Policy rollout is slow after an upgrade to SIEM 11.4.3 or later
Last Modified: 2023-04-13 18:54:04 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
After December 1, 2024, please log in to the Thrive Portal for support, knowledge articles, tools, and downloads. For information about using the Thrive Portal, view the Trellix Thrive Portal User Guide.
Policy rollout is slow after an upgrade to SIEM 11.4.3 or later
Technical Articles ID:
KB94725
Last Modified: 2023-04-13 18:54:04 Etc/GMT Environment
SIEM Enterprise Security Manager (ESM) 11.4.5, 11.4.4, 11.4.3
Problem
After an upgrade to SIEM 11.4.3 or later, some environments have seen significant reductions in the speed at which policy rollout has occurred. In
Cause
In SIEM 11.4.3, a new process is added to roll out policy. This action was previously handled within Any testing must be carried out by rolling out policy to multiple datasources because the new process makes extensive use of parallel processing. Rolling out policy to a single datasource is unlikely to improve in speed. Solution 1
This issue is expected to be resolved in SIEM 11.4.6. NOTE: Any future product functionality or releases mentioned in the Knowledge Base are intended to outline our general product direction and should not be relied on, either as a commitment, or when making a purchasing decision. To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.
Solution 2
If an error is displayed as below: Add the following line to Workaround 1
Enable caching the RuleUseException table. You can enable caching by adding the following line to To create a Service Request, log on to the ServicePortal:
Workaround 2
As a temporary workaround, you can disable the new process so the old method of policy rollout takes effect. To disable the new process, rename the executable for PolicyRoller as shown below: Affected ProductsLanguages:This article is available in the following languages: |
|