Detect Agent Installation via Prisma Cloud

ScottMiller1 — Wed, 24 Nov 2021 13:22:02 GMT

We are looking to be able to check the following scenarios via Prisma Cloud.

1) Is EDR / Anti-Virus installed on compute workloads

2) Health status of the services

3) Enable auto-remediation (installation) if not present.

Has anyone worked through this scenario?

Re: Detect Agent Installation via Prisma Cloud

nikoolayy1 — Wed, 12 Jan 2022 13:06:21 GMT

I think that you should have Traps installed so it can see/check if your device has the needed software.

The other thing you can use the Globalprotect HIP checks :

You can use the HIP logs with tags to block users that don't have the right software:

Example: