What Data Does the GlobalProtect Agent Collect?

By default, the GlobalProtect agent collects vendor-specific data about the end user security packages that are running on the computer (as compiled by the OPSWAT global partnership program) and reports this data to the GlobalProtect gateway for use in policy enforcement.
Because security software must continually evolve to ensure end user protection, your GlobalProtect gateway licenses also enable you to get dynamic updates for the GlobalProtect data file with the latest patch and software versions available for each package.
While the agent collects a comprehensive amount of data about the host it is running on, you may have additional software that you require your end-users to run in order to connect to your network or to access certain resources. In this case, you can define custom checks that instruct the agent to collect specific registry information (on Windows clients), preference list (plist) information (on Mac OS clients), or to collect information about whether or not specific services are running on the host.
The agent collects data about the following categories of information by default, to help to identify the security state of the host:
Table: Data Collection Categories
Category
Data Collected
General
Information about the host itself, including the hostname, logon domain, operating system, client version, and, for Windows systems, the domain to which the machine belongs.
For Windows clients’ domain, the GlobalProtect agent collects the domain defined for ComputerNameDnsDomain, which is the DNS domain assigned to the local computer or the cluster associated with the local computer. This data is what is displayed for the Windows clients’ Domain in the HIP Match log details (MonitorHIP Match).
Patch Management
Information about any patch management software that is enabled and/or installed on the host and whether there are any missing patches.
If you want to configure the Severity value for missing patches as a match condition in your HIP object (ObjectsGlobalProtectHIP Objects<hip-object>Patch ManagementCriteria), use the following mappings between the GlobalProtect severity values and the OPSWAT severity ratings to understand what each value means:
  • -2—Not Available
  • -1—Unknown
  • 0—Low
  • 1—Moderate
  • 2—Important
  • 3—Critical
Firewall
Information about any client firewalls that are installed and/or enabled on the host.
Antivirus
Information about any antivirus software that is enabled and/or installed on the host, whether or not real-time protection is enabled, the virus definition version, last scan time, the vendor and product name.
GlobalProtect uses OPSWAT technology to detect and assess third-party security applications on the endpoint. By integrating with the OPSWAT OESIS framework, GlobalProtect enables you to assess the compliance state of the endpoint. For example, you can define HIP objects and HIP profiles that verify the presence of a specific version of Antivirus software from a specific vendor on the endpoint and also ensure that it has the latest virus definition files.
Anti-Spyware
Information about any anti-spyware software that is enabled and/or installed on the host, whether or not real-time protection is enabled, the virus definition version, last scan time, the vendor and product name.
Disk Backup
Information about whether disk backup software is installed, the last backup time, and the vendor and product name of the software.
Disk Encryption
Information about whether disk encryption software is installed, which drives and/or paths are configured for encryption, and the vendor and product name of the software.
Data Loss Prevention
Information about whether data loss prevention (DLP) software is installed and/or enabled for the prevention sensitive corporate information from leaving the corporate network or from being stored on a potentially insecure device. This information is only collected from Windows clients.
Mobile Devices
Information about the mobile device, including the device name, logon domain, operating system, app version, and the mobile device network information to which the device is connected. In addition, GlobalProtect collects whether the device is rooted or jailbroken.
To collect mobile device attributes and utilize them in HIP enforcement policies, GlobalProtect requires an MDM server. GlobalProtect currently supports HIP integration with the AirWatch MDM server.
For devices managed by AirWatch, host information collected by the GlobalProtect app can be supplemented with additional information collected from the AirWatch service. Refer to Configure Windows User-ID Agent to Collect Host Information for a list of attributes that can be retrieved from AirWatch.
You can exclude certain categories of information from being collected on certain hosts (to save CPU cycles and improve client response time). To do this, you create a client configuration on the portal excluding the categories you are not interested in. For example, if you do not plan to create policy based on whether or not client systems run disk backup software, you can exclude that category and the agent will not collect any information about disk backup.
You can also choose to exclude collecting information from personal devices in order to allow for user privacy. This can include excluding device location and a list of apps installed on the device that are not managed by a third-party mobile device manager.

Related Documentation