Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

ForeScout

Reply
This is an open group. Sign in and click the "Join Group" button to become a group member and start posting.
DEMO VIDEO & TEMPLATES. INTEGRATION WITH FORESCOUT
Moderator
Posts: 84
Registered: ‎06-21-2017
Moderator
Moderator
Posts: 69
 
 
Hi there,
 

Infoblox and ForeScout CounterACT together enable security and incident response teams to leverage the integration of NAC, IPAM and DNS security to enhance visibility, manage assets, ease compliance and automate remediation. This video shows how the integration with ForeScout CounterACT works using Outbound API NIOS 8.1 feature.

 

 

All necessary templates are attached to this post. The templates are provided “as-is”, please check them in you Lab environment and modify for your needs before implementing them in production.

 

The templates require Extensible Attributes, described in the table below. It is recommended to inherit attributes with the default values from the network view level

Extensible Attribute

Description

FS_Sync

Defines if an object should be synced with ForeScout. Possible values: true, false

FS_SyncedAt

Contains date/time when the object was synchronized, updated by the assets management template

FS_RemediateOnEvent

Defines if a remediation task/policy should be executed for RPZ or DNS Tunneling events that are triggered

 

You can use attached PHP script to create these EAs (do not forget to update $NIOS_baseURL, $NIOS_User, $NIOS_PWD, $data variables based on your configuration)

 

The detailed description how the templates work and how to configure it you can find in these posts:

Any feedback and/or questions are much appreciated.

 

BR,

Kevin Zettel

Showing results for 
Search instead for 
Did you mean: