To prevent the installation of incompatible security content, security content packages are validated automatically when they are downloaded from the Trellix Dynamic Threat Intelligence (DTI) cloud or from the Trellix DTI Offline Update Portal. This feature is supported for the following appliances:
Central Management System release 8.1.0 and later.
Network Security release 8.0.0 and later.
Email Security — Server release 8.1.4 and later.
About automatic validation of security content
When a security content package is downloaded, the appliance queries the package to obtain its attributes. Some of the attributes are compared to attributes of the installed security content and to values configured on the target appliance. The criteria that determine whether a downloaded package is compatible are listed in Conditions that indicate a compatible security content package .
If the package passes all applicable compatibility checks, the new security content is installed on the target appliance.
If the package fails a compatibility check, the appliance does the following:
Sends an error code in log messages.
Displays an error message at the CLI or the Web UI.
Performs no further checking on the downloaded package.
Discards the downloaded package without installing
Requires that the next security content update uses a full update package and not a delta update package.
Conditions that indicate a compatible security content package
Downloaded security content packages are automatically evaluated against the following conditions in the order listed:
If the appliance is connected to the Internet: Was the package downloaded from the correct update channel of the DTI download server?
If the appliance is not connected to the Internet: Was the package downloaded from the correct content channel of the DTI Offline Portal?
Is the package version number compatible with the target appliance release?
Does the package acceptance level match the level configured on the target appliance?
If the downloaded package is a delta package: Is the version of the content delta package compatible with the version of the security content installed on the target appliance?
Is the version of the downloaded package the same as or newer than the version of the installed content?
Error codes for incompatible security content packages
The appliance writes a log message when a downloaded security content package is determined to be incompatible with the target appliance settings or the security content installed on the appliance. The following paragraphs describe the error codes for these events.
81 ― Incompatible DTI download server update channel
The package was built for an update channel other than stable (such as beta), but the appliance is not configured to use the same update channel.
82 ― Incompatible DTI offline portal content channel
The package was built for and downloaded from a content channel other than the one configured on the target appliance. Examples of DTI Offline Portal content channels are SCNET‑5.0, SCNET‑4.0, SCNET‑3.0, SCNET‑2.0, and SCEP‑1.0.
83 ― Package version is incompatible with the appliance release
The package acceptance level configured on the appliance must be compatible with the appliance software release. By default, the package acceptance level configured on the appliance is stable. Other package acceptance levels are beta and long_beta.
84 ― Package acceptance level does not match the target appliance configuration
The package acceptance level (such as beta or long_beta) does not match the acceptance level configured on the appliance.
85 ― Delta content package version is incompatible with the installed security content
The package is a delta (incremental) content package, and its version number is incompatible with the security content version installed on the target appliance.
86 ― Package version is newer than the installed security content version
The package version is newer than the installed security content version, and this is not a content rollback operation.