Defining patch management in HIP objects.

Announcements
Attention: The LIVEcommunity is experiencing an interruption with videos in some areas. We apologize for any inconvenience this may cause. Thank you for your patience as we work towards a solution to restore videos.
Reply
Highlighted
L3 Networker

Re: Defining patch management in HIP objects.

Hello Gururaj,

I understand that you are trying to find out if a patch is missing on your GP Client host machine.

The way that PAN Firewalls are matching the missing patches is by the identifier.

In your example you mentioned the Microsoft Security update "Security Update for Microsoft Windows (KB2778344)"

To match this particular patch you need to reference it by the KB Identifier.

When GP agent is sending the missing patch data to the GP Gateway it's sending the following details in an XML parsing format :

<title>Security Update for Windows 7 (KB2778344)</title>

                                        <description>A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain access to information. You can help                                    protect your system by installing this update from Microsoft. After you install this update, you may have to restart your system.</description>

                                        <product>Windows 7</product>

                                        <vendor>Microsoft Corporation</vendor>

                                        <info-url>http://go.microsoft.com/fwlink/?LinkId=273872</info-url>

                                        <kb-article-id>2778344</kb-article-id>

                                        <security-bulletin-id>MS13-006</security-bulletin-id>

                                        <severity>2</severity>

                                        <category>0</category>

                                        <is-installed>no</is-installed>

                                </entry>

To match this in a HIP object use the data inside the <kb-article-id> field .  That would be 2778344.

Hope this answers your question.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!