> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/air-gapped-systems/how-do-i-update-enginsight-in-an-air-gapped-system.md).

# How do I update Enginsight in an air-gapped system?

An air-gapped system is a device or network that is physically and logically fully isolated from other devices, networks, and the internet.

In principle, data can therefore only be transferred in one of two ways:

* manually via suitable portable storage media.
* via an upstream demilitarized zone (DMZ) that has a secured connection to the internet or to other networks. Communication between the air-gapped system and the DMZ server is exclusively initiated from the air-gapped system.

For updating the Enginsight platform and its components, this means that the air-gapped system cannot directly access the Enginsight update repository over the internet (<https://get.enginsight.com>).

<p align="center">--------------------</p>

For this scenario, Enginsight provides two additional alternative update paths. Both must be completed to update the entire Enginsight instance:

* [Alternative update path for air-gapped systems: Part 1](#alternative-update-path-for-air-gapped-systems-part-1): This updates the Docker containers running on the Enginsight Application Server.
* [Alternative update path for air-gapped systems: Part 2](#alternative-update-path-for-air-gapped-systems-part-2): This updates the Enginsight components Pulsar, Observer, Hacktor, Watchdog, and Loggernaut, the Enginsight SIEM, the CVE database, the YARA rules for detecting APTs (Advanced Persistent Threats), and more.

{% hint style="danger" %}
**Please note**: To perform the updates, you need a machine with an internet connection and Docker Engine installed. We recommend using a DMZ server for this purpose.
{% endhint %}

***

## Alternative Update Path for Air-Gapped Systems: Part 1

Complete the following steps to update the Docker containers running on the Enginsight Application Server:

{% stepper %}
{% step %}

### Download the required update script to the DMZ server

Download the update script for the Docker containers using the following command:

```
curl -fsSLO https://get.enginsight.com/airgap/airgap.sh
chmod +x airgap.sh
```

{% endstep %}

{% step %}

### Log in to the Enginsight Docker registry on the DMZ server

1. Log in to the Docker registry using the following command:

```
sudo docker login registry.enginsight.com
```

2. You will now be prompted to enter the username and password for the Docker registry.

{% hint style="warning" %}
**Please note**: You will receive the access credentials for the Enginsight Docker registry from us. To request them, contact us at *<insidesales@enginsight.com>*.
{% endhint %}

If the login was successful, the message `Login succeeded` is displayed.
{% endstep %}

{% step %}

### Run the update script on the DMZ server

Now run the update script on the DMZ server using the following command:

```
sudo ./airgap.sh export
```

The update script:

* downloads the complete Enginsight Enterprise repository from GitHub.
* extracts the current **docker-compose.yml** file and reads the Docker container versions.
* creates the **airgap.versions** file.
* pulls all Enginsight Docker images and dependencies (for example MongoDB and Redis).
* packages everything into a single file archive, **enginsight.airgap**.

{% hint style="info" %}
Depending on the speed of your internet connection, this process may take a while.
{% endhint %}
{% endstep %}

{% step %}

### Transfer the update script and the created file archive to the air-gapped system

You now need to transfer both the update script downloaded in [step 1](#download-the-required-update-script-to-the-dmz-server), **airgap.sh**, and the file archive created in [step 3](#run-the-update-script-on-the-dmz-server), **enginsight.airgap**, to your air-gapped system.

To do this, copy the files manually to your air-gapped system using portable storage media, or use another transfer method of your choice.

{% hint style="warning" %}
**Please note**: We recommend performing this step **at least once a month**.
{% endhint %}
{% endstep %}

{% step %}

### Run the update script on the air-gapped system

Now run the update script on your air-gapped system using the following commands:

```
chmod +x airgap.sh
sudo ./airgap.sh import enginsight.airgap
```

The update script:

* loads all Enginsight Docker images and dependencies.
* updates all Docker image versions in the **docker-compose.yml** file.
* copies the **airgap.versions** file and the **enginsight.airgap** file archive to the default directory **/opt/enginsight/enterprise/**.

{% hint style="warning" %}
**Please note**: Your Enginsight configuration files under **./conf/** are not affected by the update script.
{% endhint %}
{% endstep %}

{% step %}

### Optional: Save files in an alternative directory

If you want to save the **airgap.versions** file and the **enginsight.airgap** file archive in a directory other than **/opt/enginsight/enterprise/**, run the update script as follows:

<pre><code>chmod +x airgap.sh
<strong>sudo ./airgap.sh import -d &#x3C;AlternativeDirectoryPath> enginsight.airgap
</strong></code></pre>

{% hint style="info" %}
Remember to replace `<AlternativeDirectoryPath>` accordingly.
{% endhint %}
{% endstep %}

{% step %}

### Restart the Docker containers on the air-gapped system

Now restart the Docker containers on your air-gapped system using the following commands to apply the changes:

```
cd /opt/enginsight/enterprise
sudo docker compose down
sudo docker compose up -d
```

{% hint style="warning" %}
**Please note**: If you specified a directory other than the default directory **/opt/enginsight/enterprise/** in [step 6](#optional-save-files-in-an-alternative-directory), you must adjust the directory path accordingly.
{% endhint %}
{% endstep %}
{% endstepper %}

***

## Alternative Update Path for Air-Gapped Systems: Part 2

Part 2 of the update includes, *among other things*, updates of the Enginsight components Pulsar, Observer, Hacktor, Watchdog, and Loggernaut, the Enginsight SIEM, the CVE database, and the YARA rules for detecting APTs.

{% hint style="danger" %}
**Please note**: We strongly recommend performing this update path **at least once a day** to keep the CVE database and APT detection rules up to date.
{% endhint %}

Follow these steps:

{% stepper %}
{% step %}

### Download the required file archives to the DMZ server

For part 2 of the update, **three file archives** are available. For security reasons, they are hosted on **different servers**:

* Complete memory dump on the AWS Content Delivery Network (CDN): <https://dls.enginsight.com/airgap.tar.gz>

{% hint style="warning" %}
This file archive is required for the update.
{% endhint %}

* Dump of the checksums (hashes) in the regular Enginsight update repository: <https://get.enginsight.com/airgap.tar.gz.sha1> <https://get.enginsight.com/airgap.tar.gz.sha256>

{% hint style="info" %}
These file archives are optional.
{% endhint %}

Download the file archive or archives you need to your DMZ server using the specified URLs.
{% endstep %}

{% step %}

### Transfer the file archives to the air-gapped system

1. Copy the downloaded file archive or archives manually to your air-gapped system using portable storage media, or use a different transfer method of your choice.

{% hint style="warning" %}
**Please note**: To keep the CVE database and APT detection rules up to date, we strongly recommend automating this step, for example by using a script.
{% endhint %}

2. Save the file archive or archives to a directory of your choice. The path to the directory in which the file archives are stored is required when adjusting the Enginsight configuration file in [step 4.3](#adjust-the-enginsight-configuration-file-on-the-air-gapped-system).
   {% endstep %}

{% step %}

### Extract the file archive on the air-gapped system

Extract the **airgap.tar.gz** file archive using the following command:

```
tar -xzf airgap.tar.gz
```

{% endstep %}

{% step %}

### Adjust the Enginsight configuration file on the air-gapped system

Now adjust the configuration file of your Enginsight installation on the air-gapped system.

{% hint style="warning" %}
**Please note**: The following steps must be performed *on the Enginsight Application Server*.
{% endhint %}

1. Log in to the Enginsight Application Server.
2. Open the Enginsight configuration file using the following command:

```
sudo nano /opt/enginsight/enterprise/conf/services/config.json 
```

3. Add the attribute `"updateRepositoryUrl"` at root level in the configuration file and, as the value for `<UpdateDirectoryURL>`, enter the URL pointing to the directory that contains the extracted files from [step 3](#extract-the-file-archive-on-the-air-gapped-system).

{% hint style="danger" %}
**Please note**: The directory path must be specified **including https\:// or http\://**. It is **not** sufficient to enter only the domain.
{% endhint %}

<pre><code><strong>"updateRepositoryUrl": "&#x3C;UpdateDirectoryURL>", 
</strong>"api": { 
      ... 
       },
</code></pre>

4. Save the changes in the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).

{% hint style="info" %}
Enginsight now accesses the specified directory instead of the default update repository (<https://get.enginsight.com>).
{% endhint %}

5. Now navigate to the Enginsight installation directory using the following command:

```
cd /opt/enginsight/enterprise  
```

6. Run the Enginsight setup script for the Application Server anew using the following command and confirm all prompts for the changes to take effect:

```
sudo ./setup.sh
```

{% endstep %}
{% endstepper %}

***