About the ARF Reports Module

This topic describes the ARF Reports Module.

The Forescout ARF Reports Module provides you with the ARF Report template, which is available in the Forescout Reports Portal. Working with this report template, users define and generate reports that provide information about assets detected by Forescout eyeSight.

The structure and content of these reports follow the Asset Reporting Format (ARF) data model, which is a component of the Security Content Automation Protocol (SCAP). ARF is a standard for compiling IT asset information. Information that is compiled using this standard can be easily shared with third-party systems.

ARF Reports are generated in XML format into a file that is then transferred to a remote server, which is specified by the user.

All features provided by the Forescout Reports Portal are available for use with the ARF Report template. These include accessing reports, scheduling reports, saving reports and managing reports.

Supported eyeSight Version

This table lists the eyeSight version that works with each plugin version covered by this guide.

Module Version Version

1.0.4

8.2, 8.2.1, 8.2.2, 8.3, 8.4, 8.4.1

1.0.3

8.1.x

ARF Report Content

ARF Reports contain XML sections for assets and reports.

Assets

The XML assets section provides the computing-device properties for each detected asset. The report lists each detected asset by an assigned asset-id. Properties reported per asset are:

  • Common Platform Enumeration (CPE): IT product and platform information encoded in a standard, machine-readable format. CPE information is reported for Windows, Macintosh, and Linux endpoints.
    • For the module to report operating system CPE information, these endpoints must be managed by Remote Inspection or by the SecureConnector. The ARF Reports Module obtains operating system CPE information about these endpoints from the resolved OS CPE Format property.

    CPE information examples:

    • Windows: cpe:2.3:o:microsoft:Windows_Server_2008_64-bit_R2:-:Service_Pack_1:-:*:Enterprise_Edition
    • Macintosh: cpe:2.3:o:apple:mac_os_x:10.8.0:*:*:*:*:*:*:*
    • Linux: cpe:2.3:o:centos:centos:6.1:*:*:*:*:*:*:*
  • Connections:
    • IP address
    • MAC address
  • Fully Qualified Domain Name (FQDN)
  • Host Name

When no information is available to report about a property, that property is not listed for the detected asset. For example, if a detected asset has no FQDN, there will be no fqdn entry for the asset listed in the report.

Reports

The XML reports section follows the XML assets section. The module does not provide any information in this section. This section can be ignored.

ARF Report File Transfer

Definition of an ARF Report template includes a remote server location to which the generated report is transferred (a server location that should be accessible to report consumers). The following data transfer protocols are available:

  • FTP
  • SFTP
  • SCP

Example:

Define an ARF report that is generated daily at 5:00 am and transferred via SFTP to your Enterprise GRC system.