If a particular version of malware protection indicators causes performance issues or instability, you can roll it back to previously stable content, if available, with the malware protection content backup utility. Content can be rolled back for any Windows, macOS, or Linux host. Content Backup is disabled by default on your host endpoints.
Content backup is available only when signature and heuristic detection is enabled on Endpoint Security (HX) xAgent 35.31.0.
Note
Content backup for the MalwareGuard engine is not supported.
Backup process
Content backup maintains a maximum of two known stable content versions. The older backup is always replaced. Content backup creates a new pair of backup content versions every 72 hours, by the following example schedule:
Time | Backup Content Version (C) |
|---|---|
Day 0 | – |
Day 1 | C0 |
Day 2 | C0 |
Day 3 | C0 |
Day 4 | C0 and C3 |
Day 5 | C0 and C3 |
Day 6 | C0 and C3 |
Day 7 | C3 and C6 |
Rollback process
Important
Because each set of new definitions includes protection against new threats, reverting to an older revision could lead to missed detections.
If the current version of malware protection indicators causes problems, you can add it to a content exclusion list in the malware protection policy. The problematic version will be replaced with a backup version, and it will not be downloaded in future updates.
This section covers how to use the Web UI to enable, disable, and define the Content Exclusion List for unstable content versions. See the Endpoint Security (HX) REST API Guide for information on using the API to manage your Content Exclusion List.
Enabling and disabling content backup
You can enable and disable content backup for all of your hosts using the xAgent default policy or for specific hosts in your environment using a custom policy. Content backup is disabled by default on your host endpoints.
To enable content backup, you must first enable "Signature and Heuristic Detection" in the malware protection policy category.
To enable content backup on your hosts:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Malware Protection tab.
Under Content Backup, toggle the switch next to Enable AV Content Backup to ON.
.png)
Click Save to save the policy settings.
To disable content backup on your hosts:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Malware Protection tab.
Under Content Backup, toggle the switch next to Enable AV Content Backup to OFF.
.png)
Click Save to save the policy settings.
Building the Content Exclusion List
If the current version of malware protection indicators causes problems, you can add it to a content exclusion list in the malware protection policy. The problem version will be replaced with an earlier backup version, and it will not be downloaded in future updates.
Entries to the content exclusion list can be specified in three formats:
Single entry. Example:
7.1234Closed range. Example:
7.1236-7.8765Open range. Example:
7.8967-
To create a single entry in the content exclusion list:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Malware Protection tab.
Under Content Backup, ensure the switch next to Enable AV Content Backup is set to ON.
Enter the content version number in the Content Exclusion List field.
.png)
Click Add to add the entry to the Content Exclusion List.
Click Save to save the policy settings.
To create a closed range entry in the content exclusion list:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Malware Protection tab.
Under Content Backup, ensure the switch next to Enable AV Content Backup is set to ON.
Select the Enter Content Range checkbox.
Enter the range of content version numbers in the Content Exclusion List field.
.png)
Click Add to add the range to the Content Exclusion List.
Click Save to save the policy settings.
To create an open range entry in the content exclusion list:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Malware Protection tab.
Under Content Backup, ensure the switch next to Enable AV Content Backup is set to ON.
Select the Enter Content Range checkbox.
Enter the open range of problematic content version numbers in the Content Exclusion List field. An open range consists of only one version number followed by a hyphen (
-).Important
Entering an open range for the Content Exclusion List will halt all updates. Because each set of new definitions includes protection against new threats, reverting to an older revision could lead to missed detections.
.png)
Click Add to add the range to the Content Exclusion List.
Click Save to save the policy settings.