ForescoutEyeInspect

Forescout EyeInspect

Delivers flexible and scalable OT/ICS asset visibility.
This integration was integrated and tested with version 4.2.20 of Forescout EyeInspect.

Configure Forescout EyeInspect in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

forescout-ei-host-list

Retrieves information about the hosts in the eyeInspect CC database.

Base Command

forescout-ei-host-list

Input

Context Output

Command example

!forescout-ei-host-list page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "Host": {
            "first_seen": "2022-03-18T00:58:27.000+01:00",
            "host_mac_addresses": [],
            "id": 34558,
            "ip": "20.190.159.71",
            "ip_reuse_domain_id": 1,
            "last_seen": "2022-03-18T00:58:27.000+01:00",
            "mac_addresses": [
                "C4:24:56:A4:86:11"
            ],
            "nested_address": "",
            "sensor_ids": [
                9
            ],
            "vlan": ""
        }
    }
}

Human Readable Output

Hosts List

Current page size: 1
Showing page 1 out of others that may exist.

ID	IP	MAC Addresses
34558	20.190.159.71	C4:24:56:A4:86:11

forescout-ei-link-list

Retrieves information about the links in the eyeInspect CC database.

Base Command

forescout-ei-link-list

Input

Context Output

Command example

!forescout-ei-link-list page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "Link": {
            "dst_host_id": 34555,
            "first_seen": "2022-03-18T10:28:47.000+01:00",
            "id": 203725,
            "last_seen": "2022-03-18T10:28:56.000+01:00",
            "proto": "FailedConnection (TCP)",
            "src_host_id": 8
        }
    }
}

Human Readable Output

Host Links List

Current page size: 1
Showing page 1 out of others that may exist.

ID	Source Host ID	Destination Host ID	Protocol
203725	8	34555	FailedConnection (TCP)

forescout-ei-vulnerability-info-get

Retrieves information about a specific vulnerability stored in the eyeInspect CC database.

Base Command

forescout-ei-vulnerability-info-get

Input

Context Output

Command example

!forescout-ei-vulnerability-info-get cve_id=CVE-2019-20218

Context Example

{
    "ForescoutEyeInspect": {
        "CVE": {
            "cve_id": "CVE-2019-20218",
            "cvss_access_complexity": "LOW",
            "cvss_access_vector": "NETWORK",
            "cvss_authentication": "NONE",
            "cvss_availability_impact": "PARTIAL",
            "cvss_confidentiality_impact": "NONE",
            "cvss_exploitability": "UNDEFINED",
            "cvss_integrity_impact": "NONE",
            "cvss_remediation_level": "UNAVAILABLE",
            "cvss_reporting_confidence": "CONFIRMED",
            "cvss_score": 5,
            "cvss_temporal_score": 0,
            "cvss_version": "VERSION_2",
            "icsa_id": "",
            "id": "CVE-2019-20218",
            "last_modified_date": "2020-04-14T02:00:00.000+02:00",
            "published_date": "2018-11-27T01:00:00.000+01:00",
            "references": [
                {
                    "label": "Siemens CERT",
                    "url": "https://cert-portal.siemens.com/productcert/pdf/ssb-439005.pdf"
                }
            ],
            "solution": "Siemens is working on an update for the firmware, and recommends the following mitigations until an update is available:\n - Apply Defense-in-Depth: https://www.siemens.com/cert/operational-guidelines-industrial-security\n - Only build and run applications from trusted sources",
            "summary": "selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.\n VULNERABLE PRODUCT\n - SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant): firmware version V2.6.1, and might also affect previous versions of the firmware",
            "title": "Improper handling of exceptional conditions vulnerability in SQLite database in the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP",
            "vendor": "Siemens",
            "vendor_specific_id": "SSB-439005"
        }
    }
}

Human Readable Output

CVE CVE-2019-20218 Information

ID	Title	Published Date	Cvss Score
CVE-2019-20218	Improper handling of exceptional conditions vulnerability in SQLite database in the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP	2018-11-27T01:00:00.000+01:00	5.0

forescout-ei-alert-list

Retrieves information about the alerts inside eyeInspect CC.

Base Command

forescout-ei-alert-list

Input

Context Output

Command example

!forescout-ei-alert-list page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "Alert": {
            "alert_id": 1,
            "case_id": 0,
            "case_name": "",
            "description": "TCP portscan: the attacker sends multiple out-of-state ACK packets to scan the victim's hosts and determine the open ports. This might be intelligence gathering or (the first phase of) an attack (e.g., DoS, exploit)\n\nFailed connections:\n - (scanner) 213.8.143.143  \n    - 192.168.92.12  \n        * 54009 (    1 failed connection(s) [ ACK: 1 ] )\n        * 54010 (    1 failed connection(s) [ ACK: 1 ] )\n        * 54011 (    1 failed connection(s) [ ACK: 1 ] )\n        * 54013 (    1 failed connection(s) [ ACK: 1 ] )\n        * 54017 (    1 failed connection(s) [ ACK: 1 ] )\n",
            "direction_certain": false,
            "dst_ip": "192.168.92.12",
            "dst_mac": "",
            "dst_port": 0,
            "engine": "PORTSCAN",
            "event_type_ids": [
                "ps_tcp_ack"
            ],
            "event_type_names": [
                "TCP ACK portscan"
            ],
            "fea_alert_count": 0,
            "fea_duration_sec": 0,
            "fea_start": "1970-01-01T01:00:00.000+01:00",
            "fea_state": "None",
            "hotstart": false,
            "l2_proto": "ETHERNET",
            "l3_proto": "IP",
            "l4_proto": "TCP",
            "l7_proto": "UNDEFINED",
            "labels": "",
            "link": "https://192.168.30.115/evt?id=1",
            "normalized": false,
            "notes": "",
            "profile_id": 0,
            "profile_module_name": "Portscan",
            "sensor_id": 9,
            "sensor_name": "Test1",
            "severity": 2,
            "src_ip": "213.8.143.143",
            "src_mac": "",
            "src_port": 0,
            "status": "Not analyzed",
            "timestamp": "2022-02-03T07:49:50.092+01:00",
            "vlan": "",
            "xsoar_severity": 1
        }
    }
}

Human Readable Output

Alerts List

Current page size: 1
Showing page 1 out of others that may exist.

Alert ID	Description	Timestamp	Source IP	Destination IP
1	TCP portscan: the attacker sends multiple out-of-state ACK packets to scan the victim’s hosts and determine the open ports. This might be intelligence gathering or (the first phase of) an attack (e.g., DoS, exploit) Failed connections: - (scanner) 213.8.143.143 - 192.168.92.12 54009 ( 1 failed connection(s) [ ACK: 1 ] ) 54010 ( 1 failed connection(s) [ ACK: 1 ] ) 54011 ( 1 failed connection(s) [ ACK: 1 ] ) 54013 ( 1 failed connection(s) [ ACK: 1 ] ) * 54017 ( 1 failed connection(s) [ ACK: 1 ] )	2022-02-03T07:49:50.092+01:00	213.8.143.143	192.168.92.12

forescout-ei-alert-pcap-get

Retrieves the PCAP file associated to a given alert.

Base Command

forescout-ei-alert-pcap-get

Input

Context Output

Command example

!forescout-ei-alert-pcap-get alert_id=1

Context Example

{
    "InfoFile": {
        "EntryID": "3111@8479e914-8493-4968-8f32-78852375d17b",
        "Extension": "pcap",
        "Info": "application/vnd.tcpdump.pcap",
        "Name": "alert_1_sniff.pcap",
        "Size": 424,
        "Type": "tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 65535)"
    }
}

Human Readable Output

forescout-ei-sensor-list

Retrieves information about the sensors associated to the eyeInspect CC.

Base Command

forescout-ei-sensor-list

Input

Context Output

Command example

!forescout-ei-sensor-list page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "Sensor": {
            "address": "127.0.0.1",
            "health_status": {
                "cpu_load_avg_1_min": {
                    "current_value": "8.5%",
                    "level": "NORMAL",
                    "name": ""
                },
                "disk_usage": [
                    {
                        "current_value": "8%",
                        "level": "NORMAL",
                        "name": "/"
                    }
                ],
                "dropped_packets": {
                    "current_value": "0%",
                    "level": "NORMAL",
                    "name": ""
                },
                "license_status": {
                    "current_value": "VALID",
                    "level": "NORMAL",
                    "name": ""
                },
                "memory_usage": {
                    "current_value": "84.62%",
                    "level": "WARNING",
                    "name": ""
                },
                "net_if_status": [
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "br-1b1f2d7e6a87"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "ens160"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "ens192"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "veth24fab08"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "vethf0fd758"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "vethfb6c608"
                    }
                ],
                "services": [],
                "throughput": {
                    "current_value": "0.0 bps",
                    "level": "CRITICAL",
                    "name": ""
                }
            },
            "id": 2,
            "name": "sensor1",
            "port": 9999,
            "sensor_version": "4.3.21",
            "state": "OPERATIVE_ON",
            "type": "PASSIVE"
        }
    }
}

Human Readable Output

Sensors List

Current page size: 1
Showing page 1 out of others that may exist.

ID	Name	Address	Port	Type
2	sensor1	127.0.0.1	9999	PASSIVE

forescout-ei-sensor-module-list

Retrieves information about the modules of the specified sensor.

Base Command

forescout-ei-sensor-module-list

Input

Context Output

Command example

!forescout-ei-sensor-module-list sensor_id=2 page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "SensorModule": {
            "date_last_update": "2022-03-18T11:13:09.898+01:00",
            "description": "",
            "engine": "THREAT_LIBRARY",
            "id": 1,
            "name": "Industrial threat library (ITL)",
            "operational_mode": "",
            "sensor_id": 2,
            "singleton": true,
            "started": true
        }
    }
}

Human Readable Output

Sensor 2 Modules List

Current page size: 1
Showing page 1 out of others that may exist.

ID	Name	Engine	Started
1	Industrial threat library (ITL)	THREAT_LIBRARY	true

forescout-ei-sensor-module-update

Changes the specified properties of the specified module.

Base Command

forescout-ei-sensor-module-update

Input

Context Output

Command example

!forescout-ei-sensor-module-update sensor_id=2 module_id=5 started=true

Context Example

{
    "ForescoutEyeInspect": {
        "SensorModule": {
            "date_last_update": "1970-01-01T01:00:00.000+01:00",
            "description": "",
            "engine": "PORTSCAN",
            "id": 5,
            "name": "Portscan",
            "operational_mode": "",
            "sensor_id": 2,
            "singleton": true,
            "started": true
        }
    }
}

Human Readable Output

Updated Module 5 of Sensor 2

Name	Engine	Started
Portscan	PORTSCAN	true

forescout-ei-sensor-module-delete

Deletes the specified module from the specified sensor and from the eyeInspect CC database.

Base Command

forescout-ei-sensor-module-delete

Input

Context Output

There is no context output for this command.

Command example

!forescout-ei-sensor-module-delete sensor_id=2 module_id=8

Human Readable Output

The module 8 of sensor 2 was successfully deleted

forescout-ei-ip-blacklist-get

Retrieves the IP blacklist from the Industrial Threat Library of the specified sensor.

Base Command

forescout-ei-ip-blacklist-get

Input

Context Output

Command example

!forescout-ei-ip-blacklist-get sensor_id=2 page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "IPBlacklist": {
            "address": "1.1.1.5",
            "comment": "demo test",
            "sensor_id": 2
        }
    }
}

Human Readable Output

IP Blacklist of Sensor 2

Current page size: 1
Showing page 1 out of others that may exist.

Address	Comment
1.1.1.5	demo test

forescout-ei-ip-blacklist-add

Adds a new entry to the IP blacklist from the Industrial Threat Library of the specified sensor.

Base Command

forescout-ei-ip-blacklist-add

Input

Context Output

There is no context output for this command.

Command example

!forescout-ei-ip-blacklist-add sensor_id=2 address=3.4.5.6 comment=Malicious

Human Readable Output

New IP Blacklist Entry of Sensor 2

Address	Comment
3.4.5.6	Malicious

forescout-ei-domain-blacklist-get

Retrieves the domain name blacklist from the Industrial Threat Library of the specified sensor.

Base Command

forescout-ei-domain-blacklist-get

Input

Context Output

Command example

!forescout-ei-domain-blacklist-get sensor_id=2 page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "DomainBlacklist": {
            "comment": "demo command",
            "domain_name": "028xmz.com",
            "sensor_id": 2
        }
    }
}

Human Readable Output

Domain Blacklist of Sensor 2

Current page size: 1
Showing page 1 out of others that may exist.

Domain Name	Comment
028xmz.com	demo command

forescout-ei-domain-blacklist-add

Adds a new entry to the domain name blacklist from the Industrial Threat Library of the specified sensor.

Base Command

forescout-ei-domain-blacklist-add

Input

Context Output

There is no context output for this command.

Command example

!forescout-ei-domain-blacklist-add sensor_id=2 domain_name=malicious.xyz comment=Maleware

Human Readable Output

New Domain Blacklist Entry of Sensor 2

Domain Name	Comment
malicious.xyz	Maleware

forescout-ei-ssl-client-blacklist-get

Retrieves the SSL client application blacklist from the Industrial Threat Library of the specified sensor.

Base Command

forescout-ei-ssl-client-blacklist-get

Input

Context Output

Command example

!forescout-ei-ssl-client-blacklist-get sensor_id=2 page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "SSLClientBlacklist": {
            "application_name": "Potential malware: eitest-hoeflertext-chrome-popup-traffic-4-of-6",
            "comment": "Generated from all PCAPs on https://www.malware-traffic-analysis.net",
            "ja3_hash": "098f55e27d8c4b0a590102cbdb3a5f3a",
            "sensor_id": 2
        }
    }
}

Human Readable Output

SSL Client Applications Blacklist of Sensor 2

Current page size: 1
Showing page 1 out of others that may exist.

Application Name	Ja3 Hash	Comment
Potential malware: eitest-hoeflertext-chrome-popup-traffic-4-of-6	098f55e27d8c4b0a590102cbdb3a5f3a	Generated from all PCAPs on https://www.malware-traffic-analysis.net

forescout-ei-ssl-client-blacklist-add

Adds a new entry to the SSL client application blacklist from the Industrial Threat Library of the specified sensor.

Base Command

forescout-ei-ssl-client-blacklist-add

Input

Context Output

There is no context output for this command.

Command example

!forescout-ei-ssl-client-blacklist-add sensor_id=2 application_name=Shodan ja3_hash=0ad94fcb7d3a2c56679fbd004f6b12cd comment=Malicious

Human Readable Output

New SSL Client Blacklist Entry of Sensor 2

Application Name	Ja3 Hash	Comment
Shodan	0ad94fcb7d3a2c56679fbd004f6b12cd	Malicious

forescout-ei-file-operation-blacklist-get

Retrieves the file operation blacklist from the Industrial Threat Library of the specified sensor.

Base Command

forescout-ei-file-operation-blacklist-get

Input

Context Output

Command example

!forescout-ei-file-operation-blacklist-get sensor_id=2 page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "FileOperationBlacklist": {
            "comment": "Access 2007 Database File. A database file created with Microsoft Access 2007 or later. It typically contains data organized into tables and fields. (default blacklist entry).",
            "file_or_folder": "\\.accdb$",
            "matching_type": "REGEX",
            "operation": "WRITE",
            "sensor_id": 2
        }
    }
}

Human Readable Output

File Operation Blacklist of Sensor 2

Current page size: 1
Showing page 1 out of others that may exist.

Matching Type	File Or Folder	Operation	Comment
REGEX	.accdb$	WRITE	Access 2007 Database File. A database file created with Microsoft Access 2007 or later. It typically contains data organized into tables and fields. (default blacklist entry).

forescout-ei-file-operation-blacklist-add

Adds entries to the file operation blacklist from the Industrial Threat Library of the specified sensor.

Base Command

forescout-ei-file-operation-blacklist-add

Input

Context Output

There is no context output for this command.

Command example

!forescout-ei-file-operation-blacklist-add sensor_id=2 matching_type=REGEX file_or_folder=\\.mal$ operation=WRITE comment=Virus

Human Readable Output

New File Operation Blacklist Entry of Sensor 2

Matching Type	File Or Folder	Operation	Comment
REGEX	.mal$	WRITE	Virus

forescout-ei-diagnostics-information-get

Retrieves information about all monitored Command Center resources and their health status excluding the logs.

Base Command

forescout-ei-diagnostics-information-get

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Command example

#### Context Example

```json
{
    "ForescoutEyeInspect": {
        "CCInfo": {
            "cc_version": "4.3.21",
            "health_status": {
                "analytics_db_used_mem": {
                    "current_value": "4.3 GiB",
                    "name": ""
                },
                "cpu_load_avg_1_min": {
                    "current_value": "5.5%",
                    "level": "NORMAL",
                    "name": ""
                },
                "disk_usage": [
                    {
                        "current_value": "8%",
                        "level": "NORMAL",
                        "name": "/"
                    }
                ],
                "memory_usage": {
                    "current_value": "84.56%",
                    "level": "WARNING",
                    "name": ""
                },
                "message_queue_used_mem": {
                    "current_value": "602.4 MiB",
                    "name": ""
                },
                "net_if_status": [
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "ens160"
                    },
                    {
                        "current_value": "Not running",
                        "level": "NORMAL",
                        "name": "docker0"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "br-1b1f2d7e6a87"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "ens192"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "vethf0fd758"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "veth24fab08"
                    },
                    {
                        "current_value": "Running",
                        "level": "NORMAL",
                        "name": "vethfb6c608"
                    }
                ],
                "relational_db_used_mem": {
                    "current_value": "3.4 GiB",
                    "name": "silentdefense"
                },
                "web_server_used_mem": {
                    "current_value": "4.4 GiB",
                    "name": ""
                }
            },
            "hostname": "4321-bundle-16g",
            "ip_address": "192.168.30.115",
            "open_ports": [
                "443"
            ]
        }
    }
}

Human Readable Output

Command Center Diagnostics Information

IP Address	Hostname	Open Ports	Cc Version
192.168.30.115	4321-bundle-16g	443	4.3.21

forescout-ei-diagnostic-logs-get

Download the ZIP file which contains diagnostic logs of the Command Center.

Base Command

forescout-ei-diagnostic-logs-get

Input

Context Output

Command example

!forescout-ei-diagnostic-logs-get sensor_id=2

Context Example

{
    "InfoFile": {
        "EntryID": "3167@8479e914-8493-4968-8f32-78852375d17b",
        "Extension": "zip",
        "Info": "application/zip",
        "Name": "command_center_diagnostic_logs.zip",
        "Size": 26280500,
        "Type": "Zip archive data, at least v2.0 to extract"
    }
}

Human Readable Output

forescout-ei-group-policy-list

Get all group policies.

Base Command

forescout-ei-group-policy-list

Input

Context Output

Command example

!forescout-ei-group-policy-list page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "GroupPolicy": {
            "constraints": [
                {
                    "operator": "equals",
                    "os_version": "Windows 10",
                    "type": "os_version"
                }
            ],
            "description": "Test",
            "id": 8,
            "name": "Test Playbook Policy"
        }
    }
}

Human Readable Output

Group Policies List

Current page size: 1
Showing page 1 out of others that may exist.

ID	Name	Description
8	Test Playbook Policy	Test

forescout-ei-group-policy-create

Create a new group policy.

Base Command

forescout-ei-group-policy-create

Input

Context Output

Command example

!forescout-ei-group-policy-create name="example policy" description="policy" constraints="[{\"type\": \"os_version\", \"operator\": \"equals\", \"os_version\": \"Windows 10\"}]"

Context Example

{
    "ForescoutEyeInspect": {
        "GroupPolicy": {
            "constraints": [
                {
                    "operator": "equals",
                    "os_version": "Windows 10",
                    "type": "os_version"
                }
            ],
            "description": "policy",
            "id": 20,
            "name": "example policy"
        }
    }
}

Human Readable Output

Group Policy Information

ID	Name	Description
20	example policy	policy

Group Policy Constraints

Type	Operator	Os Version
os_version	equals	Windows 10

forescout-ei-group-policy-update

Update a group policy. Note: the whole policy will be overridden, therefore all fields are required.

Base Command

forescout-ei-group-policy-update

Input

Context Output

Command example

!forescout-ei-group-policy-update policy_id=20 name="example policy" description="policy" constraints="[{\"type\": \"os_version\", \"operator\": \"equals\", \"os_version\": \"Windows 10\"}]"

Context Example

{
    "ForescoutEyeInspect": {
        "GroupPolicy": {
            "constraints": [
                {
                    "operator": "equals",
                    "os_version": "Windows 10",
                    "type": "os_version"
                }
            ],
            "description": "policy",
            "id": 20,
            "name": "example policy"
        }
    }
}

Human Readable Output

Updated Group Policy

ID	Name	Description
20	example policy	policy

Group Policy Constraints

Type	Operator	Os Version
os_version	equals	Windows 10

forescout-ei-group-policy-delete

Delete a group policy.

Base Command

forescout-ei-group-policy-delete

Input

Context Output

There is no context output for this command.

Command example

!forescout-ei-group-policy-delete policy_id=20

Human Readable Output

The group policy 20 was successfully deleted

forescout-ei-group-policy-hosts-assign

Add all hosts not assigned to any policy (individual or group) matching the filter to the group policy.

Base Command

forescout-ei-group-policy-hosts-assign

Input

Context Output

There is no context output for this command.

Command example

!forescout-ei-group-policy-hosts-assign policy_id=20 filter_type=address filter_value=192.168.1.1

Human Readable Output

1 Additional Hosts Were Assigned to Group Policy 20

forescout-ei-group-policy-hosts-unassign

Unassign all hosts assigned to the group policy matching the filter.

Base Command

forescout-ei-group-policy-hosts-unassign

Input

Context Output

There is no context output for this command.

Command example

!forescout-ei-group-policy-hosts-unassign policy_id=20 filter_type=address filter_value=192.168.1.1

Human Readable Output

1 Additional Hosts Were Unassigned from Group Policy 20

forescout-ei-ip-reuse-domain-list

Get all IP reuse domains.

Base Command

forescout-ei-ip-reuse-domain-list

Input

Context Output

Command example

!forescout-ei-ip-reuse-domain-list page=2 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "IPReuseDomain": {
            "address": "192.168.99.0",
            "description": "Servers IP Reuse",
            "id": 2,
            "mask": 0,
            "name": "servers",
            "vlan_ids": "any"
        }
    }
}

Human Readable Output

IP Reuse Domains List

Current page size: 1
Showing page 2 out of others that may exist.

ID	Name	Description	Address
2	servers	Servers IP Reuse	192.168.99.0

forescout-ei-hosts-changelog-list

Retrieves information about the changes of host properties and configuration from the eyeInspect CC database.

Base Command

forescout-ei-hosts-changelog-list

Input

Context Output

Command example

!forescout-ei-hosts-changelog-list page=1 limit=1

Context Example

{
    "ForescoutEyeInspect": {
        "HostChangeLog": {
            "event_category": "PROPERTIES",
            "event_type_id": "hostcl_new_host",
            "event_type_name": "New host",
            "host_address": "192.168.30.82",
            "host_id": 1,
            "host_ip_reuse_domain_id": 1,
            "host_mac_addresses": [
                "00:50:56:A6:41:89",
                "C4:24:56:A4:86:11"
            ],
            "host_name": "",
            "host_vlan": "",
            "id": 1,
            "information_source": "USER",
            "new_value": "",
            "old_value": "",
            "sensor_id": 0,
            "timestamp": "2022-01-16T17:38:41.505+01:00",
            "username": "admin"
        }
    }
}

Human Readable Output

Hosts Changes List

Current page size: 1
Showing page 1 out of others that may exist.

ID	Host ID	Event Type Name
1	1	New host