SENSOR UPDATE POLICIES

Question 1

Define an update policy

Answer 1

• Controls the update process for sensors on all hosts
  **no restart is required during in place updates.

-Each host is assigned to a sensor policy, based on host group.

Question 2

What can you use sensor update policies for

Answer 2

Use sensor update policies to:

- Lock host groups to a specific sensor version

- Control whether the cloud manages sensor version updates 

- Protect sensors from unauthorized uninstallation by end 
      users 

- Deploy new sensor versions to host groups for testing and 
      validation

- Update Schedules: Use sensor update policies to 
      automatically update test and production hosts to 
      appropriate versions

- Sensor and channel update throttling: Throttle sensor 
      update speeds to conserve bandwidth on slower networks

- Sensor uninstall protection: Control whether an end user 
      with local admin permissions can manually update or 
      uninstall the sensor

Question 3

Demonstrate what the default policy is used for

Answer 3

• Default Policy is used for hosts that do not have a sensor update policy assigned/attached to them

Question 4

What are considered best practice when configuring default policies?

Answer 4

• Best practice is to choose a specific version for the update policy, not an “Auto version”
• Best practice to keep Uninstall and Maintenance Protection enabled for all sensor update policies

Question 5

What does auto update do?

Answer 5

• Automated sensor is set to one of 3 Auto policy options:

1. Auto – N – 1: When a schedule release happens, hosts with this setting update to the second newest version
2. Auto – N – 2: When a scheduled release happens, hosts with this setting update to the third – newest version
3. Auto – Latest: When a scheduled release happens, hosts with this setting update to the newest version – for hosts designated with sensor testing

Question 6

Where are build versions visible for a single sensor?

Answer 6

• Host setup and management > Sensor Update Policies > Build (column)

Question 7

Do all hosts maintain the same sensor update policy?

Answer 7

-No. There is a separate sensor update policy for separate platforms, and a separate update policy for Falcon Identity Protection DC Sensors.

Question 8

How to configure a default policy according to best practice?

Answer 8

Falcon Console > Hosts > Groups > create new custom groups called Test QA Group, Tech Pilot Group, and Business Pilot Group > Sensor Update Policies > Set “Test QA Group” to Auto version/ latest version

Set specific builds for other groups

-Once “Test QA Group” is successfully updated, configure the other groups to update to that version

-Best Practice is to keep Uninstall and Maintenance Protection enabled for all sensor update policies

Question 9

Can you revert a sensor to a previous version?

Answer 9

• Yes, but only to a version released in the last 180 days.