Configure HIP Exceptions for Patch Management

1. Configure HIP-Based Policy Enforcement.
2. Define the patches you want to exclude from the HIP report and the date until which to exclude them.

   If you are using Strata Cloud Manager (NGFW), then

   1. On Strata Cloud Manager (NGFW), ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectAgent SettingsAdd Agent App Settings.
   2. On the Add Agent App Settings page, under HIP Data CollectionShow Advanced OptionsExclude Categories and then edit the Exclude Categories.
   3. Click Add and select the Category as Patch Management and add the Vendor.

   If you are using Strata Cloud Manager (Prisma Access), then:

   1. On Strata Cloud Manager (Prisma Access), ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessMobile Users ContainerGlobalProtectSetupGlobalProtect AppApp Settings <default>.
   2. On the Default page, HIP Data CollectionShow Advanced OptionsExclude Categories and then edit the Exclude Categories.
   3. Click Add and select the Category as Patch Management and add the Vendor.

   1. On the firewall that is hosting your GlobalProtect portal (or on Panorama), select NetworkGlobalProtectPortals.
   2. Select the portal configuration that you want to modify.
   3. On the Agent tab, select the agent configuration from which to exclude categories, or Add a new one.
   4. Under Exclude Categories, Add a new exclude category.
   5. Select patch-management as the Vendor and then Add the vendor.
   6. Specify the patch name or number <kb-article-id value> and optionally a date <MM/DD/YYYY> until which you want to exclude the patch updates from the HIP report.

      Use the following format:

      Exclude:[kb-article-id1: MM/DD/YYYY], [kb-article-id2: MM/DD/YYYY]

      Where kb-article value is the number in the attribute, example <kb-article-id>2267602</kb-article-id> and the MM/DD/YYYY specifies the date up to which the patch is excluded from the HIP report. If you do not set a date, the patch will be excluded from the HIP report indefinitely. If you choose to set a date, the patch will be excluded until the specified date.

      The Kb-article id should be in the same format displayed in the logs, for example:

      Repeat this step for each patch you want to exclude from the HIP report.

      If you want to exclude all patches from a specific vendor, you would just exclude the entire category instead of specifying specific patches.
3. To save the settings, click OK and then Commit your changes.