topic Re: Global Protect HIP Check - Defender ATP in General Topics

Global Protect HIP Check - Defender ATP

it_dist — Fri, 27 Mar 2020 09:53:08 GMT

Hi, we're implementing Defender ATP as an anti-malware solution.

I would like HIP checks to restrict Global Protect connections from clients without a recent AV scan performed, without Real Time Protection Enabled or with out-of-date virus definitions, however the GP Host profile on the client doesn't collect this information:

Many full scans have completed and Real Time Protection is enabled, and the client has downloaded the latest definitions.

Am I missing something obvious or is this a bug?

Regards

Re: Global Protect HIP Check - Defender ATP

kiwi — Mon, 30 Mar 2020 11:04:48 GMT

Hi @it_dist ,

It's likely an OPSWAT issue where this ATP version isn't yet fully covered.

I'd recommend reaching out to support. Collect the OPSWAT diagnostic logs from a system with MS Defender ATP installed.

Cheers,

-Kiwi.

Re: Global Protect HIP Check - Defender ATP

it_dist — Mon, 30 Mar 2020 11:49:23 GMT

Looks about right based on the GP HIP logs. Would you suggest reaching out to Palo support or direct to OPSWAT?

P2381-T775 Mar 30 12:39:00:642846 Debug(1623): GetProductHipInfo for product: Microsoft Defender ATP (100.86.92), vendor: Microsoft Corporation P2381-T775 Mar 30 12:39:00:649126 Debug(2005): Opswat Error(-12): An error when a method call was made on a component that does not implement it. Product: Microsoft Defender ATP (Ver: 100.86.92, Vendor: Microsoft Corporation), Method: WAAPI_MID_GET_RTP_STATE(V4), Signature: 100369, Category: 5(ANTIMALWARE), OESIS (V4 ver: 4.3.999.0, V3V4 ver: 4.3.749.0) P2381-T775 Mar 30 12:39:00:655530 Debug(2005): Opswat Error(-12): An error when a method call was made on a component that does not implement it. Product: Microsoft Defender ATP (Ver: 100.86.92, Vendor: Microsoft Corporation), Method: WAAPI_MID_GET_DEF_STATE(V4), Signature: 100369, Category: 5(ANTIMALWARE), OESIS (V4 ver: 4.3.999.0, V3V4 ver: 4.3.749.0) P2381-T775 Mar 30 12:39:00:662279 Debug(2005): Opswat Error(-12): An error when a method call was made on a component that does not implement it. Product: Microsoft Defender ATP (Ver: 100.86.92, Vendor: Microsoft Corporation), Method: WAAPI_MID_GET_LAST_SCAN_TIME(V4), Signature: 100369, Category: 5(ANTIMALWARE), OESIS (V4 ver: 4.3.999.0, V3V4 ver: 4.3.749.0)

Re: Global Protect HIP Check - Defender ATP

kiwi — Mon, 30 Mar 2020 12:39:38 GMT

Hi @it_dist ,

I'd reach out to support.

There might already be a bug filed for this to have OPSWAT engaged to cover this properly.

Cheers,

-Kiwi.

Re: Global Protect HIP Check - Defender ATP

it_dist — Mon, 30 Mar 2020 12:41:32 GMT

Thanks Kiwi,

Ticket raised: 01417370

Regards,

Tom

Re: Global Protect HIP Check - Defender ATP

BigPalo — Tue, 16 Nov 2021 09:49:09 GMT

Hello

do you have any news about this case?

Thanks

Kind regards