Wrong HIP match

[Jafar_Hussain]

Dear All,

issue:

I have the firewall 5220 with PAN-OS 10.0.3 and I am facing an below issue:-

As GlobalProtect 5.2.6 is released with support for OPSWAT v4 only while OPSWAT v3 is discontinued starting from 5.2.6, I tried to test it on a few machines.

We apply HIP checking for the below:

-        FireEye Endpoint Agent – Installed & Real Time Protection = Yes & Product Version >= 31.0.0 & Virus Definition Version is within last 7 days

In the HIP logs, I checked FireEye Endpoint Agent detect the wrong Virus Definition Version date as 1/1/1970.

I rolled back to GlobalProtect 5.2.5-c84, and FireEye Endpoint Agent is detected with the correct Virus Definition Version.

Below is the screenshot update GP -5.2.6 showing wrong information:-

Agent screen shot:-

The same HIP logs below:-

Once I rollback the GP version is 5.2.5 the logs showing correct.

# When I checked the logs by below command with GP version 5.2.6:-

• debug user-id dump hip-report ip <IP address> user <domain\username> computer <system name>

<client-version>5.2.6-84</client-version>

<ProductInfo> <Prod vendor="FireEye, Inc." name="FireEye Endpoint Agent" version="32.30.0" defver="" engver="" datemon="1" dateday="1" dateyear="1970" prodType="3" osType="1"/>

<real-time-protection>yes</real-time-protection>

<last-full-scan-time>n/a</last-full-scan-time>

# When I checked the logs by below command with GP version 5.2.5:-

• debug user-id dump hip-report ip <IP address> user <domain\username> computer <system name

<client-version>5.2.5-84</client-version>

<ProductInfo>

<Prod vendor="FireEye, Inc." name="FireEye Endpoint Agent" version="32.30.0" defver="2021.05.05" engver="" datemon="5" dateday="5" dateyear="2021" prodType="3" osType="1"/>

<real-time-protection>yes</real-time-protection>

<last-full-scan-time>n/a</last-full-scan-time>

Can any one help on this.

[kiwi]

Hi @Jafar_Hussain ,

From the looks of it the new OPSWAT database version is unable to correctly identify some of the product information. 

Please gather your findings and contact support as it might need a fix/update.

Cheers,

-Kiwi.

[Jafar_Hussain]

@kiwu 

I opened a case with TAC support. this issue with current version 5.2.6 they will fix this issue in new release. 5.2.7