8.3 Host Information Profile (HIP) Checks and Endpoint Security Enforcement

8.3 Host Information Profile (HIP) Checks and Endpoint Security Enforcement

Quick Answer: Palo Alto Networks Host Information Profile (HIP) technology enforces Zero Trust endpoint posture assessment for remote endpoints connecting via GlobalProtect. The GlobalProtect client app collects telemetry—such as operating system patch levels, disk encryption status (BitLocker/FileVault), active antivirus/EDR software, firewall state, and specific registry keys—and transmits a structured HIP XML Report to the Gateway. PAN-OS evaluates these reports using HIP Objects and HIP Profiles, enabling security policies that automatically restrict non-compliant endpoints to isolated remediation zones while granting compliant devices access to sensitive corporate assets.

Authenticating a user identity is only the first step in modern Zero Trust Network Access (ZTNA). In a remote work ecosystem, an authenticated user operating a compromised, unpatched, or unencrypted laptop poses a severe threat to corporate infrastructure. A stolen laptop lacking disk encryption can expose cached credentials, while an endpoint missing critical security patches or lacking active Endpoint Detection and Response (EDR) software can serve as a bridge for ransomware into the corporate datacenter.

Palo Alto Networks addresses this vulnerability through Host Information Profile (HIP) matching, allowing PAN-OS firewalls to evaluate security compliance telemetry from connected endpoints before granting access to network resources.

---

GlobalProtect Telemetry Collection and HIP Report Structure

When an endpoint connects to a GlobalProtect Gateway, the GlobalProtect client app acts as an endpoint posture collector. It queries the local operating system security subsystems (such as Windows Security Center, macOS System Information, or Linux system APIs) to generate a comprehensive HIP XML Report.

Telemetry Categories Collected

1. System Identification: Operating system vendor, version, build number, service pack level, host name, and network interface MAC addresses.
2. Disk Encryption: Status of disk encryption software (e.g., Microsoft BitLocker, Apple FileVault, Symantec Endpoint Encryption). Checks whether encryption is enabled, fully encrypted, or in progress across all fixed storage drives.
3. Antivirus & Antispyware: Installed security vendors (e.g., CrowdStrike Falcon, Microsoft Defender, Palo Alto Networks Cortex XDR, SentinelOne). Checks whether real-time protection is enabled and verifies the exact virus definition version and release date/age.
4. Patch Management & Missing OS Patches: Identifies missing operating system patches, Windows update status, or patch management agent compliance (e.g., Microsoft SCCM/Intune, Tanium).
5. Host Firewall State: Verifies whether local host firewall software (Windows Defender Firewall, macOS Application Firewall) is active and enforcing rules.
6. Custom Checks (Process, Registry, Plist):
   • Process Checks: Verifies whether specific security software binaries are actively executing in memory (e.g., checking if edr_agent.exe is running).
   • Registry Keys (Windows): Validates specific registry keys, values, or DWORD entries (e.g., corporate domain ownership markers or compliance flags).
   • Plist Files (macOS): Inspects property list files for specific organizational configurations.

Submission & Re-Check Lifecycle

• Initial Submission: Upon establishing an encrypted tunnel to the GlobalProtect Gateway, the client app transmits its raw HIP XML report over the control channel.
• Periodic Re-Check Interval: To prevent endpoints from disabling security software post-connection, the Gateway enforces a configurable HIP Report Interval (default is typically 60 minutes). The client periodically re-evaluates local posture and submits updated HIP reports. If an endpoint becomes non-compliant during an active session, its HIP profile state updates dynamically, triggering immediate policy enforcement adjustments.

---

Configuring HIP Objects and HIP Profiles

In PAN-OS, posture enforcement relies on a two-tier configuration model: HIP Objects define raw health criteria, while HIP Profiles combine those objects using logical Boolean expressions.

+-----------------------------------------------------------------------+
|                              HIP PROFILE                              |
|   Boolean Logic: (HIP-Obj-Win11 AND HIP-Obj-BitLocker AND HIP-Obj-EDR) |
|                       AND NOT HIP-Obj-HighRiskApps                    |
+-----------------------------------------------------------------------+
                                   |
        +--------------------------+--------------------------+
        |                                                     |
        v                                                     v
+-----------------------------------+     +-----------------------------------+
|            HIP OBJECT 1           |     |            HIP OBJECT 2           |
| OS: Windows 11 (Build >= 22621)   |     | Antivirus: Real-Time Protection=ON|
| Encryption: BitLocker C: Encrypted|     | Definition Age: <= 7 Days         |
+-----------------------------------+     +-----------------------------------+

1. HIP Objects (Granular Compliance Criteria)

A HIP Object defines specific, single-category compliance requirements. Administrators create distinct objects for different health parameters:

• HIP-Obj-BitLocker-Encrypted: Category = Disk Encryption | Encryption Location = C: | Disk Encryption Status = Encrypted.
• HIP-Obj-Cortex-XDR-Active: Category = Anti-Virus | Vendor = Palo Alto Networks | Real-Time Protection = Enabled | Def Version = < 7 days old.
• HIP-Obj-Win11-Approved-Build: Category = Operating System | OS = Microsoft Windows 11 | Minimum Build = 22631.

2. HIP Profiles (Boolean Policy Expressions)

A HIP Profile evaluates one or more HIP Objects using Boolean logic (AND, OR, NOT). The HIP Profile evaluates to True (Match) or False (No Match) for each connected endpoint:

• Compliant Corporate Endpoint Profile: HIP-Obj-Win11-Approved-Build AND HIP-Obj-BitLocker-Encrypted AND HIP-Obj-Cortex-XDR-Active AND NOT HIP-Obj-Prohibited-Software
• Non-Compliant Endpoint Profile: NOT (HIP-Obj-BitLocker-Encrypted AND HIP-Obj-Cortex-XDR-Active)

---

Security Policy Enforcement and Remediation Workflows

HIP Profiles are integrated directly into PAN-OS Security Policy Rules on the firewall. Under the Source tab of a Security Policy rule, administrators select specific HIP Profiles alongside Source Zones and Source Users.

Policy Rule Structure Example

Automated Remediation and End-User Messaging

When an endpoint fails a HIP check (for instance, if its antivirus definitions are 14 days out of date):

1. Dynamic Policy Shift: PAN-OS matches the endpoint against the Non-Compliant-HIP profile. The firewall immediately blocks access to sensitive datacenter zones and permits access only to the Remediation-Zone (allowing the endpoint to reach Microsoft Update or AV update servers).
2. Custom Notification Popups: In the Portal configuration, administrators can enable HIP Notification Messages. When a HIP match fails or changes state, GlobalProtect displays a customizable pop-up message on the user's desktop:

   "Access Restricted: Your laptop fails corporate security policy because BitLocker disk encryption is disabled or Antivirus definitions are out of date. Please update your antivirus and re-connect."

3. Automatic Re-Evaluation: Once the user updates their antivirus software, the GlobalProtect client generates a new HIP XML report during the next re-check interval (or upon manual reconnect), automatically restoring full corporate network access once compliance is verified.

---

Monitoring and Troubleshooting HIP Matches

PAN-OS provides comprehensive logging tools under Monitor > Logs > HIP Match:

• HIP Match Logs: Records every instance where an endpoint matches or unmatches a configured HIP Profile, detailing the User, IP Address, HIP Profile Name, and Timestamp.
• Detailed HIP Report Inspection: Engineers can view raw HIP XML reports submitted by endpoints using the PAN-OS CLI command: debug user-id dump hip-report computer <computer_name> user <user_name>
• Connection Summary: Inspect active Gateway connections and associated HIP profiles via CLI: show globalprotect-gateway current-connection gateway <gateway_name>