Update rules and intelligence offline

Bring a signed update bundle on removable media, check it, and apply it from the console — nothing is applied unless its signature and every file check out.

Detection rules and threat intelligence change between releases. On a deployment with no internet they arrive as a signed update bundle: a legit-update-<version>.tar.gz file carried in on removable media.

Who can apply an update

An update changes detection for everyone on the platform, so not every administrator may apply one:

on a platform on your own server — with or without internet — its administrator: the first administrator Legit AI handed over, or anyone with the ADMIN role in that first organisation;
in Legit AI’s cloud, Legit AI applies updates for you.

A read-only support session cannot stage or apply updates, and neither can an API key without the admin scope. Anyone with the VIEWER role can see the update history.

Apply a bundle

Open Settings → Offline updates and upload the bundle. Uploading only puts it in the staging folder; it changes nothing.
Choose Check. The platform runs every check an apply would: the signature over the bundle’s manifest, then the SHA-256 of each file against that manifest. A failed check says which file or what was wrong.
Choose Apply and confirm. The console offers Apply only after a check has passed. The checks run once more, then the detection rules are replaced and the indicator snapshot is loaded. Applied on this deployment lists the version and how many rules and indicators came in; the audit log records who applied it.

A bundle whose signature or file hashes do not match is refused and nothing in it is applied. An unsigned bundle is never accepted, whatever the request asks for.

Limit	Size
One bundle	512 MB
Everything staged	2 GB

Staged bundles you no longer need can be removed from the same page.

ClamAV signatures

A bundle can carry fresh ClamAV signatures, about 230 MB of them. They go through the same checks as everything else in the bundle. Once applied, they wait in the data folder until the ClamAV container brings them in, within a minute, and reloads; it keeps scanning with the old signatures until the new ones are in place. The file scanner page shows how old the signatures are.

Through the API

Method and path	Does
`GET /api/airgap/updates`	History, and whether you may manage updates
`GET /api/airgap/updates/staged`	Staged bundles and the space they use
`POST /api/airgap/updates/upload`	Stage a bundle (multipart `file`)
`POST /api/airgap/updates/verify`	Check a staged bundle without applying it
`POST /api/airgap/updates/apply`	Check and apply it
`DELETE /api/airgap/updates/staged/{name}`	Remove a staged bundle

Staging, removing and applying are each written to the audit log.