ForeScout CounterACT

ForeScout CounterACT platform provides insight into network-connected devices.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices

Parameters

1. ForeScout CounterACT Domain (required) – The URL for the ForeScout CounterAct domain.
2. User Name and Password (required) - The credentials for a user account that has the Required Permissions to fetch assets.
3. Verify SSL (required, default: False) - Verify the SSL certificate offered by the value supplied in ForeScout CounterACT Domain. For more details, see SSL Trust & CA Settings.
   • If enabled, the SSL certificate offered by the value supplied in ForeScout CounterACT Domain will be verified against the CA database inside of Axonius. If the SSL certificate can not be validated against the CA database inside of Axonius, the connection will fail with an error.
   • If disabled, the SSL certificate offered by the value supplied in ForeScout CounterACT Domain will not be verified against the CA database inside of Axonius.
4. HTTPS Proxy (optional, default: empty) - A proxy to use when connecting to the value supplied in ForeScout CounterACT Domain.
   • If supplied, Axonius will utilize the proxy when connecting to the value supplied in ForeScout CounterACT Domain.
   • If not supplied, Axonius will connect directly to the value supplied in ForeScout CounterACT Domain.
5. To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Do not fetch devices with no MAC address and no hostname (required, default: False) - Select whether to exclude fetching devices without MAC address and without hostname.
   • If enabled, all connections for this adapter will only fetch devices having MAC address or hostname.
   • If disabled, all connections for this adapter will fetch devices even if those do not have MAC address and no hostname.
2. Do not fetch devices with no IP (required, default: False) - Select whether to exclude fetching devices without an IP address.
   • If enabled, all connections for this adapter will only fetch devices with an IP address.
   • If disabled, all connections for this adapter will fetch devices even if those do not have an IP address.
3. Ignore irrelevant device manufacturers - Select this option to ignore the device manufacturer field.
4. Number of parallel requests (required, default: 10) - Set the number of parallel requests that the ForeScout CounterAct server will get data from devices.
5. Re-authenticate every X requests (required, default 100) - Set the number of requests to allow before attempting to re-authenticate to get a new session token.
6. Do not fetch rule information for devices (fast mode) - Select this option to not fetch each device's Forescout policies and rules.

APIs

Axonius uses the Forescout eyeExtend Connect Module: Web API.

Required Permissions

The value supplied in User Name must have permissions to use the API, see Configure the Web API section in the ForeScout eyeExtend Connect Module for Web API Plugin Configuration Guide.