Upgrade Xprotect agents

Upgrade to newer versions of the Xprotect agent to avail better security features and performance improvements. We recommend installing the latest version of the agent on new hosts and upgrading the managed hosts to the latest version.

During the upgrade, the agent services and processes stop and restart on the host. The agent caches up to 500 events/alerts generated during the upgrade. The agent sends the telemetry data that is cached during the upgrade when it sends the next heartbeat to the Xprotect instance.

Need Update widget

Use the Need Update widget on the Dashboard page to see the list of the hosts that are not using the latest version of the agent. 

Click this widget and see the Hosts page filtered by hosts that are not using the latest version. See Xprotect Dashboard for more details.

Alternatively, you can use the Has Latest Version=No filter on the Hosts page to see the same results.

Upgrade agent

As a best practice, always initiate the agent upgrade process only when the hosts are reachable to the Xprotect instance (Status= Online on the Hosts page). This ensures a quick and seamless upgrade on the hosts.

  1. Go to Hosts on the Xprotect UI.

  2. Select One or more hosts and click Upgrade Agent (in the floating panel on the top).

  3. From the Approval Source drop-down list, select a reason.

  4. Enter the details about why you want to upgrade the agent.

  5. Click Upgrade Agent.

    You will see a confirmation when the agent is upgraded on the hosts.

Verify - hosts upgraded successfully

Hosts page

The Agent version column for the upgraded hosts shows the latest version of the agent.

For hosts that are being upgraded, the Status column on the Hosts page shows Upgrading. After the upgrade, you will see the hosts' status based on their reachability with the instance.

Issue - status of hosts show Upgrading

If you initiate the agent upgrade process when the status of a host is Offline or Unreachable, Xprotect schedules the upgrade. However, it cannot upgrade the agent because it cannot reach the host. 

The host status shows Upgrading until you make the host reachable to Xprotect. You will see the host's status based on its reachability with the instance after the agent is upgraded to the host.

Next steps

  • ColorTokens often adds new features and improves the existing features in Xprotect. Some of these features may only work with the latest versions of the agents. Keep track of the new features and feature updates for Xprotect. See Xprotect Updates for more details.

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.