Triaging and analyzing threats detected by

 

This section explains the process of detecting and triaging threats with , which is accomplished by automated systems of the and the hands-on monitoring of your own or Forescout's SOC analysts.

Raw Logs: This is where the threat detection process begins – raw logs are fed into Forescout's proprietary data funnel. Raw logs are not necessarily ingested for the sole purpose of detecting threats against existing rulesets, but also to provide data that assists SecOps with proactive threat hunting and discovery. is designed to ingest a collection of various machine-generated data sources related to IT, compliance, device, network, application, system and security.

Enriched Logs: An Enriched Log is a data record generated in after Raw Logs are ingested and processed (parsed, cleaned, normalized, and enriched). An Enriched Log is a real and observable occurrence in a Customer Data Source that happened at some point in time. An Enriched Log can be related to security-oriented Raw Logs but can also be generated by logs that, on their own, are not directly related to a cybersecurity function.

Indicator: An Indicator is a single Enriched Log, or a sequence/aggregation of Enriched Logs, correlated to Threat Intelligence or to an analytics model result based on many Enriched Logs that indicate possible malicious activity but also possible legitimate activity. An Indicator, by itself, is not normally enough to raise an alert or require a response, but it can contribute to a Detection event that alerts Forescout to Security Incident.

Detection: A Detection is a high-confidence, high-fidelity set of logically grouped Indicators, generated by Forescout's proprietary Indicator-Detection Engine, enriched with contextual data, and attributed to a host or user that indicates a potential Threat. A Detection is typically attributed to a Host or User, although related devices/users/threats will be included in the Security Incident case. When creating a Detection rule, the rule code writer can specify a possible list of fields other than Host or User to which they want the Detection attributed.

Suspicious Entities: A Suspicious Entity (also referred to as “Triage Card”) is defined as a single Detection or a series of Detections that have been automatically aggregated and correlated based on Forescout’s proprietary’s threat detection algorithms and engines. A Suspicious Entity may represent an attack or potential attack.

Security Incident: When a Suspicious Entity is detected and creates a triage card to alert the user, if the Suspicious Entity cannot be immediately dismissed by the user a Case is typically created by the user, at which point the Suspicious Entity becomes a Security Incident. The Case is tracked and managed by Forescout's Incident Response Team and, where applicable, in collaboration with the customer until the Security Incident is resolved. For more information about Case management, see Creating and Managing Security Incident Cases and the Workbench.