Policy Management

 

Forescout policies let you automate and simplify the intricate and time-consuming tasks involved in dealing with a multitude of events, users, vendors and devices; continuously changing downloads and patches; new vulnerabilities; extensive compliance requirements, and more. For example, policies can be used to:

  • Pinpoint and quarantine endpoints that are working without antivirus software or that are not properly patched.
  • Limit the network access available to guests and consultants.
  • Enable automated detection of endpoints that are missing required Microsoft Service Packs and provide self-remediation tools.
  • Verify that all mission critical servers are hardened according to the server hardening policy.
  • Run scheduled vulnerability checks and automatic repair and protection mechanisms.
  • Automatically discover and quarantine rogue wireless access points.
  • Create admission control policies to determine who can access the network and under what conditions.
  • Display important policy results in the Dashboards view, a web-based center that delivers dynamic at-a-glance information about network compliance, threats and guests.

Policies let you define instructions for automatically identifying, analyzing, and responding to a broad range of network activity for the purpose of bringing endpoints into policy compliance.

Specifically, you use policies to initiate endpoint inspection, specify conditions under which Forescout products should respond to endpoints, and define actions to perform at endpoints that match or do not match the policy requirements. You can define policies as simple as identifying missing laptops or more complex policies that control network access and VLAN assignment based on the organizational structure.

Note: In addition to creating your own policies, you can also use policy templates – out-of-the-box templates that help you quickly create important policies based on predefined policy parameters. See Policy Templates for details.

How Policies Are Structured

Policies are composed of the following elements:

  • A unique policy name.
  • A policy scope, for example, the endpoints that you want to inspect.
  • Policy Conditions: Instructions to Forescout eyeSight regarding what properties to look for on endpoints. For example, detect endpoints running Windows XP and an outdated Symantec Antivirus application.
  • Policy Actions: Measures to take at endpoints, if those properties or condition are either met or not met, for example, halt peer-to-peer applications, block Internet access, or notify endpoint users.

About Templates for Policy Creation

The Console is delivered with ready-to-use templates. Using them helps you quickly create commonly used policies.

About Custom Policy Creation

Carry out extensive, deep inspection on endpoints by creating your own customized policies. Use the custom feature to create policies not covered by templates. See Create a Custom Policy.

Working with Policy Results

After running a policy, you can view detection information in the Home view, Detections pane. You can also manage policies from this location. See Control Endpoints from the Detections Pane for details.

Broaden the Scope – Plugins and eyeExtend Modules

The platform is delivered with predefined policy detection criteria and actions. You can broaden the scope of these parameters, however, by integrating items that better correspond to your organizational and networking environment. This is accomplished by utilizing plugins and eyeExtend modules. For example, the Forescout eyeExtend for McAfee ePolicy Orchestrator lets you integrate with McAfee ePO, access related information, synchronize with related servers, and more.

See Base Modules, Content Modules, and eyeExtend Modules and refer to the relevant configuration guide for details.