Forescout Cloud Data Source Onboarding Overview

This guide provides information on Data Source device configuration and data telemetry onboarding for both customer environments and the Forescout Cloud product suite (eyeAlert, eyeFocus, eyeScope, as applicable).

Caution: This reference is frequently updated but may not reflect the latest information about the configuration of third-party (non-Forescout) hardware and software devices. Always ensure that you are using the latest vendor documentation for your specific product and product version when performing configuration procedures.

Note: This configuration reference assumes the Forescout Cloud Connector you will be using has been provisioned and deployed either on-premises or hosted by Forescout. If you are unsure whether or not the Connector for the Data Source you are adding has been deployed, contact your Forescout sales representative. For detailed information about Connector provisioning and configuration, see the Forescout Cloud Connector Deployment and Configuration Guide.

What is a Forescout Cloud Data Source?

A Data Source is any customer entity that sends data to a Forescout Cloud product, which typically consists of logged event data. For simplicity's sake, an entity that acts as a source or provider of logs shall be referred to in this guide as a device. This could be a server, a network appliance, a cloud service or an endpoint. Examples of functions of devices that can act as a Data Source for Forescout Cloud include the following:

Endpoint Security & EDR
Email Security
Network Security
Cloud Services
Infrastructure & Authentication
Enrichment Solutions
Application Logs
Other Log Sources

When the customer-side Data Source device and Forescout Cloud are correctly configured so that the device's targeted data logs can be retrieved and filtered (ingested) by Forescout Cloud, the resulting actionable intelligence is referred to as Telemetry.

What is a Forescout Cloud Connector?

A Forescout Data Source Connector is a small utility that establishes a secure connection between a Data Source and Forescout Cloud for the purpose of ingesting raw log data. A Connector can be deployed on-premise at the customer site or it can be hosted by Forescout. The Connector deployment environment, combined with the nature of the Data Source device or service itself, determines the transport configuration settings for the successful ingestion of log files. This manual assumes the Connector you will be using has been provisioned and deployed either on-premise or hosted by Forescout. If you are unsure whether or not the Connector for the Data Source you are adding has been deployed, contact your Forescout sales representative.

For detailed information about Connector provisioning and configuration, see the Forescout Cloud Connector Deployment and Configuration Guide.

What is Loggify?

Loggify is a filtering tool that Forescout developed to transform Data Source log records after they have been ingested into the platform. Loggify parses, cleans, normalizes, and enriches raw logs. It is a critical process that empowers Forescout's Threat Detection Engine to automatically extract Suspicious Entities that pose or expose a potential cybersecurity risk. You may see reference to Loggify in this documentation but there is no need for customers to configure the tool in any way.