HIP Objects - matching multiple OS versions in one object

[PA_nts]

Hi All,

Within PAN-OS (10.1.x)

Using GP, I want to setup one HIP object to match for multiple OS versions for instance Windows 10 and upwards. But does not seem to be doable instead i can only select each version within a specific OS range.

I want to avoid having to create an object for each version of Windows10 and 11 and wondering if there is a way to do one object to have it match any OS version for Windows10 and above?

Same needs be done for Android11+ / IOS15+ and want to avoid having a multitude of objects in my HIP profile.

any ideas if this is doable?

thanks in adv

[Brandon_Wertz · Accepted solution]

---

@PA_nts wrote:

Hi All,

Within PAN-OS (10.1.x)

Using GP, I want to setup one HIP object to match for multiple OS versions for instance Windows 10 and upwards. But does not seem to be doable instead i can only select each version within a specific OS range.

I want to avoid having to create an object for each version of Windows10 and 11 and wondering if there is a way to do one object to have it match any OS version for Windows10 and above?

Same needs be done for Android11+ / IOS15+ and want to avoid having a multitude of objects in my HIP profile.

any ideas if this is doable?

thanks in adv

---

No, you need to create a specific OS version object, then use those objects in a group.  There's not a way to say "this "minimum+""

[BPry]

@PA_nts,

As @Brandon_Wertz what you're after really isn't possible out of the box. I'd actually go a step further and say that you shouldn't be checking to make sure it's just Windows 10 or Windows 11. Just because someone is running Windows 10 doesn't mean they're running a supported system, because they could be running Windows 10 version 1507 where supported stopped in 2017.

I highly recommend building out custom checks and actually checking the CurrentBuildNumber value under 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion and actually maintaining supported releases. Yes you'll end up having a lot of individual objects tied into your HIP profiles, but you gain additional security that's well worth that effort. 

[PA_nts]

Thanks for the feedback. within each object I have built out more specific checks like client specifics on anti-malware (AV), that the device belongs to a domain, disc encryption checks, updates enabled etc... still testing some additional options. but multiple hp objects it is.. 😞