我的學習手記 A technical geek blog: FireEye

Showing posts with label FireEye. Show all posts

Thursday, March 30, 2023

Configuring Trellix Endpoint Security Products (ENS & HX) to Coexist on Endpoints

(Trellix) FireEye EX――奇安信邮件威胁检测系统

(Trellix) FireEye NX――奇安信天眼威胁监测与分析系统

(Trellix) FireEye HX、EDR――奇安信终端安全管理系统

Error message: 'Critical: 1# subscriber:OpenDNS is with http response code:502 details…..502 Bad Gateway

Check Cisco Umbrella Service status: there are schedule maintenance the traffic being re-routed to another DC.

Resolution:

Run CLI – 'show health system warning' and show fenotify healthcheck' to check the Details for subscriber status. Fix the subscriber

Run CLI – 'fenotify healthcechk recheck' fter fix the subscribers config and server

Before you upgrade NX or EX, you need to upgrade your CMS first

Upgrade CMS

Backup the configuration (It need to run estimate first to check the first space is it enough to backup.)
The CMS need to upgrade first and also it needs to be higher version than FireEye NX and EX
CMS Update take a long time (90 mins) and also need to click “refresh” at each steps.
Reboot the CMS before start the upgrade process

Upgrade NX

Backup the configuration (It need to run estimate first to check the first space is it enough to backup.)
Before upgrade, it needs to reboot. To reboot the appliance, you need to use SSH login and change to enable mode, then run #reload
After reboot, wait for 20 mins
Apply the new firmware, then reboot it. It take 30 mins to 45 mins
After the upgrade success, it need to update the new guest os

Upgrade EX

1. Backup the configuration (It need to run estimate first to check the first space is it enough to backup.)

2. Before upgrade, it needs to reboot. To reboot the appliance, you need to use SSH login and change to enable mode, then run #reload

3. After reboot, wait for 20 mins

4. Apply the new firmware, then reboot it. It take 30 mins to 45 mins