¿How to configure more time for SEC updates?

Question

Hi, 
 &iquest;How can i configure the time SEC control panel decide a endpoint is updated or not? 
 I mean. Now it's 10:00h and last endpoint update was at 9:26. SEC says that endpoint is not up to date. How can i increase that value to 12-24h?

Thanks in advance.

QC · Accepted Answer

Hello mariano pop , 
 first of all, some explanation what the value means. You might notice that the time is the same for all entries - quite unlikely that the endpoints have all updated at the same time. The value does not represent an endpoint's last update time but the time the next package became available . Well, that's not of much help so: Package means a specific combination of software and threat detection data. When SUM downloads new detection data or software it records the package's contents along with the timestamp when it has been deployed. When an endpoint updates it sends the according information from its installation to the management server which uses this information to determine whether the endpoint has the latest package installed or not. If you right-click View computer details you'll find for the out-of-date endpoints a Time next package became available value. If this value exists it (actually an adjusted value, more below) is displayed as Not since ( No desde ). Note that this is always the value for the next package (i.e. the oldest the endpoint has not yet installed), not the latest. Time installed package became available is actually a little bit confusing as it refers to the time of the base detection data (right now 4.53) update. When new data is available endpoints are supposed to update according to the policy - by default within 10 minutes. Again by default the management server allows 60 minutes before it reports endpoints as out-of-date. If you compare the Not since to the Time next package became available you'll notice the former is one hour off. In your case it means the endpoints have not updated since at least 8:26:58. The might have failed to send a status message for whatever reason, the might actually have an update interval longer than one (rather two in your case) hour. Thus you should consider increasing the latency only if your updating policy has an interval considerably longer than the default 10 minutes . 
 The Dashboard Out-of-date computers count considers only connected computers. As protection data is updated several times a day the Not since indicates endpoints with potential (updating) problems. If a connected endpoint hasn't updated in the last hour it's not very likely that it will do so if you give it 12 or 24. 
 Christian