Rapid7 Insight Agent not showing as vendor in HIP Object Anti-Malware tab despite OPSWAT V4 support

[JuanMAbellan]

Hi everyone,

I'm trying to configure a HIP Object to detect Rapid7 Insight Agent as an antimalware vendor, but the vendor doesn't appear in the Anti-Malware dropdown when creating the HIP Object.

According to the OPSWAT support chart (software.opswat.com), Rapid7 Insight Agent is listed under Signature 4098 with categories ANTIMALWARE and HEALTH_AGENT, and the tested version is 4.0.20.15.

My environment:
- PAN-OS: 11.1.6-h3
- GlobalProtect client package: 6.1.5

Is there a known gap between what OPSWAT lists on their support chart and what Palo Alto actually includes in the datafile?

Has anyone successfully configured a HIP check for Rapid7 Insight Agent (NGAV module) on a similar PAN-OS version?

I'd like to understand why the vendor doesn't appear if it's officially listed as supported by OPSWAT.

[JayGolf]

Hi @JuanMAbellan ,

GlobalProtect relies on OPSWAT data to identify endpoint security products, but that data is packaged into the GlobalProtect app/version being used. So even if OPSWAT lists a product publicly, there can still be a delay or mismatch before that same vendor/product is available or detectable through GlobalProtect HIP checks.

I’d check the actual HIP report from an endpoint with Rapid7 installed and confirm whether GP is detecting it at all, and under what name/category. If not, you can could also test with a newer GlobalProtect client version if possible, since a newer client may include updated OPSWAT detection support.