Custom Rules constraints
Forescout Cloud will automatically disable Custom Rules that could significantly degrade system performance and platform availability. Scenarios where a Custom Rule would be automatically disabled include the following:
- Max bucket aggregation threshold being exceeded
- Search Query execution timeout
- Search Query Detection or Indicator results that exceed 100
When a Custom Rule is automatically disabled, Forescout Cloud automatically notifies the 24/7 Forescout Assist SOC, the Forescout Cloud Data Science team, and the rule author.