Purpose
This guide explains how to configure the Forescout Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, exclude an IP from Forescout policy enforcement, add an IP or MAC to Forescout's passive-learning scope, and move/reclassify an IP into a different network segment. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device. Its methods manage exceptions and segment classification rather than directly triggering a block; actual containment behavior (quarantine, VLAN change, port shutdown) is driven by Forescout's own policies reacting to the segment/classification changes this integration makes.
Prerequisites
- A Forescout appliance (CounterACT/eyeSight) with its Web API (or applicable API module) enabled and reachable from the Logsign server.
- An account with API access and permission to manage policy exceptions and segment/classification changes.
- Use least privilege. Create a dedicated Forescout account for this integration scoped to the specific policy/segment management features it needs, rather than a full administrator account, if your Forescout deployment supports scoped roles.
Step 1: Prepare Forescout for API Access
- Log in to the Forescout console with an administrator account.
- Enable the Web API module (or confirm it is already enabled) and create a dedicated account/client for Logsign to use.
- Note the appliance's hostname/IP, the protocol used to reach it, and the username/password (and Client ID, if your deployment's Web API setup uses one) for the account.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Forescout, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Forescout device in Logsign. |
| Host | Yes | Hostname or IP address of the Forescout appliance. |
| Protocol | Yes | Typically https. |
| Client Id | Yes | Client identifier for the Web API, as configured in Forescout. See the Note below about a manifest inconsistency around this field. |
| User Name | Yes | The Forescout account username from Step 1. |
| Password | Yes | Password for that account. Stored encrypted at rest. |
| Insecure Skip Verify | No | Disables TLS certificate validation on Logsign's outbound calls when enabled. Leave off unless you have a specific reason to keep it on. |
Note: Logsign's configuration form for this integration lists a Client Secret as a required field in its underlying definition, but no corresponding input actually exists in the configuration schema or the integration's code; this appears to be a leftover inconsistency in the integration definition rather than a real field. Do not expect to see (or need to fill in) a Client Secret box; if the Logsign UI does show one unexpectedly, treat it as unused and confirm with Logsign support.
Click Create to save the device.
Available Methods
- add_ignored_ip — excludes an IP from Forescout policy enforcement, useful for preventing Forescout from acting on a host Logsign is separately investigating or handling.
- add_passive_learning_ip — adds an IP to Forescout's passive-learning/allow scope.
- add_passive_learning_mac — adds a MAC address to Forescout's passive-learning/allow scope.
- ip_segment_change (Containment/Recovery, depending on direction) — moves or reclassifies an IP into a different network segment; this is the typical way to trigger network-level containment (for example, moving a host into a quarantine VLAN) or to restore it afterward, depending on how your Forescout policies react to segment membership.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong User Name/Password, or the Web API module is disabled. | Re-enter the User Name and Password fields and confirm the Web API module is enabled in Forescout. |
| 403 Forbidden | The account does not have permission for policy/segment management. | Confirm the account's role in Forescout includes the relevant permissions. |
| ip_segment_change succeeds but no containment behavior is observed | No Forescout policy reacts to the segment/classification this integration set. | Confirm your Forescout policies are configured to take action (quarantine, VLAN change, etc.) based on the segment/classification this method changes. |
Notes and Limits
- This integration does not directly command a device-level block, port shutdown, or VLAN change; it changes Forescout's own policy exceptions and segment classification, and relies on Forescout's existing policy engine to translate that into actual network enforcement. Confirm your Forescout policies are set up to react to these changes before relying on this integration for containment.
- The exact Forescout console navigation path for enabling the Web API and creating a scoped account was not independently verified against a live deployment during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.