Download Host Information Profile Reports for Prisma Access Agents

Table of Contents

What HIP Data is Collected by the Prisma Access Agent

Learn how to download host information profile reports for Prisma Access Agents.

Where Can I Use This?	What Do I Need?
Prisma Access (Managed by Strata Cloud Manager) Prisma Access (Managed by Panorama) NGFW (Managed by Panorama)	Check the prerequisites for the deployment you're using Contact your Palo Alto Networks account representative to activate the Prisma Access Agent feature

The Prisma Access Agent provides a host information profile (HIP) check that runs on your endpoints to ensure that only endpoints that meet enterprise security requirements are allowed to access corporate resources and applications. The HIP check ensures device integrity by ensuring that the device has the latest patches and other security precautions in place so that an attacker can’t compromise the device using known vulnerabilities.

Because of stringent security requirements, many Prisma Access Agent connectivity issues occur due to failed compliance checks, which can result in increased support cases and frustration for end users.

Using the Inventory page (ManagePrisma Access Agent), you can conveniently download and view the latest HIP report to understand the underlying issue and remediate the threat. You can download the latest HIP report for a set of Prisma Access Agents.

By default, HIP data collection is enabled for the Prisma Access Agent when you configure HIP data collection in Prisma Access Agent Settings.

To download the latest HIP report for one or more devices:

Select ManagePrisma Access Agent.
(Optional) Set the Time Range for which you want to view the data. You can select a preset time range or customize the time range.
In the Devices table, scroll through the list to find the device or search for a device.
Select the check boxes corresponding to the devices for which you want to download HIP reports. You can select up to 20 devices at a time.
Select ActionsRetrieve Last HIP Report.

If you are viewing the details for an individual agent, you can also select ActionsRetrieve Last HIP Report from the individual details view.

The retrieve last HIP report action is not available to administrators with the View Only Administrator role.
In the Confirmation dialog, click Yes. The Prisma Access Agent sends the HIP report to the compliance service, which saves the HIP report and provides the service to download HIP reports.

The Jobs button appears or changes to indicate that the download HIP report job has been added to the queue.

If you downgraded the HIP report from the device details pane, you must close the pane to see the Jobs button in the Devices table.
To view the status of the HIP download, click Jobs. The status of the job appears in the Remote Jobs window.
The status descriptions are as follows:
- Requested—The administrator has initiated the request. The Prisma Access Agent has not yet acknowledged or acted on the request.
- Pending—The agent has received the request, and is currently processing the request. The agent acknowledges the receipt of the command.
- Completed—The agent has processed the request.
- Failed—The agent was unable to complete the request.
When the Get Last HIP Reports job is complete, click the Download links to access the HIP reports. The download link will expire in approximately 24 hours, after which you’ll have to request a new download link by repeating the steps in this procedure. The HIP reports are saved to the download location on your computer.

The HIP report is an .xml file that you can view with a web browser or text editor, for example:
After you finish downloading the HIP report, close the Remote Jobs window.