What HIP Data is Collected by the Prisma Access Agent

The Host Information Profile (HIP) feature enables you to collect information about the security status of your endpoints—such as whether they have the latest security patches and antivirus definitions installed, whether they have disk encryption enabled, whether the endpoint is jailbroken or rooted, or whether it is running specific software you require within your organization—and base the decision as to whether to allow or deny access to a specific host based on adherence to the host policies you define.

The Prisma Access Agent collects information about the host that the agent runs on and submits the host information to the gateway upon successful connection. The gateway checks the raw host information against any HIP objects and HIP profiles that have been defined. If it finds a violation, the corresponding security policy is enforced. For example, you can configure endpoints to have a minimum version of anti-malware software installed before they are allowed access to corporate resources and applications.

By default, the Prisma Access Agent collects vendor-specific data about the end user security packages that are running on the endpoint and reports this data to the gateway for policy enforcement when you configure HIP data collection in Prisma Access Agent Settings.

The following types of data are collected by the Prisma Access Agent.