Configure HIP Data Collection Settings for Dynamic Privilege Access

From
Strata Cloud Manager
, select
Manage
Configuration
NGFW and
Prisma Access
Overview
and expand the Configuration Scope to view the
Snippets
.
Select the snippet that the Superuser admin assigned to you.
Select
Objects
Dynamic Privilege Access
to open the Dynamic Privilege Access settings.
Select the
Agent Settings
tab.
Add Agent Settings
or select an existing configuration from the Agent Setting table.
In the Host Information Profile (HIP) section, select
Collect HIP Data
to enable HIP data collection on the endpoints that logged in using a project.
Select
Show Advanced Options
.
Specify the
Max Wait Time
(in seconds) that the Prisma Access Agent should search for HIP data before submitting the available data. The range is 10-60 seconds; the default is 20 seconds.
Edit
Exclude Categories to exclude specific categories, or vendors, applications, or versions within a category from HIP data collection.
Select a
Category
(such as data loss prevention) to exclude from HIP collection. After selecting a category, you can
Add
a particular
Vendor
, and then
Add
a specific
Product
from the vendor to further refine the exclusion as needed. You can add multiple vendors and products to the exclude list.
Save
your settings in each dialog.
If you don't want to exclude an entire vendor, you can exclude specific patches from a vendor. After adding the vendor, you can specify the patch name or number and optionally a date until which you want to exclude the patch updates from the HIP report using the following format:
Exclude: [kb-article-id1: MM/DD/YYYY], [kb-article-id2: MM/ DD/YYYY]
Where
<kb-article-id>
is the name or number in the attribute (for example
<kb-article-id>2267602</kb-article-id>
) and the
MM/DD/YYYY
specifies the date up to which the patch is excluded from the HIP report. If you do not set a date, the patch will be excluded from the HIP report indefinitely. If you choose to set a date, the patch will be excluded until the specified date.
Edit
Custom Checks to define any custom data you want to collect from the hosts running this configuration.
For example, if you have any required applications that are not included in the Vendor or Product lists for creating HIP objects, you can create a custom check to determine whether that application is installed (it has a corresponding Windows registry or Mac plist key) or is currently running (has a corresponding running process):
Windows
—
Add
a check for a particular Registry Key or Registry Value. To restrict data collection to a specific Registry Value,
Add
and then define the specific registry values.
Mac
—
Add
a check for a particular
Plist
key or
Key
value. To restrict the data collection to specific key values,
Add
the Key values. Click OK to save the settings.
Process List
—
Add
the processes you want to check for on user endpoints to see if they are running. For example, to determine whether a software application is running, add the name of the executable file to the process list. You can add a process to the
Windows
tab, the
Mac
tab, or both.
Save
the custom check settings when you are done.
When you have finished configuring the project-specific
Prisma Access Agent
settings,
Save
the configuration.