Managing Updates (Content & Agent Upgrades)

[RFeyertag]

Hello dear community, 

I have a few questions how did you implemented your staging in Cortex XDR? Or did you say, no we trust PA and do not delay the content updates? 

It is all about these two categories in the agent settings:

Content Auto-Update:

1. How long do you delay the content update with the setting "Setting Contenton"=enabled your staged agent setting?

2. Which clients do you cover with your staged content Auto Update agent settings? 

3. How do you check this? Is there any overview for this? Maybe this one? Any widget?

4. Do your settings for staged look like this?

Content Auto-Update = Enabled

Staging Content = Enabled

Delay Period In Days = 1

Agent Upgrade:

1. what is your prefered delay period? Any expieriences?

2. when is the beginning time of the delay? Maybe by adding the agent installation? I couldn't find out. 

3. Are these the same clients like in the staged content auto update?

BR

Rob

[micomi]

Hi Rob

Content Update:

1. We usually delay the content update for one day. We don't want to delay it any longer for security reasons

2. We cover all agents except if there are any defined testing groups. When a test group is available we update the content update immediately for the test group and use 1 day delay for all other clients

3. I assume you could create an xql query based on your needs. I don't know what exactly you're looking for

4. It mostly looks like this:

Content Auto-Update = Enabled

Staging Content = Disabled

Delay Period In Days = 1

I'm interested as well how other community members configured these settings.