Wrong HIP match

Jafar_Hussain — Wed, 05 May 2021 13:34:17 GMT

Dear All,

issue:

I have the firewall 5220 with PAN-OS 10.0.3 and I am facing an below issue:-

As GlobalProtect 5.2.6 is released with support for OPSWAT v4 only while OPSWAT v3 is discontinued starting from 5.2.6, I tried to test it on a few machines.

We apply HIP checking for the below:

- FireEye Endpoint Agent – Installed & Real Time Protection = Yes & Product Version >= 31.0.0 & Virus Definition Version is within last 7 days

In the HIP logs, I checked FireEye Endpoint Agent detect the wrong Virus Definition Version date as 1/1/1970.

I rolled back to GlobalProtect 5.2.5-c84, and FireEye Endpoint Agent is detected with the correct Virus Definition Version.

Below is the screenshot update GP -5.2.6 showing wrong information:-

Agent screen shot:-

The same HIP logs below:-

Once I rollback the GP version is 5.2.5 the logs showing correct.

# When I checked the logs by below command with GP version 5.2.6:-

debug user-id dump hip-report ip <IP address> user <domain\username> computer <system name>

<client-version>5.2.6-84</client-version>

<real-time-protection>yes</real-time-protection>

<last-full-scan-time>n/a</last-full-scan-time>

# When I checked the logs by below command with GP version 5.2.5:-

debug user-id dump hip-report ip <IP address> user <domain\username> computer <system name

<client-version>5.2.5-84</client-version>

<real-time-protection>yes</real-time-protection>

<last-full-scan-time>n/a</last-full-scan-time>

Can any one help on this.

Re: Wrong HIP match

kiwi — Fri, 07 May 2021 07:24:59 GMT

Hi @Jafar_Hussain ,

From the looks of it the new OPSWAT database version is unable to correctly identify some of the product information.

Please gather your findings and contact support as it might need a fix/update.

Cheers,

-Kiwi.

Re: Wrong HIP match

Jafar_Hussain — Wed, 26 May 2021 11:50:53 GMT

@kiwu

I opened a case with TAC support. this issue with current version 5.2.6 they will fix this issue in new release. 5.2.7

topic Re: Wrong HIP match in General Topics

Wrong HIP match

Re: Wrong HIP match

Re: Wrong HIP match