Notes de mise à jour
1.0.0
Added
- Initial Release.
- Le plugin Forescout récupère les hôtes et leurs informations de risque à partir de la page Tous les hôtes de Forescout. Il ne prend en charge aucune action sur Forescout. Calcul du score de normalisation Netskope pour le score de risque de sécurité OT et le score de risque CYSIV => ((Score Forescout – Min Forescout) / (Max Forescout – Min Forescout)) * (Max Netskope – Min Netskope) + Min Netskope
Ce document explique comment configurer le plugin Forescout v1.0.0 avec le module Risk Exchange de la plateforme Netskope Cloud Exchange. Le plugin Forescout récupère les hôtes et leurs informations de risque à partir de la page All Hosts de Forescout. Il ne prend en charge aucune action sur Forescout.
Conditions préalables
Pour réaliser cette intégration, vous avez besoin de :
- Un locataire Netskope (ou plusieurs, par exemple des instances de production et de développement/test).
- Un locataire Netskope Cloud Exchange avec le plugin Tenant et le plugin Risk Exchange déjà configurés.
- Un nom d'utilisateur et un mot de passe Forescout.
- Connectivité à la plateforme Forescout :
https://<Instance IP\>
Prise en charge du plugin Forescout
Le plugin Forescout récupère les hôtes et leurs informations de risque à partir de la page Tous les hôtes de Forescout. Il ne prend en charge aucune action sur Forescout. Calcul du score de normalisation Netskope pour le score de risque de sécurité OT et le score de risque CYSIV => ((Score Forescout – Min Forescout) / (Max Forescout – Min Forescout)) * (Max Netskope – Min Netskope) + Min Netskope
| Type de données extraites | Actions soutenues |
|---|---|
| Hôtes | Non pris en charge |
Mises en correspondance
Le mappage ci-dessous peut être utilisé pour extraire les hôtes et leurs détails respectifs. Les champs mappés lors de la configuration du plugin seront visibles sur la page Enregistrements une fois les données extraites. Ci-dessous est le mappage suggéré qui doit être utilisé lors de la configuration du plugin.
Cartographie des tractions
| Étiquette du champ du plugin | Type de données attendu | Étiquette suggérée pour le champ | Stratégie globale suggérée |
|---|---|---|---|
| ID de l'hôte | String | ID de l'hôte | Unique |
| Score de classification | String | Score de classification | Overwrite |
| Criticité du périphérique de risque CYSIV | String | Criticité du périphérique CYSIV | Overwrite |
| Cotation des risques CYSIV | String | Score CYSIV | Overwrite |
| Gravité du risque CYSIV | String | Gravité CYSIV | Overwrite |
| Score de découverte | String | Score de découverte | Overwrite |
| Score de classification du micrologiciel | String | Score de classification du micrologiciel | Overwrite |
| Adresse MAC de l'hôte | String | Adresse MAC de l'hôte | Overwrite |
| Score de classification du modèle | String | Score de classification du modèle | Overwrite |
| Score de découverte de l'OS | String | Score de découverte de l'OS | Overwrite |
| Criticité OT | String | Criticité OT | Overwrite |
| Risque opérationnel OT | String | Risque opérationnel OT | Overwrite |
| Risque de sécurité OT | String | Risque de sécurité OT | Overwrite |
| Cotation de la découverte Prim | String | Cotation de la découverte Prim | Overwrite |
| Score de classification du fournisseur | String | Score de classification du fournisseur | Overwrite |
| Score normalisé de Netskope | String | Score normalisé de Netskope | Overwrite |
Détails de l'API
Liste des API utilisées
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/login | PUBLIER | Obtenir un jeton d'authentification |
| /api/hosts | OBTENIR | ID d'hôte pull |
| /api/hosts/<Host ID> | OBTENIR | Extraire les détails des risques liés à l’hôte |
Obtenir un jeton d'authentification
Endpoint: /api/login
Method: PUBLIER
Headers
| Clé | Value |
|---|---|
| User-Agent | netskope-ce-5.1.0-cre-forescout-v1.0.0 |
| Content-Type | application/x-www-form-urlencoded |
Parameters
| Clé | Value |
|---|---|
| nom d'utilisateur | <Nom d’utilisateur\> |
| password | <Mot de passe\> |
Sample API Response
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiLim6TpurPlpZXpgJvmv6fotJ3njJ7iiLLqi7zuspPkl6Lnj7npkb3vvJvktpjrl7Hsv6npgorquITqrr3hhrjku4vjoZHptbLugYDsp4Tni5HnvpHph4zug5_sg5rinpzit4XQq-6jgs2K65yB5Lym5ZiD5qGg6LSy4oyg6ZWy44yl642w6J2F6qag4KW57qev45C-75Wc46KL6qOE7YW86amH7Iyu4qeZ6Kib5Kaf7Z7J-X5aaR27rtm6LuroDmmY7nhZXtgKfmtprskorioobkkaIiLCJleHAiOjE3MjU1Mjg5NTF9.AeuUS69vof-Iq9kpaEdJMol5EQNadbw_zW4EcBJa088
ID hôte de retrait
Endpoint: /api/hosts
Method: PUBLIER
Headers
| Clé | Value |
|---|---|
| User-Agent | netskope-ce-5.1.0-cre-forescout-v1.0.0 |
| Content-Type | application/x-www-form-urlencoded |
| If-None-Match | Initialement, il n'est pas défini, mais à partir de la 2e requête, l'ETag <Response Headers.ETag> reçu des en-têtes de réponse sera ajouté. |
Sample API Response
{
"hosts": [
{
"hostId": 167838209,
"ip": "10.1.2.1",
"mac": null,
"links": [
{
"rel": "self",
"href": "https://10.0.1.15/api/hosts/167838209"
}
]
},
]
}
Extraire les détails du risque de l'hôte
Endpoint: /api/hosts/<Host ID>
Method: OBTENIR
Headers
| Clé | Value |
|---|---|
| User-Agent | netskope-ce-5.1.0-cre-forescout-v1.0.0 |
| Authorization | <Jeton d’authentification\> |
Sample API Response
{
"host": {
"ip": "10.5.0.22",
"mac": "0022e51f9018",
"fields": {
"rem_category": {
"timestamp": 1724755548,
"value": "OT"
},
"model_classification_source": {
"timestamp": 1724839679,
"value": "otsm"
},
"is_behind_nat": {
"timestamp": 1724753946,
"value": "false"
},
"cysiv_risk_severity": {
"timestamp": 1724755548,
"value": "low"
},
"onsite": {
"timestamp": 1724395424,
"value": "true"
},
"classification_source_os": {
"timestamp": 1724839679,
"value": "dpl"
},
"linux_manage": {
"timestamp": 1724753946,
"value": "false"
},
"access_ip": {
"timestamp": 1724839650,
"value": "10.5.0.22"
},
"openports": [
{
"timestamp": 1724398100,
"value": "18507/UDP"
}
],
"cc_last_saved_value": {
"timestamp": 1724395455,
"value": "{\"raw_data_value\":\"{\\\"db_creation_date\\\":\\\"2024-07-30 10:41:16.407\\\",\\\"os\\\":\\\"NA\\\",\\\"os_version\\\":\\\"NA\\\",\\\"caption\\\":\\\"NA\\\",\\\"type\\\":\\\"NA\\\",\\\"db_version\\\":\\\"2.0\\\",\\\"has_data\\\":\\\"false\\\",\\\"os_build\\\":\\\"NA\\\",\\\"vendor\\\":\\\"NA\\\",\\\"rank\\\":\\\"NA\\\",\\\"model\\\":\\\"NA\\\",\\\"make\\\":\\\"NA\\\",\\\"group\\\":\\\"NA\\\"}\",\"request_parameters\":[{\"property_value\":\"0022e51f9018\",\"property_name\":\"mac\"}]}"
},
"otsm_details_firmware_version": {
"timestamp": 1724826201,
"value": "12.3.0.4972.xr"
},
"segment_path_calculated": [
{
"timestamp": 1724395424,
"value": "5305124740861699347/-8087060916317949182/-2438220170031211496/"
}
],
"otsm_details_server_protos": [
{
"timestamp": 1724826201,
"value": "DELTAV_IO (UDP 18507)"
},
{
"timestamp": 1724826201,
"value": "DELTAV_MGMT (TCP 18519)"
}
],
"agent_install_mode": {
"timestamp": 1724839650,
"value": "None"
},
"otsm_details_manufacturer": {
"timestamp": 1724826201,
"value": "Emerson"
},
"in-group": [
{
"timestamp": 0,
"value": "Purdue0HostVulnerability"
},
{
"timestamp": 0,
"value": "Purdue0Host"
},
{
"timestamp": 0,
"value": "HostCriticality4"
},
{
"timestamp": 0,
"value": "ICS Client Protocols"
},
{
"timestamp": 0,
"value": "HighHostwithVulnerability"
},
{
"timestamp": 0,
"value": "CVSS-8andHigher"
},
{
"timestamp": 0,
"value": "IoT Devices"
},
{
"timestamp": 0,
"value": "Properties - Passive Learning"
},
{
"timestamp": 0,
"value": "IOOffline"
},
{
"timestamp": 0,
"value": "CVSS-High Matching Confidence"
},
{
"timestamp": 0,
"value": "ICS Server Protocols"
},
{
"timestamp": 0,
"value": "Campus Network"
}
],
"rem_firmware": {
"timestamp": 1724755548,
"value": "12.3.0.4972.xr"
},
"agent_visible_mode": {
"timestamp": 1724839650,
"value": "None"
},
"classification_source_func": {
"timestamp": 1724839679,
"value": "otsm"
},
"otsm_details_cves": [
{
"timestamp": 1724826201,
"value": {
"cvss_score": "7.5",
"vendor_specific_id": "",
"cvss_temporal_score": "0.0",
"title": "Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services",
"matching_confidence": "product",
"cvss_access_complexity": "LOW",
"cvss_exploitability": "UNDEFINED",
"cvss_remediation_level": "OFFICIAL_FIX",
"cvss_authentication": "NONE",
"icsa_id": "ICSA-14-133-02",
"cvss_confidentiality_impact": "PARTIAL",
"cve_id": "CVE-2014-2350",
"cvss_reporting_confidence": "CONFIRMED",
"cvss_availability_impact": "PARTIAL",
"id": "CVE-2014-2350",
"suppressed": "false",
"cvss_access_vector": "NETWORK",
"cvss_integrity_impact": "PARTIAL"
}
},
{
"timestamp": 1724826201,
"value": {
"cvss_score": "4.2",
"vendor_specific_id": "",
"cvss_temporal_score": "0.0",
"title": "OT:ICEFALL: Use of hard-coded credentials vulnerability in Emerson DeltaV",
"matching_confidence": "productVersion",
"cvss_remediation_level": "OFFICIAL_FIX",
"icsa_id": "ICSA-22-181-03",
"cvss_confidentiality_impact": "LOW",
"cve_id": "CVE-2022-29962",
"cvss_reporting_confidence": "CONFIRMED",
"cvss_availability_impact": "LOW",
"id": "CVE-2022-29962",
"suppressed": "false",
"cvss_integrity_impact": "LOW"
}
},
{
"timestamp": 1724826201,
"value": {
"cvss_score": "6.8",
"vendor_specific_id": "",
"cvss_temporal_score": "0.0",
"title": "OT:ICEFALL: Missing authentication for critical function vulnerability in Emerson DeltaV",
"matching_confidence": "productVersion",
"cvss_remediation_level": "OFFICIAL_FIX",
"icsa_id": "ICSA-22-181-03",
"cvss_confidentiality_impact": "NONE",
"cve_id": "CVE-2022-29957",
"cvss_reporting_confidence": "CONFIRMED",
"cvss_availability_impact": "HIGH",
"id": "CVE-2022-29957",
"suppressed": "false",
"cvss_integrity_impact": "HIGH"
}
},
{
"timestamp": 1724826201,
"value": {
"cvss_score": "6.3",
"vendor_specific_id": "",
"cvss_temporal_score": "0.0",
"title": "OT:ICEFALL: Insufficient verification of data authenticity vulnerability in Emerson DeltaV",
"matching_confidence": "productVersion",
"cvss_remediation_level": "OFFICIAL_FIX",
"icsa_id": "ICSA-22-181-03",
"cvss_confidentiality_impact": "HIGH",
"cve_id": "CVE-2022-30620",
"cvss_reporting_confidence": "CONFIRMED",
"cvss_availability_impact": "HIGH",
"id": "CVE-2022-30620",
"suppressed": "false",
"cvss_integrity_impact": "HIGH"
}
},
{
"timestamp": 1724826201,
"value": {
"cvss_score": "8.8",
"vendor_specific_id": "",
"cvss_temporal_score": "0.0",
"title": "OT:ICEFALL: Broken cryptographic algorithm vulnerability in Emerson DeltaV",
"matching_confidence": "productVersion",
"cvss_remediation_level": "UNAVAILABLE",
"icsa_id": "ICSA-22-181-03",
"cvss_confidentiality_impact": "HIGH",
"cve_id": "CVE-2022-29965",
"cvss_reporting_confidence": "CONFIRMED",
"cvss_availability_impact": "HIGH",
"id": "CVE-2022-29965",
"suppressed": "false",
"cvss_integrity_impact": "HIGH"
}
},
{
"timestamp": 1724826201,
"value": {
"cvss_score": "4.2",
"vendor_specific_id": "",
"cvss_temporal_score": "0.0",
"title": "OT:ICEFALL: Use of hard-coded credentials vulnerability in Emerson DeltaV",
"matching_confidence": "productVersion",
"cvss_remediation_level": "OFFICIAL_FIX",
"icsa_id": "ICSA-22-181-03",
"cvss_confidentiality_impact": "LOW",
"cve_id": "CVE-2022-29964",
"cvss_reporting_confidence": "CONFIRMED",
"cvss_availability_impact": "LOW",
"id": "CVE-2022-29964",
"suppressed": "false",
"cvss_integrity_impact": "LOW"
}
},
{
"timestamp": 1724826201,
"value": {
"cvss_score": "1.8",
"vendor_specific_id": "",
"cvss_temporal_score": "0.0",
"title": "OT:ICEFALL: Use of hard-coded credentials vulnerability in Emerson DeltaV",
"matching_confidence": "productVersion",
"cvss_remediation_level": "OFFICIAL_FIX",
"icsa_id": "ICSA-22-181-03",
"cvss_confidentiality_impact": "LOW",
"cve_id": "CVE-2022-29963",
"cvss_reporting_confidence": "CONFIRMED",
"cvss_availability_impact": "NONE",
"id": "CVE-2022-29963",
"suppressed": "false",
"cvss_integrity_impact": "NONE"
}
}
],
"mac_prefix32": {
"timestamp": 1724839643,
"value": "0022e51f"
},
"samba_open_ports": {
"timestamp": 1724753951,
"value": "0"
},
"model_classification_score": {
"timestamp": 1724839679,
"value": "95"
},
"otsm_details_last_seen": {
"timestamp": 1724826201,
"value": "1724826194"
},
"model_classification": {
"timestamp": 1724839679,
"value": "Wireless I/O Card"
},
"otsm_details_host_name": {
"timestamp": 1724826201,
"value": "wioc-1f903a"
},
"macs": [
{
"timestamp": 1724839650,
"value": "0022e51f9018"
}
],
"dpl_model_classification": {
"timestamp": 1724839679,
"value": ""
},
"cysiv_risk_device_criticality": {
"timestamp": 1724755548,
"value": "high"
},
"os_discovery_score": {
"timestamp": 1724839675,
"value": "64"
},
"prim_discovery_score": {
"timestamp": 1724839675,
"value": "83"
},
"otsm_details_host_mac_addresses": [
{
"timestamp": 1724826201,
"value": "00:22:E5:1F:90:18"
}
],
"mediator_otsm_prim_classification": {
"timestamp": 1724839649,
"value": "Operational Technology/Industrial Control Systems/IO Module"
},
"vendor_classification_score": {
"timestamp": 1724839675,
"value": "46"
},
"rem_equipment_function": {
"timestamp": 1724755548,
"value": "Unknown"
},
"mac": {
"timestamp": 1724839650,
"value": "0022e51f9018"
},
"otsm_details_security_risk": {
"timestamp": 1724839643,
"value": "8.2"
},
"manufacturer_classification": {
"timestamp": 1724839679,
"value": "Emerson"
},
"vendor": {
"timestamp": 1724839643,
"value": "fisher-rosemount systems inc."
},
"segment_name_calculated": {
"timestamp": 1724395424,
"value": "Operational Technology"
},
"hostname_calculated": {
"timestamp": 1724395424,
"value": "wioc-1f903a"
},
"mediator_otsm_vendor_classification": {
"timestamp": 1724839649,
"value": "Emerson"
},
"dex_Forescout_Risk_Score": {
"timestamp": 1724839648,
"value": "0"
},
"gst_signed_in_stat": {
"timestamp": 1724753946,
"value": "na"
},
"vendor_discovery_score": {
"timestamp": 1724839675,
"value": "93"
},
"vpn_login": {
"timestamp": 1724821286,
"value": "false"
},
"groups_path_calculated": [
{
"timestamp": 1724818528,
"value": "5483371701762015725/"
},
{
"timestamp": 1724818528,
"value": "5006884535761276673/6881123241563699922/-774523594407371799/-7432780537313919341/"
},
{
"timestamp": 1724818528,
"value": "5006884535761276673/6881123241563699922/-774523594407371799/8677054046804567500/"
}
],
"eds_empty_results": [
{
"timestamp": 1724839648,
"value": "dex_Forescout_Risk_Score"
}
],
"cysiv_risk_score_last_updated": {
"timestamp": 1724755548,
"value": "1724755324"
},
"mac_calculated": {
"timestamp": 1724395424,
"value": "0022e51f9018"
},
"dpl_vendor_classification": {
"timestamp": 1724839675,
"value": "Emerson"
},
"cysiv_risk_cve_list": [
{
"timestamp": 1724755548,
"value": {
"cysiv_cve_reported_time": "1400792106",
"cysiv_cve_cisa": "false",
"cysiv_cve_cvss_score": "7.5",
"cysiv_cve_exploitability_level": "Low",
"cysiv_cve_id": "CVE-2014-2350",
"cysiv_cve_exploitability_percentile": "0.754"
}
},
{
"timestamp": 1724755548,
"value": {
"cysiv_cve_reported_time": "1672035310",
"cysiv_cve_cisa": "false",
"cysiv_cve_cvss_score": "7.8",
"cysiv_cve_exploitability_level": "Low",
"cysiv_cve_id": "CVE-2022-30260",
"cysiv_cve_exploitability_percentile": "0.268"
}
}
],
"classification_score": {
"timestamp": 1724839675,
"value": "32"
},
"firmware_classification": {
"timestamp": 1724839651,
"value": "12.3.0.4972.xr"
},
"otsm_details_module_identities": [
{
"timestamp": 1724826201,
"value": {
"vendor": "Rosemount",
"name": "",
"model": "781 RL",
"serial_number": "",
"firmware_version": "",
"state": "UNDEFINED",
"type": "Wireless Access Point",
"hardware_version": "",
"slot_number": "WAP01"
}
},
{
"timestamp": 1724826201,
"value": {
"vendor": "Emerson",
"name": "WIOC-1F903A",
"model": "12P5030X032",
"serial_number": "",
"firmware_version": "12.3.0.4972.xr",
"state": "UNDEFINED",
"type": "Wireless I/O Card",
"hardware_version": "9.3",
"slot_number": "0"
}
}
],
"manage_agent": {
"timestamp": 1724839650,
"value": "false"
},
"dpl_os_classification": {
"timestamp": 1724839675,
"value": "Unknown"
},
"ipv4_report_time": {
"timestamp": 1724826081,
"value": "true"
},
"manufacturer_classification_score": {
"timestamp": 1724839679,
"value": "-1"
},
"otsm_details_first_seen": {
"timestamp": 1724826201,
"value": "1635282777"
},
"firmware_classification_source": {
"timestamp": 1724839651,
"value": "otsm"
},
"otsm_details_cc_ip": {
"timestamp": 1724826201,
"value": "10.0.1.60"
},
"otsm_details_hardware_version": {
"timestamp": 1724826201,
"value": "9.3"
},
"classification_source_vendor": {
"timestamp": 1724839679,
"value": "dpl"
},
"mac_vendor_string": {
"timestamp": 1724839643,
"value": "FISHER-ROSEMOUNT SYSTEMS INC."
},
"rem_function": {
"timestamp": 1724755548,
"value": "IO Module"
},
"mediator_otsm_model_classification": {
"timestamp": 1724839649,
"value": "Wireless I/O Card"
},
"prim_classification_source": {
"timestamp": 1724839679,
"value": "otsm"
},
"otsm_details_client_protos": [
{
"timestamp": 1724826201,
"value": "DELTAV_IO (UDP 18507)"
}
],
"firmware_classification_score": {
"timestamp": 1724839651,
"value": "60"
},
"ccg_prim_classification": {
"timestamp": 1724395455,
"value": "Unknown"
},
"os_classification_score": {
"timestamp": 1724839679,
"value": "-1"
},
"prim_classification_score": {
"timestamp": 1724839679,
"value": "-1"
},
"mediator_otsm_firmware_classification": {
"timestamp": 1724839649,
"value": "12.3.0.4972.xr"
},
"otsm_details_sensor_names": [
{
"timestamp": 1724839643,
"value": "Sensor1 at 10.0.1.60"
}
],
"adm": [
{
"timestamp": 1724395388,
"value": "new"
},
{
"timestamp": 1724839643,
"value": "online_again"
}
],
"snow_mac_exist": {
"timestamp": 1724839650,
"value": "snow_mac_exist_true"
},
"otsm_details_model": {
"timestamp": 1724826201,
"value": "Wireless I/O Card"
},
"wifi_client_login": {
"timestamp": 1724817697,
"value": "false"
},
"rem_vendor": {
"timestamp": 1724755548,
"value": "Emerson"
},
"matched_fingerprints": [
{
"timestamp": 1724839675,
"value": "SM-Vendor-Emerson"
},
{
"timestamp": 1724839675,
"value": "SM-IO module"
}
],
"otsm_details_criticality": {
"timestamp": 1724826201,
"value": "4"
},
"os_classification_source": {
"timestamp": 1724839679,
"value": "dpl"
},
"discovery_score": {
"timestamp": 1724839675,
"value": "80"
},
"compliance_state": {
"timestamp": 1724839680,
"value": "COMPLY"
},
"device_role": {
"timestamp": 1724839675,
"value": "false"
},
"dpl_prim_classification": {
"timestamp": 1724839675,
"value": "Operational Technology/Industrial Control Systems/IO Module"
},
"manufacturer_classification_source": {
"timestamp": 1724839679,
"value": "dpl"
},
"os_classification": {
"timestamp": 1724839679,
"value": "Unknown"
},
"cc_host_classifier": {
"timestamp": 1724395455,
"value": "{\"db_creation_date\":\"2024-07-30 10:41:16.407\",\"os\":\"NA\",\"os_version\":\"NA\",\"caption\":\"NA\",\"type\":\"NA\",\"db_version\":\"2.0\",\"has_data\":\"false\",\"os_build\":\"NA\",\"vendor\":\"NA\",\"rank\":\"NA\",\"model\":\"NA\",\"make\":\"NA\",\"group\":\"NA\"}"
},
"snow_add_update_status": {
"timestamp": 1724817882,
"value": "2"
},
"cact_script_result.2a1b2d019d0fb891a7c8d7c32d3f8a6c": {
"timestamp": 1724752766,
"value": "Sending ICMP MS_SYNC_REQ\nSending ICMP ECHO"
},
"rem_function_taxonomy": {
"timestamp": 1724755548,
"value": "Operational Technology/Industrial Control Systems/IO Module"
},
"otsm_details_role": {
"timestamp": 1724826201,
"value": "io_module"
},
"cysiv_risk_score": {
"timestamp": 1724755548,
"value": "2.0"
},
"is_iot": {
"timestamp": 1724839675,
"value": "false"
},
"manage_domain_strict": {
"timestamp": 1724753951,
"value": "false"
},
"ipv4_calculated": {
"timestamp": 1724395424,
"value": "10.5.0.22"
},
"misc": {
"timestamp": 1724839658,
"value": "3* cysiv_risk_internet_exposure_indication 1724755548 mac_manage 1724817902 p2p_running 1724839650 aws_resource_tag 1724817902 nbthost 1724839650 aws_instance_id 1724817808 va_netfunc 1724839650 ad_memberof 1724755633 ad_departmenp 0 1 1724752155 0 0 cloud_application_running 0 1 1724752155 0 0 service 0 1 1724752155 0 0 device_interfaces 0 1 1724752155 0 0 nmap_def_fp7 0 1 1724752155 0 0 p2p_running 0 1 1724752155 0 0 nmap_def_fp5 0 1 1724752155 0 0 va_netfunc 0 1 1724752155 0 0 snmp2 0 1 1724752155 0 0 user 0 1 1724752155 0 0 comp_application 0 1 1724752155 0 0 registry_1 0 1 1724752155 0 0 * cysiv_risk_last_vulnerability_scans 1724755548 suggested_prim_classification 1724817903 suggested_vendor_classification 1724817903 atc_ioc_scan_stats 1724752053 cysiv_risk_exposed_services 1724755548 "
},
"prim_classification": {
"timestamp": 1724839679,
"value": "Operational Technology/Industrial Control Systems/IO Module"
},
"vendor_classification": {
"timestamp": 1724839675,
"value": "Emerson"
},
"rem_model": {
"timestamp": 1724755548,
"value": "Wireless I/O Card"
},
"rem_os": {
"timestamp": 1724755548,
"value": "Unknown"
},
"otsm_details_operational_risk": {
"timestamp": 1724839643,
"value": "0.0"
},
"last_nbt_report_time": {
"timestamp": 1724753947,
"value": "1724753947"
},
"otsm_details_purdue_level": {
"timestamp": 1724826201,
"value": "LEVEL0"
},
"agent_version": {
"timestamp": 1724753946,
"value": "None"
},
"rem_os_taxonomy": {
"timestamp": 1724755548,
"value": "Unknown"
},
"local-credentials-OK": {
"timestamp": 1724753946,
"value": "false"
},
"_times": [
{
"timestamp": 1724839643,
"value": "last_onsite"
}
],
"online": {
"timestamp": 1724839643,
"value": "true"
},
"engine_seen_packet": {
"timestamp": 1724839643,
"value": "true"
}
},
"id": 168099862
},
"links": [
{
"rel": "self",
"href": "https://10.0.1.15/api/hosts/168099862"
}
]
}
Agent utilisateur
netskope-ce-5.1.0-cre-forescout-v1.0.0
Workflow
- Obtenez votre URL de base Forescout, votre nom d'utilisateur et votre mot de passe.
- Configurer le plugin Forescout.
Obtenez vos identifiants Forescout
Suivez les étapes fournies dans la documentation de Forescout pour générer les paramètres de configuration du plugin. Le nom d'utilisateur et le mot de passe peuvent être générés à partir de la page Paramètres > Web API > Paramètres utilisateur. Ces derniers ainsi que l'URL de base sont nécessaires pour configurer le plugin.
Configurer le plugin Forescout
-
Dans Cloud Exchange, allez sur Settings > Plugin Store. Recherchez et sélectionnez le plugin Forescout v1.0.0 (CRE).
-
Saisissez les informations de base :
- Configuration Name: Nom unique pour la configuration.
- Sync Interval: Leave the default.
-
Cliquez sur Next et entrez les paramètres de configuration :
- Base URL: URL de base de l'instance Forescout, telle que
https://<Instance IP>. - Username: Nom d’utilisateur du compte Forescout.
- Password: Mot de passe du compte Forescout.
- Netskope Normalization Field: Select le champ à utiliser pour la normalisation dans la plage de scores Netskope.
- Base URL: URL de base de l'instance Forescout, telle que
-
Cliquez sur Next et sélectionnez l'entité et fournissez le mappage pour le plugin.
-
Cliquez sur Save.
