topic Re: Default behavior on Dynamic Updates in Advanced Threat Prevention Discussions

Default behavior on Dynamic Updates

AlexandroDelAngel — Wed, 27 Feb 2019 21:51:05 GMT

Hello friends,

I'm planning to implement Dynamic Updates schedules for my Antivirus, Applications and Threats, and WildFire features.

I know I can do it daily, hourly, etc and define treshold.

But first I would like to understand the default behavior of these updates, as currently I see that my Antivirus database already has the installed version from today! My current configuration says "Schedule: None" on my 3 mentioned features.

If someone could share the knowledge with me, that would be great.

Thanks in advance,

Re: Default behavior on Dynamic Updates

nigelswift — Wed, 27 Feb 2019 22:46:07 GMT

Hey Alexandro,

The default behavior with a schedule of none would mean that no signatures in the category in question would be downloaded or updated. If these packages were performed manually as opposed to scheduled, whatever the last installed package was would be the one that was in effect (so anything after that released) would not be installed into the firewall.

So assuming you just have AV installed, without the other profiles your firewall wouldn't be able to leverage app or threat signatures beyond AV. AV signatures are file based, so assuming it is currently installed but there is no schedule the AV signatures you currently have installed would continue to be enforced as configured in your security profiles with whatever the current release that is installed on your firewall assuming there are no scheduled updates as well as you don't manually perform a download/install.

As far as how often these are updated on our side to help you get a better idea of how often you should schedule these, the intervals for each package I've listed below:

Content (Apps and Threats): twice weekly (or more for emergency releases)
Antivirus: daily
WildFire: every 5 minutes

Re: Default behavior on Dynamic Updates

AlexandroDelAngel — Wed, 27 Feb 2019 22:57:32 GMT

Hi nswift,

Thanks for your feedback, that's what I suspected.

I went through my Panorama > Device Deployment > Dynamic Updates > Schedules and found that it is configured there.

I just realized that Panorama is downloading and installing updates for the 3 categories and is pushing them to all of our devices.

Kind Regards,