topic Manually update content version? in Cortex XDR Discussions

Manually update content version?

enewman — Wed, 13 Oct 2021 19:20:50 GMT

Is there a way to manually update the content version? I downloaded the agent install plus latest content version and I can't figure out what to do with the content version files or find a way to push the latest content version. This particular machine is stuck on 188.xxxx even after an uninstall/reinstall. The agent is talking to the server and everything, I just need to figure out how to get the content version updated on it. Any ideas?

Re: Manually update content version?

P.Jacob — Thu, 14 Oct 2021 18:54:59 GMT

while installing you could do something like:

msiexec /i “installer_x64.msi” CONTENT=\\SCCM\Share\MyCortexXDRAgentDeploymentFolder\content-XXX-XXXXX.zip /qn

I wished you could force a content update from the cloud platform but I think they saying with a "check in" or a "perform heartbeat" it should just check in and do that automatically. I think as an admin keeping an eye on all your managed cortex assets and their corresponding content versions is really important, I see I have a few active devices that are a version or so behind not sure how to remediate.

Re: Manually update content version?

enewman — Sat, 16 Oct 2021 20:39:50 GMT

Thank you! I think I can work with this. I agree that keeping our content versions up to date on our endpoints is mega important and saves us from a ton of unnecessary alerts and false positives.

Re: Manually update content version?

asitbon — Thu, 31 Aug 2023 13:13:05 GMT

Hi,

To go further. is there a generic link to get the latest content updates ? (and which do not change between versions) we would like to automate this and make it possible to repair corrupted content updates on endpoints as it happens quite regularly.

Thanks.

Alex.

Re: Manually update content version?

Bhavin_Patel — Tue, 05 Sep 2023 14:44:44 GMT

Is it possible to update content version from Cortex XDR?

Re: Manually update content version?

asitbon — Tue, 05 Sep 2023 15:05:39 GMT

Hi,

The normal behaviour is to have automatic updates deployed of course. But sometimes it remains stuck.

You can "force" an update like this:

1. Get the latest contest update (when you download a package, you can select to include the latest content updates). The package is around 250MB.

2. Copy it locally on an endpoint

3. Use the command cytool import content PATH

For my case I want to automate the first point as it is manual. I was wondering if a link existed to get the latest content update. That way i would be able to automate the entire process.

Regards,