Trellix regularly updates Endpoint Security (HX) xAgent software to add new features, enhance performance, and maintain compatibility with new Endpoint Security (HX) xAgent software versions. Trellix highly recommends that you obtain new xAgent software versions and upgrade your xAgent s whenever a new version of the xAgent is released. You can create and manage your xAgent upgrade jobs from the Web UI, using the xAgent Upgrade page. See Creating a New Agent Upgrade Job.
If instead you prefer upgrading the xAgent software manually, see "Manually Installing Agent Software" in the Endpoint Security Agent (HX) Deployment Guide.
Important
Trellix recommends that you upgrade your Endpoint Security (HX) Server software before you upgrade your agent software.
In addition, Trellix recommends that you stop all acquisition requests and Enterprise Search requests that are running before you upgrade your xAgent software.
After upgrading or installing Endpoint Security (HX) xAgent version 26 or later, the user must log off and log on the Windows endpoint to ensure agent notifications are started.
After upgrading or installing Endpoint Security (HX) xAgent software on your host endpoint, if you revert the host endpoint to an earlier snapshot, new alerts may not show in the Endpoint Security (HX) Web UI.
See the Endpoint Security Agent (HX) Deployment Guide for more information on the minimum system requirements for a Trellix Endpoint Security (HX) xAgent version 35 installation.
Using host sets
You can include or exclude defined groups of hosts in an upgrade job. These groups are based on host sets created by server administrators and operators. See "Working with Host Sets" in the Endpoint Security (HX) Server User Guide.
Note
Trellix recommends that contained host endpoints be excluded from xAgent upgrades. The upgrade process will temporarily remove the endpoint from containment.
Enterprises may want to upgrade different groups of host endpoints at different times for a variety of reasons:
Large or widely distributed host endpoint populations
Slow network connections between xAgent s and servers
Complex IT organizational plans that group host endpoints into different organizations with different needs
Sensitive or high-availability host endpoints or host users
Upgrading xAgent software for different OS platforms
You can run upgrade jobs for different operating system platforms (such as Windows, macOS, and Linux) at the same time. A Windows upgrade job running on Windows hosts can run at the same time as an macOS upgrade job running on macOS hosts, or a Linux upgrade job running on Linux hosts.
Important
Two upgrade jobs for the same operating system platform cannot run at the same time. For example, if you have two Windows upgrade jobs, you must wait for the first Windows upgrade job to complete before starting the second Windows upgrade job.
Real-Time event database reset
As in previous xAgent releases, when you upgrade to this version of the Trellix Endpoint Security (HX) xAgent, all of the existing data in your real-time event database on the endpoint will be lost. After the upgrade and after the xAgent has restarted, real-time event data will be recorded again in the new real-time event database.
Caution
The database reset may affect any current incident response investigation. Complete all incident response investigations before upgrading your Endpoint Security (HX) xAgent software.
If you are unable to complete your open incident response investigations before upgrading your Endpoint Security (HX) xAgent software, perform one of the following data collection options to obtain all your endpoint data:
If you have an Endpoint Security (HX) Power (HX_Advanced) license, use the Web UI to request a Standard Investigative Details data acquisition or a Comprehensive Investigative Details data acquisition against your endpoints before you upgrade to ensure you have collected all the data necessary for an investigation. Alternatively, to obtain the same data, you can use the API to request a data acquisition or bulk acquisition that runs the stateagentinspector audit on your endpoints.
If you do not have an Endpoint Security (HX) Power license, request a standard triage for your endpoints before you upgrade to ensure you have collected the data from the events database for each endpoint.
Linux operating system Upgrade
If you upgrade the operating system on your Linux endpoint from RHEL 6.8 to RHEL 7.x, after using the xagt-30.x.x-1.el6.x86_64.rpm file in the Linux xAgent installation package to install the Trellix Endpoint Security (HX) xAgent version 35.31.0, you must use the rpm -e command to uninstall the Linux agents and then install the Linux agents using the rpm file that is compatible with your RHEL version. See "Installation and Deployment" in the Endpoint Security (HX) Server Deployment Guide for more information.
Important
The .rpm file you use to install the xAgent software on your Linux endpoints must be compatible with your Linux operating system. For example, if your Linux endpoints are currently running RHEL version 6.8, you must use the xagt-30.x.- 1.el6.x86_64.rpm to install the agent software. If your Linux endpoints are running RHEL version 7.2, 7.3, or 7.4, you must use the xagt-30.x.x-1.el7.x86_64.rpm to install the xAgent software.
When to reboot
The xAgent upgrade process is completely invisible to endpoint users. The process does not usually require restarting host endpoints and does not prompt end users for action. However, after upgrading or installing Endpoint Security (HX) xAgent version 26 or later, you must restart your Windows endpoints to ensure xAgent notifications are started and host containment properly filters existing network connections.
A reboot may also be required to complete the Windows installation and avoid problems with future installations that check for pending reboots. One way to determine whether a reboot is necessary is to run the following command at a Windows command prompt:
wevtutil qe Application /rd:true /f:text /q:"*[System/EventID=1029] and *[EventData[Data='FireEye Endpoint Security Agent']]"
If a reboot is required, the following event will appear:
"FireEye Endpoint Security Agent. Restart required. The installation or update for the product required a restart for all changes to take effect. The restart was deferred for a later time."
You can use the following command to identify the reboot cause:
wevtutil qe Application /rd:true /f:text /q:"*[System/EventID=1025] and *[EventData[Data='FireEye Endpoint Security Agent']]"
This command returns the name and process ID of the application that locked a Trellix system file open. The example below shows the name and process ID for Firefox, the application that locked the AppMonitorDll.dll file open.
"FireEye Endpoint Security Agent. The file C:\Windows\FireEye\AppMonitorDll.dll is being used by the following process: Name: firefox , Id 1060."
Close the application that caused the reboot and rerun the wevtutil qe Application command above to verify if a reboot is still required.
An endpoint reboot may also be required in the rare instance when the agent executable cannot be replaced during the upgrade.
Configuring specific upgrade jobs settings in the CLI
You cannot set up or schedule upgrade jobs using the CLI.. However, the CLI shows two parameters that control the behavior of upgrade jobs:
hx server upgrade task-limitcan be used to set the maximum number of pending agent upgrade tasks.hx server upgrade task-timeout.can be used to set the upgrade task time.
Caution
Do not change the default settings for these parameters until you have consulted Trellix Customer Support.
See Configuring the Maximum Number of Pending Upgrade Tasks and Configuring the Upgrade Task Time-Out Period.
This section covers the following topics:
Admin or Operator access