topic Re: HIP Objects - matching multiple OS versions in one object in General Topics

HIP Objects - matching multiple OS versions in one object

PA_nts — Tue, 09 Jan 2024 09:39:57 GMT

Hi All,

Within PAN-OS (10.1.x)

Using GP, I want to setup one HIP object to match for multiple OS versions for instance Windows 10 and upwards. But does not seem to be doable instead i can only select each version within a specific OS range.

I want to avoid having to create an object for each version of Windows10 and 11 and wondering if there is a way to do one object to have it match any OS version for Windows10 and above?

Same needs be done for Android11+ / IOS15+ and want to avoid having a multitude of objects in my HIP profile.

any ideas if this is doable?

thanks in adv

Re: HIP Objects - matching multiple OS versions in one object

Brandon_Wertz — Tue, 09 Jan 2024 14:18:41 GMT

@PA_nts wrote:

Hi All,

Within PAN-OS (10.1.x)

Using GP, I want to setup one HIP object to match for multiple OS versions for instance Windows 10 and upwards. But does not seem to be doable instead i can only select each version within a specific OS range.

I want to avoid having to create an object for each version of Windows10 and 11 and wondering if there is a way to do one object to have it match any OS version for Windows10 and above?

Same needs be done for Android11+ / IOS15+ and want to avoid having a multitude of objects in my HIP profile.

any ideas if this is doable?

thanks in adv

No, you need to create a specific OS version object, then use those objects in a group. There's not a way to say "this "minimum+""

Re: HIP Objects - matching multiple OS versions in one object

BPry — Tue, 09 Jan 2024 21:59:48 GMT

@PA_nts,

As @Brandon_Wertz what you're after really isn't possible out of the box. I'd actually go a step further and say that you shouldn't be checking to make sure it's just Windows 10 or Windows 11. Just because someone is running Windows 10 doesn't mean they're running a supported system, because they could be running Windows 10 version 1507 where supported stopped in 2017.

I highly recommend building out custom checks and actually checking the CurrentBuildNumber value under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion and actually maintaining supported releases. Yes you'll end up having a lot of individual objects tied into your HIP profiles, but you gain additional security that's well worth that effort.

Re: HIP Objects - matching multiple OS versions in one object

PA_nts — Wed, 10 Jan 2024 06:14:17 GMT

Thanks for the feedback. within each object I have built out more specific checks like client specifics on anti-malware (AV), that the device belongs to a domain, disc encryption checks, updates enabled etc... still testing some additional options. but multiple hp objects it is.. 😞