Adding ForeScout CounterACT via Syslog

Updated October 15, 2026 05:47

Purpose

This guide explains how to forward ForeScout CounterACT events to Logsign USO over syslog. The integration covers NAC policy evaluations, appliance and plugin log messages, console and directory authentication activity, Enterprise Manager Console user audit messages, block and scan events, system statistics and connection notifications. Logsign parses the messages natively and normalizes them under Vendor ForeScout, Product CounterACT.

Prerequisites

A CounterACT Console account that is allowed to configure the Syslog plugin.
Network connectivity from the CounterACT Appliance and Enterprise Manager to the Logsign USO collector on your syslog port (UDP or TCP 514 by default).
The IP address of each CounterACT device that will send logs, so the source can be added in Logsign USO.

Step 1: Configure syslog forwarding on CounterACT

Menu names differ between CounterACT releases. In most versions the Syslog plugin is configured from the CounterACT Console under Tools > Options > Modules > Syslog. If the path does not match your console, check the ForeScout Syslog Plugin documentation for your version.

Open the Syslog plugin configuration and add a new syslog server.
Enter the IP address of the Logsign USO collector, the syslog port and the protocol (UDP or TCP).
Enable the message categories you want to collect. Policy events, event logs and appliance or plugin messages are the ones this integration classifies.
Leave the message format at the plugin default. Both the classic BSD header and the newer RFC5424 header are accepted, so you do not need to change the header style for Logsign.
Apply the configuration and make sure it is assigned to every Appliance that should forward logs, not only to the Enterprise Manager.

Step 2: Add the data source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select ForeScout as the vendor and CounterACT as the product, and enter the IP address of the CounterACT device as the host. Click Save. Repeat this for every Appliance that forwards logs. Once the plugin starts sending, events appear under Search.

Supported message formats

Logsign accepts CounterACT messages with either syslog header style, and it also accepts CEF output from CounterACT.

A message with the classic BSD header looks like this (anonymized):

<14>Sep 17 08:32:39 nacappliance CounterACT[2298]: NAC Policy Log: Source: 10.0.0.22, Rule: Policy "0.1 Test New Host" , Match: "0.1 Test New Host:Unmatched", Category: N/A, Details: Host evaluation changed from "0.1 Test New Host:Match" to "0.1 Test New Host:Unmatched" due to condition . Reason: Admission expired. Duration: 10 minutes and 1 second

The same event with an RFC5424 header looks like this:

<14>1 2026-09-17T08:32:39.000000Z nacappliance CounterACT - - - NAC Policy Log: Source: 10.0.0.22, Rule: Policy "0.1 Test New Host" , Match: "0.1 Test New Host:Unmatched", Category: N/A, Details: Host evaluation changed from "0.1 Test New Host:Match" to "0.1 Test New Host:Unmatched" due to condition . Reason: Admission expired. Duration: 10 minutes and 1 second

In the RFC5424 form the version field must be 1, the timestamp must carry a Z suffix or a numeric offset, and the process ID, message ID and structured data fields must all be present, either with a value, as a single -, or as a bracketed structured data block. This matches what the CounterACT Syslog plugin produces. Plain text messages that arrive without a recognizable syslog header are not parsed by this integration.

The Enterprise Manager Console writes a user audit trail in the form User <user> session <id> changed <object>. Details: <details>. Logsign recognizes this envelope and reads the user, the session ID and the changed object from it. Login, logout and inactive session messages are also broken down further. Examples (anonymized):

Oct 13 08:20:41 nacmanager 1[3842424]: User user.name session 0 changed Enterprise Manager Console. Details: User 'user.name' at host IP workstation.example.local attempted to log in to Enterprise Manager 10.10.1.1: Login succeeded<EOL> 144 successful login(s) in the last 60 days.
Oct 13 10:52:47 nacmanager 1[3842424]: User user.name session 4065177827932307336 changed Enterprise Manager Console. Details: Logout from 10.10.1.1 by host 10.10.2.2: Logout succeeded
Oct 13 10:50:46 nacmanager 1[3842424]: User user.name session 4065177827932307336 changed Enterprise Manager Console. Details: CounterACT 10.10.1.1 terminated inactive session with host at 10.10.2.2

CEF messages are recognized as soon as the body starts with CEF:<version>|. The CEF body can arrive on its own, behind a syslog tag such as CounterACT[2477315]: or CounterACT_CEF[1672]:, behind a BSD header with that tag, or behind an RFC5424 header. A CEF compliance event with a BSD header looks like this (anonymized):

<14>Sep 24 10:08:08 nacappliance CounterACT[2477315]: CEF:0|ForeScout Technologies|CounterAct|9.1.2|COMPLIANCE|host is compliant|1|cs1Label=Compliancy Policy Name cs2Label=Compliancy Policy Subrule Name cs3Label=Host Compliancy Status cs4Label=Compliancy Event Trigger cs1=1.2 DLP Agent Check cs2=DLP Agent Not Installed cs3=yes cs4=CounterAct Action dmac=00:50:56:aa:bb:cc dst=10.10.20.30 dntdom=EXAMPLE dhost=workstation01 duser=user dvc=10.10.1.5 dvchost=nacappliance rt=1790232488000

Recognition of CEF messages that carry the CounterACT[pid]: tag or a full syslog header in front of the CEF body is available from Logsign USO 6.4.121. On earlier versions only a bare CEF body or the CounterACT_CEF[pid]: tag is recognized, and other CEF messages end up as Uncategorized Event with the whole body in Event.Note.

Notes and limits

Time zones are not converted. The timestamp is stored exactly as CounterACT sends it, for both header styles. If the plugin sends UTC and your console shows local time, the events appear shifted by your offset, so send local time if you want the two to line up. CEF messages are different: rt is an epoch value, so it is converted to the local time of the Logsign server.
Sub second precision is dropped. A timestamp such as 08:32:39.000000Z is stored with second precision.
Long messages that CounterACT splits with a | Part (1/6) | prefix are collected, but the parts are not joined back together. Each part is stored on its own and the message body goes to Event.Note.
Policy names arrive with the literal prefix that CounterACT puts in the Rule field, so Policy.Name reads Policy "0.1 Test New Host rather than the bare policy name. Take this into account when you build searches or dashboards on Policy.Name. Rule.Name is not affected.
Uptime notices such as Uptime 1234 seconds have no dedicated rule. They are collected, with the text kept in Event.Note.
A CEF message behind a syslog header whose CEF header is cut short or otherwise malformed is not dropped. It is collected as a plain message with the body in Event.Note.
Enterprise Manager Console user audit messages are classified only on Logsign USO versions that include this mapping. On earlier versions they are collected as Uncategorized Event with the whole body in Event.Note.
For console user audit messages, only successful logins, successful logouts and inactive session terminations get a dedicated EventMap. Other details, including a failed console login and changes to objects other than the Enterprise Manager Console, are recorded as Identity / User / Info. The user, session ID and object are still filled in.
Source.IP and Destination.IP are filled in from console user audit messages only for IPv4 addresses. A host name for the connecting host goes to Source.HostName. Other address forms are kept only in Event.Info.
Messages that do not match any of the classifications above are still collected and searchable, but they show as Uncategorized Event because no EventMap applies to them.

Verification

In Logsign USO, open Settings > Data Collection and confirm that the ForeScout CounterACT source is receiving data.
Go to Search and look for events with Vendor ForeScout and Product CounterACT. A policy evaluation should appear with Event.Type NAC Policy Log, EventMap System / Application / Info, the endpoint address in Source.IP and the policy result in Event.Action.
If CounterACT sends CEF, a compliance event should appear with Event.Category COMPLIANCE, EventMap Network / Other / Info, the policy in Policy.Name and the appliance in Device.IP and Device.HostName.
Log in to the CounterACT Console to generate an authentication event. It should appear with EventMap Identity / User / Login and your user name in Source.UserName.
Log in to the Enterprise Manager Console and log out again. The two events should appear with Event.Type User audit, Object.Name Enterprise Manager Console, your user name in Source.UserName and the session number in Session.ID. The login carries EventMap Identity / User / Login and the logout carries Identity / User / Logout.
If the source is receiving data but the events carry no Vendor value, the messages are not in a format this integration recognizes. Check that the Syslog plugin is left at its default message format and that the syslog header is not stripped or rewritten by a relay on the path.