AlienVault® USM Anywhere™

USM Anywhere Updates

The USM Anywhere updates occur automatically as new versions become available. The update is transparent, requires no action on your part, and runs in the background. If you want to be notified about the USM Anywhere updates (and other incidents), subscribe to the USM Anywhere Status page. You can also follow the USM Anywhere Product Announcements to find out what's included in each update.

When you subscribe to receive updates from USM Anywhere, you will receive two kinds of notifications at the email address used in the subscription:

  • USM Anywhere Provisioning Update: This is to update the provisioning system (for new customers). Therefore, new deployments are not created until maintenance is complete.
  • USM Anywhere Service Update: This is to update existing USM Anywhere services. Your service may be offline during this period.

For each update, you receive an email when it is scheduled (with start time and estimated duration), when it is in progress, and when it is completed. The estimated duration is the time it takes for all USM Anywhere services to be updated, also referred to as the maintenance window. Your service restarts after its update has completed.

When your USM Anywhere Sensor tries to connect to the USM Anywhere service after it has completed an update, the sensor downloads and installs the update immediately. Your USM Anywhere Sensor restarts after its update has completed. You do not need to reconfigure the sensor or restart it after an update.

In general, your USM Anywhere Sensor can complete its update during the USM Anywhere Service Update maintenance window.

Warning: The VMware Sensor and Hyper-V Sensor require all five Network Interface Cards (NICs) to be enabled. The USM Anywhere update will fail if not all five NICs are associated to some network (active or inactive).

You should connect each of the additional NICs to any additional network you want to monitor, or to a dead or inactive network. Do not configure the additional NICs to the same Switched Port Analyzer (SPAN) port, because this causes duplicated events.