DEMO VIDEO & TEMPLATES. INTEGRATION WITH FORESCOUT

Vadim

Hi there,

Infoblox and ForeScout CounterACT together enable security and incident response teams to leverage the integration of NAC, IPAM and DNS security to enhance visibility, manage assets, ease compliance and automate remediation. This video shows how the integration with ForeScout CounterACT works using Outbound API NIOS 8.1 feature.

 

 

All necessary templates are attached to this post. The templates are provided “as-is”, please check them in you Lab environment and modify for your needs before implementing them in production.

 

The templates require Extensible Attributes, described in the table below. It is recommended to inherit attributes with the default values from the network view level

Extensible Attribute	Description
FS_Sync	Defines if an object should be synced with ForeScout. Possible values: true, false
FS_SyncedAt	Contains date/time when the object was synchronized, updated by the assets management template
FS_RemediateOnEvent	Defines if a remediation task/policy should be executed for RPZ or DNS Tunneling events that are triggered

 

You can use attached PHP script to create these EAs (do not forget to update $NIOS_baseURL, $NIOS_User, $NIOS_PWD, $data variables based on your configuration)

 

The detailed description how the templates work and how to configure it you can find in these posts:

• Asset Management
• Security Events
• Deployment guide

Any feedback and/or questions are much appreciated.

BR,

Vadim Pavlov.

benngl

When I try to add the two Forescout templates, I get this error:

 

         The template is not validated correctly with the schema. Unsupported template version 2.0

 

Running latest code- should I be using a different template version number?

 

TIA for any suggestions.

 

 

gary

Vadim

Hi,

 

Which NIOS version are you running? Templates version 2.0 are supported starting NIOS 8.1.

You said that you are running the lattest code but it seems like lattest NIOS 8.0 branch.

 

BR,

Vadim

benngl

You're correct. I'm running a POC, but it's at 8.0.3 instead of 8.1.  Do I need to upgrade to 8.1, first?

 

Thanks for your assistance.

 

 

gary

Vadim

Yep. Some new features were implemented in NIOS 8.1 which are used in the templates, so 8.1 is required.

Of cource you can "downgrade" (rewrite) the templates to be supported on NIOS 8.0 but anyway I do recommend use 8.1 minimum.

 

Vadim

Vadim

The assets management template was updated to address some copy/past bugs with leases management.

Vadim

The assets management template was updated:

- check for discovery data;

- FS_RemediateOnEvent EA was removed.

steirtet

Hello,

 

Are these templates support for NIOS version 8.3?

 

Regards

Thierry

Vadim

Yes

steirtet

When I try to import the Forescout assets template (FS_Assets.json.txt) in Infoblox (version 8.2 and 8.3) , I get an error indicating that the json file is malformed.

The exact error:

The template contains invalid JSON. Expecting property name : line 175 column 5 (char 5261).

 

Another thing is that I can’t select a template in the outbound endpoint – Rest API configuration. Probably, this problem is linked to the previous.

How can i solve this? Can you check the json template?

 

kzettel

Hello steirtet,

I'll take a look today and get back to you soon with a solution. Thank you for letting me know!

Thank you
Kevin Zettel

steirtet

Any update?

Thierry

EPeeters

The block opening at line 165 does not seam to close properly.

Adding a close of the curly bracket gets the syntax error out of the script.

Also the indentation of that block seams to be off, so it could be there is some other stuff missing in the template.

I did not test that the json file is now working, but can you try the attached one?

 

this is the unclosed block which I closed with "},"

 

{
  "name": "check_For_Discovery_Information",
  "operation": "CONDITION",
  "condition": {
    "condition_type": "AND",
    "statements": [{"left": "${P::discovered_data}","op": "!=","right": ""}],
    "eval": "${XC:COPY:{L:discovered_data}:{P:discovered_data}}",
    "else_eval": "${XC:ASSIGN:{L:discovered_data}:{S:.}}"
  }
},