GlobalProtect is no longer able to retrieve information for Trend Micro Apex One Security Agent

[alkanermis]

We are experiencing an issue where GlobalProtect is no longer able to retrieve information for Trend Micro Apex One Security Agent. As a result, our HIP Objects that rely on this product are no longer matching correctly, and we cannot enforce the related security policies.

Everything was working as expected until 17 June 2026, when the issue appeared without any known changes on our side.

As far as I understand, GlobalProtect relies on OPSWAT for antivirus and endpoint security product definitions. It appears that the OPSWAT definition currently available on our firewall may be older than the version of Trend Micro Apex One deployed in our environment.

Has anyone encountered a similar issue recently? If so, were you able to resolve it? Any recommendations or troubleshooting steps would be greatly appreciated.

Thank you.

[kiwi]

Hi @alkanermis ,

GlobalProtect relies on an embedded OPSWAT SDK database hardcoded within the client application itself to recognize security products.  If it doesn't recognize it, it can be because Trend Micro performed an update on their end.

Because of how this architecture works, I recommend opening a case with Palo Alto Networks TAC to confirm whether your specific Trend Micro build requires a full GlobalProtect App software upgrade to be recognized again. 

While you wait for confirmation from TAC you can possibly workaround this by using the Within option inside your firewall's HIP Object configuration.

If the GlobalProtect agent still recognizes that Trend Micro is installed but is failing on a strict version or definition age check, change your HIP Object criteria to use Within = 4 (or another number). This tells the gateway to evaluate the software against the historical version data synced via your firewall's dynamic GlobalProtect Data File updates, providing a buffer that should allow your users to pass enforcement in the meantime.

If GlobalProtect completely fails to discover the application this workaround will not work. If the product itself isn't recognized, it's a whole other matter, and your only recourse is to temporarily loosen the policy to "Is Installed" (if it catches the process) or wait for a updated OPSWAT db (new GP version) from TAC.

Sources: 

• https://docs.paloaltonetworks.com/globalprotect/administration/host-information/host-information-pro...
• https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HChSCAW

Cheers !

[Matteus.Cruz]

I'm having the same problem in the environment; to work around it, I removed the requirement for the antivirus to be from Trend Micro from the HIP object. But we need an opinion soon on what's happening and a definitive solution.

[CarlBlosser]

I have a customer experiencing the same issue, but it appears a new product was launched in the environment Trend Vision One Endpoint Security.  
<entry name="anti-malware">
<list>
<entry>
<ProductInfo>
<Prod name="Windows Defender" defver="1.449.120.0" version="4.18.25100.9008" prodType="3" engver="1.1.26030.3008" osType="1" vendor="Microsoft Corporation" dateday="15" dateyear="2026" datemon="4">
</Prod>
<real-time-protection>n/a</real-time-protection>
<last-full-scan-time>n/a</last-full-scan-time>
</ProductInfo>
</entry>
<entry>
<ProductInfo>
<Prod name="Trend Vision One Endpoint Security" defver="" version="1.1" prodType="3" engver="" osType="1" vendor="Trend Micro, Inc." dateday="" dateyear="" datemon="">
</Prod>
<real-time-protection>n/a</real-time-protection>
<last-full-scan-time>n/a</last-full-scan-time>
</ProductInfo>

I am waiting for TSF to download so I can upload to my case.  

[CarlBlosser]

Ok so TAC instructed me to see if this new product was listed at https://www.opswat.com/products/oesis-framework/support-charts?search=Trend and its not but I did find something about the product but we are showing v1.1 and it states on v1.0
https://www.opswat.com/products/oesis-framework/device-compliance/antimalware
Trend Vision One Endpoint Security
Signature: 4044
Last version: 1.0
Vendor: Trend Micro, Inc.
Certification:
0
1.0 is the only supported version