You can automatically deploy content packages to devices when a new update is available.
Content packages allow you to collect data that is sent to the cloud for analysis to detect a threat and its severity. The mechanism to automatically update content packages is enabled by default, with update tasks scheduled every 240 minutes (4 hours). This is a task that is enabled in ePO - On-prem or ePO - SaaS. For configuration details, see General policy configuration in Product Guide.
Log on to ePO - On-prem or ePO - SaaS as administrator.
Select Menu → Policy → Policy Catalog.
Select Trellix EDR, click My Default.
To disable this feature, deselect Enable content updates.
Note
If you disable this feature, you can still upgrade new content manually. Check for SNS notifications to keep up to date.
To change the default time for Check for content updates at an interval, edit the value in the field.