palo alto hip data collection best practices

[RobertShawver]

Are there any recommended settings for excluding categories, such as disk-backup or firewall? And if there is one there, but no vendor is listed what will it default to? For example, if under Portal > Hip Data Collection > Exclude Categories patch-management is listed under Category, but there is nothing listed under Vendor, what does that mean it will do?

I can wrap my head around what it means if there is something listed there like Vendor > Kaspersky Lab > Product > Kaspersky Small Office Security, but what if nothing is there other than patch-management listed under Exclude Categories?

[BPry · Accepted solution]

@RobertShawver,

I'm not aware of any best practice document for HIP collection, primarily because every environment is going to be different in what the organization wants to check or not. If you're exclude entire categories you simply won't collect any information for that entire category, so in your example you wouldn't collect any information about patch management.