topic Re: PAN GP HIP in GlobalProtect Discussions

PAN GP HIP

KInkster — Thu, 29 Jul 2021 17:27:29 GMT

This is messing up our EDR solution.

This program will run cmd.exe and then whoami /groups

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe

Whoami as the Local System authority is a bad thing in our EDR world. Is there anyway to change this behaviour?

Re: PAN GP HIP

DavidHendy — Thu, 02 Mar 2023 13:19:32 GMT

did you ever find a solution? we have the same issue

Re: PAN GP HIP

PeteP — Thu, 02 Mar 2023 14:15:56 GMT

We have the same issue and currently have a ticket open with Palo Alto Support.

Latest comment from Support asked us to disable "Collect HIP Data", this will prevent the whoami.exe process. However, I replied informing them that we are not able to disable the HIP Data collection as this would also remove the HIP-based policy enforcement we are using (which is the reason why Collect HIP Data is enabled in the first place: GlobalProtect Portals Agent HIP Data Collection Tab).

No resolution yet, no ETA.

Re: PAN GP HIP

KInkster — Thu, 02 Mar 2023 20:21:00 GMT

I have heard nothing. We still have the same issue