Skip to main content

Forescout Eyesight

Visualize Forescout Eyesight hosts, policies, users and vulnerabilities, map Forescout hosts to its matching policies, assigned user and identified vulnerabilities, and monitor changes through queries and alerts.

Installation​

To set up this integration in JupiterOne, you first create a Web API user in Forescout and, optionally, an Admin API user if you want to ingest IP ranges.

Prerequisites​

  • The Web API Plugin is installed and started on your Enterprise Manager or standalone Appliance. JupiterOne authenticates every Web API request with a Web API user you create below.
  • To ingest IP ranges, the Admin API Plugin (Core Extensions Module) is installed and started. This is required only for the IP Ranges data.

Configuration in Forescout Eyesight​

Create a Web API user​

  1. In the Forescout Console, select Options from the Tools menu, then select Web API.
  2. On the User Settings tab, click Add.
  3. Enter a user name and password, then click OK.
  4. Save the user name and password. You enter these later in the Web API Username and Web API Password fields in JupiterOne.
  5. Go to Options > Access > Web, select the Client IPs tab, and click Add. Add the IP range or subnet JupiterOne connects from (your collector host if you run one, otherwise contact JupiterOne Support for JupiterOne's egress addresses), then click OK. Forescout rejects Web API logins from addresses outside this list, even with valid credentials.
note

The Web API Authentication Security Settings control account lockout and token expiration.

Create an Admin API user (optional, for IP Ranges)​

  1. In the Forescout Console, select Options from the Tools menu, then select CounterACT User Profiles and click Add.
  2. In the General pane, set User Type to Single-Password and enter a user name and password.
  3. In the Permissions pane, select Group Management and Policy Management with view-only access. JupiterOne only reads network segments, so update access is not needed.
  4. In the Scope pane, select View All Hosts.
  5. Save the user name and password. You enter these later in the Admin API Username and Admin API Password fields in JupiterOne.
note

The Admin API user is required only to ingest IP ranges. Forescout recommends a dedicated user for Admin API access with no permissions beyond Group Management and Policy Management, and advises against using the built-in admin user.

Configuration in JupiterOne​

To install the Forescout Eyesight integration in JupiterOne, navigate to the Integrations tab and select Forescout Eyesight. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Forescout Eyesight account in JupiterOne. Ingested entities store this value in tag.AccountName when the AccountName toggle is enabled.
  • A Description to help identify the integration instance, if desired.
  • A Polling Interval sufficient for your monitoring needs. You can leave this as DISABLED and run the integration manually.
  • Your Hostname — the host of your Forescout Eyesight instance, for example https://eyesight.example.com.
  • The Web API Username and Web API Password for the Web Service user you created.
  • The Admin API Username and Admin API Password, only if you want to ingest IP ranges.

Click Create once all values are provided to finalize the integration.

Advanced Configuration​

These TLS transport options are optional and only needed when your Enterprise Manager or appliance presents a certificate that JupiterOne cannot verify against a public certificate authority.

FieldDescriptionDefault
CA CertificateA PEM file with the CA certificate (and any intermediates) that issued the Enterprise Manager or appliance TLS certificate. Use it when that certificate is self-signed or issued by an internal CA.None
Disable TLS VerificationWhen enabled, JupiterOne skips TLS certificate verification.Disabled
caution

Disabling TLS verification is not recommended. Use it only for appliances with self-signed certificates, and prefer uploading a CA Certificate instead.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.