category: Network Security
provider: Advent International
sectionorder:
- Connect
- Collect
commonfields:
  id: ForescoutEyeInspect
  version: -1
configuration:
- display: Server URL
  name: server_url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: Default is 50. Maximum is 200.
  defaultvalue: 50
  display: Maximum incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, like 12 hours, 7 days).
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
description: Delivers flexible and scalable OT/ICS asset visibility.
display: Forescout EyeInspect
name: ForescoutEyeInspect
script:
  commands:
  - arguments:
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    - description: List only records with the last seen timestamp greater than or equal to the provided parameter.
      name: last_seen
    - description: Retrieve hosts that are equal to or greater than the specified ID.
      name: id_min
    - description: A comma-separated list of IP addresses. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: ip
    - description: A comma-separated list of VLAN IDs. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: vlan_id
    - description: A comma-separated list of MAC addresses. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: mac_address
    - description: A comma-separated list of sensor IDs. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: sensor_id
    - auto: PREDEFINED
      description: List records and sort them based on the specified field, as well as by ID. Also, the command will filter the results from the returned page.
      name: sort_field
      predefined:
      - ip_reuse_domain_id
      - ip_reuse_domain
      - address
      - ip
      - vlan
      - nested_address
      - mac_addresses
      - sorted_mac_addresses
      - real_mac_addresses
      - sorted_real_mac_addresses
      - observed_mac_addresses
      - sorted_observed_mac_addresses
      - mac_vendors
      - vendor_with_real_macs
      - vendor_with_observed_macs
      - sensor_ids
      - is_broadcast_ip
      - is_multicast_ip
      - is_public_ip
      - is_learnt_host
      - name
      - all_names
      - description
      - role
      - all_roles
      - vendor_model
      - all_vendors_models
      - os_version
      - client_proto_port_info
      - server_proto_port_info
      - first_seen
      - last_seen
      - labels
      - sorted_labels
      - purdue_level
      - criticality
      - firmware_version
      - hardware_version
      - serial_number
      - project
      - ip_type
      - monitored_networks
      - open_ports
      - complex_cves
      - sorted_client_protocols
      - sorted_server_protocols
      - module_count
      - sorted_module_details
      - security_risk
      - operational_risk
      - alert_count
    - auto: PREDEFINED
      defaultValue: false
      description: Indicates whether the result list should be sorted in ascending or descending order.
      name: sort_ascending
      predefined:
      - "true"
      - "false"
    description: Retrieves information about the hosts in the eyeInspect CC database.
    name: forescout-ei-host-list
    outputs:
    - contextPath: ForescoutEyeInspect.Host.id
      description: The unique ID of the host in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.Host.ip_reuse_domain_id
      description: The unique ID of the IP Reuse Domain the host is in.
      type: Number
    - contextPath: ForescoutEyeInspect.Host.ip
      description: The IP address of the host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.nested_address
      description: In case of a nested device host, the nested address of the host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.vlan
      description: The VLAN ID of the host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.mac_addresses
      description: The MAC addresses associated to the host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.sensor_ids
      description: The unique IDs of the sensors that have "seen" this host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.main_name
      description: The main name of the host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.description
      description: Description of the host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.os_version
      description: The operating system version of the host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.open_ports
      description: The open TCP and UDP ports of the host.
      type: String
    - contextPath: ForescoutEyeInspect.Host.first_seen
      description: The ISO-formatted timestamp of when the host was first seen.
      type: String
    - contextPath: ForescoutEyeInspect.Host.last_seen
      description: The ISO-formatted timestamp of when the host was last seen.
      type: String
  - arguments:
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    - description: List only records with the src_host_id property set to the specified value.
      name: src_host_id
    - description: List only records with the dst_host_id property set to the specified value.
      name: dst_host_id
    - description: List only records with the proto field containing the specified value.
      name: proto
    - description: List only records with one of the values of the port property equal to the specified parameter.
      name: port
    - description: List only records with the last_seen timestamp greater than or equal to the provided parameter.
      name: last_seen
    - description: Retrieve links that are equal to or greater than the specified ID.
      name: id_min
    - auto: PREDEFINED
      description: List records and sort them based on a specific field, as well as on ID.
      name: sort_field
      predefined:
      - src_host_id
      - dst_host_id
      - proto
      - ports
      - tx_bytes
      - rx_bytes
      - first_seen
      - last_seen
    - auto: PREDEFINED
      defaultValue: false
      description: Indicates whether the result list should be sorted in ascending or descending order.
      name: sort_ascending
      predefined:
      - "true"
      - "false"
    description: Retrieves information about the links in the eyeInspect CC database.
    name: forescout-ei-link-list
    outputs:
    - contextPath: ForescoutEyeInspect.Link.id
      description: The unique ID of the link in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.Link.src_host_id
      description: The unique ID of the source host in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.Link.dst_host_id
      description: The unique ID of the destination host in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.Link.proto
      description: The name of the protocol (application layer (L7) and transport or datalink layer (L4 or L3/L2) detected for the link.
      type: String
    - contextPath: ForescoutEyeInspect.Link.tx_bytes
      description: The total number of bytes sent upstream.
      type: Number
    - contextPath: ForescoutEyeInspect.Link.rx_bytes
      description: The total number of bytes sent downstream.
      type: Number
    - contextPath: ForescoutEyeInspect.Link.first_seen
      description: Timestamp in ISO format of when the link was first seen.
      type: String
    - contextPath: ForescoutEyeInspect.Link.last_seen
      description: Timestamp in ISO format of when the link was last seen.
      type: String
    - contextPath: ForescoutEyeInspect.Link.ports
      description: TCP or UDP ports used in the link.
      type: String
  - arguments:
    - description: The unique ID of the vulnerability information record to be retrieved. The CVE ID can be retrieved from public vulnerability databases, such as NVD, or from the "CVEs and IoCs" page inside Forescout EyeInspect.
      name: cve_id
      required: true
    description: Retrieves information about a specific vulnerability stored in the eyeInspect CC database.
    name: forescout-ei-vulnerability-info-get
    outputs:
    - contextPath: ForescoutEyeInspect.CVE.id
      description: The vulnerability ID.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cve_id
      description: The CVE ID from the NVD.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.icsa_id
      description: The ICS Cert Security Advisory ID related to the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.vendor_specific_id
      description: The vendor-specific advisory ID related to the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.published_date
      description: The timestamp in ISO format when the vulnerability information was published.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.last_modified_date
      description: The timestamp in ISO format when the vulnerability information was last modified.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_score
      description: The CVSS score of the vulnerability.
      type: Number
    - contextPath: ForescoutEyeInspect.CVE.cvss_temporal_score
      description: The CVSS temporal score of the vulnerability.
      type: Number
    - contextPath: ForescoutEyeInspect.CVE.cvss_access_vector
      description: The CVSS access vector scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_access_complexity
      description: The CVSS access complexity scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_authentication
      description: The CVSS authentication scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_confidentiality_impact
      description: The CVSS confidentiality impact scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_integrity_impact
      description: The CVSS integrity impact scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_availability_impact
      description: The CVSS availability impact scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_exploitability
      description: The CVSS exploitability scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_remediation_level
      description: The CVSS remediation level scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.cvss_reporting_confidence
      description: The CVSS reporting confidence scoring of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.references
      description: The list of references (URLs) related to the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.vendor
      description: The vendor of the product affected by the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.title
      description: A short summary of the vulnerability.
      type: String
    - contextPath: ForescoutEyeInspect.CVE.description
      description: Description of the vulnerability (including list of vulnerable devices and versions).
      type: String
    - contextPath: ForescoutEyeInspect.CVE.solution
      description: Description of the proposed vulnerability solution (including to what version to update the software/firmware).
      type: String
  - arguments:
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    - description: List only records with the timestamp property greater than or equal to the specified value. For example, 2020-05-26T15:00:00.000Z+01:00.
      name: start_timestamp
    - description: List only records with the timestamp property less than or equal to the specified value. For example, 2020-05-26T15:00:00.000Z+01:00.
      name: end_timestamp
    - description: List records that have the event_type_id property containing the specified parameter.
      name: event_type_id
    - auto: PREDEFINED
      description: List records that have the l4_proto property equal to the specified parameter.
      name: l4_proto
      predefined:
      - TCP
      - UDP
      - ICMP
      - UNDEFINED
    - description: List records that have the l7_proto property equal to the specified parameter.
      name: l7_proto
    - description: List records that have the src_ip property equal to the specified parameter, or contained in the given CIDR-defined network.
      name: src_ip
    - description: List records that have the dst_ip property equal to the specified parameter, or contained in the given CIDR-defined network.
      name: dst_ip
    - description: List records that have either the src_ip or the dst_ip property equal to the specified parameter, or contained in the given CIDR-defined network.
      name: ip
    - description: A comma-separated list of severities. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: severity
    - description: A comma-separated list of VLAN IDs. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: vlan_id
    - auto: PREDEFINED
      description: A comma-separated list of statuses. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: status
      predefined:
      - Not analysed
      - In progress
      - Analyzed
      - False alert
      - Relevant
      - Not relevant
      - Unknown
      - Trimmed
    - description: A comma-separated list of sensor names. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: sensor_name
    - description: Fetch records that have the dst_port property equal to the specified parameter.
      name: dst_port
    - description: List records that have the src_ip or src_mac property equal to the IP address or MAC address of the host with the ID equal to the specified parameter.
      name: src_host_id
    - description: List records that have the dst_ip or dst_mac property equal to the IP address or MAC address of the host with the ID equal to the specified parameter.
      name: dst_host_id
    - description: List records that have either the src_ip, src_mac or dst_ip, dst_mac equal to the IP address or MAC address of the host with the ID equal to the specified parameter.
      name: host_id
    description: Retrieves information about the alerts inside eyeInspect CC.
    name: forescout-ei-alert-list
    outputs:
    - contextPath: ForescoutEyeInspect.Alert.alert_id
      description: The ID of the alert in the eyeInspect database.
      type: Number
    - contextPath: ForescoutEyeInspect.Alert.timestamp
      description: Timestamp of the alert in ISO format.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.event_type_ids
      description: The list of unique IDs identifying the type of events reported in the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.event_type_names
      description: The list of names of the type of events reported in the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.description
      description: A description of the event types reported in the alert, as well as other details regarding the specific alert instance coming from the sensor.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.notes
      description: Notes that a eyeInspect user may have attached to the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.sensor_id
      description: The unique ID of the sensor firing the alert.
      type: Number
    - contextPath: ForescoutEyeInspect.Alert.sensor_name
      description: The name of the sensor firing the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.engine
      description: The detection engine that raised the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.profile_module_name
      description: The name of the profile or module that raised the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.profile_id
      description: The unique ID of the profile that raised the alert.
      type: Number
    - contextPath: ForescoutEyeInspect.Alert.l2_proto
      description: The layer 2 (datalink) protocol.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.l3_proto
      description: The layer 3 (network) protocol.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.l4_proto
      description: The layer 4 (transport) protocol.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.l7_proto
      description: The layer 7 (application) protocol.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.vlan
      description: The VLAN ID used in the network communication reported in the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.src_mac
      description: The MAC address of the host initiating the connection reported in the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.dst_mac
      description: The MAC address of the host receiving the connection reported in the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.src_ip
      description: The IP address of the host initiating the connection reported in the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.dst_ip
      description: The IP address of the host receiving the connection reported in the alert.
      type: String
    - contextPath: ForescoutEyeInspect.Alert.src_port
      description: The source TCP or UDP port used in the connection reported in the alert.
      type: Number
    - contextPath: ForescoutEyeInspect.Alert.dst_port
      description: The destination TCP or UDP port used in the connection reported in the alert.
      type: Number
    - contextPath: ForescoutEyeInspect.Alert.severity
      description: The severity level of the alert.
      type: Number
    - contextPath: ForescoutEyeInspect.Alert.status
      description: The status of the alert.
      type: String
  - arguments:
    - description: The unique ID of the alert to get the PCAP of.
      name: alert_id
      required: true
    description: Retrieves the PCAP file associated to a given alert.
    name: forescout-ei-alert-pcap-get
    outputs:
    - contextPath: InfoFile.Size
      description: The size of the file.
      type: Number
    - contextPath: InfoFile.Name
      description: The name of the file.
      type: String
    - contextPath: InfoFile.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: InfoFile.Info
      description: File information.
      type: String
    - contextPath: InfoFile.Type
      description: The file type.
      type: String
    - contextPath: InfoFile.Extension
      description: The file extension.
      type: String
  - arguments:
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    - auto: PREDEFINED
      defaultValue: false
      description: Whether to retrieve all the sensors (ICS Patrol and passive) or only the passive ones.
      name: all_sensors
      predefined:
      - "true"
      - "false"
    - description: A comma-separated list of sensor names. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: name
    - description: A comma-separated list of IP addresses or domain names. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: address
    - description: A comma-separated list of listening ports. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: port
    - auto: PREDEFINED
      description: A comma-separated list of sensor types. The command will filter the results according to the provided values.
      isArray: true
      name: type
      predefined:
      - PASSIVE
      - PATROL
    - auto: PREDEFINED
      description: A comma-separated list of sensor states. The command will filter the results from the returned page according to the provided values.
      isArray: true
      name: state
      predefined:
      - OPERATIVE_ON
      - OPERATIVE_OFF
      - DISCONNECTED
      - LICENSE_EXPIRED
      - LICENSE_INVALID
      - UNKNOWN
    description: Retrieves information about the sensors associated to the eyeInspect CC.
    name: forescout-ei-sensor-list
    outputs:
    - contextPath: ForescoutEyeInspect.Sensor.id
      description: Unique ID of the sensor in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.Sensor.name
      description: Name of the sensor.
      type: String
    - contextPath: ForescoutEyeInspect.Sensor.address
      description: IP address or domain name of the sensor's management interface.
      type: String
    - contextPath: ForescoutEyeInspect.Sensor.port
      description: TCP port number on which the sensor is listening for incoming CC connections.
      type: Number
    - contextPath: ForescoutEyeInspect.Sensor.type
      description: Type of the sensor (PASSIVE / PATROL).
      type: String
    - contextPath: ForescoutEyeInspect.Sensor.sensor_version
      description: Version of the eyeInspect sensor software.
      type: String
    - contextPath: ForescoutEyeInspect.Sensor.state
      description: Current status of the sensor.
      type: String
    - contextPath: ForescoutEyeInspect.Sensor.health_status
      description: Current health status of the sensor.
      type: String
  - arguments:
    - description: The unique ID of the sensor to query for modules.
      name: sensor_id
      required: true
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    description: Retrieves information about the modules of the specified sensor.
    name: forescout-ei-sensor-module-list
    outputs:
    - contextPath: ForescoutEyeInspect.SensorModule.id
      description: Unique ID of the module in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.SensorModule.sensor_id
      description: Unique ID of the sensor the module is deployed in, in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.SensorModule.engine
      description: Name of the engine powering the module in the sensor.
      type: String
    - contextPath: ForescoutEyeInspect.SensorModule.singleton
      description: Whether the module can only have one single instance or can have multiple instances in the sensor.
      type: Boolean
    - contextPath: ForescoutEyeInspect.SensorModule.name
      description: The name of the module.
      type: String
    - contextPath: ForescoutEyeInspect.SensorModule.description
      description: The description of the module.
      type: String
    - contextPath: ForescoutEyeInspect.SensorModule.started
      description: Whether the module is started or paused in the sensor.
      type: Boolean
    - contextPath: ForescoutEyeInspect.SensorModule.operational_mode
      description: Operational mode of the module in the sensor.
      type: String
    - contextPath: ForescoutEyeInspect.SensorModule.date_last_update
      description: Timestamp in ISO format of when the module was last updated.
      type: String
  - arguments:
    - description: The unique ID of the sensor that has the module to update.
      name: sensor_id
      required: true
    - description: The unique ID of the module to update.
      name: module_id
      required: true
    - description: Name of the module.
      name: name
    - description: Description of the module.
      name: description
    - auto: PREDEFINED
      description: If set to true, the module will be started. If set to false, the module will be paused.
      name: started
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      description: Changes the operational mode of the module to the specified value.
      name: operational_mode
      predefined:
      - Learning
      - Detecting
    description: Changes the specified properties of the specified module.
    name: forescout-ei-sensor-module-update
    outputs:
    - contextPath: ForescoutEyeInspect.SensorModule.id
      description: Unique ID of the module in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.SensorModule.sensor_id
      description: Unique ID of the sensor the module is deployed in, in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.SensorModule.engine
      description: Name of the engine powering the module in the sensor.
      type: String
    - contextPath: ForescoutEyeInspect.SensorModule.singleton
      description: Whether the module can only have one single instance or can have multiple instances in the sensor.
      type: Boolean
    - contextPath: ForescoutEyeInspect.SensorModule.name
      description: The name of the module.
      type: String
    - contextPath: ForescoutEyeInspect.SensorModule.description
      description: The description of the module.
      type: String
    - contextPath: ForescoutEyeInspect.SensorModule.started
      description: Whether the module is started or paused in the sensor.
      type: Boolean
    - contextPath: ForescoutEyeInspect.SensorModule.operational_mode
      description: Operational mode of the module in the sensor.
      type: String
    - contextPath: ForescoutEyeInspect.SensorModule.date_last_update
      description: Timestamp in ISO format of when the module was last updated.
      type: String
  - arguments:
    - description: The unique ID of the sensor of the module to delete.
      name: sensor_id
      required: true
    - description: The unique ID of the module to delete.
      name: module_id
      required: true
    description: Deletes the specified module from the specified sensor and from the eyeInspect CC database.
    name: forescout-ei-sensor-module-delete
    outputs: []
  - arguments:
    - description: The unique ID of the sensor for which to retrieve the IP blacklist.
      name: sensor_id
      required: true
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    description: Retrieves the IP blacklist from the Industrial Threat Library of the specified sensor.
    name: forescout-ei-ip-blacklist-get
    outputs:
    - contextPath: ForescoutEyeInspect.IPBlacklist.address
      description: A blacklisted IP address.
      type: String
    - contextPath: ForescoutEyeInspect.IPBlacklist.comment
      description: A comment provided by the user. The comment might be empty.
      type: String
  - arguments:
    - description: The unique ID of the sensor for which to update the IP blacklist.
      name: sensor_id
      required: true
    - description: The IP address to add to the blacklist.
      name: address
      required: true
    - description: A comment about the blacklisted IP address.
      name: comment
    description: Adds a new entry to the IP blacklist from the Industrial Threat Library of the specified sensor.
    name: forescout-ei-ip-blacklist-add
    outputs: []
  - arguments:
    - description: The unique ID of the sensor that contains the domain blacklist.
      name: sensor_id
      required: true
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    description: Retrieves the domain name blacklist from the Industrial Threat Library of the specified sensor.
    name: forescout-ei-domain-blacklist-get
    outputs:
    - contextPath: ForescoutEyeInspect.DomainBlacklist.domain_name
      description: A blacklisted domain name.
      type: String
    - contextPath: ForescoutEyeInspect.DomainBlacklist.comment
      description: A comment provided by the user. The comment might be empty.
      type: String
  - arguments:
    - description: The unique ID of the sensor of the domain to be updated.
      name: sensor_id
      required: true
    - description: The domain name to add to the blacklist.
      name: domain_name
      required: true
    - defaultValue: Command and Control server
      description: A comment about the domain name.
      name: comment
    description: Adds a new entry to the domain name blacklist from the Industrial Threat Library of the specified sensor.
    name: forescout-ei-domain-blacklist-add
    outputs: []
  - arguments:
    - description: The unique ID of the sensor for which to retrieve the SSL client blacklist.
      name: sensor_id
      required: true
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    description: Retrieves the SSL client application blacklist from the Industrial Threat Library of the specified sensor.
    name: forescout-ei-ssl-client-blacklist-get
    outputs:
    - contextPath: ForescoutEyeInspect.SSLClientBlacklist.sensor_id
      description: The unique ID of the sensor for which to retrieve the SSL client.
      type: Number
    - contextPath: ForescoutEyeInspect.SSLClientBlacklist.application_name
      description: The application name related to the entry.
      type: String
    - contextPath: ForescoutEyeInspect.SSLClientBlacklist.ja3_hash
      description: The JA3 hash of a blacklisted client application.
      type: String
    - contextPath: ForescoutEyeInspect.SSLClientBlacklist.comment
      description: A comment provided by the user. The comment might be empty.
      type: String
  - arguments:
    - description: The unique ID of the sensor of the SSL client.
      name: sensor_id
      required: true
    - description: The related application name to add to the blacklist.
      name: application_name
      required: true
    - description: The JA3 hash of a blacklisted client application.
      name: ja3_hash
      required: true
    - description: Comment about the SSL client application.
      name: comment
    description: Adds a new entry to the SSL client application blacklist from the Industrial Threat Library of the specified sensor.
    name: forescout-ei-ssl-client-blacklist-add
    outputs: []
  - arguments:
    - description: The unique ID of the sensor for which to retrieve the file operation blacklist.
      name: sensor_id
      required: true
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    description: Retrieves the file operation blacklist from the Industrial Threat Library of the specified sensor.
    name: forescout-ei-file-operation-blacklist-get
    outputs:
    - contextPath: ForescoutEyeInspect.FileOperationBlacklist.matching_type
      description: The way the file or folder should be matched.
      type: String
    - contextPath: ForescoutEyeInspect.FileOperationBlacklist.file_or_folder
      description: The name of the file or folder the entry applies to.
      type: String
    - contextPath: ForescoutEyeInspect.FileOperationBlacklist.operation
      description: The name of the file operation.
      type: String
    - contextPath: ForescoutEyeInspect.FileOperationBlacklist.comment
      description: A comment provided by the user. The comment might be empty.
      type: String
  - arguments:
    - description: The unique ID of the sensor for which to update the file operation blacklist.
      name: sensor_id
      required: true
    - auto: PREDEFINED
      description: The way the file or folder should be matched.
      name: matching_type
      predefined:
      - CONTAINS
      - STARTS_WITH
      - ENDS_WITH
      - MATCHES
      - REGEX
      required: true
    - description: The name of the file or folder the entry applies to.
      name: file_or_folder
      required: true
    - auto: PREDEFINED
      description: The name of the file operation.
      name: operation
      predefined:
      - WRITE
      - READWRITE
      required: true
    - description: A comment provided by the user.
      name: comment
    description: Adds entries to the file operation blacklist from the Industrial Threat Library of the specified sensor.
    name: forescout-ei-file-operation-blacklist-add
    outputs: []
  - arguments: []
    description: Retrieves information about all monitored Command Center resources and their health status excluding the logs.
    name: forescout-ei-diagnostics-information-get
    outputs:
    - contextPath: ForescoutEyeInspect.CCInfo.ip_address
      description: IP address of the Command Center.
      type: String
    - contextPath: ForescoutEyeInspect.CCInfo.hostname
      description: Hostname of the Command Center.
      type: String
    - contextPath: ForescoutEyeInspect.CCInfo.open_ports
      description: TCP open port number of the Command Center.
      type: String
    - contextPath: ForescoutEyeInspect.CCInfo.cc_version
      description: Version of the Command Center software.
      type: String
    - contextPath: ForescoutEyeInspect.CCInfo.health_status
      description: Current health status of the Command Center.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: true
      description: Whether to include Command Center diagnostic logs inside the downloaded zip, in addition to sensors logs. If this value is false, the downloaded zip won't contain the general server logs, but only the logs about the sensors.
      name: cc_info
      predefined:
      - "true"
      - "false"
    - description: Include logs from a specific sensor by its ID, or all sensors (by specifying All).
      name: sensor_id
    description: Download the ZIP file that contains diagnostic logs of the Command Center.
    name: forescout-ei-diagnostic-logs-get
    outputs:
    - contextPath: InfoFile.Size
      description: The size of the file.
      type: Number
    - contextPath: InfoFile.Name
      description: The name of the file.
      type: String
    - contextPath: InfoFile.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: InfoFile.Info
      description: File information.
      type: String
    - contextPath: InfoFile.Type
      description: The file type.
      type: String
    - contextPath: InfoFile.Extension
      description: The file extension.
      type: String
  - arguments:
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    description: Get all group policies.
    name: forescout-ei-group-policy-list
    outputs:
    - contextPath: ForescoutEyeInspect.GroupPolicy.id
      description: The ID of the policy.
      type: Number
    - contextPath: ForescoutEyeInspect.GroupPolicy.name
      description: The name of the group policy.
      type: String
    - contextPath: ForescoutEyeInspect.GroupPolicy.description
      description: The description of the group policy.
      type: String
    - contextPath: ForescoutEyeInspect.GroupPolicy.constraints
      description: List of constraints of the policy.
      type: Unknown
  - arguments:
    - description: The name of the group policy.
      name: name
      required: true
    - description: The description of the group policy.
      name: description
      required: true
    - description: "List of constraints of the policy.\n\nEach policy constraint is an object that includes the following fields:\n* type: The type of the constraint. Possible values are os_version, firmware_version, open_ports.\n* operator: The operator of the constraint. Possible values are equals (all types), allowed (open_ports) and contains (os_version, firmware_version).\n* os_version: The value of the OS version for the os_version type.\n* firmware_version: The value of the firmware version for the firmware_version type.\n* open_ports_tcp: Comma-separated list of ports or range of ports for the open_ports type. Example: \"10, 20-30\".\n* open_ports_udp: Comma-separated list of ports or range of ports for the open_ports type. Example: \"10, 20-30\".\n\nExample for list of policy constraints: [{ \"type\": \"os_version\", \"operator\": \"contains\", \"os_version\": \"Windows\" }]."
      isArray: true
      name: constraints
      required: true
    description: Create a new group policy.
    name: forescout-ei-group-policy-create
    outputs:
    - contextPath: ForescoutEyeInspect.GroupPolicy.id
      description: The ID of the policy.
      type: Number
    - contextPath: ForescoutEyeInspect.GroupPolicy.name
      description: The name of the group policy.
      type: String
    - contextPath: ForescoutEyeInspect.GroupPolicy.description
      description: The description of the group policy.
      type: String
    - contextPath: ForescoutEyeInspect.GroupPolicy.constraints
      description: List of constraints of the policy.
      type: Unknown
  - arguments:
    - description: The unique ID of the policy to be updated.
      name: policy_id
      required: true
    - description: The name of the group policy.
      name: name
      required: true
    - description: The description of the group policy.
      name: description
      required: true
    - description: "List of constraints of the policy.\n\nEach policy constraint is an object that includes the following fields:\n* type: The type of the constraint. Possible values are os_version, firmware_version, open_ports.\n* operator: The operator of the constraint. Possible values are equals (all types), allowed (open_ports) and contains (os_version, firmware_version).\n* os_version: The value of the OS version for the os_version type.\n* firmware_version: The value of the firmware version for the firmware_version type.\n* open_ports_tcp: Comma-separated list of ports or range of ports for the open_ports type. Example: \"10, 20-30\".\n* open_ports_udp: Comma-separated list of ports or range of ports for the open_ports type. Example: \"10, 20-30\".\n\nExample for list of policy constraints: [{ \"type\": \"os_version\", \"operator\": \"contains\", \"os_version\": \"Windows\" }]."
      isArray: true
      name: constraints
      required: true
    description: "Update a group policy. Note: Since the entire policy will be overridden, all fields are required."
    name: forescout-ei-group-policy-update
    outputs:
    - contextPath: ForescoutEyeInspect.GroupPolicy.id
      description: The ID of the policy.
      type: Number
    - contextPath: ForescoutEyeInspect.GroupPolicy.name
      description: The name of the group policy.
      type: String
    - contextPath: ForescoutEyeInspect.GroupPolicy.description
      description: The description of the group policy.
      type: String
    - contextPath: ForescoutEyeInspect.GroupPolicy.constraints
      description: List of constraints of the policy.
      type: Unknown
  - arguments:
    - description: The unique ID of the policy for which the hosts will be added to.
      name: policy_id
      required: true
    description: Delete a group policy.
    name: forescout-ei-group-policy-delete
    outputs: []
  - arguments:
    - description: The unique ID of the policy for which the hosts will be added to.
      name: policy_id
      required: true
    - auto: PREDEFINED
      description: The type of the filter.
      name: filter_type
      predefined:
      - address
      - host_mac_address_exact
      - vendor_model
      - os_version
      - firmware_version
      - ip_reuse_domain
      required: true
    - description: The value of the filter.
      name: filter_value
      required: true
    description: Add all hosts not assigned to any policy (individual or group) matching the filter to the group policy.
    name: forescout-ei-group-policy-hosts-assign
    outputs: []
  - arguments:
    - description: The unique ID of the policy for which the hosts will be removed.
      name: policy_id
      required: true
    - auto: PREDEFINED
      description: The type of the filter.
      name: filter_type
      predefined:
      - address
      - host_mac_address_exact
      - vendor_model
      - os_version
      - firmware_version
      - ip_reuse_domain
      required: true
    - description: The value of the filter.
      name: filter_value
      required: true
    description: Unassign all hosts assigned to the group policy matching the filter.
    name: forescout-ei-group-policy-hosts-unassign
    outputs: []
  - arguments:
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    description: Get all IP reuse domains.
    name: forescout-ei-ip-reuse-domain-list
    outputs:
    - contextPath: ForescoutEyeInspect.IPReuseDomain.id
      description: The ID of the IP reuse domain.
      type: Number
    - contextPath: ForescoutEyeInspect.IPReuseDomain.name
      description: The name of the IP reuse domain.
      type: String
    - contextPath: ForescoutEyeInspect.IPReuseDomain.description
      description: The description of the IP reuse domain.
      type: String
    - contextPath: ForescoutEyeInspect.IPReuseDomain.address
      description: The address of the IP reuse domain.
      type: String
    - contextPath: ForescoutEyeInspect.IPReuseDomain.mask
      description: The number of bits in the mask.
      type: Number
    - contextPath: ForescoutEyeInspect.IPReuseDomain.vlan_ids
      description: VLAN IDs of the IP reuse domain.
      type: String
  - arguments:
    - defaultValue: 1
      description: The page number of the results to retrieve (minimum is 1).
      name: page
    - defaultValue: 50
      description: Maximum number of records to retrieve.
      name: limit
    - description: List only records with the host_id property equal to the provided parameter.
      name: host_id
    - description: List only records with the timestamp property greater than or equal to the specified value. For example, 2020-05-26T15:00:00.000Z+01:00.
      name: start_timestamp
    - description: List only records with the timestamp property less than or equal to the specified value. 2020-05-26T15:00:00.000Z+01:00.
      name: end_timestamp
    - description: List only records with the event_type_id property equal to the specified value.
      name: event_type_id
      auto: PREDEFINED
      predefined:
      - hostcl_new_host
      - hostcl_new_mac
      - hostcl_new_name
      - hostcl_new_role
      - hostcl_new_vendor_model
      - hostcl_new_os_version
      - hostcl_changed_os_version
      - hostcl_new_client_proto
      - hostcl_new_client_port
      - hostcl_new_server_proto
      - hostcl_new_server_port
      - hostcl_new_label
      - hostcl_new_fw_version
      - hostcl_changed_fw_version
      - hostcl_new_hw_version
      - hostcl_changed_hw_version
      - hostcl_changed_serial
      - hostcl_new_project
      - hostcl_changed_project
      - hostcl_new_module
      - hostcl_changed_module_name
      - hostcl_changed_module_type
      - hostcl_changed_module_vendor
    - description: List only records with the event_type_id property equal to the specified value.
      name: event_category
      auto: PREDEFINED
      predefined:
      - PROPERTIES
      - CONFIGURATION
      - ALL
    description: Retrieves information about the changes of host properties and configuration from the eyeInspect CC database.
    name: forescout-ei-hosts-changelog-list
    outputs:
    - contextPath: ForescoutEyeInspect.HostChangeLog.id
      description: The unique ID of the HostChangeLog in the eyeInspect CC.
      type: Number
    - contextPath: ForescoutEyeInspect.HostChangeLog.timestamp
      description: Timestamp in ISO format of when the host change was detected.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.event_type_id
      description: An identifier of the type of change detected.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.event_type_name
      description: A human readable representation of the type of change detected.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.event_category
      description: A more general type of the change detected.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.host_id
      description: The unique ID of the host in the eyeInspect CC database in which the change was detected.
      type: Number
    - contextPath: ForescoutEyeInspect.HostChangeLog.information_source
      description: The source of information for the detected change.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.sensor_id
      description: In case the detected change was reported from a sensor, the unique ID in the eyeInspect CC database of the sensor reporting the information.
      type: Number
    - contextPath: ForescoutEyeInspect.HostChangeLog.username
      description: In case the detected change was reported from a eyeInspect user, the username of the user reporting the information.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.old_value
      description: The old value of the host property.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.new_value
      description: The new value of the host property.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.host_address
      description: The IP address, or nested address (in case of a nested device) of the host.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.host_vlan
      description: The VLAN ID of the host (only present if the process_vlan_tags option is enabled in the sensor).
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.host_name
      description: The main name of the host.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.host_ip_reuse_domain_id
      description: The unique ID of the IP Reuse Domain the host is in.
      type: String
    - contextPath: ForescoutEyeInspect.HostChangeLog.host_mac_addresses
      description: The MAC addresses associated to the host.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: "-"
  subtype: python3
  type: python
fromversion: 6.0.1
tests:
- No tests (auto formatted)