topic Re: Trouble with HIP checks for Anti-Malware in GlobalProtect Discussions

Trouble with HIP checks for Anti-Malware

pasmartin — Thu, 27 May 2021 10:50:19 GMT

Hi Community!

I have some issues getting HIP checks to work on a PA820.
Have configured a couple Objects that checks whether the Cortex XDR agent or Windows Defender is installed/enabled

And have them added to a profile that I have added to the GlobalProtect Gateway.

This seems to be working fine on a LAB-PA220 - triggers whenever Cortex XDR is not found, or if Defender is turned off. Verified on three separate devices (VM running Windows 10, Laptop running Windows 10, VM running server 2016).

On the PA820 however, users get the "Not Match Message" regardless of Cortex XDR / Defender status.

The funny part is that on the test machines mentioned above, I'm unable to reproduce the issues my coworkers are seeing. HIP works as intended.

Anyone know what could cause this behavior? My guess is that this is due to some local issues on Windows - but could there also be some issues where the firewalls (in general, or PA820 specifically?) are unable to get the the Host Information for some reason?

Appreciate any help!

Re: Trouble with HIP checks for Anti-Malware

jdelio — Wed, 02 Jun 2021 20:02:37 GMT

It is strange that it acts differently on the 2 different devices, as it should act the same on both.

Do you mind letting us know what PAN-OS version is running on those 2 devices?

Re: Trouble with HIP checks for Anti-Malware

pasmartin — Thu, 03 Jun 2021 07:58:26 GMT

Thanks for your reply!
Indeed - the PA220 is running 10.0.3, and the PA820 is running 10.0.4 (I know, the PA220 should be the one "on the bleeding edge-SW", rather than the PA820, but haven't found a fitting moment for it yet.

Re: Trouble with HIP checks for Anti-Malware

jdelio — Thu, 03 Jun 2021 19:58:44 GMT

@pasmartin Thanks for the PAN-OS versions.. I was thinking it would be drastically different.. So that isn't it, or don't think so.. other than ensuring the versions match..

What about dynamic updates versions? between the 2 devices?

Re: Trouble with HIP checks for Anti-Malware

pasmartin — Fri, 04 Jun 2021 06:25:56 GMT

@jdelio Oh snap - the PA220 had no check or action for antivirus - but other than that, they are configured the same for app&threat, wildfire are on the same versions.