Different view of the definitions details in the new version released of SPE 8.2.2 under LiveUpdate Content tab

Products

• Protection Engine for Cloud Services

Issue/Introduction

After the new version installation of SPE 8.2.2, URL reputation and filtering tabs are active in policy, and also license is active, but only AV definition information is drawn in the live update content. The buttons under the Scanning tab and rapid release content tab are inactive.

 

Environment

Release : 8.2.2.x

Component : Default-Sym

Cause

it's only a small modification in the newer version released SEP 8.2.2 and nothing is lost, all features are available but in a different view. 

Resolution

1. From your license snapshot, the license looks good and nothing seems to be wrong with it.
2. To check if the license is correctly installed or not we need to check the "System" > "License" page of the SPE local UI instead of the "System" > "LiveUpdate Content" page. The "License" page lists each feature inside the license along with details like expiration dates, license Ids etc. You'll find all the license features from your license file on this page. I'm attaching the snapshot from my machine.

Now, coming to the point of why we see only "AV definitions" on the "LiveUpdate Content" page.

I'm assuming the old version you are mentioning is either 8.0.x or even older. In these versions of SPE, we had three broad categories of definitions available for download 1. AntiVirus 2. File insight reputation 3. URL filtering and reputation

With the latest SPE version 8.2.x, SPE uses next-generation AV technologies with improved efficacy with Advanced machine learning, emulation for PE, Non-PE/script files, etc. and all of these technologies are live updatable i.e. the complete security technology stack/engines can be updated at runtime with LiveUpdate for any hotfixes/improvements. What's new in Symantec Protection Engine 8.1

With this change in 8.2.x, all Anti-malware technology definitions are combined in a single AV package which includes Static Antivirus signatures, file insight/reputation feeds, ML models, etc. So you won't separately see the "Insight cache revocation..." row on the LiveUpdate table since it's part of the AV package itself.

 

With the EOL of RuleSpace and DeepSight- based URL filtering and reputation, the same and more robust capabilities are now available in SPE with WebPulse-based integration. What's new in Symantec Protection Engine 8.2.1

The RuleSpace and DeepSight -based URL filtering and reputation were working with static contents downloaded via LiveUpdate and hence there were options for such on the LiveUpdate content page. With WebPulse integration, the URL lookups are based on a  local cache that gets built over the period along with web queries for such lookups if not found locally. So, the minimal data download and local cache building happen in the background and hence there is no option for updating definitions for URLs on the LiveUpdate page since it happens in the background. make sure you get the result either from the local cache or web query.

 

Finally, in terms of feature capabilities and efficacy, SPE 8.2.x is at par or more advanced than older versions of SPE and hence there is no functionality loss. Let us know if you see any concerns.

 

So, in summary - what you see on the LiveUpdate Content page is correct and nothing wrong with your license.