The OPSWAT support
charts contain the product name and version information for the antivirus,
antispyware, and firewall applications that you use. HostScan supports v2
OPSWAT APIs, while ISE Posture Compliance Module supports the v3 and v4 OPSWAT
APIs. The biggest difference in the organization of these two versions is that
v2 organizes the library files by vendor whereas v3 organizes them by product
The OPSWAT v4 library was introduced for the ISE Posture
Compliance Module in AnyConnect 4.3. The OPSWAT support charts contain the
product name and version information for the anti-malware and firewall
applications that you use, as antivirus and antispyware are combined under the
With AnyConnect release 4.3 (or later) or ISE 2.1 (or later),
you can choose to use either OPSWAT v3 or v4 for the ISE Compliance Module. The
configuration for antimalware is on the ISE UI at
Centers > Posture > Posture Elements > Conditions >
AnyConnect 4.4.x is incompatible with HostScan releases prior to
HostScan 4.3.05017. AnyConnect 4.4.x is however backwards compatible with
HostScan 4.3.05017, and you must use HostScan 4.3.05017 (or later HostScan
4.3.x releases) as the HostScan image in ASDM (Configuration > Remote Access
VPN > Secure Desktop Manager > Host Scan image).
The individual XML
files within the library (a zip file) are digitally signed by OPSWAT, Inc., and
the library itself is packaged as a single, self-extracting executable which is
code signed by a Cisco certificate.
When there is any
mismatch in the version number between the headend (ISE or ASA) and the
endpoint, the OPSWAT compliance module gets updated or downgraded. These
upgrades/downgrades are mandatory and happen automatically without end user
intervention, as soon as a connection to the headend is established.
In HostScan, the OPSWAT binaries are part of the package, and you can download the HostScan support charts .
In AnyConnect ISE
posture, the OPSWAT binaries are packaged into a separate installer.
OPSWAT v3 and v4 libraries can be uploaded to ISE, and you can
manually load to the ISE from the local file system or directly via the ISE
Update Feed URL.