How to send data to and retrieve data from Forescout Cloud

The plugin sends data to at different intervals depending on the data type using function-specific APIs. Restarting the plugin also triggers a data exchange. Newly added Assets are uploaded to   within 15 minutes, and then different information types are retrieved or sent at the default intervals specified in the reference table below.

Some specific URLs must be allow-listed so that the   plugin can retrieve or pass required information from or to  . Use the API description sections below to guide your configuration of the various data transfer functions. The   plugin uses the following API-specific URLs on Port:443 to send and retrieve data from the Cloud, where {main} is the URL, based on location, set in Configure the Cloud Data Exchange Plugin.

Get detections from  

This API function has the following values:

  • URL: https://<main>/active-detections
  • Default interval: 15 minutes
  • How to configure the interval: Configured via the "Detections Polling Time Interval" in the Configuration Page of the Cloud Data Exchange plugin.
  • Relationship with focal appliance: Always sent from the focal appliance, even if the "Use only focal appliance" checkbox isn't checked.

Get REM Properties from  

This API function has the following values:

  • URL: https://<main>/rem-assets
  • Default interval: 15 minutes
  • How to configure the interval: Configured via the "Risk Polling Time Interval" in the Configuration Page of the   plugin.
  • Relationship with focal appliance: Always sent from the focal appliance, even if the "Use only focal appliance" checkbox isn't checked.

Send Data to  

This API function has the following values:

  • URL: https://<main>/publish
  • Default interval: 6 hours (new asset data uploaded every 15 minutes)
  • How to configure the interval:

    For 6 hours interval

    SSH into console and then issue the following two commands (i.e., for 6 hours, replace <minutes> with 360):

    fstool cysiv set_property upload.assets.period.minutes <minutes>

    fstool cysiv restart

    For 15 minute new asset interval

    SSH into console and then issue the following two commands (i.e., for 15 minutes, replace <minutes> with 15):

    fstool cysiv set_property upload.assets.fast_period.minutes <minutes>

    fstool cysiv restart

  • Relationship with focal appliance: Sent from each appliance unless the "Use only focal appliance" checkbox is selected. If so, the API forwards information to the focal appliance.

Send DICOM Protocol Data from DPI Plugin to  

This API function has the following values:

  • URL: https://<main>/dicom-events
  • Default interval: 30 minutes
  • How to configure the interval:

    SSH into console and then issue the following two commands:

    fstool cysiv set_property cysiv.dicom_events.interval <minutes>

    fstool cysiv restart

  • Relationship with focal appliance: Sent from each appliance unless the "Use only focal appliance" checkbox is selected. If so, the API forwards information to the focal appliance.

Send Flow Data to  

This API function has the following values:

  • URL: https://<main>/flows-upload
  • Default interval: 10 minutes
  • How to configure the interval:

    SSH into console and then issue the following two commands:

    fstool cysiv set_property flows.connections_table_storage.rotation_interval.minutes <minutes>

    fstool cysiv restart

  • Relationship with focal appliance: Ignores the Focal Appliance. Always sent from each appliance, even if the "Use only focal appliance" checkbox is selected.

Send Health Monitoring Data to  

This API function has the following values:

  • URL: https://<main>/eyesight-health-monitoring
  • Default interval: 5 minutes
  • How to configure the interval:

    SSH into console and then issue the following two commands:

    fstool cysiv set_property upload.health-monitoring.period.minutes <minutes>

    fstool cysiv restart

  • Relationship with focal appliance: Sent from each appliance unless "Use only focal appliance" checkbox is checked. If so, forwards information to focal appliance.