Hello,
you may see what happens if you click "LiveUpdate..." in the SEP client UI.
If that button is disabled, click "view logs" in the main SEP client panel, then "view logs" under "client management" and then select "system logs", you will find there entries like "downloaded new content update from...<the source of the content>". The same kind of logs are also available in the SEPM console > monitors > logs, then filter log type=system, log content=client activity.