This section covers the following information:
Web UI warning for outdated security content
CLI warnings for outdated security content
About outdated security content
The NX appliance issues warnings if the installed security content becomes outdated. This feature helps to ensure that Trellix appliances—offline appliances in particular—do not use outdated security content. By regularly downloading and installing the latest security content, you minimize false negative and false positive results.
This feature is supported in Network Security software release 7.9.2 and later.
The security content timestamp
The security content creation date is indicated by a timestamp embedded in the security content metadata.
In the appliance Web UI, the timestamp of the installed security content is displayed in the Content Version panel of the About page.
.png)
In the appliance CLI, the timestamp of the installed security content is displayed in the Timestamp (UTC) field of the show fenet security-content status command output. This timestamp is also displayed in the Web UI and the CLI command output of the managing Central Management System appliance. See the Central Management System Administration Guide.
Warnings for outdated security content
The appliance periodically checks the age of the installed security content by comparing its system clock time to the timestamp embedded in the security content metadata. If the security content is more than 5 hours old for network-connected appliances or more than 36 hours old for offline appliances, warnings are distributed as follows:
Email is sent to recipients who are configured to receive notifications for failure-level system events, provided that automatic security content updates are enabled.
The Web UI displays a warning message at the top of the Dashboard.
The output of a CLI command includes a warning message.
Email notifications for outdated security content
The NX appliance can send email notifications when the installed security content becomes outdated. Email notifications for outdated security content have the following requirements:
The email server is configured to send notifications for failure-level system events.
Automatic security content updates are enabled.
Email recipients who need to know about outdated security content are configured to receive notifications for failure-level system events.
You can use the appliance Web UI or CLI to configure email notifications for outdated security content:
Configuring email notifications for outdated security content using the Web UI
From the appliance Web UI, you can use the Settings > DTI Network page and the Settings > Email page to configure email notifications for outdated security content.
Operator or Admin access
Go to the Settings > DTI Network page.
Select the Notify checkbox in the Security Contents row.
Make sure that event notifications are configured, as described in the NX User Guide.
Make sure that automatic security content updates are enabled. When this feature is enabled, the Settings field in the Security Contents row includes the message "Autoupdate Enabled: true."
If the message is not displayed, enable the feature, as described in Configuring automatic security content updates using the Web UI.
Go to the Settings > Email page.
Make sure that everyone who needs to be warned about outdated security content has an email address listed in the Recipient column of the table.
To add an email address to the list, use the Add Email Recipient field and the Add Recipient button, as described in Configuring email recipients using the Web UI.
Make sure that everyone who needs to be warned about outdated security content is configured to receive email notifications for "failure" level events. By default, email notification recipients are configured to receive all system events.
To enable a recipient to receive notifications for failure-level events, select the checkbox for that recipient, as described in Configuring system event notifications using the Web UI.
Configuring email notifications for outdated security content using the CLI
Use the commands in this topic to configure email notifications for outdated security content using the appliance CLI.
Operator or Admin access
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
View the security content status.
hostname (config) # show fenet security-content status
Make sure that the appliance is configured to send notifications for failure-level system events.
If the option is disabled, use the following command to enable it, as described in Configuring automatic security content updates using the CLI .
hostname (config) # fenet security-content autoupdate notification class fail
Make sure that event notifications are configured, as described in the NX User Guide.
Make sure that automatic security content updates are enabled. When this feature is enabled, the Enabled field in the Security Content Autoupdate section of the command output displays "
yes."If the field displays "
no," enable the feature, as described in Configuring automatic security content updates using the CLI .View the configuration settings for generating email alerts for system events.
hostname (config) # show email
Information about the email notification recipients is listed in the Email notification recipients section of the command output. Each entry is of the following format:
<emailAddress> (<eventLevel>, <detailLevel>)
where configuration parameters are as follows:
<emailAddress>—Email address that can receive system event notifications.<eventLevel>—The types of events sent to this recipient:all events,failure events only, orinfo events only.<detailLevel>—The type of information sent to this recipient:in detailorsummarized.
The following is an example of the Email notification recipients section of the
show emailcommand output:Email notification recipients: alan.brown@yourcompany.com (all events, in detail) john.green@yourcompany.com (failure events only, in detail) mary.jones@yourcompany.com (info events only, in detail) seth.smith@yourcompany.com (all events, summarized)
By default, email notification recipients are configured to receive all system events and in detail, as shown in the first entry in the example.
Make sure that everyone who needs to be warned about outdated security content has an email address listed in the Email notification recipients section of the output.
If an email address is missing from the list, add the recipient as described in Adding and removing system event notification recipients .
Make sure that every recipient who needs to be warned about outdated security content is configured to receive email notifications for "
failure events only" or for "all events."Important
System event notification recipients configured to receive notifications for "
info events only" will not receive notifications for outdated security content.If you need to change the type of events to send to an event notification recipient, see Configuring system event notifications for each user .
Verify your changes.
hostname (config) # show fenet security-content status hostname (config) # show email
Save your changes.
hostname (config) # write memory