Bitdefender GlobalProtect HIP check - where does GP get data from?

[J.Cousineau]

Hello,

I'm trying to determine the root cause when Bitdefender Endpoint Security Tools fails an update, Global Protect will reject our HIP check due to Engine Version, and Malware Definition Version showing as blank, and Malware Definition Date becomes 01/01/1970.  As we're connected full tunnel, when the HIP fails thus all internet is blocked and Bitdefender cannot recover.

I've reached out to Bitdefender and they are determining the root cause of the failed update, but they would like to understand where exactly does GlobalProtect get the data from?

I would expect the Engine Version to return to the last known installed version, and not show as blank.  

How does GlobalProtect check the Engine information?

[J.Cousineau · Accepted solution]

Update:

I’ve found:

“GlobalProtect uses OPSWAT technology to detect and assess third-party security applications on the endpoint. By integrating with the OPSWAT OESIS framework, GlobalProtect enables you to assess the compliance state of the endpoint. For example, you can define HIP objects and HIP profiles that verify the presence of a specific version of antivirus software from a specific vendor on the endpoint and also ensure that it has the latest virus definition files.”

(Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/host-information/about-host...)

I see Bitdefender has OPSWAT partnership and certified for “Bitdefender Endpoint Security Tools 7.x”: https://www.opswat.com/partners/bitdefender

I'll reach out to Bitdefender directly now.  Thank you.