GlobalProtect and OPSWAT basic overview

• PAN-OS 8.1+
• GlobalProtect App 5.0+
• Windows, macOS, and Linux endpoints 

1. The Palo Alto GlobalProtect App uses the OPSWAT platform for detecting installed anti-malware products, anti-malware definition version, and for collecting other host information.
2. OPSWAT is used in GlobalProtect for Windows, macOS, and Linux hosts.
   A particular GlobalProtect App version has a fixed OPSWAT database.
3. If a new anti malware product is released, the currently installed GlobalProtect App will never be able to detect it.
4. If a new version of an anti malware product is released, the currently installed GlobalProtect App in some cases will not be able to detect it or may have reduced detection functionality.
5. The only way to correct these situations will be to install a new version of the GlobalProtect App that contains an updated OPSWAT database version.
6. When the GlobalProtect App is updated, the release notes for the new version will usually list anti-malware products for which OPSWAT detection capability has been updated or fixed.
7. There is also an important relationship between both GlobalProtect and OPSWAT versions. Starting with GlobalProtect app 5.2.6, support for OPSWAT SDK V3 has been removed and the GlobalProtect app will only use OPSWAT SDK V4. Vendor and product names are based on OPSWAT SDK V4. GlobalProtect app 5.2.6 and later release HIP check functionality will not work with PAN-OS 8.0 and earlier releases. 

OPSWAT publishes current support for anti-malware products on their website. Support for Windows, macOS, and Linux anti-malware products can be found here:
https://www.opswat.com/products/metadefender/endpoint-security-sdk/device-compliance/antimalware