Device criticality

Device Criticality is based on the device's function criticality. Forescout provides a pre-defined criticality rating for each device function within its taxonomy. Devices with unknown function classification will have a low Device Criticality rating.

Device Criticality ratings are classified as low, medium, high, or critical.

A device with a low / medium Device Criticality rating, such as a Smart light bulb, usually shows low impact when under threat to the organization's confidentiality, integrity, and availability. On the other hand, a device with a high Device Criticality rating, such as a DNS Server, has high impact under threat.

is pre-configured with Device Criticality ratings defined for devices according to their Function property.

You can create custom Forescout policies for Device Criticality to override the default Device Criticality ratings for Forescout Groups, IP ranges, and Segments (see the examples described below). See the Forescout Platform Administration Guide for additional information.

Example: Apply a Device Criticality rating to all the devices on a specific segment:

  1. Create a custom policy and give it a relevant name.
  2. Set the Scope as the required segment.
  3. In the Main Rule, do not add a Condition. Select the Set Custom Device Criticality action, and then set the Custom Device Criticality rating from the drop-down.
  4. Complete the policy.

Example: Initiate an email to people in the organization for devices with a Device Criticality rating of Critical, and a Risk Severity of High or Critical.

  1. Create a custom policy with a relevant name.
  2. Set the Scope for all the devices that this policy with cover.
  3. In the Main Rule, add the Device Criticality condition, and select the Critical check box.
  4. In the Main Rule, add the Risk Severity condition, and select the High and Critical check boxes.
  5. In the Main Rule, add the Set Email action.
  6. Complete the policy.