About the Plugin

The Plugin manages endpoints running Mac/OS X operating systems.

The Plugin is a component of the Endpoint Module, which is one of several Base Modules of the (formerly Forescout Platform or CounterAct) .

It supports properties, actions and other management functionality for OS X endpoints. This plugin parallels the features of the HPS Inspection Engine which manages Windows endpoints, and the Linux Plugin which manages Linux endpoints.

Each OS X Plugin version provides the latest regularly updated version of SecureConnector that is native to OS X.

Access and manage endpoints

This section describes methods used by the plugin to access and manage endpoints.

Endpoint Module plugins access endpoints to learn detailed information about the endpoint, such as file metadata and operating system information. In addition, the plugins run scripts on endpoints and perform other remediation actions.

  • The HPS Inspection Engine interacts with Windows endpoints.
  • The Linux Plugin interacts with Linux endpoints.
  • The OS X Plugin interacts with OS X endpoints.

When you configure these plugins, you determine the methods used to access and manage endpoints. When these access methods are successful, the endpoint is resolved as Manageable.

The following methods for accessing endpoints can be deployed together in a single network environment.

  • Remote Inspection
  • SecureConnector

Remote Inspection

Remote Inspection uses the SSH communications protocol to query the endpoint, and to run scripts and implement remediation actions on the endpoint.

Agentless

Remote Inspection is agentless - The does not install any applications on the endpoint to query it. This makes Remote Inspection useful when administrators or end users do not want to install utilities or other executables on the endpoint.

Specify Remote Inspection settings in the Remote Inspection tab of each plugin during plugin configuration.

The following properties indicate whether Remote Inspection is used to access and manage an endpoint:

  • For Windows endpoints (supported by the HPS Inspection Engine):
    • Windows Manageable Domain
    • Windows Manageable Domain (Current)
    • Windows Manageable Local
  • For Linux endpoints (supported by the Linux Plugin):
    • Linux Manageable (SSH Direct Access)
  • For OSX endpoints (supported by the OSX Plugin):
    • Macintosh Manageable (SSH Direct Access)

SecureConnectorTM

SecureConnector is a small-footprint executable that runs on the endpoint. It reports endpoint information back to Forescout eyeSight, and implements Forescout actions on the endpoint. The Start SecureConnector action initiates SecureConnector installation on endpoints.

Agent-Based

The SecureConnector executable file must be installed and maintained on the endpoint. This may not be acceptable in certain network environments, or for some endpoints or users.

SecureConnector can be installed in several ways:

 

Windows Endpoints

Linux Endpoints

OS X Endpoints

SecureConnector installer package provided by:

HPS Inspection Engine

Linux Plugin

OSX Plugin

Can install SecureConnector as a dissolvable utility

Y

Y

Y

Can install SecureConnector as a permanent application

Y

X

X

Can install SecureConnector as a permanent service / system daemon

Y

Y

Y

The following properties indicate whether SecureConnector is used to access and manage an endpoint:

  • For Windows endpoints (supported by the HPS Inspection Engine):
    • Windows Manageable SecureConnector
    • Windows Manageable SecureConnector (via any interface)
  • For Linux endpoints (supported by the Linux Plugin):
    • Linux Manageable (SecureConnector)
  • For OSX endpoints (supported by the OSX Plugin):
    • Macintosh Manageable (SecureConnector)