Upgrade devices

Download the device update files.

1. Go to the Trellix download site.

2. Click Download, enter your grant number and email address, type the CAPTCHA characters as displayed, then submit.

3. Select SIEM Mangement Solutions (left menu) and select a device.

4. Download the update file for each type of device in your system.

   Note

   Trellix ESM - ACE, Trellix DSB, Trellix ESM - ELM, Trellix ESM - ELS, and SIEM Collector use the same upgrade file.

Make sure that you have communication with each device in the system.

1. From the dashboard, click and select Configuration.

2. Select a device from the device tree and click Properties.

3. Click Status and check that the device is communicating.

Update Data Streaming Bus (if applicable)

1. From the navigation menu , select Data Streaming Bus.

2. Right-click the Trellix DSB and click Settings.

3. Expand Update Software File.

4. Click Upload and browse to the update file.

5. Select the update file and click Continue.

   User input is paused while the Trellix DSB is updated and restarted.

If you are updating a single Trellix Enterprise Security Manager - Enterprise Log Manager:

1. From the dashboard, select the Trellix Enterprise Security Manager - Enterprise Log Manager device on the system navigation tree, then click the Properties icon.

2. Click <device> Management, then select the Maintenance tab.

3. Click Update <device>.

4. Select an update from the table or click Browse to locate the update file on your local system.

5. Click OK.

6. Go to ELM Properties → ELM Information.

7. If the message Database is rebuilding appears in the Active Status field, do not stop or start the ELM database. The system indexes all new ELM data on the sending device before sending that data to the ELM.

If you are updating redundant Trellix Enterprise Security Manager - Enterprise Log Manager devices:

1. Update the standby Trellix Enterprise Security Manager - Enterprise Log Manager.

2. Update the active Trellix Enterprise Security Manager - Enterprise Log Manager.

3. On the system navigation tree, select the standby ELM and go to ELM Properties → ELM Redundancy → Return to Service.

4. Go to ELM Properties → ELM Information and click Refresh. Both the active and standby ELMs display an OK status.

5. If the standby Trellix Enterprise Security Manager - Enterprise Log Manager displays a Not OK status, click Refresh again. After a few minutes, the standby Trellix Enterprise Security Manager - Enterprise Log Manager status changes to OK, redundant ELM resync is 100% complete. You might need to click Refresh several times.

Update your Trellix Enterprise Security Manager - Enterprise Log Search.

1. From the dashboard, select the Trellix ESM - ELS device on the system navigation tree, then click the Properties icon.

2. Click <device> Management, then select the Maintenance tab.

3. Click Update <device>.

4. Select an update from the table or click Browse to locate the update file on your local system.

5. Click OK.

Update Trellix Enterprise Security Manager - Event Receiver, Trellix ESM - ACE, and Trellix Application Data Monitor devices.

1. From the dashboard, select the device on the system navigation tree, then click the Properties icon.

2. Click <device> Management, then select the Maintenance tab.

3. Click Update <device>.

4. Select an update from the table or click Browse to locate the update software on your local system.

5. Click OK.

Wait for the update process to finish (which can take several hours) then verify that the Trellix ESM can communicate with the devices.

Write device settings.

1. From ESM Properties, select Clustering.

2. Select the primary Trellix ESM device.

3. Make a minor change to enable the Write button. For example, type an extra digit in the port number and then remove it.

4. Click Write.

If you are upgrading from one major version to another (10.x to 11.x, for example) rekey all peripheral devices (ESM Properties → ESM Management → Key Management → Regenerate SSH).

Apply updated rules.

1. On the system navigation tree, select the Trellix ESM device, then click the Properties icon .

2. On the System Information page, click Rules Update, then click Check Now or Manual Update.

3. Browse to the update file, click Upload, then click OK.

Write settings to the Trellix Enterprise Security Manager - Event Receiver or Trellix ESM/Event Receiver combo.

1. On the dashboard, select the device in the system navigation tree, then click the Properties icon.

2. Click Data Sources → Write.

3. Click Vulnerability Assessment → Write.

Write settings to the Trellix ESM - ACE.

1. On the dashboard, select the device in the system navigation tree, then click the Properties icon.

2. Click Correlation Management → Write.

3. If the Trellix ESM - ACE is being used in Historical Mode, click Historical → Enable Historical Correlation → Apply. If it's already selected, deselect it and click Apply, select it again and click Apply.

4. Click Rule Correlation, select Enable Rule Correlation, and click Apply. If it's already selected, deselect it and click Apply, select it again and click Apply.

Write settings to Trellix Application Data Monitor.

1. On the dashboard, select the device in the system navigation tree, then click the Properties icon.

2. Click Virtual Devices → Write.

3. For database servers: Click Database Servers → Write.

Roll out policy.

If you have a device configured to send events to a Trellix Enterprise Security Manager - Enterprise Log Manager, sync the Trellix Enterprise Security Manager - Enterprise Log Manager (Device Properties → Device Configuration → Sync ELM).