Content Update

The ADMIN > Content Update page displays the FortiSIEM version that is running and can be used to check if there are available updates. If any updates are available, they can be downloaded and installed. Content Updates must be done in the following order:

  1. Upgrade FortiSIEM Manager.
  2. Upgrade FortiSIEM Supervisor.
  3. Upgrade FortiSIEM Worker.

Specific Content Pack Updates information can be found here.

The following topics are available:

Content Update Notification

If a Content Update is available, the following icon will appear in the top header: 

Clicking this icon anywhere from the FortiSIEM GUI will redirect the user to the ADMIN > Content Update page.

Viewing Content Updates

The current running version is displayed in Running Version. Any available versions that can be applied in an update are displayed in Available Versions.

The Content Update table provides the following information.

Settings Description
Version The version of released content is displayed.
Release Date The release date of the content is displayed.
Content Description Information about a content update is provided here.

Checking for Content Updates

To check for any available content updates, click the Check Now button. If any content update is available, the Install button will be active. If more than one new version is found, then the button name will appear as Install All.

Viewing Content Update History

To check your FortiSIEM content update history, take the following steps:

  1. Click the History button. A Content Update History window will appear.
  2. Select Relative or Absolute Time, and input or select the time frame you wish to view.
    Click OK.
    The following information is provided, if available.
    SettingsDescription
    Update TimeThe time the content update was applied is displayed.
    Source IPThe IP address from where the update was downloaded is displayed.
    UserThe user who performed the update is displayed.

    Version

    The version of the content update is displayed.

  3. When done viewing the information, click Close.

Installing Content Update

This section allows you to update content for your Supervisor, Workers and Collectors without needing to update your FortiSIEM version. When the content installation occurs, all new content is pushed to all available nodes (Supervisor, Workers, Collectors).

Content Update Installation for Supervisor and Workers

Install Content Updates for Supervisor and Workers

Note: Any changes that have occurred during an installation CANNOT be reverted.

  1. Click the Install button.

    Note: If more than one update is available an Install All button will appear instead. In this situation, click Install All to perform all installations.

     

    A progress bar will appear as installation begins. When the progress bar is complete, the installation is done.

    You can also click on the Jobs/Errors icon () and select the Jobs tab to view the progress of the content installation. When the Status column shows "Done", and Progress column is "100%", installation for the Supervisor and Workers is complete.

    Example: The Supervisor and Worker content update (The first and second lines) are shown as "Done".

    If you register/power on any Collector after the Supervisor has had a Content Update, then proceed to Content Update Installation for Collectors.

    Note: You can click Abort to stop the installation.

Content Update Installation for Collectors

Install Content Updates to Collectors

  1. Navigate to ADMIN > Health > Collector Health.
  2. Click on the Action drop-down list and select Download Content.
    Click on the Jobs/Errors icon () and select the Jobs tab to view the progress of the content installation. When the Status column shows "Done", and Progress column is "100%", for the Collector job, the content update is complete.
    Example: The third line shows the Collector Content Update as "Done" for Collector CO7.