Apply security updates
To remain effective at identifying new threats, your Deep Security Agents need periodic security updates.
- Initiate security updates
- Check your security update status
- View details about pattern updates
- Revert, import, or view details about rule updates
- Configure security updates
Instead of manually checking for updates, configure Workload Security to automatically check for security updates via a scheduled task. See Schedule Workload Security to perform tasks.
You can manually initiate security updates at any time, regardless of scheduled tasks.
- To get security updates on one agent, go to Computers, select the agent, then right-click and select Actions > Download Security Update.
To view the status of your security updates, go to Administration > Updates > Security.
- Trend Micro Update Server: Indicates whether relays can connect to Trend Micro ActiveUpdate to check for the latest security updates.
Workload Security: Indicates when the last successful check and download were performed, and when the next scheduled check will be performed. All Relays are in sync indicates that all relays are distributing the latest successfully downloaded pattern updates.
Out-of-sync status usually indicates that the relay cannot connect to Trend Micro Update Servers. Usually, this is not normal. You should fix network connectivity problems. In "air-gapped" deployments, however, network isolation is intentional; you must provide updates manually.
- Computers: Indicates whether any computers are out-of-date compared to the pattern updates currently on the relays. To tell all computers to get the latest pattern updates from their assigned relays, click Send Patterns to Computers.
To view a list of the components in an Anti-Malware pattern update, go to Administration > Updates > Security > Patterns. This page is displayed only when Workload Security has an active relay.
- Component: The type of update component.
- For Use By: The Workload Security product this component is intended for.
- Platform: The operating system for which the update is intended.
Current Version: The version of the component currently being distributed by the Deep Security Relays.To check which security update component version is being used on a protected computer, go to Computers, double-click the computer, and then select Updates.
- Last Updated: When the current security update was downloaded from Trend Micro.
To view a list of the most recent Intrusion Prevention, Integrity Monitoring, and Log Inspection Rules that have been downloaded into the Workload Security database, go to Administration > Updates > Security > Rules.
From there you can:
View details about a rule update: Select a rule update and click View. Details include a list of the update's specific rules.
To check which rule update version a relay is distributing, go to Computers, double-click the relay, and then select Security Updates. If Anti-Malware is enabled for that computer, it also displays the computer's pattern version.
Roll back a rule update: If a recent rule update has caused problems, you can revert to a previous rule version. Select the rule update that you want to revert to and then click Rollback. Workload Security generates a preview change summary so that you can confirm results before finalizing.
All policies affected by the reverted rules will be immediately updated on all computers using those policies.
- Reapply the current rule set: indicates that a rule update has been applied. To reapply that rule update to protected computers, right-click the rule update and click Reapply.
Import a rule update: Normally, rule updates are imported either manually or automatically (via scheduled task). However, if your deployment has no connectivity to the Trend Micro Update servers on the Internet (an "air-gapped" deployment), or if you are asked to do so by your support provider, you can click this button to manually upload and import a security update package.
- Export a rule update: Normally, you should not need to export a rule update unless your support provider asks you.
Delete a rule update: Removes the selected rule update from the Workload Security database.
To limit the number of rule updates that are kept in the Workload Security database, go to Administration > System Settings > Storage .
Security update packages must have a valid digital signature. If you try to view or use an invalid package (including old security updates that don't have a signature), then Workload Security displays an error message. See How Deep Security validates update integrity.
You can make the following configurations:
- Enable automatic patches for rules
- Enable security updates for older agents
- Change the alert threshold for late security updates
Trend Micro sometimes updates an existing Workload Security rule to improve performance or fix a bug. To automatically apply these patches, go to
For some platforms, Workload Security supports older versions. See Deep Security Agent platforms.
By default, to conserve disk space, Deep Security Relay will not download and distribute security updates for these older agents. To enable security updates for them, go to Administration > System Settings > Updates. Select Allow supported 8.0 and 9.0 Agents to be updated.
Deep Security Agent 8.0 is no longer supported. This check box only applies to the 9.0 agent.
If an update has been downloaded from Trend Micro and available for some time, but computers are not updated yet, an alert occurs. For pattern updates, by default, the limit is 1 hour.
If you want to change the time limit for the alert, go to Administration > System Settings > Alerts and configure Length of time an Update can be pending before raising an Alert.