The AV Signature Pack is not packaged with the sensor installation, but should be downloaded and installed automatically after sensor installation based on policy settings. As a best practice, we recommend that you download and install the AV Signature Pack 10 seconds or more after sensor installation.

Note: The local scan feature is only available for Windows sensors 2.0 and later.

The AV Signature Pack requires approximately 120MB at rest. During run time, 400MB is required because a second copy is created; the scan continues to function while signatures are being updated. After the update is complete, the old signatures are deleted. At least 200MB of memory is required to run the local scan.

Signature file updates are ON by default via a policy setting. You might encounter high bandwidth utilization upon sensor installation due to the initial signature file download. Subsequent updates following the initial install of the AV Signature Pack are differential. Therefore, setting a regular update schedule ensures that every subsequent update remains small.

To avoid network saturation during sensor installation, we recommend the following best practices:

  • Install sensors in small batches.
  • Set up a local mirror server for signature updates and configure your policy so that sensors download updates from the local server. See Signature Mirror Instructions.
  • Disable automatic signature updates. Deploy the initial signature pack by using the standalone installer, and then re-enable automatic signature updates.