies and settings.
Poll Type | Description |
|---|---|
Full | A full poll is used to transfer information and task requests from the Endpoint Security (HX) server to the agents installed on the host endpoints. To establish a full poll session, the agent establishes a secure connection with the Endpoint Security (HX) server, exchanges information, queries the Endpoint Security (HX) server for any tasks to be run, and downloads the instructions for these tasks. See Configuring the full poll interval. |
Fastpoll | A fastpoll is used to determine quickly if a full poll is required. The agent sends a non-encrypted (non-secure) poll request to the Endpoint Security (HX) server to determine if any tasks are waiting or if any information is waiting to be shared with the agent. If information is waiting, the agent establishes a standard encrypted full poll session. If no information is waiting, the agent closes the connection. Fastpolls ensure that information sharing occurs promptly without degrading network performance. See Configuring the agent fastpoll interval. |
Indicator | An indicator poll is used to transfer the latest Trellix indicators from the Endpoint Security (HX) server to the agents. The agent establishes a secure connection with the server and downloads the latest indicators. Indicator update packages are signed and encrypted files containing versioned sets of indicators and conditions. See "Configuring the Trellix Indicator Update Frequency" in the Endpoint Security Agent (HX) Administration Guide. |
Agent Configuration File | A configuration file poll is used to transfer the latest agent configuration from the Endpoint Security (HX) server to the agents. The agent establishes a secure connection with the server and downloads the latest configuration. See Configuring the agent configuration file update frequency. |
Malware Definition Updates | A malware protection indicator updates poll is used to transfer the latest malware protection indicators to the agent. The agent establishes a secure connection with the Endpoint Security (HX) server and downloads the latest malware protection indicators. See "Configuring the Update Interval for Malware Protection Indicators" in the Endpoint Security Agent (HX) Administration Guide. |
Collecting agent host system information
You can also use the Web UI to configure how often agent host system information is collected and updated malware protection indicators are downloaded to the agent. A system information (sysinfo) task is scheduled at regular intervals to transfer information from the agents to the Endpoint Security (HX) server. The Endpoint Security (HX) server requests host system information whenever it sends information to an agent. The sysinfo interval is the longest period of time the server will allow before sending the agent a sysinfo task to collect host system information. See Configuring the system information request and System information frequency setting.
See the Endpoint Security Agent (HX) Administration Guide and the Endpoint Security (HX) REST API Guide for more information on configuring agent policies and settings.