Global Protect HIP check issues

[mattwech]

Have had an open case with support since August 2019 with HIP checks setup for Global Protect.  There are options to allow HIP checks for a large number of different AV vendors and their products.  The issue we have come across is that we have defined specific AV vendors that can be used and all others are denied.  The vendors we have allowed we want to check that AV is present and updates and scans are completed within a set number of days.  The Global Protect client will not detect that scans have been run for multiple different vendors even our corporate AV(BitDefender).  The only workaround for now is to turn off the check for scan times for those HIP objects.  Even though this is the same issue for different vendors we have to open a case and submit logs for each one.  We were told that the HIP checks we are trying to accomplish are not available for all AV vendors.  This seems to be an issue that they should address by not having the AV vendors listed as an option for these checks if it cannot detect it.  Is anyone else experiencing these issues and very drawn out support cases to get resolved? 

[kiwi]

Hi @mattwech ,

Trying to configure HIP checks which aren't available sounds like a feature request.

Is the case closed as such or still under investigation ? It does seem strange that AV vendors are listed as an option if it cannot detect it.

Cheers,

-Kiwi.

[Sec101]

I've found some other odd behavior with HIP checks as well, as it relates to registering/not registering to windows.   I am not surprised you are having an issue with this.   By chance, have you checked with the actual AV vendor to ensure that their product is registered and reporting to windows security center?  I'm guessing this may have something to do with the way GP is trying to grab the info from windows itself, and not the vendor.