Enforcement actions often rely on specific integrated modules (like NAC, firewall, or switch control). If the module required for the segment change (e.g., Network Integration) isn’t installed or licensed, the policy logic will work but the action will fail silently. Checking this is more targeted than restarting services or re-checking conditions you’ve already verified.

Patch information is not discovered by basic network scanning. It requires an active inventory scan (via modules like EyeInspect or an integrated vulnerability scanner) to populate the relevant Host Properties. Without this scan data, the property for the missing patch will never be true, so the group won’t populate regardless of the logic used.

The Device History is an audit trail for each individual endpoint. It logs property changes, policy hits, and enforcement actions (like segment changes) with precise timestamps. This provides direct, incontrovertible evidence linking the specific device’s non-compliant state to the specific restrictive action taken against it.

A common pitfall is associating scan results with the wrong scope. If a vulnerability scan result is mistakenly linked to an IP range or network segment instead of individual hosts, the ‘high-risk vulnerability’ property becomes true for *all* devices in that scope, causing mass, incorrect enforcement. The first step is to verify how the vulnerability data is being mapped to endpoints.

The ‘Property Changed’ trigger is the correct mechanism. It allows a policy to fire not just when a property has a certain value, but specifically when that property’s value *changes*. You can further refine it to fire only when the change is from one specific value (Low) to another (Critical), making it ideal for detecting escalations in risk state.

In a NAC context, ‘Pending’ state usually means the device is visible on the network but has not yet satisfied the required access policy, which often includes 802.1X or captive portal user authentication. The device is denied a normal IP address (often given a quarantined one) until the user successfully authenticates, at which point Forescout can apply the appropriate access policy.

IP addresses are dynamic (DHCP, VPN), and MAC addresses can be spoofed. Host Properties (like OS, logged-in user, running services, vulnerability status) define the device’s identity and risk profile in a meaningful way. Policies based on properties are more resilient, accurate, and align security actions with the device’s actual characteristics, not its temporary network location.

The ‘Change Monitoring Frequency’ action is a built-in, granular response. It allows you to temporarily increase the rate of active interrogation (e.g., from every 60 minutes to every 5 minutes) specifically for the compromised device. This is efficient because it focuses resources only on the high-risk endpoint without affecting the performance of monitoring the entire network.

Switch SPAN ports can become oversubscribed during periods of high traffic, leading to dropped packets and incomplete visibility. Network TAPs are passive, hardware-based devices that provide a guaranteed, full-fidelity copy of all traffic (both transmit and receive sides) without risk of packet loss. This ensures the Forescout sensor has complete data for accurate classification and detection.

Enforcement actions often rely on specific integrated modules (like NAC, firewall, or switch control). If the module required for the segment change (e.g., Network Integration) isn’t installed or licensed, the policy logic will work but the action will fail silently. Checking this is more targeted than restarting services or re-checking conditions you’ve already verified.0