topic Wrong HIP match in GlobalProtect Discussions

Wrong HIP match

shubhamgupta — Mon, 24 Jan 2022 20:09:56 GMT

Hi team

Hope so you all are doing great.

We are in the phase of implementing compliance checks based on HIP checks.

Before that we have created multiple HIP objects/profiles to observe our end users asset compliance and now we have asked our IT team to start installing compliance software in the end machine to avoid any issues when we fully provide access based on HIP checks.

We generate report of non-compliance machine (matching our non-compliance HIP profile) every week but I am observing something weird now, user who were matching non-compliance HIP checks earlier around 15days back are not matching those HIP checks now. There is no config change or GP client change on the end machine. As the logs are purging in almost one week but for one user I saw in the HIP report every HIP check was there still it matched wrong HIP object and now it is matching everything perfectly.We can see similar issue for various other users also.

My HIP checks are as follows-

Firstly the machine should be part of domain and secondly crowstrike should be installed.(Any version is fine).

Any machine not matching either of this criteria are posed as non-compliance.

We are nearing the final stage of this project, it will be great if you guys have any inputs or faced such issue

Re: Wrong HIP match

BPry — Mon, 24 Jan 2022 20:03:31 GMT

@shubhamgupta,

There's not a whole lot of information included in your post to actually assist with troubleshooting to be honest. What sort of things are you actually checking with your HIP Objects, how is the HIP Profile actually structured, is non-compliance just checking updates that maybe got installed since the last time an endpoint was recorded as non-compliant?

You don't really say what you're looking at outside of the fact that a few weeks ago an endpoint was matching the non-compliance profile and now it isn't. Depending on what what the non-compliance profile HIP Objects actually check that wouldn't necessarily be an unexpected thing to change. For example if I'm ensuring Windows updates are installed someone maybe just finally got around to installing the updates so they are in compliance again.

Re: Wrong HIP match

shubhamgupta — Mon, 24 Jan 2022 20:07:43 GMT

HI @BPry

Firstly,thanks for your response and secondly my bad for posting it not informative.

Actually we have kept two checks- firstly the machine should be part of domain and secondly crowstrike should be installed.(Any version is fine).

Any machine not matching either of this criteria are posed as non-compliance.