EDR Content version deprecated with version 4.1?

[Ufoto]

Hello,

Recently we started to roll out EDR 4.1 to our managed environments and we noticed something strange - on endpoints where the client was upgraded, EDR content version reports as "Deprecated" instead of the version number. Using the built-in query "EDR Clients per Content Version" it is visible that it affects all upgraded systems. This occurred in all environments we updated so far with thousands for endpoints affected so I presume it will be quite easy to reproduce. I tried searching the knowledge base, however there doesn't seem to be any information or other posts about it which surprised me. There are all types of Windows OS affected, some systems have been rebooted, some not, systems have various Trellix products installed so I cannot really correlate it with anything specific. 

I just wanted to check if someone is aware of this issue and whether there is any information about it? We are concerned whether the endpoints are not up to date, or it is just a reporting issue. 

Thank you in advance!

[Pravas · Accepted solution]

Hi @Ufoto ,

I believe Content Version has been replaced by Trace Content Version.

You may duplicate the existing query i.e. EDR Clients Per Content Version and edit the following fields.

Thanks