Enhanced HIP Remediation Process

Where Can I Use This?	What Do I Need?
NGFW (managed by Panorama ) Prisma Access (managed by Panorama)	GlobalProtect Gateway license or Prisma Access license with the Mobile User subscription PAN-OS 11.0.2 (or a later PAN-OS version) GlobalProtect app 6.3.0 or later versions GlobalProtect endpoints running on Windows, and macOS. Content release version is 8833-8679 or later

You can now configure the GlobalProtect app to rerun the HIP remediation script whenever the GlobalProtect endpoint fails the process check after running the configured HIP remediation process.

With this feature enabled, the GlobalProtect app will rerun the HIP remediation script when the process fails after the set HIP remediation timeout period to help the endpoint recover from a HIP check failure. The app reruns the remediation script after a process check failure based on the HIP remediation process retry count you configure through the app settings of the GlobalProtect portal.

For example, if you configure the retry count as 3 and the remediation timeout period as 5 mins in the portal configuration, then every time the endpoint fails the process check after performing the remediation process, the app runs the script three times and waits up to 5 mins before it submits the HIP report.

Use the following procedure to configure the HIP remediation process retry:

1. Set up custom process checks.
2. Configure a HIP remediation process for the GlobalProtect app to run a remediation script whenever a GlobalProtect endpoint fails one or more process checks to help the endpoint recover from a HIP check failure.

   1. Configure a HIP remediation timeout on the portal.
   2. Configure a HIP Process Remediation Retry.

      1. On Panorama, Select NetworkGlobalProtectPortals.
      2. Select the portal configuration to which you are adding the agent configuration, and then select the Agent tab.
      3. Select the agent configuration that you want to modify, or Add a new one.
      4. Select the App tab.
      5. To enable the HIP process remediation retry feature, set a HIP Process Remediation Retry count.
         By default, this field is set to 0, indicating that the feature is disabled. Enter a value from 1-3 to indicate the number of times you want to run the HIP remediation process in case of process check failures.
         This feature will be disabled after you upgrade or downgrade the GlobalProtect app versions.
      6. In the HIP Process Remediation Integrity Check field, specify the checksum that you generated for the HIP remediation process.
      7. Click OK twice to save your app and portal configurations.
      8. Commit the changes.

      If you are using Strata Clound Manager, then do one of the following:

      On the Strata Cloud Manager (NGFW):

      1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectAgent SettingsAdd Agent App Settings.
      2. On the Add Agent App Settings page, select App ConfigurationShow Advanced Options.
      3. Under Enforcement, configure HIP Process Remediation Timeout, HIP Process Remediation Retry, and HIP Process Remediation Integrity Check.

      On the Strata Cloud Manager (Prisma Access):

      1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessMobile Users ContainerGlobalProtectSetupGlobalPotect AppApp Settings<default>.
      2. On the Default page, select App ConfigurationShow Advanced Options.
      3. Under Enforcement, configure HIP Process Remediation Timeout, HIP Process Remediation Retry, and HIP Process Remediation Integrity Check.
3. Deploy the remediation script to your endpoints using mobile device management (MDM).

   As a best practice, use standard formats for the scripts you deploy (for example, deploy shell scripts on macOS endpoints and batch scripts on Windows endpoints). The name of the script is case sensitive and you must use the predefined name and location as follows:

   • Windows:
     Location: \Program Files\Palo Alto Networks\GlobalProtect\
     Naming convention: hip-remediation-script.bat
   • macOS:
     Location: /Applications/GlobalProtect.app/Contents/Resources/
     Naming convention: hip-remediation-script.sh
4. (Optional) Customize how the script runs on the endpoint by setting a checksum and/or a custom error message and defining the context in which the script will run.
5. Connect the GlobalProtect app and the hip remediation script runs automatically whenever the GlobalProtect endpoint fails the process check. If the process check fails even after running the remediation script, the app reruns the remediation script based on the configured retry count. After the retries, the app submits the HIP check report irrespective of whether the process check is successful or not.
6. View the GlobalProtect logs to view the hip_remediation_script log and verify whether the HIP remediation process is successful or not.

   The remediation log name and locations for

   • Windows: %AppData%\Local\Palo Alto Networks\GlobalProtect\hip_remediation_scripts.log
   • macOS: ~/Library/Logs/PaloAltoNetworks/GlobalProtect/hip_remediation_scripts.log

   The hip_remediation_scripts.log will be a part of the GlobalProtect logs bundle and will be collected when users initiate log collection through the GlobalProtect app or when the app sends diagnostic logs to the Strata Logging Service for further analysis.