Forescout® eyeSight integration

Organizations that use Forescout eyeSight to gain visibility and control over devices connected to a network can set up an integration with Absolute Secure Endpoint using the Absolute Connector for Forescout eyeSight. The connector is a Forescout eyeExtend Connect App.

This integration allows Forescout Console users to:

  • View device data points in the Forescout Console that were collected by Absolute.
  • Configure policies based on Absolute data points to assess the compliance status of devices before granting access to corporate resources.
  • Configure policies that trigger a Freeze, Send Message, or Remove Freeze action when a specified condition is met.

For Windows, Mac and Chromebook devices, the Absolute Connector enables the automatic retrieval of device data from the Absolute database, including:

  • Device UID
  • Asset data, such as operating system and network adapter information
  • Details about the status of the device, including anti-malware protection status, encryption status, and Application Resilience status (if applicable)
  • Last reported device location, including the number of hours the device was in the location, and whether it's in an ITAR prohibited country
  • Status of the device's Secure Endpoint Agent

In the Forescout Console, you can view the synced device data in Asset Inventory, in the Absolute view.

By default, a scheduled import job syncs data on a daily basis, but you can change the frequency of the data syncs during the Connector setup process. Note that if a custom policy is based on an Absolute data point, data is synced every four hours.

The Absolute Connector also enables you to configure custom policies that trigger the following Absolute device actions:

  • Freeze: remotely disable a device by showing a custom full-screen message that device users can't close or bypass
  • Remove Freeze: remotely remove a Freeze
  • End User Messaging: remotely send on-screen messages to your devices to share or gather information

These actions are available for devices assigned an Absolute Control or Absolute Resilience license.

The Absolute Connector for Forescout eyeSight is compatible with Forescout eyeSight 2.0.17 and higher.

Devices must be running a supported operating system.

To use the Absolute Connector, the following prerequisites must be met:

  • Your organization has an existing account with Absolute and your Absolute product licenses are active.
  • For Windows and Mac devices, the Secure Endpoint Agent is installed and activated on the devices that you want to view in Forescout eyeSight.
  • For Chromebook devices, the current version of the Absolute for Chromebooks extension is running on the devices that you want to view in Forescout eyeSight, and your Google account is configured in the Secure Endpoint Console.

To set up the integration:

Step 1: Log in to the Forescout Console and import the Absolute package.

Step 2: Configure the connection to allow data synchronization from Absolute to Forescout eyeSight.

Note that as part of the connection configuration process, you'll need to generate an API token in the Secure Endpoint Console.

Step 3: Optionally, set up one or more custom policies based on Absolute data points. Your custom policies can also trigger a Freeze, Remove Freeze, or End User Messaging device action.

For more information about the Absolute Connector for Forescout eyeSight, go to the Forescout Marketplace. For more information about deploying and configuring an eyeExtend Connect App, see Forescout documentation.