topic Re: Outdated Definitions in Endpoint Security

Outdated Definitions

harrysocker — Sat, 09 Mar 2019 01:47:19 GMT

I'm currently trialling AMP for Endpoints and have found there's no consistency with the status of the connectors I've installed on machines. Some show that the definitions are up to date. Some show as 'outdated definitions'. There isn't anything referenced in the documentation I've seen or on the forum.

Is there a way to force the clients to update, either from client side or the portal? What prompts the connector to download new definitions that are available?

Thanks for any help.

Re: Outdated Definitions

Jetsy Mathew — Sat, 14 Apr 2018 06:19:19 GMT

Hello Harry

Did you added the required server address based on the Cloud that you have registered account with ?

https://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-sourcefire-00.html

If you want to schedule the new connector updates, then you can schedule it accordingly in the Management > Policies.

Regards

Jetsy

Regards

Jetsy

Re: Outdated Definitions

tonypearce1 — Fri, 14 Dec 2018 06:49:56 GMT

OP did you get this sorted? I'm having the same issue as you. I have the policy set with these two options and these are all that I can see that would be required:

1. "automatic content updates" this is checked / enabled

2. "content update interval" this is set to 1 hour which is the default

Both options above around found in edit policy > Advanced > TETRA

@Jetsy Mathew - the OP is talking about TETRA definitions, not software or AMP client update

Re: Outdated Definitions

Jetsy Mathew — Fri, 14 Dec 2018 07:31:57 GMT

Hello Tony

Is this was something working previously? In the following link there are server address that you should allow for the successful tetra definition update based on the cloud that you have registered with. Just make sure based on the cloud (EU,APJC,NAM) allow the traffic and make sure no inspection happens on the same.

https://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-sourcefire-00.html

If its still doesnt work then its better to get a wireshark capture for a day or so from any of those workstation which shows definition outdated along with the diagnostics file and submit it to the Cisco TAC.

Just fyi there was a known bug which got fixed sometime back.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj58637/?reffering_site=dumpcr

But if the issue has started recently then please contact the Cisco TAC and we will help you on the same.

Regards

Jetsy

Re: Outdated Definitions

harrysocker — Fri, 14 Dec 2018 09:10:18 GMT

Hi both,

We didn't get this working in the end, or at least I never found out the cause. The endpoints that hadn't been updated would suddenly show as compliant days later - so it could be the bug Jetsy linked. I didn't make any changes myself to our settings.

Thanks.