I am changing Symantec AV for Sophos Intercept X, and I used to control the AV definitions/signatures. But now with Sophos I have found that we can control Sophos updates, but I wonder if it also includes the update of AV definitions, please could you clarify it?. Can I just control update AV definitions?
Hello Jaime L,
you can, to a certain extent, control software updates - detection data updates can't be delayed or suspended. What would be the purpose of this? Latest definitions should protect from latest threats. Why is it preferable to control definition updates?
Hi Christian, I agree with you about that it will be better to be updated all the time, but in the past we had a situation when AV definitions were corrupted and we had a big problem (using Symantec SEP), since then we prefer just to update partially of the devices and later update the rest of systems. That why I am interested to looking for the way to do it, but it looks that it is not possible, right?
in the past we had a situationwho hadn't . Understandable, but it's not the best idea considering actual probabilities, possible kinds of "corruption" and whether your approach can detect all of them in time (well, you could just wait if other users encounter problems, you don't have to endanger your devices), and last but not least what difference a few hours can make in case of a malware campaign. Sure, there's Live Protection so a little updating latency is not as bad - but also are timely updates not as moot as one might think. The latter provide a "baseline" for Live Protection.
it is not possibleAFAIK - no. It never was, IIRC, all you could do (in the on-premise product) was stretching the interval between updates to a maximum of 1440 minutes. This feature has been withdrawn with Central/Intercept x (and for a reason, I assume). Botched definitions that cause big problems are very rare, veeeery veeeery rare. Late or missed updates have much more adverse potential.
thanks a lot!, I really appreciate your comments.
I think there are deployment groups for updates. You could ask your account manager/Support about being added to a later group for data updates. Might be something.