The update_source key specifies the malware protection indicator download channel used to download the latest malware protection indicators to the Trellix Endpoint Security (HX) xAgents on your host endpoints. Valid values include internet, hx-preferred, andhx-only.
The table below lists the available channel options. The Internet is the default source.
Indicator Source | Description |
|---|---|
Internet | Malware protection indicator updates are downloaded directly from the Internet. |
HX-Preferred | Malware protection indicator updates are downloaded from the Endpoint Security (HX) server. If the Endpoint Security server is unavailable, malware protection indicator updates are downloaded from the Internet. |
HX-Only | Malware protection indicator updates are downloaded from the Endpoint Security (HX) server only. |
NoteWhen you first enable malware protection, the latest malware indicators are downloaded to your agents. By default, this initial download of these indicators can take up to four hours to complete. Malware protection will not start until the indicators have been downloaded. To verify that the data has downloaded successfully, review the Host Details tab in the Web UI for a Windows host and verify the values in the Content Version and Last Updated fields under Malware Protection on the tab. For more information, see the Endpoint Security (HX) Server User Guide . | |
Change this setting using one of the following methods:
Web UI (see Configuring the Malware Protection Indicator Download Channel ).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).