To process traffic, create events, and detect incidents, PT ISIM View Sensor uses a special Positive Technologies Industrial Security Threat Indicators (PT ISTI) expert database issued as the ptisim-rules package. If changes are made to PT ISTI (for example, rules for analyzing a new protocol or detecting new incidents and violations are added, or an error in existing rules is fixed), you can update the package separately from the rest of the product.

You can update the PT ISTI database on a single node or on multiple nodes at once. Use PT ISIM Overview Center to centrally update the database on all sensors in the hierarchy that are connected directly or via other Overview Center nodes. Package versions later than the current version are available for installation.

Each PT ISTI database update package includes all previous changes, so there's no need to install all updates in sequence, you just need to install the latest version.