Apply security updates

To remain effective at identifying new threats, your agents need periodic security updates.

By default, the relays provided as part of the Workload Security service (the Primary Tenant Relay Group) provide security updates to your agents. You can also deploy your own relays that get security updates from the Primary Tenant Relay Group and then distribute the updates to your agents. For details see How relays work.

You can do the following:

• Configure the security update source
• Initiate security updates
• Check your security update status
• View details about pattern updates
• Revert, import, or view details about rule updates
• Configure security updates

Configure the security update source

The default configuration for security updates is adequate for most environments, but you can change the settings to suit your needs:

1. Go to Administration > System Settings > Updates.

   

2. Select an option for the Primary Security Update Source.

   By default, the primary source is Trend Micro Update Server, which is accessed via the Internet. Do not change the setting unless your support provider has instructed you to configure Other update source. Alternative update source URLs must include "http://" or "https://".

3. Configure the Secondary Source for security updates. Usually, agents connect to a relay to obtain security updates when Workload Security tells them to. But if your computers cannot always connect with Workload Security or relays (such as during scheduled maintenance times) and enough Internet or WAN bandwidth is available, these options are useful:

   • Allow Agents/Appliances to download security updates directly from Primary Security Update Source if Relays are not accessible
   • Allow Agents/Appliances to download security updates when Workload Security is not accessible
   • Allow Agents/Appliances to download security and software updates from Primary Tenant Relay Group if user-deployed Relays are not accessible

   If you protect laptops and portable computers, they might be located far from support services. To avoid risk of a potentially problematic security update while at a remote location, deselect these options.

4. Trend Micro sometimes updates an existing security rule to improve performance or fix a bug. By default, Automatically apply Rule Updates to Policies is selected.

5. If you have deployed your own relays and they will be providing updates for regions other than the one where Workload Security is located, select Download Patterns for all Regions. This setting is disabled by default because it uses more disk space.

   If you do not want to use the default relays provided by the Workload Security service, deselect Use the Primary Tenant Relay Group as my Default Relay Group. If this option is disabled, when you click Administration > Updates > Relay Groups, the relay group name is Default Relay Group, not Primary Tenant Relay Group.

Initiate security updates

Instead of manually checking for updates, you can configure Workload Security to automatically check for security updates via a scheduled task. See Schedule Workload Security to perform tasks.

You can manually initiate security updates at any time, regardless of scheduled tasks.

To get security updates on a single agent, go to Computers, select the agent, then right-click and select Actions > Download Security Update.

Deep Security Agent version 20.0.0-179 or later for macOS supports rolling back a security update. Agents for macOS earlier than 20.0.0-179 do not support rolling back a security update.

Check your security update status

To view the status of your security updates, go to Administration > Updates > Security.

• Trend Micro Update Server: Indicates whether or not relays can connect to Trend Micro ActiveUpdate to check for the latest security updates.

• Workload Security: Indicates when the last successful check and download were performed, and when the next scheduled check is performed. All Relays are in sync indicates that all relays are distributing the latest successfully downloaded pattern updates.

  Out-of-sync status usually indicates that the relay cannot connect to Trend Micro Update Servers. In most cases, this is not an expected behavior and you should fix network connectivity problems. However, in air-gapped deployments, network isolation is intentional, so you must provide updates manually.

• Computers: Indicates if any computers are out-of-date compared to the pattern updates currently on the relays. To prompt all computers to get the latest pattern updates from their assigned relays, click Send Patterns to Computers.

View details about pattern updates

To view a list of the components in an Anti-Malware pattern update, go to Administration > Updates > Security > Patterns. This page is displayed only when Workload Security has an active relay.

• Component: The type of update component.
• For Use By: The Workload Security product this component is intended for
• Platform: The operating system for which the update is intended.

• Current Version: The version of the component currently being distributed by the relays.

  To check which security update component version is being used on a protected computer, go to Computers, double-click the computer, and then select Updates.

• Last Updated: When the current security update was downloaded from Trend Micro.

Revert, import, or view details about rule updates

To view a list of the most recent Intrusion Prevention, Integrity Monitoring, and Log Inspection Rules that have been downloaded into the Workload Security database, go to Administration > Updates > Security > Rules.

You can do the following:

• View details about a rule update: Select a rule update and click View. Details include a list of the update's specific rules.

  To check which rule update version a relay is distributing, go to Computers, double-click the relay, and then select Security Updates. If Anti-Malware is enabled for that computer, it also displays the computer's pattern version.

• Roll back a rule update: If a recent rule update has caused problems, you can revert to a previous rule version. Select the rule update that you want to revert to and then click Rollback. Workload Security generates a preview change summary so that you can confirm results before finalizing.

  All policies affected by the reverted rules are immediately updated on all computers using those policies.

• Reapply the current rule set: indicates that a rule update has been applied. To reapply that rule update to protected computers, right-click the rule update and click Reapply.

• Import a rule update: Typically, rule updates are imported either manually or automatically (via scheduled task). However, if your deployment has no connectivity to the Trend Micro Update servers on the Internet (an air-gapped deployment), or if you are asked to do so by your support provider, you can click this button to manually upload and import a security update package.

• Export a rule update: Typically, you should not need to export a rule update unless your support provider asks you.

• Delete a rule update: Removes the selected rule update from the Workload Security database.

Security update packages must have a valid digital signature. If you try to view or use an invalid package (including old security updates that do not have a signature), then Workload Security displays an error message. See How Workload Security validates update integrity.

Configure security updates

You can make the following configurations:

• Enable automatic patches for rules
• Enable automatic Anti-Malware engine updates
• Enable security updates for older agents
• Change the alert threshold for late security updates

Enable automatic patches for rules

Trend Micro sometimes updates an existing Workload Security rule to improve performance or fix a bug. To automatically apply these patches, go to Computer or Policy editor > Settings > General and in the Send Policy Changes Immediately area, select Automatically send Policy changes to computers and set the drop-down to Yes. If it is not selected, you must manually apply downloaded rule updates to policies: go to Administration > System Settings > Updates and click Automatically apply Rule Updates to Policies.

By default, changes to policies are automatically applied to computers.

Enable automatic Anti-Malware engine updates

By default, when you update Deep Security Agent, the Deep Security Anti-Malware engine is updated together with it. If you don't update software often, then over time, the Anti-Malware engine might become much older than the malware patterns it uses (which should be frequently updated).

For better protection, you can configure agents to automatically keep the Anti-Malware engine part of the software updated—an approach more similar to the security updates that it uses.

1. Go to Computers or Policies.
2. Double-click a computer or policy.
3. Go to Settings > Engine Update.

4. For Automatically update anti-malware engine, select Yes .

   If this setting is disabled, then visit Computer Details > Updates > Advanced Threat Scan Engine and confirm that the Is Latest section displays N/A.

Regardless of this setting, relays always receive the latest Anti-Malware engine updates. This keeps the relay's local protection and engine update source for the same relay group up to date. Therefore, you cannot enable or disable engine updates directly on a relay.

Enable security updates for older agents

For some platforms, Workload Security supports older versions. See Agent platforms.

By default, to conserve disk space, the relay does not download and distribute security updates for these older agents. To enable security updates for them, go to Administration > System Settings > Updates. Select Allow supported 8.0 and 9.0 Agents to be updated.

Deep Security Agent 8.0 is no longer supported. This selection only applies to the 9.0 agent.

Change the alert threshold for late security updates

If an update has been downloaded from Trend Micro and available for some time, but computers are not updated yet, an alert occurs. For pattern updates, by default, the limit is 1 hour.

If you want to change the time limit for the alert, go to Administration > System Settings > Alerts and configure Length of time an Update can be pending before raising an Alert.