Wrong HIP match

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Wrong HIP match

L1 Bithead

Hi team

 

Hope so you  all are doing great.

We are in the phase of implementing compliance checks based on HIP checks.

Before that we have created multiple HIP objects/profiles to observe our end users asset compliance and now we have asked our IT team to start installing compliance software in the end machine to avoid any issues when we fully provide access based on HIP checks.

We generate report of non-compliance machine (matching our non-compliance HIP profile) every week but I am observing something weird now, user who were matching non-compliance HIP checks earlier around 15days back  are not matching those HIP checks now. There is no config change or GP client change on the end machine. As the logs are purging in almost one week but for one user I saw in the HIP report every HIP check was there still it matched wrong HIP object and now it is matching everything perfectly.We can see similar issue for various other users also.

 

My HIP checks are as follows-

Firstly the machine should be part of domain and secondly crowstrike should be installed.(Any version is fine).

Any machine not matching either of this criteria are posed as non-compliance.

 

We are nearing the final stage of this project, it will be great if you guys have any inputs or faced such issue

2 REPLIES 2

Cyber Elite
Cyber Elite

@shubhamgupta,

There's not a whole lot of information included in your post to actually assist with troubleshooting to be honest. What sort of things are you actually checking with your HIP Objects, how is the HIP Profile actually structured, is non-compliance just checking updates that maybe got installed since the last time an endpoint was recorded as non-compliant?

You don't really say what you're looking at outside of the fact that a few weeks ago an endpoint was matching the non-compliance profile and now it isn't. Depending on what what the non-compliance profile HIP Objects actually check that wouldn't necessarily be an unexpected thing to change. For example if I'm ensuring Windows updates are installed someone maybe just finally got around to installing the updates so they are in compliance again. 

L1 Bithead

HI @BPry 

Firstly,thanks for your response and secondly my bad for posting it not informative.

Actually we have kept two checks- firstly the machine should be part of domain and secondly crowstrike should be installed.(Any version is fine).

Any machine not matching either of this criteria are posed as non-compliance.

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!