Adding ForeScout CounterACT via Syslog

Purpose

This guide explains how to forward ForeScout CounterACT events to Logsign USO over syslog. The integration covers NAC policy evaluations, appliance and plugin log messages, console and directory authentication activity, block and scan events, system statistics and connection notifications. Logsign parses the messages natively and normalizes them under Vendor ForeScout, Product CounterACT.

Prerequisites

• A CounterACT Console account that is allowed to configure the Syslog plugin.
• Network connectivity from the CounterACT Appliance and Enterprise Manager to the Logsign USO collector on your syslog port (UDP or TCP 514 by default).
• The IP address of each CounterACT device that will send logs, so the source can be added in Logsign USO.

Step 1: Configure syslog forwarding on CounterACT

Menu names differ between CounterACT releases. In most versions the Syslog plugin is configured from the CounterACT Console under Tools > Options > Modules > Syslog. If the path does not match your console, check the ForeScout Syslog Plugin documentation for your version.

1. Open the Syslog plugin configuration and add a new syslog server.
2. Enter the IP address of the Logsign USO collector, the syslog port and the protocol (UDP or TCP).
3. Enable the message categories you want to collect. Policy events, event logs and appliance or plugin messages are the ones this integration classifies.
4. Leave the message format at the plugin default. Both the classic BSD header and the newer RFC5424 header are accepted, so you do not need to change the header style for Logsign.
5. Apply the configuration and make sure it is assigned to every Appliance that should forward logs, not only to the Enterprise Manager.

Step 2: Add the data source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select ForeScout as the vendor and CounterACT as the product, and enter the IP address of the CounterACT device as the host. Click Save. Repeat this for every Appliance that forwards logs. Once the plugin starts sending, events appear under Search.

Supported message formats

Logsign accepts CounterACT messages with either syslog header style, and it also accepts CEF output from the CounterACT CEF plugin.

A message with the classic BSD header looks like this (anonymized):

<14>Sep 17 08:32:39 nacappliance CounterACT[2298]: NAC Policy Log: Source: 10.0.0.22, Rule: Policy "0.1 Test New Host" , Match: "0.1 Test New Host:Unmatched", Category: N/A, Details: Host evaluation changed from "0.1 Test New Host:Match" to "0.1 Test New Host:Unmatched" due to condition . Reason: Admission expired. Duration: 10 minutes and 1 second

The same event with an RFC5424 header looks like this:

<14>1 2026-09-17T08:32:39.000000Z nacappliance CounterACT - - - NAC Policy Log: Source: 10.0.0.22, Rule: Policy "0.1 Test New Host" , Match: "0.1 Test New Host:Unmatched", Category: N/A, Details: Host evaluation changed from "0.1 Test New Host:Match" to "0.1 Test New Host:Unmatched" due to condition . Reason: Admission expired. Duration: 10 minutes and 1 second

In the RFC5424 form the version field must be 1, the timestamp must carry a Z suffix or a numeric offset, and the process ID, message ID and structured data fields must all be present, either with a value, as a single -, or as a bracketed structured data block. This matches what the CounterACT Syslog plugin produces. Messages that arrive without a recognizable syslog header are not parsed by this integration.

What gets collected

Other key and value pairs in policy messages, such as Duration, are kept as they arrive. Every event is recorded with Vendor ForeScout, Product CounterACT, EventSource Type Security System and Category NAC.

Event classification

When CounterACT sends CEF instead, the classification is taken from the CEF signature ID. The COMPLIANCE signature is recorded as Network / Other / Info and NONCOMPLIANCE as Network / Other / Error.

Notes and limits

• Time zones are not converted. The timestamp is stored exactly as CounterACT sends it, for both header styles. If the plugin sends UTC and your console shows local time, the events appear shifted by your offset, so send local time if you want the two to line up.
• Sub second precision is dropped. A timestamp such as 08:32:39.000000Z is stored with second precision.
• Long messages that CounterACT splits with a | Part (1/6) | prefix are collected, but the parts are not joined back together. Each part is stored on its own and the message body goes to Event.Note.
• Policy names arrive with the literal prefix that CounterACT puts in the Rule field, so Policy.Name reads Policy "0.1 Test New Host rather than the bare policy name. Take this into account when you build searches or dashboards on Policy.Name. Rule.Name is not affected.
• Uptime notices such as Uptime 1234 seconds have no dedicated rule. They are collected, with the text kept in Event.Note.
• Messages that do not match any of the classifications above are still collected and searchable, but they show as Uncategorized Event because no EventMap applies to them.

Verification

• In Logsign USO, open Settings > Data Collection and confirm that the ForeScout CounterACT source is receiving data.
• Go to Search and look for events with Vendor ForeScout and Product CounterACT. A policy evaluation should appear with Event.Type NAC Policy Log, EventMap System / Application / Info, the endpoint address in Source.IP and the policy result in Event.Action.
• Log in to the CounterACT Console to generate an authentication event. It should appear with EventMap Identity / User / Login and your user name in Source.UserName.
• If the source is receiving data but the events carry no Vendor value, the messages are not in a format this integration recognizes. Check that the Syslog plugin is left at its default message format and that the syslog header is not stripped or rewritten by a relay on the path.