HIP Check - Windows Intune Defender Protection

StarksJA — Mon, 03 Jul 2023 19:26:01 GMT

We are managing some test devices in intune and we want update our HIP checks to look for Microsoft Intune Endpoint Detection on devices.

Any recommendation on setting up that HIP object to look for intune being present on devices?

#globalprotect #hip

Re: HIP Check - Windows Intune Defender Protection

Gareth-Doyle — Sat, 08 Jul 2023 00:59:22 GMT

You would look for a custom process using something like this method:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMQuCAM

If you just want to check that it is installed you could look for a registry key, but technically that would be easy to add in manually without the application being truly installed (or if an uninstaller didn't clean up properly, it could still match despite the application being uninstalled).

There is some more detail here:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-agent-configuration-tab/globalprotect-portals-agent-data-collection-tab

topic HIP Check - Windows Intune Defender Protection in GlobalProtect Discussions

HIP Check - Windows Intune Defender Protection

Re: HIP Check - Windows Intune Defender Protection