Manage updaters in a managed environment

If a program is configured as an updater, it can install new software and update existing software. You can add, edit, or remove updaters.

1. Manage updaters in rule groups.
   1. On the Trellix ePO - On-prem console, select Menu → Configuration → Solidcore Rules.
   2. Locate the rule group and under Actions, click View.
   3. On the Updater Processes tab, you can Add, Edit, or Remove an updater.
2. Manage updaters in policies.
   1. On the Trellix ePO - On-prem console, select Menu → Policy → Policy Catalog.
   2. On the Policy Catalog page, select the product and category from the list.
   3. Click the selected policy.
3. Complete the addition of an updater to a rule group or policy.
   1. On the Updater Processes tab, click Add.
   2. Enter the location of the file.
      If you add the updater by name, the updater is not authorized automatically. The file must be added to the whitelist.
   3. Specify an identification updater label for the program.
   4. Specify conditions that the file must meet to run as an updater.
      • Select condition None to allow the file to run as an updater without any conditions.
      • Select condition Parent to allow the file to run as an updater only if it is started by the specified parent.
   5. When adding an updater by name, indicate whether to disable inheritance for the updater.
      For example, if Process A (that is set as an updater) starts Process B, disabling inheritance for Process A makes sure that Process B does not become an updater.
   6. When adding an updater by name, indicate whether to suppress events generated for the actions performed by the updater. Typically, when an updater changes a protected file, a File Modified event is generated for the file. If you select this option, no events are generated for changes made by the updater.
   7. Click OK.