A utility's security team reads a Talos advisory about a new remote code execution exploit, and their FTD release is already current and stable. Only content-level updates are approved in this week's change window, and the team wants detection coverage today. Which Management Center content update should be applied first?
Select an answer to reveal the explanation.
Short Explanation
A rule update is like adding the latest pages to your detection playbook: it brings new intrusion rules into Management Center, and you’ll deploy the updated policy to your devices. Since your FTD release is already current, this content-only step gets detection coverage in place today; refreshing vulnerability data or redeploying without the update won’t add those signatures.
Full Explanation
The Management Center's rule update delivers the current Snort rule set to its rule database. To make updated rules available to managed devices, deploy the updated intrusion policy after applying the rule update. This changes intrusion-rule content without installing a new software image, fitting a content-only change window. Installing a software patch changes the running image, so it falls outside that window. Updating the Vulnerability Database refreshes vulnerability metadata used for event mapping and related lookups; it does not update the rules that detect the exploit in traffic. Redeploying the current intrusion policy alone does not contact the update service or fetch new signatures; the rule update must come first. Content packages are matched to software versions, so confirm your release can accept the offered update. After deployment, search the intrusion policy for the new signature by name or SID and confirm it is present and enabled.