Properties

This series of topics describe the properties used to calculate Risk Score and other values related to Asset tracking and classification.

properties help you assess the risk to the devices in your internal network. Some of these properties are calculated in Forescout Cloud and downloaded to the on-premise platform, and can be used in Risk policies. These properties are marked as (cloud-based) properties.

Scoring and Severity

Risk Score
Indicates the risk score for a device and is a value in the range of 0.1 to 10 inclusive, where 0.1 indicates the least risk, and 10 indicates the greatest risk.
Risk Score reflects the current / potential risk state of a device, and considers both internal and external risk threats
Risk Score of 0.1 (Normal risk). The data received from the risk indicators does not show that the device is at risk.
In this case, one or more of the following apply:
CVEs: Forescout Risk and Exposure Management matched the device with CVEs, but did not find any relevant CVEs
Exposed Services: Forescout Risk and Exposure Management received information about exposed services and protocols on the device, but none were found to be risky.
Internet Exposure: Forescout Risk and Exposure Management received online traffic on the device during the session, but there were no connections initiated from the public internet.
Risk Score of Not Available (0): There is not enough data available from the risk indicators to perform the calculation for the device.
In this case, all of the following apply:
CVEs: Forescout Risk and Exposure Management was not able to match the device with CVE information.
Exposed Services: Forescout Risk and Exposure Management did not receive information about exposed services and protocols for the device.
Internet Exposure: Forescout Risk and Exposure Management did not receive traffic information during the session.
You can create policies based on this property in the Console.
Risk Severity
Indicates the severity level of the risk score for a device. Each risk severity level has an allocated default risk score range:
N/A (0) - Not Applicable
Low (0.2 - 3.9)
Medium (4.0 - 6.9)
High (7.0 - 8.9)
Critical (9.0 - 10.0)
You can create policies based on this property in the Console.
Risk Score Last Updated
Indicates the timestamp for the last risk score update, in the format:
MM/DD/YYYY HH:MM:SS AM / PM
For example, 01/01/2021 11:11:41 AM
Regarding the risk score duration, from the time when the device received that risk score, consider the following scenario:
On 01/01/2021 at 09:00, the risk score changed to 9.0.
On 01/21/2021 at 08:00, the risk score is still 9.0.
In this case, the Risk Score Updated property still shows 01/01/2021 09:00:00, even if the system recalculated the risk score several times since 01/01/2021 at 09:00.

Device Criticality

Indicates the potential impact to the organization if the device is compromised.

Device Criticality
According to one of the following levels:
Critical (impact)
High (impact)
Medium (impact)
Low (impact)
You can integrate Forescout Risk and Exposure Management Device Criticality with eyeExtend for ServiceNow Business Criticality. See Working with eyeExtend for ServiceNow.
You can create policies based on this property in the Console.

Risk Indicator - Known Vulnerabilities

These are known vulnerabilities from threat intelligence feeds, which affect the probability that a device could be compromised. You can create policies in the Console based on the indicator properties marked with an asterisk (*).

Vulnerability Exploitability (cloud-based)
Based on CISA and an EPSS score (0-100), according to one of the following levels:
Extreme (greater than 97.5%)
High (greater than 95% and less than 97.5%)
Medium (greater than 90% and less than 95%)
Low (less than 90%)
If no EPSS found, score is 1.4% default.
Vulnerability ID*
Indicates the ID of the known vulnerability, in the standard format.
To view more details about any vulnerability in the list, click on the hyperlink.
Vulnerability Title
This is the title of the known Vulnerability.
Vulnerability Score*
Indicates the score of the known vulnerability, in the range 0.0-10.0.
Vulnerability Details
Indicates the known vulnerability details.
Last VA Scan
Indicates the last time that a VA scan was performed.
Source
Indicates the source of a VA Scan, for example, Forescout or Rapid7.

Risk Indicator - Internet Exposure

These properties indicate that one or more public IP addresses attempted to access internal devices.

You can create policies in the Forescout Console based on the indicator properties marked with an asterisk (*)

Internet Exposure Detected*
Boolean (Yes / No)
This property is only available in the Console.

Risk Indicator - Exposed Services

Exposed services potentially broaden the device's attack surface, either by allowing adversaries to collect valuable information about the host or its running services, or by weaponizing known attack vectors to abuse or take control of the device. Forescout differentiates between the potential impact each service holds during targeting.

You can create policies in the Console based on this indicator.
Exposed Services
Indicates that the device has one or more exposed services and protocols. The format for the exposed service name is as follows:

<service name> <port number / protocol>. for example, ftp 21/tcp

Cloud Data Exchange Asset Classification Properties

The following Asset Classification Properties for IT, IOT, OT, Network, and Medical devices are polled every two minutes from via the Cloud Data Exchange Plugin:

Cloud Data Exchange Function
This property defines the function of the Asset.
Cloud Data Exchange Model
This property identifies the Asset model.
Cloud Data Exchange Vendor
This property identifies the Asset vendor.
Cloud Data Exchange Operating System
This property identifies the Asset's operating system.
Cloud Data Exchange Firmware
This property identifies the Asset's firmware type and version.
Cloud Data Exchange OS Taxonomy
This property describes the Asset's Operating System taxonomy.
Cloud Data Exchange Function Taxonomy
This property describes taxonomy of the Asset's function.