Create Host Compliance Object

Table of Contents

Configure Host Compliance Services-based Security Policy

Create Host Compliance Profile with Host Compliance Objects

Create Host Compliance Object

This section describes how to create host compliance object

Where Can I Use This?	What Do I Need?
NGFW managed by Panorama	GlobalProtect Subscription License GlobalProtect app 6.0. or later versions PAN-OS 12.1.2 and later versions Cloud Identity Engine Device Certificate

Host Compliance Object (HCO) is a specific, granular security check that the firewall performs on a device trying to connect to your network. The GlobalProtect app installed on the endpoints collects this information and reports it back to the firewall. HCOs are not used directly in security policy rules. Instead, they are added to create HCPs, which are then applied to security policy rules.

You can create one or more HCOs that define the specific criteria for a compliant device (e.g., checking for specific software, patch levels, and so on).

On the firewall(s) hosting GlobalProtect gateway(s), select ObjectsHost Compliance Objects and then Add a new HCO.
Enter a Name and Description for the object.
Define the specific host criteria you want to check by selecting:
- Category: Select the type of check (e.g., Antivirus, Firewall, Patch Management).
- Attribute: Define the specific detail to evaluate (e.g., Product Version, Last Scan Time).
- Operator: Set the comparison logic (e.g., is, is not, contains, is greater than, less than, greater equal, and less equal).
- Operating System: Choose the OS (e.g., Windows, macOS) and the version to check against.
The operator of 'Within'/'Not Within' N versions is not supported for attribute 'Product Version' or 'Virus Definition Version' for Anti-Malware category.
Click OK to create the HCO.
Repeat these steps to create each additional HCO you require.
Commit the changes.