Threat protection advanced tools

Conventions

Forescout eyeControl responds to reconnaissance activity by generating marks - virtual resource information expected by probing endpoints - and forwards this information back to them. For example, if the system identifies a probing endpoint that is attempting to gather information about user names in your network, the system responds by creating and returning a mark in the form of a virtual user name to that attacker.

Two types of naming options are available:

• Create mark rules that reflect the naming conventions used for host and user names in your network.
• Create lists of names similar to the host and user names used in your network.

These tasks are performed from the Mark Names pane.

Access to the tools detailed in this section is limited by permissions. See Access to Console Tools - On-premises Permissions for details.

To open the Mark Names pane select Tools > Options, and then select Threat Protection > Advanced > Mark Names.

About mark rules

Endpoint and user names are often organized into logical segments, i.e., host names begin with a fixed text string and end with a specific number combination.

For example, computers in your network may be organized and named as follows:

• SC_WIN_123
• SC_WIN_223
• SC_LINX_123
• SC_LINX_223

Where:

• SC = the company name (Sample Company)
• WIN/LINX = the platform (Windows or Linux)
• 123/223 = a numeric sequence

You can define the naming convention rules for the host and user resource names to use as marks for your system. The mark rules can contain several segments that reflect the naming conventions used in your networking/organizational environment.

Forescout eyeControl is set up with default mark rules, which appear in the Mark Names pane. If you add mark-naming conventions, marks are sent according to the default rules and rules that you create. It is recommended that you delete the default names if your company maintains a policy where all host or user names are created according to a specific convention. This ensures that marks appear consistently and realistically to probing endpoints.