Content Modules

Content Modules deliver data that is used by other Modules for classification, inspection, and control. For example, the Windows Applications Module delivers host properties and actions used by the HPS Inspection Engine to support in-depth discovery and management of software and applications on Windows endpoints.

Module Name	Details
Deep Packet Inspection Plugin	Uses deep packet inspection techniques to passively audit the network traffic to support endpoint classification and compliance assessment on the .
Device Profile Library	A library of pre-defined device classification profiles, each composed of properties and corresponding values that match a specific device type. Each profile maps to a combination of values for function, operating system, and/or vendor and model. The Device Classification Engine uses this information to provide the best possible classification for the device.
Visibility Content	Provides updated protocols, fingerprints, and device profiles used by the Active Probing Plugin and the Deep Packet Inspection Plugin. These updates enhance device visibility and classification capabilities.
Windows Vulnerability DB	Makes vulnerability updates available to the soon after they are released from Microsoft. These updates are used when working with vulnerability policies.
IoT Posture Assessment Library	Delivers a library of pre-defined login credentials that are used by the IoT Posture Assessment Engine to aid in determining the security risk of devices.
NIC Vendor DB	Works with the HPS Inspection Engine to map Network Interface Controllers to their vendors based on their MAC address. Delivers host properties that let you detect and manage endpoints based on this information.
Switch Content	Supplies product definitions about vendor network devices (L2/L3 Switches, Layer 3 Devices) to the Switch Plugin. Each product definition enables Switch Plugin integration with a vendor's network device(s) to both manage these devices and apply actions on connected, targeted endpoints.
Windows Applications	Delivers host properties and actions used by the HPS Inspection Engine to support in-depth discovery and management of software and applications on Windows endpoints.
Security Policy Templates	Security policy templates use existing functionality to detect, evaluate, and respond to vulnerabilities and threats – speeding and simplifying your network response. When you install this plugin, templates are available in the Policy view of the Console.

eyeSegment Module

eyeSegment allows you to analyze your physical network traffic from a dynamic zone perspective. This helps you decouple the static constraints of a physical network from the dynamic business logic that modern segmentation policies require.

The eyeSegment product provides:

Segmentation intelligence driven by the fusion of dynamic zone context and dynamic flow context
A network traffic baseline using traffic data accumulated over time
A consolidated visibility pane for mapping and analyzing traffic to and from various sources in and out of the network, and for identifying simulated traffic rule violations and conflicts
A policy management pane for creating an eyeSegment policy using rules that simulate allowing or denying specific traffic

Use the eyeSegment product to:

Monitor traffic to understand device dependencies, then map, plan, and deploy network segments.
Assess devices on the fly to automate segmentation assignment.
Monitor the network for anomalous communication.
Focus on a matrix row, column, or cell to view a matrix of all the sub-zones of the selected Source or Destination parent zone. This ‘focus’ feature allows you to see multiple types and levels of information for hierarchical structures.
Use dynamic Source and Destination zones to easily create and visualize an eyeSegment policy that simulates denying traffic for a specific segment and filter, and enable notification or other actions when a simulated traffic violation is detected.
Identify simulated traffic violations to improve your enforcement and eyeSegment policy rules.
Visualize the policy rules as a layer in the matrix, and ensure that devices are not managed by conflicting rules.
Export details about selected traffic for further study.

You can define and manage a single matrix that shows traffic for the eyeSegment zones you select.

The eyeSegment Module requires a valid eyeSegment license.

eyeExtend Modules

eyeExtend modules expand capabilities by sharing contextual device data with third-party systems and by automating policy enforcement across those disparate systems. Organizations can bridge previously siloed security solutions to accelerate system-wide response and more rapidly mitigate risks.

eyeExtend modules require valid licenses. License requirements for eyeExtend modules differ depending on the licensing mode your Forescout deployment is using.

Access eyeExtend module software downloads and related documentation from the Customer Support Portal, Downloads Page.

Advanced Threat Detection (ATD)

ATD eyeExtend modules provide security orchestration between the and your ATD system. The combined solution lets you automatically detect indicators of compromise (IOCs) on your network and quarantine infected devices, thereby limiting malware propagation and breaking the cyber kill chain. eyeExtend modules in this category include Check Point Threat Prevention, FireEye NX, and Palo Alto Networks WildFire.

Client Management Tools (CMT)

Forescout’s CMT eyeExtend modules provide visibility and control across network-connected devices, including corporate devices, while they are off the enterprise network. They also verify device compliance with security and regulatory mandates and take remediation actions. eyeExtend modules in this category include eyeExtend for HCL BigFix.

Endpoint Protection, Detection, and Response (EPP/EDR)

EPP/EDR eyeExtend modules provide bi-directional integration between the and leading endpoint security platforms to let you verify device compliance for functional antivirus, up-to-date signatures, encryption, and other endpoint policies, as well as facilitate remediation actions. eyeExtend modules in this category include eyeExtend for Carbon Black, CrowdStrike, FireEye EX, FireEye HX, McAfee ePO, and Symantec Endpoint Protection.

IT Service Management (ITSM)

eyeExtend for ServiceNow helps maintain a complete and accurate ServiceNow asset repository at all times. It also helps automate ServiceNow IT service and security incident creation and prioritization with complete device and network context and facilitates policy-driven remediation actions against noncompliant or compromised devices.

Next Generation Firewall (NGFW)

Forescout’s NGFW eyeExtend modules let you implement dynamic network segmentation, automate controls for secure access to critical resources, and create context-aware security policies within your next-generation firewalls based on device context from eyeSight. eyeExtend modules in this category include eyeExtend for Check Point NGFW, Palo Alto Networks NGFW, and Fortinet NGFW.

Privileged Access Management (PAM)

Forescout’s PAM eyeExtend modules provide you with real-time agentless visibility into undiscovered local privileged accounts and let you automate responses to threats based on holistic visibility into user activity, device security posture, incident severity, and overall threat exposure. eyeExtend modules in this category include eyeExtend for CyberArk.

Security Information and Event Management (SIEM)

Forescout’s SIEM eyeExtend modules facilitate information sharing and policy management between the and leading SIEM systems to improve situation awareness and mitigate risks using advanced analytics. The solution shares comprehensive device information with your SIEM, including IoT classification and assessment context for correlation and incident prioritization. eyeExtend modules in this category include eyeExtend for IBM QRadar, Micro Focus ArcSight, and Splunk.

Vulnerability Assessment (VA)

VA eyeExtend modules share comprehensive vulnerability assessment data between the and leading VA systems to initiate VA scanning of devices and automate policy-based enforcement actions as necessary. eyeExtend modules in this category include eyeExtend for Qualys, Rapid7 InsightVM (Nexpose), and Tenable.

Advanced Compliance Module

Advanced Compliance Module automates on-connect and continuous device configuration assessment to comply with security benchmarks. It enables you to leverage standards-based security benchmarks and content published in the SCAP format.

eyeExtend Connect (formerly the Open Integration Module – OIM)

eyeExtend Connect allows customers, systems integrators, and technology vendors to easily integrate custom applications, security tools, and management systems with . It enables new integrations to be created as applications that are easy to build, consume, and share with the wider community.