CYBER DR / Forescout Knowledge Base

Cyber DR indexed public knowledge. Customer identifiers and private addressing are redacted.

\r\n\r\n

Service Unavailable

\r\n\r\n

The server is temporarily unable to service your\r\n\r\nrequest due to maintenance downtime or capacity\r\n\r\nproblems. Please try again later.

\r\n\r\n","u":"Switch-API-5XX-Error-or-Rate-Limit-Error-or-blank-page","d":"2023-07-14","c":"2023-06-16","v":7,"ver":1,"id":"ka06S000000tPeCQAU"},{"k":"kb","n":"000012908","t":"Troubleshooting network connectivity issues related to network interfaces using SFP modules in CounterACT.","b":"If you're experiencing network connectivity issues with a network interface using an SFP (Small Form-Factor Pluggable) module in CounterACT, this guide provides step-by-step troubleshooting instructions. These steps are intended for general users with a working knowledge of the command line and will help you diagnose and resolve common network connectivity issues related to SFP modules.","u":"Troubleshooting-network-connectivity-issues-related-to-network-interfaces-using-SFP-modules-in-CounterACT","d":"2023-07-14","c":"2023-06-16","v":7,"ver":1,"id":"ka06S000000tL3fQAE"},{"k":"kb","n":"000012912","t":"OSX plugin fails to manage Mac hosts via Secure Connector when ZScaler Client Connector is active","b":"","u":"OSX-plugin-fails-to-manage-Mac-hosts-via-Secure-Connector-when-ZScaler-Client-Connector-is-active","d":"2023-06-27","c":"2023-06-21","v":7,"ver":1,"id":"ka06S000000tL5RQAU"},{"k":"kb","n":"000012913","t":"Join appliance to multiple child domains under the same parent domain","b":"If the appliance successfully joins one of the child domains, it will fail to join the second child domain.\r\nThe reason is that a new computer account and two SPN records will be created after the appliance joins one of the child domains.\r\nThe duplicated SPN record needs to be removed.","u":"Join-appliance-to-multiple-child-domains-under-the-same-parent-domain","d":"2023-07-11","c":"2023-06-23","v":7,"ver":1,"id":"ka06S000000tQYPQA2"},{"k":"kb","n":"000012917","t":"The best practice to join the Forescout appliance to the Domain","b":"Here is a best practice to join the Forescout appliance to the Domain.\r\nThe hostname of the sample Forescout appliance is: CT23D.\r\nThe AD domain name is: jackymba.com.","u":"The-best-practice-to-join-the-Forescout-appliance-to-the-Domain","d":"2023-07-11","c":"2023-06-24","v":7,"ver":1,"id":"ka0UY00000041iHYAQ"},{"k":"kb","n":"000012921","t":"Running Dashboards from the GUI Console Fails","b":"","u":"Running-Dashboards","d":"2023-06-27","c":"2023-06-27","v":7,"ver":1,"id":"ka06S000000tL9YQAU"},{"k":"kb","n":"000012922","t":"Where is the tech-support file saved on the appliance?","b":"With Appliances that do not have internet access, the tech-support file cannot be sent directly to our snapshot server and will be saved on the appliance for you to retrieve/copy and send manually.\r\n\r\nDepending on the how the tech-support was run, on which prompt you are currently on, the tech-support will be saved on a different locations.","u":"Where-is-the-tech-support-file-saved-on-the-appliance","d":"2023-06-28","c":"2023-06-28","v":7,"ver":1,"id":"ka06S000000tLB0QAM"},{"k":"kb","n":"000012924","t":"Linux host classified as Windows even though SecureConnector was showing as manageable","b":"","u":"Linux-host-classified-as-Windows-even-though-SecureConnector-was-showing-as-manageable","d":"2023-07-14","c":"2023-06-28","v":7,"ver":1,"id":"ka06S000000tLBUQA2"},{"k":"kb","n":"000012925","t":"How to resolve certain hosts not getting updated in the eyeInspect Command Center","b":"In eyeInspect versions 5.1.0, 5.1.0-h01, 5.0.0-h01 and 5.0.0-h02 there are some issues with regard to fetching Host and Link updates from sensors, causing some hosts to potentially not get updated at all. This article explains how to resolve this issue.","u":"How-to-resolve-certain-hosts-not-getting-updated-in-the-eyeInspect-Command-Center","d":"2023-10-14","c":"2023-06-28","v":7,"ver":1,"id":"ka06S000000tLBeQAM"},{"k":"kb","n":"000012928","t":"How to identify and trim excessive logs on the appliances","b":"This article explores the process of identifying and trimming excessive logs on Forescout appliances. \r\nIt provides techniques to optimize log storage which is turn will improve system performance, and enable efficient troubleshooting. \r\nThe aim of the article is to empower you with the knowledge and skills needed to effectively manage log files through detailed insights and step-by-step instructions.\r\n\r\nDisclaimer: Exercise caution when using the command that performs log file removal, as it permanently deletes files. \r\nDouble-check the path and confirm that you are targeting the correct log files before executing any commands.","u":"How-to-identify-and-trim-excessive-logs-on-the-appliances","d":"2023-07-14","c":"2023-06-29","v":7,"ver":1,"id":"ka06S000000tLC3QAM"},{"k":"kb","n":"000012934","t":"Testing User Directory Plugin with DNS Detection enabled","b":"When troubleshooting LDAP, it may be helpful to understand how server selection takes place using DNS Detection when there are multiple servers in the environment.","u":"DNS-Detection-behavior-with-multiple-DNS-servers","d":"2023-07-14","c":"2023-07-01","v":7,"ver":1,"id":"ka06S000000tLDkQAM"},{"k":"kb","n":"000012935","t":"Failed to deploy OVF package:Transfer failed: Invalid response code: 500.","b":"\"Deploy OVF template\r\n\r\nStatus\r\n\r\nFailed to deploy OVF package. ThrowableProxy.cause A general system error occurred: Transfer failed: Invalid response code: 500.\r\n\r\nThis error pops up after the large file transfer to ESX storage, when it's trying to complete and register the VM. Not very definitive.\r\n\r\nAfter it fails, it deletes the data\"","u":"Failed-to-deploy-OVF-packageThrowableProxy-cause-A-general-system-error-occurred","d":"2023-07-14","c":"2023-07-02","v":7,"ver":1,"id":"ka06S000000tLE9QAM"},{"k":"kb","n":"000012936","t":"Radius self-signed certificate best practices","b":"With a new Forescout deployment, the RADIUS Plugin generates a self-signed RADIUS server certificate that is issued by the Forescout certificate authority (CA)","u":"Radius-self-signed-certificate-best-practices","d":"2023-07-14","c":"2023-07-02","v":7,"ver":1,"id":"ka06S000000tLEAQA2"},{"k":"kb","n":"000012938","t":"How to change Company email field in license for Command Center","b":"We can see company email field in GUI, but cannot change it using cli command.\r\nThis parameter is in the license itself.\r\nThere is no command or any way to change company mail ID.","u":"To-change-company-email-in-command-center-license","d":"2024-09-09","c":"2023-07-05","v":7,"ver":1,"id":"ka06S000000tLG5QAM"},{"k":"kb","n":"000012939","t":"Extra-large VCT-20000 option not available in Forescout device model condition.","b":"Checked in version 8.4.2. There is no extra-large VCT-20000 option available in Forescout device model condition. Due to this Health Monitor does not work properly because in Forescout device models we are missing the Virtual: Extra-large/VCT-20000 in condition. Also checked in document there is no extra-large group / Category listed in document also. \r\n\r\nhttps://docs.forescout.com/bundle/admin-guide-8-3/page/admin-guide-8-3.Health-Monitoring-Dashboard.html#pID0E05GF0HA","u":"Extra-large-VCT-20000-option-not-available-in-Forescout-device-model-condition","d":"2024-08-16","c":"2023-07-05","v":7,"ver":1,"id":"ka06S000000tLGAQA2"},{"k":"kb","n":"000012942","t":"Do not run fstool va_test command in cliadmin mode","b":"It is recommended that customers do not run \"fstool va_test\" commands in cliadmin mode. \r\nIt must be run in root access mode because cliadmin mode does not have sufficient permissions to run this command.","u":"Do-not-run-fstool-va-test-command-in-cliadmin-mode","d":"2023-07-14","c":"2023-07-10","v":7,"ver":1,"id":"ka06S000000tLJ9QAM"},{"k":"kb","n":"000012944","t":"Forescout 8.4.x, 8.5.x, 9.1.x - License Email Alert","b":"How to Stop License Expiry or Invalid Email Alerts After Upgrade/License Renewal.","u":"Forescout-8-4-x-8-5-x-9-1-x---License-Email-Alert","d":"2023-07-17","c":"2023-07-10","v":7,"ver":1,"id":"ka0R7000000PuNBIA0"},{"k":"kb","n":"000012945","t":"Radius self-signed certificate issuer chain does not match","b":"The Issuer Chain of a self-signed certificate has a 2-month validity only. There are other environments where the Issuer Chain has a 1-year validity same as the Default Radius Certificate.\r\n\t\r\n Default Radius Certificate Issuer Chain\r\n\r\nTP 1-year validity 2-month validity\r\nVM 1-year validity 1-year validity\r\nClient 1 1-year validity 1-year validity\r\n\r\nClient 2 1-year validity 1-year validity","u":"Radius-self-signed-certificate-issuer-chain-does-not-match","d":"2023-07-17","c":"2023-07-11","v":7,"ver":1,"id":"ka06S000000tLKlQAM"},{"k":"kb","n":"000012946","t":"FSLog Directory is Full","b":"","u":"FSLog-Directory-is-Full","d":"2023-07-17","c":"2023-07-11","v":7,"ver":1,"id":"ka06S000000tPlDQAU"},{"k":"kb","n":"000012948","t":"How to exclude a specific Mac address from the Mac Spoofing Tracking policy","b":"Use Case:\r\nThe customer is doing the IT maintenance, and they are reimaging a machine.\r\nAfter the machine is reimaged, its hostname, OS version and DHCP fingerprint may change.\r\nIf this customer enables the Mac Spoofing Tracking policy and enables the action, this machine will be blocked.\r\nThe customer wants to exclude this reimaged machine from the Mac Spoofing Tracking policy.","u":"How-to-exclude-a-specific-Mac-address-from-the-Mac-Spoofing-Tracking-policy","d":"2023-07-17","c":"2023-07-13","v":7,"ver":1,"id":"ka06S000000tLNLQA2"},{"k":"kb","n":"000012950","t":"Hosts on a Cisco IE2000 switch (IOS v15.2(7)E4) being reported on the wrong port.","b":"","u":"Hosts-on-a-Cisco-IE2000-switch-IOS-v15-2-7-E4-being-reported-on-the-wrong-port","d":"2023-07-17","c":"2023-07-14","v":7,"ver":1,"id":"ka06S000000tLOsQAM"},{"k":"kb","n":"000012951","t":"Policy Actions \"Run Scripts on Macintosh\" returns error (Exit Code 127) on macOS Endpoint","b":"","u":"Policy-Actions-Run-Scripts-on-Macintosh-returns-error-Exit-Code-127-on-macOS-Endpoint","d":"2023-07-14","c":"2023-07-14","v":7,"ver":1,"id":"ka06S000000tLOxQAM"},{"k":"kb","n":"000012952","t":"Radius module does not try other CoA/PoD after first NAK or no response from Cisco Meraki/switch","b":"","u":"Radius-module-does-not-try-other-CoA-PoD-after-one-failure","d":"2023-07-17","c":"2023-07-14","v":7,"ver":1,"id":"ka06S000000tLP2QAM"},{"k":"kb","n":"000012954","t":"How to check NTLMv1 is disabled on the endpoint","b":"Many customers have the security request to disable the NTLMv1 on the endpoint who joins the Domain, and they implemented the setting via the Domain GPO.\r\nNow they need to query all the endpoints to verify NTLMv1 is disabled on every endpoint.","u":"How-to-check-NTLMv1-is-disabled-on-the-endpoint","d":"2023-07-17","c":"2023-07-17","v":7,"ver":1,"id":"ka06S000000tLQAQA2"},{"k":"kb","n":"000012956","t":"EyeInspect sensor not seeing TCP traffic only UDP","b":"","u":"EyeInspect-sensor-notseeing-TCP-traffic-only-UDP","d":"2023-10-14","c":"2023-07-24","v":7,"ver":1,"id":"ka06S000000tLWwQAM"},{"k":"kb","n":"000012968","t":"SNMPv3 is not working with our configuration to monitor the health of our CounterACT Appliances with Solarwinds Orion","b":"","u":"SNMPv3-is-not-working-with-our-configuration-to-monitor-the-health-of-our-CounterACT-Appliances-with-Solarwinds-Orion","d":"2023-10-14","c":"2023-08-03","v":7,"ver":1,"id":"ka06S000001YwW9QAK"},{"k":"kb","n":"000012970","t":"Best Practices When Reimaging an Appliance","b":"This article will describe the actions and precautions that should be taken to avoid losing any configurations before reimaging a Forescout appliance.","u":"Best-Practices-when-reimaging-an-appliance","d":"2023-08-15","c":"2023-08-08","v":7,"ver":1,"id":"ka0UY0000003u2TYAQ"},{"k":"kb","n":"000012972","t":"How to update the SC agent on the MacOS","b":"Many customers update the OSX plugin during their Forescout maintenance but don’t update the SC agent accordingly.\r\nThe SC agent on the MacOS won’t be updated automatically.\r\nIt is a best practice to always update the SC agent after updating the OSX plugin.","u":"How-to-update-the-SC-agent-on-the-MacOS","d":"2023-08-15","c":"2023-08-10","v":7,"ver":1,"id":"ka06S000001YwZIQA0"},{"k":"kb","n":"000012974","t":"Getting an (RSA Key error) message when l try to ssh from the EM to any of the managed appliances","b":"","u":"Getting-an-RSA-Key-error-message-when-l-try-to-ssh-from-the-EM-to-any-of-the-managed-appliances","d":"2023-10-14","c":"2023-08-11","v":7,"ver":1,"id":"ka06S000001YwZwQAK"},{"k":"kb","n":"000012975","t":"Query ARP Failed for Aruba HPe Switch","b":"","u":"Query-ARP-Failed-for-Aruba-HPe-Switch","d":"2023-10-14","c":"2023-08-12","v":7,"ver":1,"id":"ka06S000001YwaLQAS"},{"k":"kb","n":"000012976","t":"Windows SecureConnector connects to the FS appliance successfully after verifying the appliance’s fingerprint or the HPS cert","b":"When the Windows SecureConnector connects to the FS appliance, the SC will check either the appliance’s fingerprint or if the HPS cert is trusted.","u":"Windows-SecureConnector-connects-to-the-FS-appliance-successfully-after-verifying-the-appliance-s-fingerprint-or-the-HPS-cert","d":"2023-08-15","c":"2023-08-14","v":7,"ver":1,"id":"ka06S000001YwafQAC"},{"k":"kb","n":"000012977","t":"Report Not Generated - CounterAct Scheduled Report","b":"","u":"Report-Not-Generated","d":"2023-08-15","c":"2023-08-15","v":7,"ver":1,"id":"ka06S000001YwbiQAC"},{"k":"kb","n":"000012978","t":"COA action doesn’t work on the WLC","b":"Sometimes the COA action doesn’t work.\r\nThe customer needs to ensure the Firewall between the Radius client (e.g., Switch, WLC, AP, etc.) and the Radius server (e.g., Forescout appliance with Radius service running) allows the required port access (the COA port on the Radius client, accessed from the Radius server).\r\nThe customer must also ensure the COA port is enabled on the Radius Client.","u":"COA-action-doesn-t-work-on-the-WLC","d":"2023-08-22","c":"2023-08-16","v":7,"ver":1,"id":"ka06S000001Ywc7QAC"},{"k":"kb","n":"000012979","t":"Azure: Error message: Enable to find valid certification path to requested target","b":"","u":"Azure-Error-message-Enable-to-find-valid-certification-path-to-requested-target","d":"2023-10-14","c":"2023-08-16","v":7,"ver":1,"id":"ka06S000001YwcWQAS"},{"k":"kb","n":"000012984","t":"Missing switch information on several endpoints","b":"","u":"Missing-switch-information-on-several-endpoints","d":"2023-10-14","c":"2023-08-22","v":7,"ver":1,"id":"ka06S000001YwhHQAS"},{"k":"kb","n":"000012986","t":"How to check the SecureConnector status on Windows and MacOS","b":"Many customers need to check the SecureConnector status on Windows and MacOS after they install the SC on the endpoints.\r\nThe details in the following steps can help the customer build a policy to verify the SC status.\r\nThe group in the following policy refers to the ProServ policy template provided by the Forescout PS team.","u":"How-to-check-the-SecureConnector-status-on-Windows-and-MacOS","d":"2023-10-14","c":"2023-08-24","v":7,"ver":1,"id":"ka06S000001YwkuQAC"},{"k":"kb","n":"000012987","t":"Can’t manually add the record in MAR","b":"The customer faces the issue that they can’t manually add the record in MAR.\r\nIf they add the FS action of the add the record in MAR into the policy, it works.\r\nIf the customer faces the above issue, there is an issue with the records in the MAR.","u":"Can-t-manually-add-the-record-in-MAR","d":"2023-10-14","c":"2023-08-29","v":7,"ver":1,"id":"ka06S000001YwpaQAC"},{"k":"kb","n":"000012989","t":"Microsoft 1.0.1 plugin needs new configuration if upgrading from 1.0.0","b":"","u":"Intune","d":"2023-10-14","c":"2023-08-31","v":7,"ver":1,"id":"ka06S000001YwsKQAS"},{"k":"kb","n":"000012991","t":"DPI traffic not populating eyeSegment Matrix","b":"","u":"DPI-traffic-not-populating-eyeSegment-Matrix","d":"2023-09-01","c":"2023-08-31","v":7,"ver":1,"id":"ka06S000001YwuQQAS"},{"k":"kb","n":"000012993","t":"Unable ssh to switch from managed appliance. working for one switch but not for another switch both switches having same configuration are exact same identical model version.","b":"","u":"Unable-ssh-to-switch-from-managed-appliance-working-for-one-switch-but-not-for-another-switch-both-switches-having-same-configuration-are-exact-same-identical-model-version","d":"2024-08-16","c":"2023-09-06","v":7,"ver":1,"id":"ka06S000001YwvnQAC"},{"k":"kb","n":"000012994","t":"MAC Script Result Returns Unknown Field Type","b":"","u":"MAC-Script-Result-Returns-Unknown-Field-Type","d":"2023-10-14","c":"2023-09-06","v":7,"ver":1,"id":"ka0UY00000040cXYAQ"},{"k":"kb","n":"000012995","t":"How to manually poll Juniper MIST for port profiles","b":"If customer finds that port profiles are missing from parameters for GUI action \"Assign to VLAN-Network Controller \", you can use this command to check if the NC plugin can manually pull those profiles via curl.","u":"How-to-manually-poll-JuniperMIST","d":"2023-09-11","c":"2023-09-06","v":7,"ver":1,"id":"ka06S000001YwwgQAC"},{"k":"kb","n":"000012998","t":"How to Setup Secure FTP Server on Windows using IIS","b":"These are basic steps on how to setup secure FTP Server on Windows using IIS on various Windows Servers and transfer Forescout backups.","u":"How-to-Setup-Secure-FTP-Server-on-Windows-using-IIS","d":"2023-10-14","c":"2023-09-11","v":7,"ver":1,"id":"ka06S000001YwxtQAC"},{"k":"kb","n":"000013000","t":"How to search for unknown reports via CLI?","b":"Occasionally, CounterACT sends emails with attached reports that are unknown because they are either old or accidentally created.","u":"How-to-search-for-unknown-reports-via-CLI","d":"2023-10-14","c":"2023-09-11","v":7,"ver":1,"id":"ka06S000001Ywy3QAC"},{"k":"kb","n":"000013004","t":"How to Measure Network Performance Using iperf3","b":"Iperf3 is a powerful command-line tool that facilitates the measurement of network bandwidth between two computers, commonly referred to as the server and the client. \r\nConducting bandwidth tests with iperf3 allows you to assess network performance and capacity accurately. \r\nIn this guide, we'll walk you through the steps to effectively measure network bandwidth and performance using iperf3.","u":"How-to-Measure-Network-Performance-Using-iperf3","d":"2023-09-19","c":"2023-09-19","v":7,"ver":1,"id":"ka0UY00000041NJYAY"},{"k":"kb","n":"000013006","t":"Vulnerability: CVE-2023-25690 (httpd) and CVE-2023-27522 (Apache HTTP Server)","b":"We have verified that the vulnerability found in httpd which requires mod_proxy configurations with RewriteRule or ProxyPassMatch (CVE-2023-25690), or requires mod_proxy_uwsgi (CVE-2023-27522) on Apache HTTP Server are not applicable to our product.","u":"Apache-HTTP-Server-and-httpd-vulns","d":"2023-09-20","c":"2023-09-20","v":7,"ver":1,"id":"ka06S000001Yx5xQAC"},{"k":"kb","n":"000013007","t":"Appliance Booting To Emergency mode","b":"System may go into emergency mode after rebooting,\r\nProblem\r\nSystem may go into emergency mode after rebooting.\r\n\r\nError Message\r\nWhen rebooting Access appliance, system may go into emergency mode with below messages:\r\n\r\nWelcome to emergency mode! After logging in, type \"journalctl -xb\" to view system logs, \"systemctl reboot\" to reboot, \"systemctl default\" or ^D to try again to boot into default mode.\r\n\r\nGive root password for maintenance\r\n\r\n(or press Control-D to continue):","u":"Appliance-Booting-To-Emergency-mode","d":"2023-11-17","c":"2023-09-21","v":7,"ver":1,"id":"ka06S000001Yx7ZQAS"},{"k":"kb","n":"000013011","t":"Limit MAC address on switch port","b":"The customer was asked to provide additional LAN ports to kiosks out in the terminals. All of these kiosks already have 1 cable, but the customer needs at least 1 more. The customer is leaning towards small switches/hubs in the kiosk cabinet. \r\nHow to further secure the connections into the core/access switches?","u":"Limit-MAC-address-on-switch-port","d":"2023-10-14","c":"2023-09-27","v":7,"ver":1,"id":"ka06S000001YxAOQA0"},{"k":"kb","n":"000013013","t":"Getting Operation Failed Error at counterACT user profile","b":"","u":"Getting-Operation-Failed-Error-at-counterACT-user-profile","d":"2023-10-14","c":"2023-09-27","v":7,"ver":1,"id":"ka06S000001YxB2QAK"},{"k":"kb","n":"000013019","t":"SSH to switch via Forescout Radius Auth","b":"Some customers want to use Forescout as a Radius Auth server for the SSH auth to a switch.\r\nAfter the configuration on the Forescout appliance and the switches, the customer can SSH to a switch via their AD accounts.","u":"SSH-to-switch-via-Forescout-Radius-Auth","d":"2023-10-14","c":"2023-10-02","v":7,"ver":1,"id":"ka0UY00000036nFYAQ"},{"k":"kb","n":"000013021","t":"Gradual Upgrade with redundant Radius Appliances","b":"This plan will allow to upgrade the appliances gradually with minimum radius authentication disruption,\r\nProvided that there are multiple redundant radius appliances available.\r\n\r\nThis will require upgrade of the first radius appliance to wait, until after the EM, and the second radius appliance are all upgraded to continue services with minimum disruption.","u":"Gradual-Upgrade-with-redundant-Radius-Appliances","d":"2023-11-14","c":"2023-10-02","v":7,"ver":1,"id":"ka0UY0000001AerYAE"},{"k":"kb","n":"000013022","t":"8.4 – Appliance synchronization with EM – “about to synchronize.”","b":"","u":"8-4-Appliance-synchronization-with-EM-about-to-synchronize","d":"2023-10-14","c":"2023-10-03","v":7,"ver":1,"id":"ka06S000001YxEuQAK"},{"k":"kb","n":"000013025","t":"VLAN assignment on FortiSW fails - VLAN ID is not configured on switch","b":"The customer is using Fortinet Switch and Forescout.\r\nAfter they configure the FortiSwitch in the Forescout switch plugin, the plugin test passes. But the action VLAN assignment fails.\r\nThe customer needs to create an interface with a VLAN name and VLAN ID for the VLAN assignment to be successful.","u":"VLAN-assignment-on-FortiSW-fails---VLAN-ID-is-not-configured-on-switch","d":"2023-10-14","c":"2023-10-04","v":7,"ver":1,"id":"ka0R7000000SU6PIAW"},{"k":"kb","n":"000013026","t":"How to check installed windows hotfixes","b":"This article explains how to verify the list of installed Microsoft Windows Hotfixes","u":"How-to-check-installed-windows-hotfixes","d":"2023-10-14","c":"2023-10-05","v":7,"ver":1,"id":"ka06S000001YxH0QAK"},{"k":"kb","n":"000013027","t":"unable to add appliance after re-image due to fingerprint","b":"","u":"unable-to-add-appliance-after-re-image-due-to-fingerprint","d":"2023-10-14","c":"2023-10-10","v":7,"ver":1,"id":"ka0UY0000001v13YAA"},{"k":"kb","n":"000013028","t":"How to install SecureConnector on Debian/Ubuntu Linux using CLI.","b":"This article describes in detail how to install and troubleshoot Forescout SecureConnector on a supported version of the Debian/Ubuntu Linux using a command-line interface. To check for supported versions of the Linux distributions, please, refer to the Compatibility Matrix: https://compatibility.forescout.com/linux-operating-systems \r\n\r\nNote: This article assumes that you are installing Forescout SecureConnector on the Debian/Ubuntu Linux systems using the command line interface, that is, on the endpoint without a graphical user interface (GUI). SecureConnector has several dependencies that need to be satisfied before installation.","u":"How-to-install-SecureConnector-on-Debian-Ubuntu-Linux-using-CLI","d":"2023-11-18","c":"2023-10-12","v":7,"ver":1,"id":"ka0UY0000003JFpYAM"},{"k":"kb","n":"000013030","t":"SecureConnector Icon is not being displayed in System Tray.","b":"When deploying the SecureConnector agent on Windows workstations using SCCM and mode \"Show SecureConnector Icon in System Tray, the icon is not displayed on the endpoint System Tray and the console will show Windows SecureConnector Systray Display: Hide.","u":"SecureConnector-Icon-is-not-being-displayed-in-System-TraySecureConnector-Icon-is-not-being-displayed-in-System-Tray","d":"2023-11-17","c":"2023-10-18","v":7,"ver":1,"id":"ka06S000000tO64QAE"},{"k":"kb","n":"000013036","t":"Epm module stops listening to SecureConnector","b":"","u":"Epm-module-stops-listening-to-SecureConnector","d":"2023-11-17","c":"2023-10-24","v":7,"ver":1,"id":"ka06S000000tOCgQAM"},{"k":"kb","n":"000013045","t":"Docs portal is not loading properly","b":"Clear “Cookies and site data” will fix the issue.","u":"Docs-portal-is-not-loading-properly","d":"2023-11-17","c":"2023-10-30","v":7,"ver":1,"id":"ka06S000000tPh6QAE"},{"k":"kb","n":"000013047","t":"RHEL 8.8 Gnome unresponsive / failed to start after SC installation / Installing Daemon SecureConnector causes GNOME 3.32.2 to no longer function","b":"","u":"RHEL-8-8-Gnome-unresponsive-failed-to-start-after-SC-installation","d":"2023-11-17","c":"2023-10-30","v":7,"ver":1,"id":"ka06S000000tOJDQA2"},{"k":"kb","n":"000013048","t":"Microsoft plugin Intune integration test fails after upgrading from version 1.0.0 to 1.0.1","b":"","u":"Microsoft-pluging-Intune-intergration-test-fails-after-upgrading-from","d":"2023-11-17","c":"2023-10-30","v":7,"ver":1,"id":"ka06S000000tOJIQA2"},{"k":"kb","n":"000013049","t":"Post-install error when installing OSX console","b":"","u":"Post-install-error-when-installing-OSX-console","d":"2023-11-17","c":"2023-10-30","v":7,"ver":1,"id":"ka06S000000tOJNQA2"},{"k":"kb","n":"000013052","t":"Wireless Plugin Block on WLC Manager Appliance","b":"","u":"Wireless-Plugin-Block-on-WLC-Manager-Appliance","d":"2023-11-17","c":"2023-10-31","v":7,"ver":1,"id":"ka06S000000tOJwQAM"},{"k":"kb","n":"000013053","t":"Run the Dell TSR (Support Assist) from the Linux Command Line","b":"It is possible to create a Dell TSR (also known as Support Assist) report from the Linux command line which means it is possible to use the fstool oneach command to create multiple reports at the same time.","u":"Run-the-Dell-TSR-Support-Assist-from-the-Linux-Command-Line","d":"2023-11-18","c":"2023-11-01","v":7,"ver":1,"id":"ka06S000000tOQiQAM"},{"k":"kb","n":"000013058","t":"Advance Tool Plugin degrading overtime","b":"","u":"Advance-Tool-Plugin-degrading-overtime","d":"2023-11-17","c":"2023-11-03","v":7,"ver":1,"id":"ka06S000000tOXUQA2"},{"k":"kb","n":"000013061","t":"automatic power-on after power shut off or feature setting after power outage","b":"FS-HW-4130-OT from Forescout have any bios update/upgrades? I am looking for automatic power-on after power shut off type feature/setting","u":"automatic-power-on-after-power-shut-off-type-feature-or-setting-after-power-outage","d":"2023-11-17","c":"2023-11-06","v":7,"ver":1,"id":"ka06S000000tOa9QAE"},{"k":"kb","n":"000013063","t":"Handle new hosts with A MAC address and no IPv4 address","b":"This option will allow FS to handle the device if it has a Mac address but no IP address.\r\nThe FS GUI console displays the device with a Mac address only.","u":"Handle-new-hosts-with-A-MAC-address-and-no-IPv4-address","d":"2023-11-17","c":"2023-11-08","v":7,"ver":1,"id":"ka06S000000tOd8QAE"},{"k":"kb","n":"000013070","t":"Missing information on Nortel switches","b":"","u":"Missing-information-on-Nortel-switches","d":"2023-11-18","c":"2023-11-14","v":7,"ver":1,"id":"ka06S000000tPE4QAM"},{"k":"kb","n":"000013074","t":"Segment Overlap Causing Service to be Stuck in Initializing","b":"","u":"Segment-Overlap-Causing-Service-to-be-Stuck-in-Initializing","d":"2023-12-22","c":"2023-11-17","v":7,"ver":1,"id":"ka06S000000tPS1QAM"},{"k":"kb","n":"000013077","t":"The SSL Web Certificate work with IP address only instead of Host Name","b":"","u":"The-SSL-Web-Certificate-work-with-IP-address-only-instead-of-Host-Name","d":"2023-12-08","c":"2023-11-21","v":7,"ver":1,"id":"ka06S000000tPY9QAM"},{"k":"kb","n":"000013079","t":"CounterACT Failed Upgrade due to ServiceNow (SNOW) v3.2.4 Installed on System","b":"","u":"CounterACT-Failed-Upgrade-due-to-ServiceNow-SNOW-v3-2-4-Installed-on-System","d":"2023-12-08","c":"2023-11-21","v":7,"ver":1,"id":"ka0UY00000040UTYAY"},{"k":"kb","n":"000013080","t":"When installing Endpoint Module 1.4.6 or higher \"Insufficient HPS Engine Version - install 113070000 or higher error message maybe generated","b":"","u":"When-installing-Endpoint-Module-1-4-6-or-higher-Insufficient-HPS-Engine-Version-install-113070000-or-higher-error-message-maybe-generated","d":"2023-11-27","c":"2023-11-27","v":7,"ver":1,"id":"ka0UY0000003y7hYAA"},{"k":"kb","n":"000013081","t":"Forescout Console does not upgrade after applying 8.4.x version upgrade.","b":"","u":"Forescout-Console-does-not-upgrade-after-applying-8-4-x-version-upgrade","d":"2023-12-08","c":"2023-11-28","v":7,"ver":1,"id":"ka06S000000tPcVQAU"},{"k":"kb","n":"000013085","t":"HPS 11.3.7 \"SecureConnector is not properly configured due to an internal error\"","b":"","u":"HPS-11-3-7-SecureConnector-is-not-properly-configured-due-to-an-internal-error","d":"2023-11-30","c":"2023-11-30","v":7,"ver":1,"id":"ka0UY00000002xtYAA"},{"k":"kb","n":"000013089","t":"Commands to show/export all MACs currently in MAR from the database devinfo table","b":"You can validate entries in the MAR using psql commands.","u":"Commands-to-show-export-all-MACs-currently-in-MAR-from-the-database-devinfo-table","d":"2023-12-08","c":"2023-12-01","v":7,"ver":1,"id":"ka06S000000tPg3QAE"},{"k":"kb","n":"000013091","t":"PUV reports HA Status: Routes - Not Detected when OOB is enabled","b":"","u":"PUV-reports-HA-Status-Routes-Not-Detected-when-OOB-is-enabled","d":"2023-12-08","c":"2023-12-04","v":7,"ver":1,"id":"ka06S000000tPgXQAU"},{"k":"kb","n":"000013095","t":"Service Unavailable 503 - Secure Connector can't be Downloaded","b":"Getting Service Unavailable when trying to download Secureconnector, with the below error: \r\n**Service Unavailable\r\nThe server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.","u":"Service-Unavailable-503-Secure-Connector-can-t-be-Downloaded","d":"2023-12-13","c":"2023-12-06","v":7,"ver":1,"id":"ka06S000000tPhVQAU"},{"k":"kb","n":"000013096","t":"How to tune SSL Ciphers for ports and protocols used by Forescout eyeSight","b":"There are numerous other KBs which touch on various specific cipher-related use cases. This KB provides a general summary and details the files and properties which control SSL Ciphers for the ports and protocols Forescout uses.","u":"How-to-tune-SSL-Ciphers-for-ports-and-protocols-used-by-Forescout-eyeSight","d":"2023-12-13","c":"2023-12-06","v":7,"ver":1,"id":"ka0UY0000002rkzYAA"},{"k":"kb","n":"000013097","t":"General Best Practices for CounterACT","b":"This KB contains a list of \"Best Practices\" that customers should find helpful to avoid problems with the CounterACT appliances.","u":"General-Best-Practices-for-CounterACT","d":"2023-12-20","c":"2023-12-06","v":7,"ver":1,"id":"ka06S000000tPhfQAE"},{"k":"kb","n":"000013098","t":"Troubleshooting third party signed certificate for OS X SecureConnector","b":"These are tips for troubleshooting an environment with third party signed certificate on OS X module, and Macbook deployed with SecureConnector.","u":"Troubleshooting-third-party-signed-certificate-for-OS-X-SecureConnector","d":"2024-10-11","c":"2023-12-07","v":7,"ver":1,"id":"ka06S000000tPhpQAE"},{"k":"kb","n":"000013100","t":"Reports Not Working: Getting HTTP ERROR 500","b":"","u":"Reports-Not-Working-Getting-HTTP-ERROR-500","d":"2023-12-13","c":"2023-12-08","v":7,"ver":1,"id":"ka06S000000tPiEQAU"},{"k":"kb","n":"000013101","t":"How to Change eyeInspect Network Configuration using Netplan","b":"In Ubuntu 20.x or later eyeInspect deployments, Netplan is the best way to change the network configuration. This is useful when the IP address, DNS servers and/or MTU for example need to be changed.","u":"How-to-Change-eyeInspect-Network-Configuration-using-Netplan","d":"2023-12-13","c":"2023-12-09","v":7,"ver":1,"id":"ka0UY000000077xYAA"},{"k":"kb","n":"000013102","t":"Passive Sensor versions 5.1+ fail to reconnect to Command Center after being disconnected for some time","b":"","u":"Passive-Sensor-versions-5-1-fail-to-reconnect-to-Command-Center-after-being-disconnected-for-some-time","d":"2023-12-13","c":"2023-12-09","v":7,"ver":1,"id":"ka06S000000tPiTQAU"},{"k":"kb","n":"000013103","t":"How to generate a HAR file","b":"This article explains how to generate a HAR (Http ARchive) file using common browsers.","u":"How-to-generate-a-HAR-file","d":"2023-12-13","c":"2023-12-11","v":7,"ver":1,"id":"ka06S000000tPiiQAE"},{"k":"kb","n":"000013104","t":"Configuring a management interface via \"sdconfig\" fails with: \"Setting static IP address on <...> failed: reverting configuration.\"","b":"","u":"Configuring-a-management-interface-via-sdconfig-fails-with-Setting-static-IP-address-on-failed-reverting-configuration","d":"2023-12-13","c":"2023-12-11","v":7,"ver":1,"id":"ka06S000000tPinQAE"},{"k":"kb","n":"000013105","t":"Unable to reimage using iDRAC","b":"","u":"Unable-to-reimage-using-iDRAC","d":"2023-12-13","c":"2023-12-11","v":7,"ver":1,"id":"ka06S000000tPisQAE"},{"k":"kb","n":"000013106","t":"CounterACT Showing the Wrong Details as MAC Address of Endpoint","b":"","u":"CounterACT-Showing-the-Wrong-Details-as-MAC-Address-of-Endpoint","d":"2023-12-13","c":"2023-12-11","v":7,"ver":1,"id":"ka0UY00000012HVYAY"},{"k":"kb","n":"000013107","t":"How to Change the Directory where Scripts are Run in Linux SecureConnector?","b":"This is a basic summary of how to run scripts on Linux SecureConnector managed hosts from a directory other than /tmp.","u":"How-to-Change-the-Directory-where-Scripts-are-Run-in-Linux-SecureConnector","d":"2023-12-20","c":"2023-12-11","v":7,"ver":1,"id":"ka06S000000tPj7QAE"},{"k":"kb","n":"000013111","t":"APC UPS failing for SNMP properties","b":"","u":"APC-UPS-failing-for-SNMP-properties","d":"2023-12-20","c":"2023-12-14","v":7,"ver":1,"id":"ka06S000000tPlcQAE"},{"k":"kb","n":"000013112","t":"NAS is reporting that radius server is dead","b":"","u":"NAS-is-reporting-that-radius-server-is-dead","d":"2023-12-20","c":"2023-12-14","v":7,"ver":1,"id":"ka06S000000tPlhQAE"},{"k":"kb","n":"000013113","t":"Flow for radius plugin","b":"","u":"Flow-for-radius-plugin","d":"2023-12-20","c":"2023-12-14","v":7,"ver":1,"id":"ka06S000000tPlmQAE"},{"k":"kb","n":"000013114","t":"Certificate Authentication fails due to unsupported certificate purpose","b":"","u":"Certificate-Authentication-fails-due-to","d":"2023-12-20","c":"2023-12-14","v":7,"ver":1,"id":"ka06S000000tPlrQAE"},{"k":"kb","n":"000013115","t":"Unable to open forescout console after upgrade to 8.4.3/8.4.2","b":"When upgrade forescout console to latest version 8.4.3 and start login to new console using smartcard for first time. Console will start crashing due to low java memory","u":"Unable-to-open-forescout-console-after-upgrade-to-8-4-3-8-4-2","d":"2023-12-20","c":"2023-12-14","v":7,"ver":1,"id":"ka06S000000tPlwQAE"},{"k":"kb","n":"000013118","t":"Guidelines for Setting refresh interval for IP to MAC from SNMP","b":"What are guidelines for setting the field \"When SNMP is used to read IP to MAC mapping, refresh reported entries every\" in the advanced settings under permissions?","u":"Guidelines-for-Setting-refresh-interval-for-IP-to-MAC-from-SNMP","d":"2023-12-20","c":"2023-12-14","v":7,"ver":1,"id":"ka06S000000tPmBQAU"},{"k":"kb","n":"000013119","t":"How to fix child appliances in a disconnected state after a restore operation to the Enterprise Manager (EM)","b":"This article describes how to resolve an issue in which, after restoring from a backup file, the child appliances are in a disconnected stated in the GUI on the Enterprise Manager.","u":"How-to-fix-child-appliances-in-a-disconnected-state-after-a-restore-operation-to-the-Enterprise-Manager-EM","d":"2023-12-20","c":"2023-12-14","v":7,"ver":1,"id":"ka06S000000tPmLQAU"},{"k":"kb","n":"000013123","t":"Centralized Web Authentication (CWA) blank page","b":"","u":"Centralized-Web-Authentication-CWA-blank-page","d":"2023-12-20","c":"2023-12-18","v":7,"ver":1,"id":"ka06S000000tPnOQAU"},{"k":"kb","n":"000013124","t":"How To Check and Confirm Upgrade Status of EM or Appliance on version 8.4.2 and above","b":"There is a new command introduced in version 8.4.2 that will allow you to confirm the upgrade progress and status of an EM or an Appliance. This command works on both single mode or HA mode appliances or EM.","u":"How-To-Check-and-Confirm-Upgrade-Status-of-EM-or-Appliance-on-version-8-4-2-and-above","d":"2023-12-20","c":"2023-12-19","v":7,"ver":1,"id":"ka06S000000tPndQAE"},{"k":"kb","n":"000013125","t":"Changing configuration options in the updated analytics stack","b":"","u":"Changing-configuration-options-in-the-updated-analytics-stack","d":"2023-12-20","c":"2023-12-19","v":7,"ver":1,"id":"ka06S000000tPniQAE"},{"k":"kb","n":"000013127","t":"Workaround for misconfiguration of DB user privileges that might cause error in DB patching during Upgrade to 5.1.0+h01","b":"This KB article focuses on providing workaround if the issue is encountered in any eyeInspect Command Center version 5.1.0+h01 and\r\ncollect all the needed information in order for the engineers to find the root cause of the issue.\r\n\r\nProblem Description\r\nAfter updating CC, accessing the web based application of Command Center returns an error like 404 Not Found\" error and \"503 Service Unavailable\". \r\nAnd If the following error is present in eyeInspect Command Center catalina.out, then the issue happened because of database patches were not applied correctly.\r\nLogin to eyeInspect Command Center SSH terminal and check catalina.out\r\nCommand - cat /opt/sdconsole/tomcat/logs/catalina.out\r\n\r\nCaused by: java.sql.SQLException: Cannot get the directory of the datastore.\r\nsome database patches weren't applied.","u":"Workaround-for-misconfiguration-of-DB-user-privileges-that-might-cause-error-in-DB-patching-during-Upgrade-to-5-1-0-h01","d":"2023-12-20","c":"2023-12-19","v":7,"ver":1,"id":"ka06S000000tPnxQAE"},{"k":"kb","n":"000013128","t":"Scan policy","b":"Scan policy is a Command Center feature that allows users to save a scan configuration and a target to reuse for an Active Sensor scan. If scheduled, the policy will run at the scheduled time(s).\r\n\r\nScan policies can also be triggered immediately by the user.\r\n\r\nA scan policy is owned by the user that created it and when scheduled, will use the permission of its owner. A policy owner is as of 5.1.0 not visible.","u":"Scan-policy","d":"2023-12-20","c":"2023-12-19","v":7,"ver":1,"id":"ka06S000000tPo2QAE"},{"k":"kb","n":"000013129","t":"Reclaim disk space from eyeInspect analytics","b":"Follow these steps if the cc machine is running low on disk space and no significant gain can be had from reclaiming database space as described in Reclaim unused disk space\r\n\r\nReclaiming space from Kafka\r\nKafka automatically cycles log files (the actual queue) based on its configuration. By default this configuration retains the messages for 24 hours or until the log files reach 5GB size total. The log files are at most 1GB, meaning we will have up to 5 files before we start removing log files. This means that the maximum disk space to be gained from this change is around 5 GB, although the recommendation is to keep the log size at 1GB or more, just to keep the buffering capabilities inherently provided by the message queue paradigm. Kafka checks for log files that can be deleted every 5 minutes by default.","u":"Reclaim-disk-space-from-eyeInspect-analytics","d":"2023-12-20","c":"2023-12-19","v":7,"ver":1,"id":"ka06S000000tPo7QAE"},{"k":"kb","n":"000013130","t":"How to configure multiple sensor containers on a host","b":"For this user requires EyeInspect Passive Sensor version ( >= 5.0.0 && < 5.2.0 ). In EyeInspect 5.2.0 routine to configure additional sensor containers is simplified by the dedicated utility - nidstools.\r\n\r\nFor the user convinience, configuration of the second sensor is simplified and consist of few steps written in the nids-compose.yml file that is located in /opt/nids-docker/config.","u":"How-to-configure-multiple-sensor-containers-on-a-host","d":"2023-12-20","c":"2023-12-19","v":7,"ver":1,"id":"ka06S000000tPoCQAU"},{"k":"kb","n":"000013131","t":"How to avoid eyeInspect Passive Sensor (5.0.0 till 5.2.1) fails to update the time zone changes","b":"This article provides a workaround to the product defect \"Sdscript does not pick up the timezone from sensor settings\" that prevents time zone changes in the eyeInspect Passive Sensor when the changes are applied from the eyeInspect Command Center User Interface.","u":"How-to-avoid-eyeInspect-Passive-Sensor-5-0-0-till-5-2-1-fails-to-update-the-time-zone-changes","d":"2023-12-19","c":"2023-12-19","v":7,"ver":1,"id":"ka06S000000tPoHQAU"},{"k":"kb","n":"000013133","t":"Failover Clustering Excess Endpoints","b":"Failover Clustering setup is a great way to have resiliency with the Forescout solution. Having excess endpoints in the scope for the failover clustering solution can be problematic, if a failover does occur with an appliance where excess endpoints will be redistributed to the other appliances in the failover cluster that does not have the total capacity to handle all the endpoints from the failed appliance.","u":"Failover-Clustering-Excess-Endpoints","d":"2024-02-24","c":"2023-12-19","v":7,"ver":1,"id":"ka06S000000tPogQAE"},{"k":"kb","n":"000013138","t":"HA Routes Show as failed on HA Pair Appliance","b":"","u":"HA-Routes-Show-as-failed-on-HA-Pair-Appliance","d":"2024-02-24","c":"2023-12-20","v":7,"ver":1,"id":"ka06S000000tPpeQAE"},{"k":"kb","n":"000013139","t":"Case Study: Plugin modules not updating/synchronizing on appliances when fs.plugin.skip.version.sync is enabled on EM","b":"","u":"Case-Study-Plugin-modules-not-updating-synchronizing-on-appliances-when-fs-plugin-skip-version-sync-is-enabled-on-EM","d":"2024-02-24","c":"2023-12-20","v":7,"ver":1,"id":"ka06S000000tPpjQAE"},{"k":"kb","n":"000013144","t":"Creation of CLI user to copy Tech-Support log files directly from /tmp directory to a local system using WinSCP Application.","b":"Considering the situation where “root” user credentials are not advised to be used or not shared among all the users in the organization, where there is need to transfer the collected tech-support logs files from /tmp directory to the local system using FTP software such as WinSCP application.","u":"Creation-of-CLI-user-to-copy-Tech-Support-log-files-directly-from-tmp-directory-to-a-local-system-using-WinSCP-Application","d":"2024-02-24","c":"2023-12-24","v":7,"ver":1,"id":"ka0UY00000040avYAA"},{"k":"kb","n":"000013145","t":"Unable to Run racadm Command","b":"","u":"Unable-to-Run-racadm-Command","d":"2024-04-26","c":"2023-12-26","v":7,"ver":1,"id":"ka06S000000tPrQQAU"},{"k":"kb","n":"000013147","t":"Linux endpoint classify as Windows","b":"","u":"Linux-endpoint-classify-as-Windows","d":"2024-05-30","c":"2023-12-27","v":7,"ver":1,"id":"ka06S000000tPrfQAE"},{"k":"kb","n":"000013148","t":"Understanding \"Session Cookie Does Not Contain the 'Secure' Attribute\" in Vulnerability Scans","b":"","u":"Understanding-Session-Cookie-Does-Not-Contain-the-Secure-Attribute-in-Vulnerability-Scans","d":"2024-05-30","c":"2023-12-27","v":7,"ver":1,"id":"ka0UY00000096hJYAQ"},{"k":"kb","n":"000013149","t":"FIPS Enabled Unable to negotiate with ********* port 22: no matching key exchange method found","b":"","u":"Fips-enabled-Unable-to-negotiate-with-port-22-no-matching-key-exchange-method-found","d":"2024-02-24","c":"2023-12-28","v":7,"ver":1,"id":"ka06S000000tPsTQAU"},{"k":"kb","n":"000013151","t":"Intune ID not resolving for mobile devices","b":"","u":"Intune-ID-not-resolving-for-mobile-devices","d":"2024-02-24","c":"2023-12-31","v":7,"ver":1,"id":"ka0R7000000S9tBIAS"},{"k":"kb","n":"000013152","t":"MAC Addresses are different between mobile phone, Intune, and Forescout","b":"","u":"Mac-Addresses-are-different-between-host-Intune-and-Forescout","d":"2024-02-24","c":"2023-12-31","v":7,"ver":1,"id":"ka06S000000tPsxQAE"},{"k":"kb","n":"000013155","t":"DEX Plugin keeps reaching its buffer limit","b":"","u":"DEX-Plugin-keeps-reaching-its-buffer-limit","d":"2024-02-24","c":"2024-01-01","v":7,"ver":1,"id":"ka06S000000tPtCQAU"},{"k":"kb","n":"000013157","t":"Palo Alto NGFW plugin is sending a large number of API Calls to Panorama","b":"","u":"Palo-Alto-NGFW-plugin-is-sending-a-large-number-of-API-Calls-to-Panorama","d":"2024-02-24","c":"2024-01-01","v":7,"ver":1,"id":"ka06S000000tPtMQAU"},{"k":"kb","n":"000013161","t":"The integration of Forescout and Tenable.SC VA","b":"Forescout eyeExtend for Tenable Vulnerability plugin can pull the VA scan result of the device from Tenable.SC server.","u":"The-integration-of-Forescout-and-Tenable-SC-VA","d":"2024-02-24","c":"2024-01-03","v":7,"ver":1,"id":"ka06S000000tPuUQAU"},{"k":"kb","n":"000013162","t":"Learn IP and Mac addresses via ARP traffic (Request and Reply)","b":"Forescout can learn the device (IP & Mac address) via ARP traffic.\r\nHere are the details to demonstrate how FS carries out the device learning.","u":"Learn-IP-and-Mac-addresses-via-ARP-traffic-Request-and-Reply","d":"2024-02-21","c":"2024-01-04","v":7,"ver":1,"id":"ka06S000000tPueQAE"},{"k":"kb","n":"000013165","t":"How to manually check certificate revocation status in Windows","b":"How to manually check revocation status of a certificate in Windows, useful for testing whether revocation works after deploying OCSP.","u":"How-to-manually-check-revocation-status-of-a-certificate-in-Windows","d":"2024-02-21","c":"2024-01-11","v":7,"ver":1,"id":"ka06S000000tQD2QAM"},{"k":"kb","n":"000013166","t":"Reports Plugin 5.4.4 does not allow to edit scope or add columns","b":"In eyeSight version 8.4.2 and below. after upgrading the Reports Plugin to version 5.4.4\r\n\r\n-The customer is unable to edit Scope from the main Reports view (Multi-Edit)\r\n-Unable to add (can remove) columns in existing and new Policy Details reports.\r\n\r\nThe error observed is: An error has occurred. Please contact customer support","u":"Reports-Plugin-5-4-4-does-not-allows-to","d":"2024-05-30","c":"2024-01-11","v":7,"ver":1,"id":"ka0UY0000001mIjYAI"},{"k":"kb","n":"000013168","t":"How to check for radius key hash","b":"Radius key mismatch between Forescout and Meraki switch","u":"How-to-check-for-radius-key-hash","d":"2024-05-30","c":"2024-01-12","v":7,"ver":1,"id":"ka0UY0000001ievYAA"},{"k":"kb","n":"000013177","t":"No Domain is Known for Users error","b":"","u":"No-Domain-is-Known-for-Users-error","d":"2024-05-30","c":"2024-01-15","v":7,"ver":1,"id":"ka06S000000tQYUQA2"},{"k":"kb","n":"000013178","t":"NetFlow causes Ghost host in the Forescout GUI console","b":"While the Forescout appliance receives the NetFlow traffic via the Flow Collector plugin, Forescout will create the Ghost host in the GUI console.","u":"NetFlow-causes-Ghost-host-in-the-Forescout-GUI-console","d":"2024-02-21","c":"2024-01-16","v":7,"ver":1,"id":"ka06S000000tQYZQA2"},{"k":"kb","n":"000013179","t":"The applied VLAN Assignment action is reverted after the device goes offline in the Forescout system","b":"This article describes how the switch port’s VLAN ID is updated when the device is online/offline/removed.","u":"The-applied-VLAN-Assignment-action-is-reverted-after-the-device-goes-offline-in-the-Forescout-system","d":"2024-02-21","c":"2024-01-17","v":7,"ver":1,"id":"ka06S000000tQZXQA2"},{"k":"kb","n":"000013186","t":"Secure Connector Compliance Centre doesn't open when command prompt cmd.exe access is blocked","b":"For Windows domain users, many of the administrators tend to block access to command prompt as a security measure. We will see how it affects the working of SecureConnector and Compliance Center.\r\nThis KB serves as a checkpoint amongst many others, for FS engineers to determine issues persisting when troubleshooting cases raised for inability to access Compliance Center.\r\nTSEs can make this check on the user's system before looking at the network and appliances.","u":"Secure-Connector-Compliance-Centre-doesnt-open-when-command-prompt-cmd-exe-access-is-blocked","d":"2024-01-24","c":"2024-01-23","v":7,"ver":1,"id":"ka0UY00000002hlYAA"},{"k":"kb","n":"000013192","t":"Upgrade Verifier reports Miniroot has insufficient free space available","b":"","u":"Upgrade-Verifier-reports-Miniroot-has-insufficient-free-space-available","d":"2024-02-02","c":"2024-02-02","v":7,"ver":1,"id":"ka0UY0000001eoDYAQ"},{"k":"kb","n":"000013195","t":"Flexx Licenses are Invalid after standalone appliance HA failover. Locking ID mismatch Error code 210006.","b":"","u":"Flexx-Licenses-are-Invalid-after-standalone-appliance-HA-failover-Locking-ID-mismatch-Error-code-210006Flexx-Licenses-are-Invalid-after-standalone-appliance-HA-failover-Locking-ID-mismatch-Error-code-210006","d":"2024-04-26","c":"2024-02-09","v":7,"ver":1,"id":"ka0UY00000006dJYAQ"},{"k":"kb","n":"000013196","t":"How to add products from Forescout eyeExtend Module to our deployment when you purchase the Forescout eyeExtend Ecosystem licenses","b":"","u":"How-to-add-products-from-Forescout-eyeExtend-Module-to-our-deployment-when-you-purchase-the-Forescout-eyeExtend-Ecosystem-licenses","d":"2024-02-24","c":"2024-02-09","v":7,"ver":1,"id":"ka0UY0000001dwzYAA"},{"k":"kb","n":"000013198","t":"Dot1x PEAP authentication failed due to Error TLS Alert read:fatal:access denied/Error in fragmentation logic","b":"","u":"Dot1x-PEAP-authentication-failed-due-to-Error-TLS-Alert-read-fatal-access-denied-Error-in-fragmentation-logic","d":"2024-02-24","c":"2024-02-15","v":7,"ver":1,"id":"ka0UY00000007ntYAA"},{"k":"kb","n":"000013207","t":"End-of-Life Announcement Forescout CyberMDX MDefend.","b":"","u":"End-of-Life-Announcement-Forescout-CyberMDX-MDefend","d":"2024-02-27","c":"2024-02-27","v":7,"ver":1,"id":"ka0UY0000000AllYAE"},{"k":"kb","n":"000013214","t":"Run Script on CounterACT Error","b":"","u":"Run-Script-on-CounterACT-Error","d":"2024-05-30","c":"2024-03-07","v":7,"ver":1,"id":"ka0UY0000000HDlYAM"},{"k":"kb","n":"000013215","t":"How Forescout proceeds with the VLAN change with the Meraki Switch","b":"The customer needs to move the non-Compliant and non-Corp devices to the quarantine VLAN.\r\n\r\nWhen the device connects to a Meraki switch, the customer could leverage one of the following methods to change VLAN:\r\nAssign to VLAN-Network Controller\r\nRadius Authorize / CoA\r\nRadius Authorize / Force Re-Auth","u":"How-Forescout-proceeds-with-the-VLAN-change-with-the-Meraki-Switch","d":"2024-05-30","c":"2024-03-09","v":7,"ver":1,"id":"ka0UY0000000IBRYA2"},{"k":"kb","n":"000013216","t":"How Forescout proceeds with the Group Policy with the Meraki Wireless Device","b":"The customer needs to apply the Group Policy to the non-Compliant and non-Corp devices.\r\n\r\nWhen the device connects to an AP via an 802.1x enabled SSID, the customer could leverage one of the following methods to apply the Group Policy:\r\nRestrict Network Access\r\nRadius Authorize / Force Re-Auth","u":"How-Forescout-proceeds-with-the-Group-Policy-with-the-Meraki-Wireless-Device","d":"2024-05-30","c":"2024-03-10","v":7,"ver":1,"id":"ka0UY0000000ID3YAM"},{"k":"kb","n":"000013217","t":"AWS Existing VPC template not working","b":"","u":"AWS-Existing-VPC-template-not-working","d":"2024-04-04","c":"2024-03-11","v":7,"ver":1,"id":"ka0UY0000000IEfYAM"},{"k":"kb","n":"000013218","t":"How to determine resource allocation for virtual appliances on AWS cloud","b":"You may need to find out specs like VCPUs and memory allocation to appliances and EM deployed on Amazon Web Services AWS Cloud to determine if they are under-provisioned. This may be useful when investigating performance related cases.","u":"How-to-determine-resource-allocation-for-virtual-appliances-on-AWS-cloud","d":"2024-04-04","c":"2024-03-11","v":7,"ver":1,"id":"ka0UY0000000IHtYAM"},{"k":"kb","n":"000013219","t":"How to Prepare to Upgrade to Forescout 8.5.x","b":"This how-to KB article explains how to prepare to upgrade an existing environment to Forescout version 8.5.x.","u":"How-to-Prepare-to-Upgrade-to-Forescout-8-5-x","d":"2024-04-11","c":"2024-03-12","v":7,"ver":1,"id":"ka0R7000000QdQjIAK"},{"k":"kb","n":"000013222","t":"eyeInspect Passive Sensors Disconnected after IoC/CVE Update","b":"","u":"eyeInspect-Passive-Sensors-Disconnected-after-IoC-CVE-Update","d":"2024-06-05","c":"2024-03-15","v":7,"ver":1,"id":"ka0UY0000000KbRYAU"},{"k":"kb","n":"000013223","t":"Interface name changed after the reboot in Hyper-V","b":"","u":"Interface-name-changed-after-the-reboot-in-Hyper-V","d":"2026-07-29","c":"2024-03-18","v":7,"ver":1,"id":"ka0UY0000000KefYAE"},{"k":"kb","n":"000013224","t":"IP to MAC mapping with ARP table reads using CLI","b":"If the customer environment is reliant on Layer 3 device ARP table reads it is best to use CLI instead of SNMP if possible.","u":"IP-to-MAC-mapping-with-ARP-table-reads-using-CLI","d":"2024-04-18","c":"2024-03-18","v":7,"ver":1,"id":"ka0UY0000000KjVYAU"},{"k":"kb","n":"000013225","t":"Interface name changed after the reboot (Hyper-V)","b":"","u":"Interface-name-changed-after-the-reboot-Hyper-V","d":"2024-06-05","c":"2024-03-19","v":7,"ver":1,"id":"ka0UY0000000LAvYAM"},{"k":"kb","n":"000013230","t":"Configuring SNMPv3 traps on Forescout running 8.4.x and 8.5.x doesn't work","b":"Configuring SNMPv3 trap under [option > SNMP settings] on Forescout running 8.4.x and 8.5.x doesn't work. The snmpv3 trap configuration was verified and all the necessary configurations were applied correctly. However, when monitoring the traps using tcpdump, no traps automatically generated on the interface.","u":"Configuring-SNMPv3-traps-on-Forescout-running-8-4-x-and-8-5-x-doesn-t-work","d":"2024-05-13","c":"2024-03-22","v":7,"ver":1,"id":"ka0UY0000000OFFYA2"},{"k":"kb","n":"000013234","t":"How to disable client ciphers","b":"This KB is only for client-side ciphers, for server-side ciphers follow KB 000006418; ideally customers will disable on their destination server the ciphers that they don’t wish to use, but they might encounter a scenario where they can’t or aren’t sure if it will cause other issues to production, therefore they can “disable” the ciphers on the client requesting the connection.","u":"How-to-disable-client-ciphers","d":"2024-06-05","c":"2024-03-27","v":7,"ver":1,"id":"ka0UY0000000SHFYA2"},{"k":"kb","n":"000013237","t":"How to reset a password of customer portal site after expiration.","b":"After the expiration of the password of the customer portal site.\r\n\r\nCustomers will need to follow the below KB article to reset the password from the community portal.","u":"How-to-reset-a-password-of-customer-portal-site-after-expiration","d":"2024-06-05","c":"2024-03-28","v":7,"ver":1,"id":"ka0UY0000000SU9YAM"},{"k":"kb","n":"000013238","t":"Switch API failing checklist, various errors and solutions","b":"","u":"Switch-API-failing-checklist-various-errors-and-solutions","d":"2024-04-12","c":"2024-03-28","v":7,"ver":1,"id":"ka0UY0000003yR3YAI"},{"k":"kb","n":"000013241","t":"SecureConnector Agent does not prompt for the password upon exit on a Mac endpoint","b":"","u":"SecureConnector-Agent-does-not-prompt-for-the-password-upon-exit-on-a-Mac-endpoint","d":"2024-06-05","c":"2024-04-01","v":7,"ver":1,"id":"ka0UY0000000UanYAE"},{"k":"kb","n":"000013242","t":"Connect module tables missing after upgrade","b":"","u":"Connect-module-tables-missing-after-upgrade","d":"2024-06-05","c":"2024-04-02","v":7,"ver":1,"id":"ka0UY0000000VGjYAM"},{"k":"kb","n":"000013243","t":"How to verify the VM dedicated resource (All In One)","b":"A few customers still haven’t reserved the dedicated VM resource for the virtual Forescout appliances.\r\nBecause of the shared VM resource, customers reported system performance issues, e.g., actions are delayed, device discovery is slow, and actions are sometimes not applied.\r\nThis article demonstrates the steps to check the physical CPU frequency, calculate the required vCPU resources & assign them to the VM, and verify the assigned vCPU resources.\r\nThis article also demonstrates how to reserve memory resources for the VM.\r\nThe content in this article is based on the VMware virtual platform.","u":"How-to-verify-the-VM-dedicated-resource-All-In-One","d":"2024-06-05","c":"2024-04-05","v":7,"ver":1,"id":"ka0R7000000P6S1IAK"},{"k":"kb","n":"000013244","t":"Must specify “http” or “https” in proxy server configuration for Cloud Data Exchange","b":"","u":"Cloud-Data-Exchange-Proxy-Server","d":"2024-06-05","c":"2024-04-05","v":7,"ver":1,"id":"ka0UY0000000bdtYAA"},{"k":"kb","n":"000013249","t":"How to verify the Radius setting is configured correctly","b":"All the settings in the Forescout GUI console / Radius plugin have been configured correctly. But the Radius function doesn’t work properly.\r\nThe Radiusd.log (/usr/local/forescout/log/plugin/dot1x/radiusd.log) with debug level 10 shows the error messages.","u":"How-to-verify-the-Radius-setting-is-configured-correctly","d":"2024-06-05","c":"2024-04-09","v":7,"ver":1,"id":"ka0UY0000000c25YAA"},{"k":"kb","n":"000013250","t":"Arista switches ARP aging timer issues","b":"","u":"Arista-switches-ARP-aging-timer-issues","d":"2024-06-05","c":"2024-04-09","v":7,"ver":1,"id":"ka0UY0000000cOfYAI"},{"k":"kb","n":"000013251","t":"FIUP v3.1.4 cannot be installed on Forescout eyesight 8.5.x and Above.","b":"Once upgraded to 8.5.x or Above, customers are unable to install Forescout Infrastructural Update Package v3.1.4.","u":"FIUP-3-1-4-can-not-be-installed-on-Forescout-eyeSight-8-5-x-and-Above","d":"2024-06-05","c":"2024-04-10","v":7,"ver":1,"id":"ka0UY0000002xqPYAQ"},{"k":"kb","n":"000013252","t":"Start the CDE (Cloud Data Exchange) plugin on all the appliances","b":"","u":"Start-the-CDE-Cloud-Data-Exchange-plugin-on-all-the-appliances","d":"2024-06-05","c":"2024-04-12","v":7,"ver":1,"id":"ka0UY0000000divYAA"},{"k":"kb","n":"000013253","t":"Device Profile Library automatically applies classification updates although \"Always apply Device Profile Library upgrades automatically\" is disabled","b":"","u":"Device-Profile-Library-automatically-applies-classification-updates-although-Always-apply-Device-Profile-Library-upgrades-automatically-is-disabled","d":"2024-06-05","c":"2024-04-12","v":7,"ver":1,"id":"ka0UY0000000e8jYAA"},{"k":"kb","n":"000013254","t":"How to run scripts with fstool va_test","b":"Various examples on how to leverage fstool va_test to execute scripts on endpoints.","u":"How-to-run-scripts-with-fstool-va-test","d":"2024-06-05","c":"2024-04-12","v":7,"ver":1,"id":"ka0UY0000000eDZYAY"},{"k":"kb","n":"000013255","t":"Correct the date and time on the Forescout appliance and admin PC with GUI installed","b":"Correct time setup is critical.\r\nThe incorrect time setup of the Forescout appliance will impact the audit logs, logs analysis, message sync among all the Forescout appliances, etc.\r\nThe incorrect time setup of the PC, which is installed with the Forescout GUI console, will cause the valid certificate to be displayed as invalid.","u":"Correct-the-date-and-time-on-the-Forescout-appliance-and-admin-PC-with-GUI-installed","d":"2024-06-05","c":"2024-04-15","v":7,"ver":1,"id":"ka0UY0000000eFBYAY"},{"k":"kb","n":"000013256","t":"Configure the Virtual Firewall rules in the Options","b":"By default, the preconfigured virtual firewall rule in the Options doesn’t include the connection to the Forescout appliance with service on TCP10005 and TCP10006.\r\nOnly TCP10003 is preconfigured for the SecureConnector connection on the Windows machine.\r\nTCP10005 is for the SecureConnector connection on the MacOS machine.\r\nTCP10006 is for the SecureConnector connection on the Linux machine.\r\nTCP2200 was used for the legacy SecureConnector connection on the MacOS and Linux machines.\r\nIf the Virtual Firewall action is applied to the device, e.g., MacOS, it may block the SC connection to the CT appliance.","u":"Configure-the-Virtual-Firewall-rules-in-the-Options","d":"2024-06-05","c":"2024-04-15","v":7,"ver":1,"id":"ka0UY0000000eGnYAI"},{"k":"kb","n":"000013264","t":"failing to install SecureConnector on windows Server with two NICs","b":"When trying to install SecureConnector to multiple Windows Server with two NICs ; primary and secondary. the server endpoint will show up showing SC installed and then it'll show it's enabled and then it'll disappear from Forescout (FS) and continue to disappear and reappear. Server has 2 NIC and even though the server is set for the primary NIC to install SC, it tries to attach to the secondary NIC, which causes it to fail.\r\nThe server wasn't able to ping the Forescout Enterprise Manager or show activity from the traceroute command from the server to the FS EM. The server was able to ping and traceroute successfully to the connecting appliance and it seems the metrics in the routing table are pointing to the secondary NIC vs the primary NIC.","u":"failing-to-install-SecureConnector-on-windows-Server-with-two-NICs","d":"2024-06-19","c":"2024-04-18","v":7,"ver":1,"id":"ka0UY0000000nS9YAI"},{"k":"kb","n":"000013266","t":"Palo Alto GlobalProtect plugin integration gateway with no IP ranges","b":"","u":"Palo-Alto-GlobalProtect-plugin-integration-gateway-with-no-IP-ranges","d":"2024-06-19","c":"2024-04-18","v":7,"ver":1,"id":"ka0UY0000000nojYAA"},{"k":"kb","n":"000013267","t":"Configure Email SMTP with Amazon SES","b":"The customer doesn’t know how to configure the email settings in the FS system.\r\nAs more and more SMTP servers are configured with TLS, which involves certificate validation, the Forescout appliance configured with SMTP settings fails the SMTP server certificate validation.\r\nThe Forescout appliance should trust the SMTP server’s server certificate or CA certificate.\r\nThe Forescout appliance should also enable the TLS verification via OCSP.","u":"Configure-Email-SMTP-with-Amazon-SES","d":"2024-06-19","c":"2024-04-19","v":7,"ver":1,"id":"ka0UY0000004Oq9YAE"},{"k":"kb","n":"000013268","t":"Linear and Logarithmic switch process generation algorithms and how they relate to switch performance issues","b":"","u":"Linear-and-Logarithmic-switch-process-generation-algorithms-and-how-they-relate-to-switch-performance-issues","d":"2024-04-26","c":"2024-04-19","v":7,"ver":1,"id":"ka0UY0000000o01YAA"},{"k":"kb","n":"000013269","t":"How to configure HA for Active Sensor 1.5.0","b":"These steps are required in addition to the sdconfig HA and icsp-ha-config when configuring HA with the 1.5.0 Active Sensor.\r\n\r\nBecause of the reversing of communication, setting up HA for ICSP-CC / ICSP-Sensor version 1.5.0 requires an additional step.\r\nThese steps have to be done before doing the failover but can be done independently from the sdconfig HA configuration and the icsp-ha-config configuration.","u":"How-to-configure-HA-for-Active-Sensor-1-5-0","d":"2024-09-09","c":"2024-04-20","v":7,"ver":1,"id":"ka0UY0000000o1dYAA"},{"k":"kb","n":"000013271","t":"How to reduce zombie process","b":"Appliances will fail and disconnect from the Enterprise Manager, and its happening more consistently . The troubled machines have a large number of zombie processes coming and going from the processes output.","u":"How-to-reduce-zombie-process","d":"2024-06-19","c":"2024-04-21","v":7,"ver":1,"id":"ka0UY0000000o4rYAA"},{"k":"kb","n":"000013272","t":"Java License for the Forescout GUI Console","b":"The Java for the Forescout GUI console is the free version.","u":"Java-License-for-the-Forescout-GUI-Console","d":"2024-06-19","c":"2024-04-22","v":7,"ver":1,"id":"ka0UY0000000o85YAA"},{"k":"kb","n":"000013276","t":"No device data updated in the eyeFocus portal","b":"The CDE (Cloud Data Exchange) plugin is configured correctly, and the plugin test is successful.\r\nBut there is no device data pop-up in the eyeFocus portal (if this is the first time to set up the CDE plugin), or there is no device data updated in the eyeFocus portal.\r\nThere are various steps to troubleshoot the issue.","u":"No-device-data-updated-in-the-eyeFocus-portal","d":"2024-06-19","c":"2024-04-25","v":7,"ver":1,"id":"ka0UY0000003LhRYAU"},{"k":"kb","n":"000013278","t":"GUI - SLOW performance after adding Recovery EM","b":"","u":"GUI-SLOW-performance-after-adding-Recovery-EM","d":"2024-06-19","c":"2024-04-25","v":7,"ver":1,"id":"ka0UY0000000qJZYAY"},{"k":"kb","n":"000013284","t":"Roaming Behaviour of MacOS SecureConnector and Windows SecureConnector","b":"When the customer has multiple Forescout deployments (e.g., multiple separated EM and CT appliances), they will have the scenario about the SecureConnector roaming between these deployments.\r\n\r\nEven the new MacOS SC installation (which has never successfully connected to the original EM) supports roaming. This means the newly installed SC can connect to the roaming EM successfully.\r\n\r\nThe customer can download one MacOS SC installation file from any deployment’s EM and install the SC on any endpoints in the multiple EM’s deployment environment.","u":"Roaming-Behaviour-of-MacOS-SecureConnector-and-Windows-SecureConnector","d":"2024-06-19","c":"2024-04-27","v":7,"ver":1,"id":"ka0UY0000003N6XYAU"},{"k":"kb","n":"000013285","t":"pxGrid Plugin setup for ERS","b":"External Rest Services (ERS) is a connection protocol used for eyeSegment to Cisco ISE integration. This feature was introduce in 1.2.1 and activated in 1.2.2. As a result, in 1.2.2 pxgrid plugin will fail the test if ERS feature is not configured.\r\n\r\nPlease refer to https://jira.fsd.forescout.com/browse/ISE-381","u":"pxGrid-Plugin-setup-for-ERS","d":"2024-06-18","c":"2024-04-28","v":7,"ver":1,"id":"ka0UY0000000udJYAQ"},{"k":"kb","n":"000013289","t":"Switch test result: Assign to VLAN action [Received commitFailed(14) error-status at error-index 1]","b":"","u":"Switch-test-result-Assign-to-VLAN-action-Received-commitFailed-14-error-status-at-error-index-1","d":"2024-06-19","c":"2024-05-01","v":7,"ver":1,"id":"ka0UY0000002jfNYAQ"},{"k":"kb","n":"000013290","t":"Android failing Radius authentication due to unsupported certificate purpose","b":"","u":"Android-failing-Radius-authentication-due-to-unsupported-certificate-purpose","d":"2024-06-19","c":"2024-05-01","v":7,"ver":1,"id":"ka0UY0000000xmTYAQ"},{"k":"kb","n":"000013291","t":"operation failed, CertAuthConfig,permission denied","b":"","u":"operation-failed-CertAuthConfig-permission-denied","d":"2024-06-19","c":"2024-05-01","v":7,"ver":1,"id":"ka0UY0000004BcnYAE"},{"k":"kb","n":"000013292","t":"How to swap an appliance","b":"Steps to replace a CounterACT appliance and add a new one to EM","u":"How-to-swap-an-appliance","d":"2024-05-07","c":"2024-05-02","v":7,"ver":1,"id":"ka0UY0000003yCXYAY"},{"k":"kb","n":"000013294","t":"Dashboard fails to stay running after various updates are applied","b":"","u":"Dashboard-fails-to-stay-running-after-various-updates-were-applied","d":"2024-06-19","c":"2024-05-03","v":7,"ver":1,"id":"ka0UY0000004HjpYAE"},{"k":"kb","n":"000013295","t":"DEX - List property - Aggregate checkbox not working properly","b":"","u":"DEX-List-property-Aggregate-checkbox-not-working-properly","d":"2024-06-19","c":"2024-05-03","v":7,"ver":1,"id":"ka0UY0000000z6jYAA"},{"k":"kb","n":"000013298","t":"Resolving Forescout Appliance Upgrade Failure Due to Missing Folders","b":"","u":"Resolving-Forescout-Appliance-Upgrade-Failure-Due-to-Missing-Folders","d":"2024-05-10","c":"2024-05-10","v":7,"ver":1,"id":"ka0UY000000129RYAQ"},{"k":"kb","n":"000013299","t":"Radius failure with unknown tls version after upgrade to 4.7.7","b":"","u":"Radius-failure-with-unknown","d":"2024-05-16","c":"2024-05-13","v":7,"ver":1,"id":"ka0UY00000012FtYAI"},{"k":"kb","n":"000013300","t":"Cannot permanently change MTU on a Sensor Network Interface to anything lower than 1280","b":"","u":"Cannot-permanently-change-MTU-on-a-Sensor-Network-Interface-to-anything-lower-than-1280","d":"2024-06-19","c":"2024-05-13","v":7,"ver":1,"id":"ka0UY00000012RBYAY"},{"k":"kb","n":"000013302","t":"How To Collect TSR Logs From iDRAC","b":"Technical Support Report (TSR) logs are for verifying the status of the Forescout Appliance. \r\nThese logs show detailed information about each component of the Appliance and can be saved locally.","u":"How-To-Collect-TSR-Logs-From-iDRAC","d":"2024-06-19","c":"2024-05-14","v":7,"ver":1,"id":"ka0UY00000013NFYAY"},{"k":"kb","n":"000013305","t":"Error: Failed to join domain: failed to lookup DC info for domain 'XYZ.COM' over RPC: {Device Timeout}","b":"","u":"Error-Failed-to-join-domain-failed-to-lookup-DC-info-for-domain-XYZ-COM-over-RPC-Device-Timeout","d":"2024-06-19","c":"2024-05-17","v":7,"ver":1,"id":"ka0UY0000001zMPYAY"},{"k":"kb","n":"000013306","t":"How to Manually Install the Plugin via CLI on EM and Appliance","b":"These are basic steps on how to install the plugin manually if the user does not want to install the whole module. We are going to use version 8.4.2 and Dot1x Plugin as an example with screenshots.","u":"How-to-Manually-Install-the-Plugin-via-CLI-on-EM-and-Appliance","d":"2024-06-19","c":"2024-05-19","v":7,"ver":1,"id":"ka0UY0000008gzlYAA"},{"k":"kb","n":"000013308","t":"How to Create a New Self-Signed Certificate","b":"These are basic steps on how to create a new self-signed certificate, this can apply for the HPS, MAC OS X, Linux and WebPortal.","u":"How-to-Create-a-New-Self-Signed-Certificate","d":"2024-06-19","c":"2024-05-19","v":7,"ver":1,"id":"ka0UY0000003rhJYAQ"},{"k":"kb","n":"000013311","t":"Troubleshooting ForeScout DEX API Authentication Failed Error","b":"","u":"The-ForeScout-DEX-API-returns-an-AUTHENTICATION-FAILED-error-with-the-following-status","d":"2024-06-19","c":"2024-05-22","v":7,"ver":1,"id":"ka0UY00000016WPYAY"},{"k":"kb","n":"000013320","t":"error\":\"Switch API does not support overlapping IPs","b":"Receive error when accessing https:///switch/api/swagger-ui/","u":"error-Switch-API-does-not-support-overlapping-IPs","d":"2024-06-28","c":"2024-05-29","v":7,"ver":1,"id":"ka0UY00000017lpYAA"},{"k":"kb","n":"000013323","t":"The use of service CertUtil.exe in Forescout","b":"","u":"The-use-of-service-CertUtil-exe-in-Forescout","d":"2024-06-19","c":"2024-05-31","v":7,"ver":1,"id":"ka0UY0000001ekzYAA"},{"k":"kb","n":"000013326","t":"Microsoft is depreciating vbs scripts","b":"VBScript deprecation: Timelines and next steps","u":"Microsoft-is-depreciating-vbs-scripts-Update","d":"2024-06-19","c":"2024-06-05","v":7,"ver":1,"id":"ka0UY0000001ijlYAA"},{"k":"kb","n":"000013327","t":"BPF Filter not filtering traffic","b":"","u":"BPF-Filter-not-filtering-traffic","d":"2024-11-05","c":"2024-06-06","v":7,"ver":1,"id":"ka0UY0000001965YAA"},{"k":"kb","n":"000013328","t":"iDRAC Vulnerabilities - CVE-2023-28531, CVE-2023-48795, CVE-2023-51767","b":"Knowledge Base on iDRAC Vulnerabilities - CVE-2023-28531, CVE-2023-48795, CVE-2023-51767","u":"iDRAC-Vulnerabilities-CVE-2023-28531-CVE-2023-48795-CVE-2023-51767","d":"2026-07-24","c":"2024-06-07","v":7,"ver":1,"id":"ka0R7000000SfLBIA0"},{"k":"kb","n":"000013329","t":"Appliance is already registered","b":"","u":"Appliance-is-already-registered","d":"2024-06-19","c":"2024-06-08","v":7,"ver":1,"id":"ka0UY0000001ilNYAQ"},{"k":"kb","n":"000013330","t":"Getting error when renew Pxgrid certificate and test the plugin \"Failed to activate account, couldn't find any available ISE node\"","b":"","u":"Getting-error-when-renew-Pxgrid-certificate-and-test-the-plugin-Failed-to-activate-account-couldn-t-find-any-available-ISE-node","d":"2024-06-19","c":"2024-06-10","v":7,"ver":1,"id":"ka0UY0000001imzYAA"},{"k":"kb","n":"000013331","t":"Problematic reports are not permanently deleted from the report portal and reappear after a few days.","b":"","u":"Problematic-reports-are-not-permanently-deleted-from-the-report-portal-and-reappear-after-a-few-days","d":"2024-06-19","c":"2024-06-10","v":7,"ver":1,"id":"ka0UY00000019SfYAI"},{"k":"kb","n":"000013333","t":"Detect the Antivirus via the Windows Security Center","b":"Forescout can natively detect the Antivirus installed on a Windows machine. The supported Antiviruses include McAfee, Sophos, Symantec, TrendMicro, etc.\r\nFor those natively unsupported AV, Forescout can integrate with the Windows Security Center to pull the AV’s details.","u":"Detect-the-Antivirus-via-the-Windows-Security-Center","d":"2024-06-19","c":"2024-06-11","v":7,"ver":1,"id":"ka0UY00000019u5YAA"},{"k":"kb","n":"000013342","t":"Aruba WLC can’t apply the WLAN Role action to the device","b":"In a Forescout and Aruba WLC integration, the customer encountered the issue of the WLAN Role action not being successfully applied to the device.\r\nSuppose the WLAN Role name is configured correctly in the Forescout action, and the admin can manually apply it to the device in the Aruba portal. In that case, the customer needs to verify if the Write Permission in the Wireless plugin is enabled or if the service account has the write permission.","u":"Aruba-WLC-can-t-apply-the-WLAN-Role-action-to-the-device","d":"2024-06-19","c":"2024-06-17","v":7,"ver":1,"id":"ka0UY0000001CiHYAU"},{"k":"kb","n":"000013343","t":"How to Update Any Module Versions to the Latest in ForeScout From GUI Console","b":"Keeping your ForeScout modules up to date is essential for maintaining security and functionality. Follow these steps to ensure your modules are updated to the latest versions.","u":"How-to-Update-Any-Module-Versions-to-the-Latest-in-ForeScout-From-GUI-Console","d":"2024-06-25","c":"2024-06-18","v":7,"ver":1,"id":"ka0UY0000001eTFYAY"},{"k":"kb","n":"000013346","t":"CVE-2023-40546 & others: Shim vulnerabilities [eyeSight]","b":"Shim Vulnerabilities: CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 \r\n\r\nCounterACT 8.4.3 is vulnerable to the following Shim vulnerabilities: \r\n\r\nCVE-2023-40546 \r\nCVE-2023-40547 \r\nCVE-2023-40548 \r\nCVE-2023-40549 \r\nCVE-2023-40550 \r\nCVE-2023-40551","u":"shim-mokutil-2023-vulns","d":"2024-06-25","c":"2024-06-21","v":7,"ver":1,"id":"ka0UY0000001KzBYAU"},{"k":"kb","n":"000013348","t":"A maximum of 100 CVEs is listed in the eyeFocus portal","b":"The asset details in the eyeFocus portal show the CVE list (if there are any).\r\nThe maximum number of CVEs listed in the asset details is 100.","u":"A-maximum-of-100-CVEs-is-listed-in-the-eyeFocus-portal","d":"2024-06-26","c":"2024-06-25","v":7,"ver":1,"id":"ka0UY0000003LmHYAU"},{"k":"kb","n":"000013352","t":"Upgrading connect module to 2.0.x causing plugin to crash","b":"","u":"Upgrading-connect-module-to-2-0-x-causing-plugin-crash","d":"2024-08-16","c":"2024-06-27","v":7,"ver":1,"id":"ka0UY0000009MirYAE"},{"k":"kb","n":"000013354","t":"Customer reports that their Vulnerability dedication software detects \"Session Cookie Does Not Contain the Secure Attribute\"","b":"","u":"Customer-reports-that-their-Vulnerability-dedication-software-detects-Session-Cookie-Does-Not-Contain-the-Secure-Attribute","d":"2024-06-28","c":"2024-06-28","v":7,"ver":1,"id":"ka0UY0000001LnBYAU"},{"k":"kb","n":"000013355","t":"Resolving Segment Display Issues in Console Using CLI Method","b":"","u":"Resolving-Segment-Display-Issues-in-Console-Using-CLI-Method","d":"2025-03-04","c":"2024-06-28","v":7,"ver":1,"id":"ka0UY0000001LqPYAU"},{"k":"kb","n":"000013359","t":"How to integrate with Aruba WLC HA setup","b":"Aruba WLC HA setup is Active and Passive. The HA setup has a VIP address.\r\nThe customer should only add the VIP address to the wireless plugin.","u":"How-to-integrate-with-Aruba-WLC-HA-setup","d":"2024-09-04","c":"2024-07-01","v":7,"ver":1,"id":"ka0UY0000001MBNYA2"},{"k":"kb","n":"000013365","t":"Policy rules under evaluation which permanently add to Passive Learning Group will MATCH and trigger Add to Group if one of those property conditions enters Pending status","b":"","u":"Policy","d":"2024-09-04","c":"2024-07-05","v":7,"ver":1,"id":"ka0UY0000001Nk9YAE"},{"k":"kb","n":"000013371","t":"Netscaler VPN Integration","b":"Syslog module configuration to allow ingesting logs from Netscaler SSL VPN","u":"Netscaler-VPN-Integration","d":"2024-10-11","c":"2024-07-16","v":7,"ver":1,"id":"ka0UY0000001QrhYAE"},{"k":"kb","n":"000013372","t":"How To Reset Console Admin Password","b":"Cannot change admin password","u":"How-To-Reset-Console-Admin-Password","d":"2024-10-11","c":"2024-07-17","v":7,"ver":1,"id":"ka0UY0000001QuvYAE"},{"k":"kb","n":"000013374","t":"Vulnerability Remediation TLS 1.1","b":"Issue\r\nOur Forescout devices are being flagged by our vulnerability scanners for deprecated TLS versions (1.0/1.1) on TCP port 10003. Based on the documentation, this port is used by the Windows Secure Connector. We are not currently using the Secure Connector for any of our policies.","u":"Vulnerability-Remediation-TLS-1-1","d":"2024-10-11","c":"2024-07-17","v":7,"ver":1,"id":"ka0UY0000001R1NYAU"},{"k":"kb","n":"000013375","t":"Unable to activate a license on an HA pair","b":"","u":"Unable-to-activate-a-license-on-an-HA-pair","d":"2024-10-11","c":"2024-07-18","v":7,"ver":1,"id":"ka0UY0000001R6DYAU"},{"k":"kb","n":"000013381","t":"InTune managed hosts are displaying error message \"1 hour timeout exceeded times for intune managed devices\"","b":"","u":"InTune-managed-hosts-are-displaying-error-message-1-hour-timeout-exceeded-times-for-intune-managed-devices","d":"2024-10-11","c":"2024-07-29","v":7,"ver":1,"id":"ka0UY0000001UdZYAU"},{"k":"kb","n":"000013384","t":"Apple OS computers with 8.5.1 GUI Console - Check For Updates fails","b":"","u":"Apple-OS-computers-with-8-5-1-GUI-Console-Check-For-Updates-fails","d":"2024-09-18","c":"2024-07-29","v":7,"ver":1,"id":"ka0UY0000001Uk1YAE"},{"k":"kb","n":"000013387","t":"How to Enable Debug for Linux plugin","b":"Enabling debug level for Linux plugin","u":"How-to-Enable-Debug-for-Linux-plugin","d":"2024-10-11","c":"2024-07-31","v":3,"ver":1,"id":"ka0UY0000001Vg5YAE"},{"k":"kb","n":"000013393","t":"Failed to detect the host switch port on a switch with ACL configured","b":"","u":"Failed-to-detect-the-host-switch-port-on-a-switch-with-ACL-configured","d":"2024-09-09","c":"2024-08-01","v":7,"ver":1,"id":"ka0UY0000001W2fYAE"},{"k":"kb","n":"000013394","t":"The wireless device has both wired and wireless properties in the Meraki network","b":"In a Meraki network (with Meraki switches and Meraki APs), the wireless device which connects to an SSID has both wired and wireless properties.\r\nThis is expected if the AP connects to the switch port, which is in access mode, or the switch port is in trunk mode but has a voice VLAN assigned to it.\r\nThe network team needs to modify the Meraki Switch port setting to ensure the wireless device only has wireless properties.","u":"The-wireless-device-has-both-wired-and-wireless-properties-in-the-Meraki-network","d":"2024-08-26","c":"2024-08-02","v":7,"ver":1,"id":"ka0UY0000004IXpYAM"},{"k":"kb","n":"000013395","t":"\"Sending syslog message timed out\" when Certification Compliance mode is enabled","b":"","u":"Sending-syslog-message-timed-out-when-Certification-Compliance-mode-is-enabled","d":"2024-10-11","c":"2024-08-05","v":7,"ver":1,"id":"ka0UY0000001X5BYAU"},{"k":"kb","n":"000013397","t":"CyberArk Plugin Inaccessible in the GUI","b":"","u":"Resolving-CyberArk-Plugin-Inaccessibility-in-the-GUI","d":"2024-10-11","c":"2024-08-06","v":7,"ver":1,"id":"ka0UY0000001Xy1YAE"},{"k":"kb","n":"000013399","t":"Seeing Hosts assigned to enterprise Manager","b":"","u":"Seeing-Hosts-assigned-to-enterprise-Manager","d":"2024-10-11","c":"2024-08-07","v":7,"ver":1,"id":"ka0UY0000001b2LYAQ"},{"k":"kb","n":"000013400","t":"Failed to power on virtual machine . Module 'MonitorLoop' power on failed.","b":"","u":"Failed-to-power-on-virtual-machine-Module-MonitorLoop-power-on-failed","d":"2024-10-11","c":"2024-08-08","v":7,"ver":1,"id":"ka0UY0000001b8nYAA"},{"k":"kb","n":"000013402","t":"Logs need to be collected for VMware Vsphere issues","b":"This kb defines what logs needs to be collected for VMware Vphere issue.","u":"Logs-need-to-be-collected-for-VMware-Vsphere-issues","d":"2024-11-20","c":"2024-08-09","v":7,"ver":1,"id":"ka0UY0000001bjtYAA"},{"k":"kb","n":"000013403","t":"How to check the EOL of hardware model series and Usage end date of the appliance:","b":"There are overall two EOL, first will be for a specific hardware model and then there is another EOL for the specific hardware that the customer purchases.","u":"How-to-check-the-EOL-of-hardware-model-series-and-Usage-end-date-of-the-appliance","d":"2024-10-11","c":"2024-08-09","v":7,"ver":1,"id":"ka0UY0000001blVYAQ"},{"k":"kb","n":"000013407","t":"CVE-2023-20569 & others: AMD Processor Vulnerabilities [eyeSight]","b":"AMD Processor Vulnerabilities: CVE-2023-20569, CVE-2023-20592, CVE-2023-20593\r\n\r\nCounterACT 8.4.3 is not vulnerable to the following vulnerabilities: \r\n\r\nCVE-2023-20569\r\nCVE-2023-20592\r\nCVE-2023-20593","u":"amd-processor-2023-vulns","d":"2024-08-16","c":"2024-08-13","v":7,"ver":1,"id":"ka0UY0000001ccjYAA"},{"k":"kb","n":"000013408","t":"CVE-2022-2601: Grub2 vulnerability [eyeSight]","b":"Grub2 Vulnerability: CVE-2022-2601 \r\n\r\nCounterACT 8.4.3 is not vulnerable to the following vulnerability: \r\n\r\nCVE-2022-2601","u":"grub2-2022-vuln","d":"2024-08-16","c":"2024-08-13","v":7,"ver":1,"id":"ka0UY0000001ceLYAQ"},{"k":"kb","n":"000013409","t":"CVE-2023-4408 & others: Bind, DHCP vulnerabilities [eyeSight]","b":"Bind, DHCP Vulnerabilities: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868\r\n\r\nCounterACT 8.4.3 is not vulnerable to the following vulnerabilities: \r\n\r\nCVE-2023-4408\t \r\nCVE-2023-50387\t \r\nCVE-2023-50868\r\n\r\nHowever, CounterACT 8.4.3 does contain the affected packages.","u":"bind-dhcp-2023-vulns","d":"2024-08-16","c":"2024-08-13","v":7,"ver":1,"id":"ka0UY0000001cfxYAA"},{"k":"kb","n":"000013410","t":"CVE-2022-43552: Curl vulnerability [eyeSight]","b":"Curl Vulnerability: CVE-2022-43552\r\n\r\nCounterACT 8.4.3 is vulnerable to the following curl vulnerability: \r\n\r\nCVE-2022-43552","u":"curl-2022-vuln","d":"2024-08-16","c":"2024-08-13","v":7,"ver":1,"id":"ka0UY0000001chZYAQ"},{"k":"kb","n":"000013415","t":"Radius authentications failing at client hello after upgrade to 4.7.8","b":"","u":"Radius-authentications-failing-at-client-hello-after-upgrade-to-4-7-8","d":"2024-08-16","c":"2024-08-16","v":7,"ver":1,"id":"ka0UY0000001eeXYAQ"},{"k":"kb","n":"000013416","t":"CVE-2024-2961 & others: Glibc Vulnerabilities [eyeSight]","b":"Glibc Vulnerabilities: CVE-2024-2961, CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602\r\n\r\nCounterACT 8.4.3 is vulnerable to the following Linux-firmware vulnerabilities: \r\n\r\nCVE-2024-2961\r\nCVE-2024-33599\r\nCVE-2024-33600\r\nCVE-2024-33601\r\nCVE-2024-33602","u":"glibc-2024-vulns","d":"2024-08-16","c":"2024-08-16","v":7,"ver":1,"id":"ka0UY0000001eppYAA"},{"k":"kb","n":"000013417","t":"CVE-2018-7409, CVE-2018-7485: unixODBC vulnerabilities [eyeSight] --Not Vulnerable","b":"unixODBC Vulnerabilities: CVE-2018-7409, CVE-2018-7485\r\n\r\nCounterACT 8.4.3 is not vulnerable to the following unixODBC vulnerabilities: \r\nCVE-2018-7409\t \r\nCVE-2018-7485","u":"unixODBC-2018-vulns","d":"2024-08-16","c":"2024-08-16","v":7,"ver":1,"id":"ka0UY0000001et3YAA"},{"k":"kb","n":"000013426","t":"Upgrade to 8.4.2 stuck on cysiv postinstall","b":"","u":"Upgrade-to-8-4-2-stuck-on-cysiv-postinstall","d":"2024-11-05","c":"2024-08-23","v":7,"ver":1,"id":"ka0UY0000003vxpYAA"},{"k":"kb","n":"000013427","t":"The “Add to address group” action doesn’t work on Fortinet NGFW plugin","b":"","u":"The-Add-to-address-group-action-doesn-t-work-on-Fortinet-NGFW-plugin","d":"2024-09-09","c":"2024-08-27","v":7,"ver":1,"id":"ka0UY0000001l1hYAA"},{"k":"kb","n":"000013431","t":"HOW TO TROUBLESHOOT SNMP ISSUES","b":"HOW TO TROUBLESHOOT SNMP ISSUES","u":"HOW-TO-TROUBLESHOOT-SNMP-ISSUES","d":"2024-10-12","c":"2024-09-02","v":7,"ver":1,"id":"ka0UY0000001mKLYAY"},{"k":"kb","n":"000013432","t":"HOW TO TROUBLESHOOT SELINUX RELATED ISSUES","b":"HOW TO TROUBLESHOOT SELINUX RELATED ISSUES","u":"HOW-TO-TROUBLESHOOT-SELINUX-RELATED-ISSUES","d":"2024-12-20","c":"2024-09-02","v":7,"ver":1,"id":"ka0UY0000001mLxYAI"},{"k":"kb","n":"000013434","t":"How To Change The Hostname And Domain Name On An Appliance In AWS","b":"How To Change The Hostname And Domain Name On An Appliance In AWS","u":"How-To-Change-The-Hostname-And-Domain-Name-On-An-Appliance-In-AWS","d":"2024-11-05","c":"2024-09-04","v":7,"ver":1,"id":"ka0UY0000001mvRYAQ"},{"k":"kb","n":"000013436","t":"ACL fails after upgrade to 8.16.9+ of Switch plugin","b":"","u":"ACL-fails-after-upgrade-to-8-16-9","d":"2024-09-05","c":"2024-09-05","v":7,"ver":1,"id":"ka0UY0000001n3VYAQ"},{"k":"kb","n":"000013443","t":"Appliances Will Not Auto Reconnect After WAN Link Flap (Juniper Smart Session Router)","b":"","u":"Appliances-Will-Not-Auto-Reconnect-After-WAN-Link-Flap-Juniper-Smart-Session-Router","d":"2024-09-12","c":"2024-09-10","v":7,"ver":1,"id":"ka0UY0000001o7dYAA"},{"k":"kb","n":"000013456","t":"Is Forescout vulnerable to CVE-2024-6387 ?","b":"CVE-2024-6387, is an unauthenticated remote code execution in OpenSSH’s server (sshd) that grants full root access. It affects the default configuration and does not require user interaction. It poses a significant exploit risk.","u":"Is-Forescout-vulnerable-to-CVE-2024-6387","d":"2024-10-12","c":"2024-09-20","v":7,"ver":1,"id":"ka0UY0000001uMjYAI"},{"k":"kb","n":"000013457","t":"How to change SNMP engine ID when ID reset button doesn't show","b":"There is no reset button on the SNMP settings.","u":"How-to-change-SNMP-engine-ID-when-ID-reset-button-doesn-t-show","d":"2024-10-12","c":"2024-09-24","v":7,"ver":1,"id":"ka0UY0000001vx7YAA"},{"k":"kb","n":"000013458","t":"Eyeinspect Sensor is showing Disconnect on CC due to MTU size issue","b":"","u":"Eyeinspect-Sensor-is-showing-Disconnect-on-CC-due-to-MTU-size-issue","d":"2024-11-05","c":"2024-09-25","v":7,"ver":1,"id":"ka0UY0000001wOXYAY"},{"k":"kb","n":"000013463","t":"SecureConnector on Windows Thin Clients disconnected x8009030 error in sc.log","b":"","u":"SecureConnector-on-Thin-Clients-disconnected-x8009030-error-in-sc-log","d":"2024-11-05","c":"2024-09-26","v":7,"ver":1,"id":"ka0UY0000001woLYAQ"},{"k":"kb","n":"000013469","t":"SD script show s grabbled text in text editor","b":"SD script shows grabbled text in text editor such as notepad or notepad++.Various encodings that could be opened in vscode won't solve the problem.","u":"SD-script-show-s-grabbled-text-in-text-editor","d":"2024-11-05","c":"2024-10-06","v":7,"ver":1,"id":"ka0UY00000020n7YAA"},{"k":"kb","n":"000013472","t":"Modify the Analytics retention time","b":"How to Modify the Analytics Retention Time on eyeInspect","u":"Modify-the-Analytics-retention-time","d":"2024-11-05","c":"2024-10-08","v":7,"ver":1,"id":"ka0UY00000021G9YAI"},{"k":"kb","n":"000013473","t":"Endpoint supports Mac Address Pass Through via BIOS configuration","b":"A few customers' endpoints connect to the docking station.\r\nBy default, these endpoints use the docking station's NIC. Thus, all endpoints connected to the same docking station would have the same Mac address.\r\nForescout would merge these endpoints because they have the same Mac address.\r\n\r\nSome endpoints' BIOS support the feature called Mac Address pass-through. This allows the endpoint's NIC Mac address to overwrite the docking station's Mac address.","u":"Endpoint-supports-Mac-Address-Pass-Through-via-BIOS-configuration","d":"2024-11-05","c":"2024-10-08","v":7,"ver":1,"id":"ka0UY00000021HlYAI"},{"k":"kb","n":"000013477","t":"How to Reconfigure Interfaces on HA Pair?","b":"These are basic steps on how to reconfigure interfaces without the need to reimage. These steps can be used if the user would like to add a second sync interface in their environment. \r\n\r\nWarning: The steps were tested on a VMWare ESXI Environment on 8.5.1.","u":"How-to-Reconfigure-Interfaces-on-HA-Pair","d":"2024-11-05","c":"2024-10-10","v":7,"ver":1,"id":"ka0UY00000022iTYAQ"},{"k":"kb","n":"000013478","t":"How to verify HPS RI Service account has sufficient privilege","b":"The following troubleshooting steps using the commands will help to verify if the configured HPS RI Service account has sufficient privilege","u":"How-to-verify-HPS-RI-Service-account-has-sufficient-privilege","d":"2026-07-29","c":"2024-10-11","v":7,"ver":1,"id":"ka0UY00000023cvYAA"},{"k":"kb","n":"000013486","t":"CVE-2024-9949 Medium Severity Vulnerability in Secure Connector HPS Inspection Engine v11.3.5 and lower","b":"Denial of Service in Forescout SecureConnector 11.1.02.1019 on Windows allows Unprivileged user to corrupt the configuration file and cause Denial of Service in the application.\r\n\r\n\r\nForescout would like to credit Kyle Hannon, Capital One Cyber Operations & Intelligence, Offensive Security - Red Team for this find.","u":"CVE-2024-9949-Medium-Severity-Vulnerability-in-Secure-Connector-HPS-Inspection-Engine-v11-3-5-and-lower","d":"2024-10-23","c":"2024-10-23","v":7,"ver":1,"id":"ka0UY0000002CbNYAU"},{"k":"kb","n":"000013487","t":"HA - Upgrade Cannot Proceed","b":"When performing the upgrade of the HA node, if we may come across the error \"Upgrade Cannot Proceed: Ignore standby flag is enabled, but the Standby node is alive\".","u":"HA-Upgrade-Cannot-Proceed","d":"2024-11-05","c":"2024-10-24","v":7,"ver":1,"id":"ka0UY0000002CebYAE"},{"k":"kb","n":"000013489","t":"Privileges required for the User Account in User Directory and HPS Inspection Engine when same user is used for both the Configurations","b":"Customers often use the same User Account for both User Directory as well as for the HPS inspection Engine. This article will guide them on what factors need to be considered if they are using the same user Account In HPS as well as in User Directory configuration.","u":"Privileges-required-for-the-User-Account-in-User-Directory-and-HPS-Inspection-Engine-when-same-user-is-used-for-both-the-Configurations","d":"2024-11-05","c":"2024-10-25","v":7,"ver":1,"id":"ka0UY0000002CxxYAE"},{"k":"kb","n":"000013490","t":"Steps to replace or migrate two old standalone appliances that are in a High-Availability (HA) setup with new appliances","b":"If you are planning to replace your old standalone appliances that are in HA setup with a fresh pair of appliances. This guide will walk you through how to smoothly transition to your new appliances without disrupting the setup.","u":"Steps-to-replace-or-migrate-two-old-standalone-appliances-that-are-in-a-High-Availability-HA-setup-with-new-appliances","d":"2025-11-19","c":"2024-10-28","v":7,"ver":1,"id":"ka0UY0000002CzZYAU"},{"k":"kb","n":"000013491","t":"Radius Authentication fails due Authentication port not found in IPtables","b":"","u":"Radius-Authentication-fails-due-Authentication-port-not-found-in-IPtables","d":"2024-11-05","c":"2024-10-29","v":7,"ver":1,"id":"ka0UY0000002DdtYAE"},{"k":"kb","n":"000013492","t":"After upgrading the appliance to 8.5.2 and HPS 11.3.11, Nmap stopped working, and a Windows manageability HPS issue started.","b":"","u":"After-upgrading-the-appliance-to-8-5-2-and-HPS-11-3-11-Nmap-stopped-working-and-a-Windows-manageability-HPS-issue-started","d":"2024-11-05","c":"2024-10-30","v":7,"ver":1,"id":"ka0UY0000002Hb3YAE"},{"k":"kb","n":"000013493","t":"HPS Inspection Engine test outputting special characters","b":"","u":"HPS-Inspection-Engine-test-outputting-special-characters","d":"2024-12-20","c":"2024-10-30","v":7,"ver":1,"id":"ka0UY0000002IorYAE"},{"k":"kb","n":"000013494","t":"Host logs failing with \"Failed to load data\" when opening","b":"","u":"Host-logs-failing-with-Failed-to-load-data-when-opening","d":"2024-12-25","c":"2024-10-30","v":7,"ver":1,"id":"ka0UY0000002IqTYAU"},{"k":"kb","n":"000013495","t":"How to identify and resolve an expired CA for the Active Sensor","b":"When certificate expires on sensor when the sensor has been removed from CC, the following steps helps redeploy the cert in the sensor.\r\n\r\nThe ICSP-CC component contains a Certificate Authority (hereafter referred to as CA) to generate SSL certificates that are used to communicate with the active sensors. This CA expires 825 after creation and there is no renewal process in place.","u":"How-to-identify-and-resolve-an-expired-CA-for-the-Active-Sensor","d":"2024-12-25","c":"2024-10-30","v":7,"ver":1,"id":"ka0UY0000002J09YAE"},{"k":"kb","n":"000013497","t":"License is invalid on High Availability Standby node","b":"","u":"License-is-invalid-on-High-Availability-Standby-node","d":"2024-11-05","c":"2024-10-31","v":7,"ver":1,"id":"ka0UY0000002J4zYAE"},{"k":"kb","n":"000013498","t":"How to create new sudo user with password never expires","b":"This KB helps to create the sudo user and set password never expire.","u":"How-to-create-new-sudo-user-with-password-never-expires","d":"2024-12-25","c":"2024-10-31","v":7,"ver":1,"id":"ka0UY0000003tzFYAQ"},{"k":"kb","n":"000013500","t":"Admin API Access error \"502 Proxy Error\"","b":"","u":"Admin-API-Access-error-502-Proxy-Error","d":"2024-11-05","c":"2024-11-01","v":7,"ver":1,"id":"ka0UY0000003o9xYAA"},{"k":"kb","n":"000013501","t":"Switch Plugin unable to manage Cisco FTD","b":"","u":"Switch-Plugin-unable-to-manage-Cisco-FTD","d":"2024-11-20","c":"2024-11-04","v":7,"ver":1,"id":"ka0UY0000002JUnYAM"},{"k":"kb","n":"000013504","t":"SNMPv3 traps are not processed after upgrading to Switch Plugin 8.16.10 or 8.16.11","b":"","u":"SNMPv3-traps-are-not-processed-after-upgrading-to-Switch-Plugin-8-16-10-or-8-16-11","d":"2024-11-07","c":"2024-11-07","v":7,"ver":1,"id":"ka0UY0000002WbhYAE"},{"k":"kb","n":"000013509","t":"How to change the iDRAC hostname","b":"This article explains the process of changing the iDRAC hostname","u":"How-to-change-the-iDRAC-hostname","d":"2024-12-25","c":"2024-11-12","v":7,"ver":1,"id":"ka0UY0000002Oz7YAE"},{"k":"kb","n":"000013510","t":"Creation of a CounterACT console user for daily Operational purposes where user will have limited access only to perform “Manage and Remediate actions” on the endpoints.","b":"Considering the requirement where customers do not wish to provide Administrator privileges to all the users on the console and provide limited privileges to the ones which are working at the helpdesk level to support daily operations, we can have a user created with limited permissions which will only allow these users to perform the “Manage and Remediations” actions on the endpoints.","u":"Creation-of-a-CounterACT-console-user-for-daily-Operational-purposes-where-user-will-have-limited-access-only-to-perform-Manage-and-Remediate-actions-on-the-endpoints","d":"2024-12-25","c":"2024-11-13","v":7,"ver":1,"id":"ka0UY0000002PGrYAM"},{"k":"kb","n":"000013512","t":"DNS Server Cache Snooping Remote Information Disclosure","b":"Vulnerability: DNS Server Cache Snooping Remote Information Disclosure","u":"DNS-Server-Cache-Snooping-Remote-Information-Disclosure","d":"2024-12-25","c":"2024-11-16","v":7,"ver":1,"id":"ka0UY0000002PwnYAE"},{"k":"kb","n":"000013513","t":"Cannot enter Shell mode, syntax error in /etc/sudoers","b":"When we try to access enter Shell mode, we get error like:\r\n/etc/sudoers: syntac error near line \r\nSudo: parse error in /etc/sudoers near line \r\nSudo: no valid sudoers sources found, quitting\r\nSudo: unable to initialize policy plugin","u":"Cannot-enter-Shell-mode","d":"2024-12-25","c":"2024-11-16","v":7,"ver":1,"id":"ka0UY0000002PyPYAU"},{"k":"kb","n":"000013516","t":"Unable to learn port information for some device (POE)","b":"","u":"Unable-to-learn-port-information-for-some-device-POE","d":"2024-12-25","c":"2024-11-21","v":7,"ver":1,"id":"ka0UY0000002WGjYAM"},{"k":"kb","n":"000013519","t":"How to clear postinstall_mark error for the postinstall finished with errors - indicator etc/.postinstall_mark CounterACT Appliance is restoring dropped database tables (source_log)","b":"Customer do encounter this issue sometimes after the upgrade where the Appliance is disconnected from Enterprise Manager and after running the command for “fstool service status” it gives the output as “Error: postinstall finished with errors - indicator etc/.postinstall_mark CounterACT Appliance is restoring dropped database tables (source_log) “\r\n\r\nThis KB article will guide you on how to solve this issue when encountered with such error.","u":"How-to-clear-postinstall-mark-error-for-the-postinstall-finished-with-errors-indicator-etc-postinstall-mark-CounterACT-Appliance-is-restoring-dropped-database-tables-source-log","d":"2024-12-25","c":"2024-11-23","v":7,"ver":1,"id":"ka0UY0000002YC5YAM"},{"k":"kb","n":"000013533","t":"How to Prepare to Upgrade to Forescout 9.1.x","b":"This how-to KB article explains how to prepare to upgrade an existing Forescout environment to Forescout version 9.1.x.","u":"How-to-Prepare-to-Upgrade-to-Forescout-9-1-x","d":"2024-12-09","c":"2024-12-04","v":7,"ver":1,"id":"ka0R7000000SF49IAG"},{"k":"kb","n":"000013535","t":"SecureConnector Compliance page is distorted and has no CSS styling","b":"We may see situations where the SecureConnector Compliance page is distorted and has no CSS styling. The functionality of SecureConnector is however not impacted but the UI looks bad.","u":"SecureConnector-Compliance-page-is-distorted-and-has-no-CSS-styling","d":"2024-12-25","c":"2024-12-04","v":7,"ver":1,"id":"ka0UY0000002b8LYAQ"},{"k":"kb","n":"000013539","t":"How to find SSH login failure logs on counteract","b":"You can check If someone tries to open an SSH session to the Counteract appliance.","u":"How-to-find-SSH-login-failure-logs-on-counteract","d":"2024-12-25","c":"2024-12-06","v":7,"ver":1,"id":"ka0UY0000002ddBYAQ"},{"k":"kb","n":"000013540","t":"How to check HPE Switch manageability issues when configured on counteract","b":"HPE Switch does not show output page by page like cisco switches to review logs when it is configured in counteract.","u":"How-to-check-HPE-Switch-manageability-issues-when-configured-on-counteract","d":"2024-12-25","c":"2024-12-06","v":7,"ver":1,"id":"ka0UY0000002denYAA"},{"k":"kb","n":"000013546","t":"How to Resolve the Issue with Installing SecureConnector on RHEL 9.4","b":"","u":"How-to-Resolve-the-Issue-with-Installing-SecureConnector-on-RHEL-9-4","d":"2024-12-25","c":"2024-12-10","v":7,"ver":1,"id":"ka0UY0000002fVJYAY"},{"k":"kb","n":"000013549","t":"How to use Tail command to monitor and follow basic logs for troubleshooting your CounterACT","b":"Tailing specific logs in your CounterACT while reproducing/simulating an issue can be very helpful in determining the underlying issues as shown in the logs.","u":"How-to-use-Tail-command-to-monitor-and-follow-basic-logs-for-troubleshooting-your-CounterACT","d":"2024-12-25","c":"2024-12-12","v":7,"ver":1,"id":"ka0UY0000002izRYAQ"},{"k":"kb","n":"000013554","t":"How to fix failed OS update on eyeInspect standalone sensors","b":"Updating to latest OS update for u22 would fail if there were previously installed OS updates not intended for standalone sensors. The OS update fails because of the OLD kernels that are still present on the system. Can see in the os-update logs that it failed the u22 update because of a lot of kernels previously installed and it is taking them into account during the install process, creating the initrd.img image for each and eventually running out of space in /boot.\r\n(see screenshots below)","u":"How-to-fix-failed-OS-update","d":"2025-03-04","c":"2024-12-13","v":7,"ver":1,"id":"ka0UY0000002jDxYAI"},{"k":"kb","n":"000013555","t":"How to verify CLI credentials are correct in Switch Plugin.","b":"If the CLI connectivity test is failing in the Switch Plugin Test, and the customer is insisting that the credentials are correct, and nothing on the network is blocking connectivity, it is always good to verify with a manual test.","u":"How-to-verify-CLI-credentials-are-correct-in-Switch-Plugin","d":"2025-03-04","c":"2024-12-13","v":7,"ver":1,"id":"ka0UY0000002jFZYAY"},{"k":"kb","n":"000013557","t":"How to fix eyeInspect Passive Sensor upgrade due to Ubuntu 22 OS update failure","b":"This article is meant to provide workaround to users facing issues like mentioned on the escalation OTD-2611 (Forescout 2130 update to Ubuntu 22.04 and eyeInspect v 5.5 fails) where there are eyeInspect Passive Sensor upgrade issues as a result of Ubuntu 22 upgrade failures.\r\n\r\nNote: This article assumes that user performs the steps in the upgrade and configuration guideline.","u":"How-to-fix-eyeInspect-Passive-Sensor-upgrade-due-to-Ubuntu-22-OS-update-failure","d":"2024-12-13","c":"2024-12-13","v":7,"ver":1,"id":"ka0UY0000002jKPYAY"},{"k":"kb","n":"000013559","t":"How to check which policy is consuming the most CPU","b":"How to check which policy is consuming the most CPU","u":"How-to-check-which-policy-is-consuming-the-most-CPU","d":"2025-03-04","c":"2024-12-13","v":7,"ver":1,"id":"ka0UY0000002jNdYAI"},{"k":"kb","n":"000013560","t":"Configuring the TOP command to display information in different formats","b":"This article will describe how to configure the TOP command so that each time the command is run, the information show will be in a format that conforms to what you want to see. Examples, running a top -c, or showing the memory information in Mb or Gb, instead of the defaults","u":"Configuring-the-TOP-command-to-display-information-in-different-formats","d":"2024-12-25","c":"2024-12-13","v":7,"ver":1,"id":"ka0UY0000002jXJYAY"},{"k":"kb","n":"000013561","t":"How to monitor your CounterACT license activation activity","b":"CounterACT license activation can take several minutes to complete, depending on the number of license modules and your network connection to the license server.\r\nSometimes it takes a long time and you will see cursor just spinning...","u":"How-to-monitor-your-CounterACT-license-activation-activity","d":"2024-12-25","c":"2024-12-14","v":7,"ver":1,"id":"ka0UY0000002jYvYAI"},{"k":"kb","n":"000013562","t":"There are times when the EyeInspector Sensors can reach to api.snapcraft.io.","b":"","u":"There-are-times-when-the-EyeInspector-Sensors-can-reach-to-api-snapcraft-io","d":"2025-03-04","c":"2024-12-14","v":7,"ver":1,"id":"ka0UY0000002jc9YAA"},{"k":"kb","n":"000013563","t":"Resolving SSH Connection Failure with Cisco Switch After CounterACT 9.1.x Upgrade","b":"","u":"Resolving-SSH-Connection-Failure-with-Cisco-Switch-After-CounterACT-9-1-x-Upgrade","d":"2024-12-25","c":"2024-12-16","v":7,"ver":1,"id":"ka0UY0000002jkDYAQ"},{"k":"kb","n":"000013565","t":"Dashboards not working properly due to Support plugin crashing or restarting","b":"","u":"Dashboards-not-working-properly-due-to-Support-plugin-crashing-or-restarting","d":"2024-12-25","c":"2024-12-16","v":7,"ver":1,"id":"ka0UY0000002jp3YAA"},{"k":"kb","n":"000013569","t":"How to clear out and reset Access>Web for CounterACT Web Features","b":"When unable to add or edit CounterACT Web features in the gui console Access>Web configurations, it is potentially due to some corruption in the config file preventing us to add or edit it.","u":"How-to-clear-out-and-reset-Access-Web-for-CounterACT-Web-Features","d":"2024-12-25","c":"2024-12-18","v":7,"ver":1,"id":"ka0UY0000002k5BYAQ"},{"k":"kb","n":"000013571","t":"Subsequent ACLs take over 15 minutes to apply","b":"","u":"Subsequent-ACLs-take-over-15-minutes-to-apply","d":"2024-12-25","c":"2024-12-18","v":7,"ver":1,"id":"ka0UY0000002kA1YAI"},{"k":"kb","n":"000013572","t":"SNMP Traps not showing in main GUI column","b":"","u":"SNMP-Traps-not-showing-in-main-GUI-column","d":"2024-12-25","c":"2024-12-18","v":7,"ver":1,"id":"ka0UY0000002kBdYAI"},{"k":"kb","n":"000013578","t":"Unable to login with CLIADMIN even after password reset","b":"","u":"Unable-to-login-with-CLIADMIN-even-after-password-reset","d":"2025-03-04","c":"2024-12-19","v":7,"ver":1,"id":"ka0UY0000002kRlYAI"},{"k":"kb","n":"000013581","t":"View Certificate that Radius plugin is using","b":"The following will explain how to see and confirm which certificate the radius plugin is using via the CLI.","u":"View-Certificate-that-Radius-plugin-is-using","d":"2025-12-21","c":"2024-12-19","v":7,"ver":1,"id":"ka0UY0000002kbRYAQ"},{"k":"kb","n":"000013583","t":"Logging in via SSH using a password fails, but the password is correct","b":"","u":"Logging-in-via-SSH-using-a-password-fails-but-the-password-is-correct","d":"2025-03-04","c":"2024-12-20","v":7,"ver":1,"id":"ka0UY0000004Xa5YAE"},{"k":"kb","n":"000013585","t":"Resolving DEX Web Service Parsing Issues with JSON Fields Containing Periods","b":"","u":"Resolving-DEX-Web-Service-Parsing-Issues-with-JSON-Fields-Containing-Periods","d":"2025-03-04","c":"2024-12-20","v":7,"ver":1,"id":"ka0UY0000002kwPYAQ"},{"k":"kb","n":"000013588","t":"Host not matching SNMP Property for APC UPS","b":"","u":"Host-not-matching-SNMP-Property-for-APC-UPS","d":"2025-03-04","c":"2024-12-20","v":7,"ver":1,"id":"ka0UY0000002l1FYAQ"},{"k":"kb","n":"000013589","t":"How to manage MAC randomization for Apple devices in enterprise or corporate networks.","b":"","u":"How-to-manage-MAC-randomization-for-Apple-devices-in-enterprise-or-corporate-networks","d":"2024-12-25","c":"2024-12-20","v":7,"ver":1,"id":"ka0UY0000002l2rYAA"},{"k":"kb","n":"000013592","t":"Firmware upgrade guidelines for rev50, 51XX, and 61XX Forescout appliances","b":"","u":"Firmware-upgrade-guidelines-for-rev50-51XX-and-61XX-Forescout-appliances","d":"2025-03-04","c":"2024-12-23","v":7,"ver":1,"id":"ka0UY0000002l7hYAA"},{"k":"kb","n":"000013596","t":"Observing a large number of Unassigned hosts Causing EM to disconnect","b":"","u":"Observing-a-large-number-of-Unassigned-hosts-Causing-EM-to-disconnect","d":"2025-03-04","c":"2024-12-23","v":7,"ver":1,"id":"ka0UY0000002lHNYAY"},{"k":"kb","n":"000013600","t":"Changing active sensor default log rotation configuration","b":"Log rotation is an automated process used in system administration in which log files are compressed, moved (archived), renamed or deleted once they are too old or too big.\r\n\r\nLogrotate is a Linux utility whose core function is to rotate logs. By default, it rotates per week or 100MB whichever is met earlier. All the rotated logs are retained for 1 week.\r\n\r\nThis default configuration can be changed on need basis.\r\n\r\nThis article explains the default configurations of active sensor log rotation and how to change the -\r\n\r\nNumber of files saved in the log rotation\r\nfile size of the log file being rotated","u":"Changing-active-sensor-default-log-rotation-configuration","d":"2025-03-04","c":"2024-12-26","v":7,"ver":1,"id":"ka0UY0000002lVtYAI"},{"k":"kb","n":"000013602","t":"How to troubleshoot eyeSight Active Probing plugin issues","b":"This article explains how to verify which nse scripts are used by active probing plugin and which logs to verify if the script output is not as expected in the active probing raw data section in Counter Act UI.","u":"How-to-troubleshoot-eyeSight-Active-Probing-plugin-issues","d":"2025-03-04","c":"2024-12-26","v":7,"ver":1,"id":"ka0UY0000002lcLYAQ"},{"k":"kb","n":"000013603","t":"Collect detailed Postgres diagnostics data in production","b":"A Postgres database server might have an undesired behavior in production. Instead of running a long diagnostic session with the customer, this guide offers a tool to collect all the diagnostic data in a file that can be analyzed offline and prepare a comprehensive maintenance script targeted to that customer.","u":"Collect-detailed-Postgres-diagnostics-data-in-production","d":"2025-03-04","c":"2024-12-26","v":7,"ver":1,"id":"ka0UY0000002ldxYAA"},{"k":"kb","n":"000013605","t":"Using nidstool to manage the passive sensor containers","b":"This page explains how to use nidstool for the basic administration of the passive sensor containers. For a more complete overview, refer to the nidstool user documentation.","u":"Using-nidstool-to-manage-the-passive-sensor-containers","d":"2025-03-04","c":"2024-12-26","v":7,"ver":1,"id":"ka0UY0000002linYAA"},{"k":"kb","n":"000013607","t":"Predictable Network Interface Name Changes in Forescout Platform 9.1.2 and above","b":"","u":"Predictable-Network-Interface-Name-Changes-in-Forescout-Platform-in-9-1-2-and-above","d":"2025-03-04","c":"2024-12-26","v":7,"ver":1,"id":"ka0UY0000002lm1YAA"},{"k":"kb","n":"000013608","t":"How to fix duplicate Passive Sensor profiles issue after upgrading EyeInspect Command Center","b":"eyeInspect Passive Sensors profiles, such as LAN CP and SD Scripts, get duplicated after the upgrade of eyeInspect Command Center to version >=5.1.0","u":"How-to-fix-duplicate-Passive-Sensor-profiles-issue-after-upgrading-EyeInspect-Command-Center","d":"2025-03-04","c":"2024-12-27","v":7,"ver":1,"id":"ka0UY0000002lndYAA"},{"k":"kb","n":"000013614","t":"Eye segment page not loading","b":"Customer raised issue that their Eye-segment dashboard page is not loading","u":"Eye-segment-page-not-loading","d":"2025-03-04","c":"2024-12-30","v":7,"ver":1,"id":"ka0UY0000002m3lYAA"},{"k":"kb","n":"000013615","t":"Asset map loading takes forever stuck on rendering map","b":"","u":"Asset-map-loading-takes-forever-stuck-on-rendering-map","d":"2025-06-05","c":"2024-12-30","v":7,"ver":1,"id":"ka0UY0000002m5NYAQ"},{"k":"kb","n":"000013617","t":"How to use sd-mm","b":"When you want to (re)fine tune the memory and cpu usage of your eyeInspect installation, for example after adding new memory or more cores to an existing environment and want it to correctly allocate without using sd-mm utility there are chances it will not be in effect , numbers will show the resources added but it will not be allocated to the required segment of it.","u":"How-to-use-sd-mm","d":"2025-06-05","c":"2024-12-30","v":7,"ver":1,"id":"ka0UY0000002m8bYAA"},{"k":"kb","n":"000013620","t":"How to enable debug, collect the logs and relative info for HPS inspection engine.","b":"When working on an HPS issue to get more details from the logs you'd need to enable the debug on the plugin and collect the logs when sending the tech-support file to the support team","u":"How-to-enable-debug-collect-the-logs-and-relative-info-for-HPS-inspection-engine","d":"2025-03-04","c":"2024-12-30","v":7,"ver":1,"id":"ka0UY0000003uiPYAQ"},{"k":"kb","n":"000013622","t":"New Appliance will not connect to Enterprise Manager","b":"","u":"New-Appliance-will-not-connect-to-Enterprise-Manager","d":"2025-03-04","c":"2024-12-30","v":7,"ver":1,"id":"ka0UY0000002mOjYAI"},{"k":"kb","n":"000013623","t":"Upgrade through Check For Updates and appliance went down - customer didn't want to SFTP fix.","b":"","u":"Upgrade-through-Check-For-Updates-and-appliance-went-down-customer-didn-t-want-to-SFTP-fix","d":"2025-03-04","c":"2024-12-30","v":7,"ver":1,"id":"ka0UY0000002mQLYAY"},{"k":"kb","n":"000013624","t":"Using Apple MAC GUI Console to upgrade through Check For Updates fails on DPI plugin","b":"","u":"Using-Apple-MAC-GUI-Console-to-upgrade-through-Check-For-Updates-fails-on-DPI-plugin","d":"2025-03-04","c":"2024-12-30","v":7,"ver":1,"id":"ka0UY0000002mRxYAI"},{"k":"kb","n":"000013625","t":"Getting \"Error: Invalid Request\" when attempting to access the web portal","b":"","u":"Getting-Error-Invalid-Request-when-attempting-to-access-the-web-portal","d":"2025-03-04","c":"2024-12-30","v":7,"ver":1,"id":"ka0UY0000002mTZYAY"},{"k":"kb","n":"000013636","t":"Abuse of Unauthenticated Compliance Recheck in SecureConnector","b":"","u":"Abuse-of-Unauthenticated-Compliance-Recheck-in-SecureConnector","d":"2025-01-02","c":"2025-01-02","v":7,"ver":1,"id":"ka0UY0000002n33YAA"},{"k":"kb","n":"000013637","t":"Endpoints Being Learned on Uplinks on HPE ProCurve Switches","b":"","u":"Endpoints-Being-Learned-on-Uplinks-on-HPE-Switches","d":"2025-03-04","c":"2025-01-06","v":7,"ver":1,"id":"ka0UY0000002nCjYAI"},{"k":"kb","n":"000013638","t":"Command Center 5.2.2 GUI become unavailable after CVE&IoC Upload","b":"","u":"Command-Center-5-2-2-GUI-become-unavailable-after-CVE-IoC-Upload","d":"2025-01-14","c":"2025-01-06","v":5,"ver":1,"id":"ka0UY0000002nXhYAI"},{"k":"kb","n":"000013640","t":"After upgrading the appliance to 8.5.2 and HPS 11.3.11, Nmap stopped working, and a Windows manageability HPS issue started.","b":"","u":"After-upgrading-the-appliance-to-8-5-2-and-HPS-11-3-11-Nmap-stopped-working-and-a-Windows-manageability","d":"2025-03-04","c":"2025-01-07","v":7,"ver":1,"id":"ka0UY0000002nvtYAA"},{"k":"kb","n":"000013642","t":"Default CSV separator should be set to what most deployments use","b":"Fresh installs of Eyeinspect deployments default CSV separator","u":"Default-CSV-separator-should-be-set-to-what-most-deployments-use","d":"2025-04-08","c":"2025-01-07","v":7,"ver":1,"id":"ka0UY0000002nz7YAA"},{"k":"kb","n":"000013647","t":"Enable \"Use Secure Connection\" and \"Verify Presented Certificates\" options in the Meraki Integration","b":"The customer needs to enable the two options \"Use Secure Connection\" and \"Verify Presented Certificates\" to secure the Meraki Cloud API connection.\r\nThey need to import the ROOT CA cert that issues the SSL server cert of the Meraki Cloud API portal to the FS system.","u":"Enable-Use-Secure-Connection-and-Verify-Presented-Certificates-options-in-the-Meraki-Integration","d":"2025-04-08","c":"2025-01-17","v":7,"ver":1,"id":"ka0UY0000004IcfYAE"},{"k":"kb","n":"000013656","t":"Changes made on the segment manager are not saved","b":"When making changes on the segment manager, the changes are not saved and the events are also not reflected on the event viewer.\r\nThe is no error on the console that reflects the cause of the issue.","u":"Changes-made-on-the-segment-manager-are-not-saved","d":"2026-07-03","c":"2025-01-30","v":7,"ver":1,"id":"ka0UY0000002toPYAQ"},{"k":"kb","n":"000013657","t":"After upgrade to 8.5.x the Recovery Manager (REM) goes in Connect/Disconnect cycle (in Console) trying to install Forescout Infrastructure Update Pack","b":"","u":"After-upgrade-to-8-5-x-the-Recovery-Manager-REM-goes-in-Connect-Disconnect-cycle-in-Console-trying-to-install-Forescout-Infrastructure-Update-Pack","d":"2025-01-31","c":"2025-01-31","v":7,"ver":1,"id":"ka0UY0000002uyzYAA"},{"k":"kb","n":"000013660","t":"FS Platform 9.1.2 Customers Should Not Install Authentication Module 1.4.8","b":"","u":"FS-Platform-9-1-2-Customers-Should-Not-Install-Authentication-Module-1-4-8","d":"2025-02-11","c":"2025-02-10","v":7,"ver":1,"id":"ka0UY0000002xDhYAI"},{"k":"kb","n":"000013662","t":"How to edit the text sent by the Forescout on the mobile device","b":"There could be a requirement for the customer to send only the verification code to the end user but by default, Forescout sends an entire message that includes \r\n\"CounterACT Guest verification code:\r\nUser Name: _LOGIN_NAME_\r\nVerification Code: _PASSWORD_\"","u":"How-to-edit-the-text-send-by-the-Forescout-on-the-mobile-device","d":"2025-04-10","c":"2025-02-11","v":7,"ver":1,"id":"ka0UY0000002xOzYAI"},{"k":"kb","n":"000013666","t":"SNMPv3 Policy Issues after upgrading to 9.1.2","b":"SNMP policies stop working after upgrading to CounterACT version 9.1.2","u":"SNMPv3-Policy-Issues-after-upgrading-to-9-1-2","d":"2025-06-05","c":"2025-02-13","v":7,"ver":1,"id":"ka0UY0000002yEbYAI"},{"k":"kb","n":"000013667","t":"Not able to reset the password for CLIADMIN via root login","b":"How to reset the password for cliadmin via root when password is not working even after reset was successful","u":"Not-able-to-reset-the-password-for-CLIADMIN-via-root-login","d":"2026-01-07","c":"2025-02-14","v":7,"ver":1,"id":"ka0UY0000002yGDYAY"},{"k":"kb","n":"000013668","t":"Potential PEAP and EAP_TLS authentication issues after upgrading from Windows 10 to Windows 11","b":"","u":"Potential-PEAP-and-EAP-TLS-authentication-issues-after-upgrading-from-Windows-10-to-Windows-11","d":"2025-03-19","c":"2025-02-14","v":7,"ver":1,"id":"ka0UY0000002ymTYAQ"},{"k":"kb","n":"000013677","t":"Packet engine down and trails files corrupted","b":"After a reboot our Forescout appliance the packet engine won't start\r\n in the Trace_cu \r\n|engine_invoker|Error|Failed to run engine command trails -o log/engine.log -e log/engine.err -i DFLT_IF_CFG -U -A -S 5 -W 50000 -Z 50000 -u _fsservice -a 4000 -b 4001 -d root -M 1 -E ./etc -m i|Thread[Engine invoker,5,FS FSThread","u":"Packet-engine-down-and-trails-files-corrupted","d":"2025-08-12","c":"2025-02-25","v":7,"ver":1,"id":"ka0UY00000031vdYAA"},{"k":"kb","n":"000013678","t":"After upgrading from version 8.4.1 to 8.5.2.1, clicking on the plugins resulted in a \"Loading Data\" message on the console","b":"","u":"After-upgrading-from-version-8-4-1-to-8-5-2-1-clicking-on-the-plugins-resulted-in-a-Loading-Data-message-on-the-console","d":"2025-03-04","c":"2025-03-03","v":7,"ver":1,"id":"ka0UY00000034VJYAY"},{"k":"kb","n":"000013681","t":"When would the Windows Update .CAB file be pushed down from FS server to endpoint?","b":"Forescout can detect the endpoint's Windows Update status via Remote Inspection / SecureConnector, 3rd party integration (e.g., WSUS, SMS/SCCM), and leveraging the Windows Hotfix ID.\r\nThis article describes the difference between Remote Inspection / SecureConnector, 3rd party integration and leveraging the Windows Hotfix ID.","u":"When-would-the-Windows-Update-CAB-file-be-pushed-down-from-FS-server-to-endpoint","d":"2025-03-14","c":"2025-03-04","v":7,"ver":1,"id":"ka0UY0000003nk9YAA"},{"k":"kb","n":"000013686","t":"SSID profile (802.1x) pushed down via GPO","b":"Many customers use the AD Domain Group Policy (GPO) to push down the wireless connection profile.\r\nThe Wireless connection profile is critical in the 802.1x auth use case.\r\nThis article explains how to configure the wireless profile in the GPO and push down to the endpoint joined the AD Domain.","u":"SSID-profile-802-1x-pushed-down-via-GPO","d":"2025-04-10","c":"2025-03-07","v":7,"ver":1,"id":"ka0R7000000SwKPIA0"},{"k":"kb","n":"000013687","t":"Remote Inspection Fails When Full C Drive Shared","b":"","u":"Remote-Inspection-Fails-When-Full-C-Drive-Shared","d":"2025-04-10","c":"2025-03-07","v":7,"ver":1,"id":"ka0UY000000368vYAA"},{"k":"kb","n":"000013688","t":"Considerations for choosing SecureConnector vs. Remote Inspection (SSH): Feature Comparison for macOS and Linux Endpoints","b":"The intent of this article is to provide a comparison between SecureConnector and Remote Inspection (SSH-based) for managing macOS and Linux endpoints within the Forescout Continuum Platform. \r\nIt outlines the key differences in capabilities, authentication methods, network impact, and policy enforcement to help organizations and administrators determine the most suitable approach for their environment. \r\nThe article will also highlight the benefits and limitations of each method, offering guidance on when to use SecureConnector for streamlined management versus SSH-based Remote Inspection for agentless visibility.","u":"Considerations-for-choosing-SecureConnector-vs-Remote-Inspection-SSH-Feature-Comparison-for-macOS-and-Linux-Endpoints","d":"2025-03-13","c":"2025-03-13","v":7,"ver":1,"id":"ka0UY0000008zCnYAI"},{"k":"kb","n":"000013689","t":"CrowdStrike eyeExtend Module 1.5.7 - Using mac address to query Device ID","b":"CrowdStrike eyeExtend Module uses Hostname(s) first to retrieve CrowdStrike Device ID for endpoints managed by CrowdStrike and when that fails, uses MAC Address. \r\n\r\nThe config parameter below can be set to true for the plugin to skip hostname correlation and use just the mac address.\r\n\r\nconfig.use.mac.only.for.endpoint.correlation \r\n\r\nThis parameters is in /usr/local/forescout/plugin/crowdstrike/install.properties. \r\nBy default, it is set to false.","u":"CrowdStrike-eyeExtend-Module-Using-mac-address-to-query-Device-ID","d":"2025-12-19","c":"2025-03-14","v":7,"ver":1,"id":"ka0UY00000039BdYAI"},{"k":"kb","n":"000013692","t":"Chinese Characters in DHCP Hostname Are Not Displayed Correctly","b":"","u":"Chinese-Characters-in-DHCP-Hostname-Are-Not-Displayed-Correctly","d":"2025-04-10","c":"2025-03-16","v":7,"ver":1,"id":"ka0UY00000039Q9YAI"},{"k":"kb","n":"000013693","t":"Resolving Certificate Directory Ownership Issues in Forescout","b":"","u":"Resolving-Certificate-Directory-Ownership-Issues-in-Forescout","d":"2025-04-10","c":"2025-03-16","v":7,"ver":1,"id":"ka0UY00000039RlYAI"},{"k":"kb","n":"000013694","t":"PXGrid certificate cannot be imported","b":"","u":"PXGrid-certificate-cannot-be-imported","d":"2025-06-05","c":"2025-03-19","v":7,"ver":1,"id":"ka0UY0000003A65YAE"},{"k":"kb","n":"000013698","t":"Which admission event triggers or keeps the device to be online (All-In-One)","b":"A few customers report that the device has disconnected from the network (switch port / SSID), but the FS GUI still shows the device is online.\r\nThis article explains the scenarios why the device is still online in the FS GUI.","u":"Which-admission-event-triggers-or-keeps-the-device-to-be-online-All-In-One","d":"2025-06-05","c":"2025-03-25","v":7,"ver":1,"id":"ka0UY0000003BN7YAM"},{"k":"kb","n":"000013699","t":"When upgrading EyeInspect Sensor install 5.2.1 - The available space in the / partition is below the minimum value of 8 GB","b":"","u":"When-upgrading-EyeInspect-Sensor-install-5-2-1-The-available-space-in-the-partition-is-below-the-minimum-value-of-8-GB","d":"2025-03-26","c":"2025-03-25","v":7,"ver":1,"id":"ka0UY0000003BtNYAU"},{"k":"kb","n":"000013702","t":"How to check if virtual eyeSight/CounterACT appliance is affected by shared virtual machine resources","b":"When virtual resources are not dedicated, virtual eyeSight/CounterACT appliance can experience degraded performance","u":"How-to-check-if-virtual-eyeSight-CounterACT-appliance-is-affected-by-shared-virtual-machine-resources","d":"2025-04-10","c":"2025-03-26","v":7,"ver":1,"id":"ka0UY0000003Pl3YAE"},{"k":"kb","n":"000013705","t":"installing secureconnector on macOS fails,with Error Domain,NSCocoaErrorDomain","b":"Running the .dmg installer directly appeared to silently fail installation.\r\nSample events from the SecureConnector log file:\r\nDAEMON(5950) 280656 25 Feb 2025 10:59:28.997 [DEBUG] sslutils.cpp(429) getNativeSocketConnection: client: connect to, abcd.com:10005 usedIP x.x.x.x local addrr x.x.x.x\r\nDAEMON(5950) 280656 25 Feb 2025 10:59:28.997 [DEBUG] sslutils.cpp(793) SSLGetDistinguishedNames: before first handshake. set ssl connection result 0\r\nDAEMON(5950) 280688 25 Feb 2025 10:59:29.029 [DEBUG] sslutils.cpp(795) SSLGetDistinguishedNames: after first handshake got result -9841\r\nDAEMON(5950) 280688 25 Feb 2025 10:59:29.029 [DEBUG] sslutils.cpp(914) SSLGetDistinguishedNames: Before Calling SSLHandshake due to errSSLPeerAuthCompleted\r\nDAEMON(5950) 280727 25 Feb 2025 10:59:29.068 [DEBUG] sslutils.cpp(1037) setAuthInfo: no issuers found!!!","u":"installing-secureconnector-on-macOS-fails-with-Error-Domain-NSCocoaErrorDomain","d":"2025-10-17","c":"2025-03-27","v":7,"ver":1,"id":"ka0UY0000003CSrYAM"},{"k":"kb","n":"000013709","t":"How to Resolve Missing Plugin Setup Files Reported by Upgrade Verifier","b":"","u":"How-to-Resolve-Missing-Plugin-Setup-Files-Reported-by-Upgrade-Verifier","d":"2025-04-16","c":"2025-03-28","v":7,"ver":1,"id":"ka0R7000000ROUTIA4"},{"k":"kb","n":"000013710","t":"CounterACT keeps applying an access control list \"forescout_acl\" to a switchport every 15 minutes","b":"","u":"CounterACT-keeps-applying-an-access-control-list-forescout-acl-to-a-switchport-every-15-minutes","d":"2025-06-13","c":"2025-03-31","v":7,"ver":1,"id":"ka0UY0000003rkXYAQ"},{"k":"kb","n":"000013711","t":"Radius ignoring authentications after upgrade to 4.7.10, 4.7.11, 4.7.12 or 4.7.13","b":"","u":"Radius-ignoring-authentications-after-upgrade-to-4-7-13","d":"2025-04-01","c":"2025-03-31","v":7,"ver":1,"id":"ka0UY0000003F5lYAE"},{"k":"kb","n":"000013713","t":"Attribute Minimum TLS version has no value","b":"","u":"Attribute-Minimum-TLS-version-has-no-value","d":"2025-06-13","c":"2025-04-01","v":7,"ver":1,"id":"ka0UY0000003DtZYAU"},{"k":"kb","n":"000013715","t":"Error: Forescout Image Extraction Failure via Remote iDRAC on Physical Appliance","b":"","u":"Error-Forescout-Image-Extraction-Failure-via-Remote-iDRAC-on-Physical-Appliance","d":"2025-06-13","c":"2025-04-01","v":7,"ver":1,"id":"ka0UY0000003DwnYAE"},{"k":"kb","n":"000013716","t":"Segment folder that existed before is not showing up in the Console UI","b":"","u":"Segment-folder-that-existed-before-is-not-showing-up-in-the-Console-UI","d":"2025-04-02","c":"2025-04-01","v":7,"ver":1,"id":"ka0UY0000003rm9YAA"},{"k":"kb","n":"000013717","t":"How to Restore EM/RM Dashboard DB when it's found dropped or corrupted.","b":"In certain circumstance, the Dashboard DB may become corrupted/dropped during the following events:\r\n\r\n1- After a major upgrade. \r\n2- After unsuccessful failover to Recovery Manager.\r\n3- After manual DB purge activity.","u":"How-to-Restore-EM-RM-Dashboard-DB-when-it-s-found-dropped-or-corrupted","d":"2025-06-13","c":"2025-04-01","v":5,"ver":1,"id":"ka0UY0000003EhZYAU"},{"k":"kb","n":"000013718","t":"Forescout Radius Auth via PAP doesn't support special character","b":"","u":"Forescout-Radius-Auth-via-PAP-doesn-t-support-special-character","d":"2025-06-13","c":"2025-04-02","v":7,"ver":1,"id":"ka0UY0000003EjBYAU"},{"k":"kb","n":"000013726","t":"Eyeinspect | How to find UUID of Sensors","b":"Eyeinspect, How to find UUIDs of Sensors and edit the config to show a name on the Command Center (CC) to make it easer to deploy sensors","u":"Eyeinspect-How-to-find-UUID-of-Sensors","d":"2025-06-13","c":"2025-04-03","v":7,"ver":1,"id":"ka0UY0000003FH3YAM"},{"k":"kb","n":"000013731","t":"Not able to install the plugin via CLI","b":"","u":"Not-able-to-install-the-plugin-via-CLI","d":"2025-06-13","c":"2025-04-07","v":7,"ver":1,"id":"ka0UY0000003GRdYAM"},{"k":"kb","n":"000013733","t":"How to fix disconnected Passive Sensor issue when Command Center logs show the error \"Insufficient buffer remaining...\"","b":"This article provides a workaround to fix the issue when Passive Sensor shows disconnected along with the error “Insufficient buffer remaining … “ which is seen in eyeInspect Command Center catalina logs /opt/sdconsole/tomcat/logs/catalina.out","u":"How-to-fix-disconnected-Passive-Sensor-issue-when-Command-Center-logs-show-the-error-Insufficient-buffer-remaining","d":"2025-04-09","c":"2025-04-09","v":7,"ver":1,"id":"ka0UY0000003HIrYAM"},{"k":"kb","n":"000013736","t":"Unable To Save Changes In Segment Manager and Console User Profile","b":"","u":"Unable-To-Save-Changes-In-Segment-Manager-and-Console-User-Profile","d":"2025-06-13","c":"2025-04-13","v":7,"ver":1,"id":"ka0UY0000003IMzYAM"},{"k":"kb","n":"000013738","t":"False Positive- Python Impacket Tool Flagging as Malicious [eyeSight]","b":"False Positive- Python Impacket Tool Flagging as Malicious By Some Scanning Tools\r\n\r\nImpacket is a collection of Python classes for working with network protocols. It is focused on providing low-level programmatic access to the packets and, for some protocols (e.g. SMB1-3 and MSRPC), the protocol implementation itself.\r\n\r\nPython “Impacket” tool being flagged as malicious by some scanning tools. This is a false positive.","u":"python-impacket-false-positive","d":"2025-04-14","c":"2025-04-14","v":7,"ver":1,"id":"ka0UY0000003IV3YAM"},{"k":"kb","n":"000013739","t":"In the CounterACT console a switch profile displays \"Unknown vendor\" for the \"NIC Vendor\" property","b":"","u":"In-the-CounterACT-console-a-switch-profile-displays-Unknown-vendor-for-the-NIC-Vendor-property","d":"2025-06-13","c":"2025-04-16","v":7,"ver":1,"id":"ka0UY0000003JVxYAM"},{"k":"kb","n":"000013743","t":"Forescout Radius Secret Key doesn't support special characters","b":"In a Forescout Radius configuration, the same Radius Secret key should be configured on both the Forescout and NAS device sides.\r\nThis article describes what special characters are supported in the Forescout Radius Secret key configuration and what are not supported.","u":"Forescout-Radius-Secret-Key-doesn-t-support-special-characters","d":"2025-06-22","c":"2025-04-19","v":7,"ver":1,"id":"ka0UY0000004LgzYAE"},{"k":"kb","n":"000013744","t":"Unable to set shell password","b":"","u":"Unable-to-set-shell-password","d":"2025-08-27","c":"2025-04-23","v":7,"ver":1,"id":"ka0UY0000003KqDYAU"},{"k":"kb","n":"000013745","t":"How Frequent the compliance center Detected Time updated?","b":"How Frequent the compliance center Detected Time updated?","u":"How-Frequent-the-compliance-center-Detected-Time-updated","d":"2025-06-22","c":"2025-04-26","v":7,"ver":1,"id":"ka0UY0000003N3JYAU"},{"k":"kb","n":"000013747","t":"RADIUS Authentication Failure After User Password Reset","b":"","u":"RADIUS-Authentication-Failure-After-User-Password-Reset","d":"2025-06-22","c":"2025-04-29","v":7,"ver":1,"id":"ka0UY0000003NbBYAU"},{"k":"kb","n":"000013748","t":"When non-domain machines access domain resources using Active Directory (AD) credentials, user authentication takes precedence over machine authentication.","b":"","u":"When-non-domain-machines-access-domain-resources-using-Active-Directory-AD-credentials-user-authentication-takes-precedence-over-machine-authentication","d":"2025-06-22","c":"2025-04-29","v":7,"ver":1,"id":"ka0UY0000003NcnYAE"},{"k":"kb","n":"000013749","t":"Malware scanners flagging legitimate Forescout Files as malicious in scans","b":"Malware scanners are flagging legitimate Forescout Files as malicious in scans","u":"Malware-scanners-flagging-legitimate-Forescout-Files-as-malicious-in-scans","d":"2025-05-20","c":"2025-04-29","v":3,"ver":1,"id":"ka0UY0000003NkrYAE"},{"k":"kb","n":"000013751","t":"EM GUI DNS Settings not able to update on v9.1.2 fresh ISO Install","b":"The /etc/resolv.conf will not sync with the Gui>Mail and DNS updates to correct it. \r\nIn previous versions prior to v9.1.2 installations, the nameserver in the resolv.conf is pointed to . \r\nThe Gui>Mail and DNS updates is reflected in the /etc/named.conf forwarder which the appliance uses if resolv.conf nameserver is pointed to . \r\nIn 912-ISO fresh install, it writes the actual DNS IP to the resolv.conf which cannot be updated afterwards using the Mail and DNS settings in the gui.","u":"EM-GUI-DNS-Settings-not-able-to-update-on-v9-1-2-fresh-ISO-Install","d":"2025-06-22","c":"2025-04-29","v":7,"ver":1,"id":"ka0UY0000003O4DYAU"},{"k":"kb","n":"000013753","t":"Permission issue for user type \"Group - SSO with User Directory (Web Only)\"","b":"","u":"Permission-issue-for-user-type-Group-SSO-with-User-Directory-Web-Only","d":"2025-06-22","c":"2025-05-01","v":7,"ver":1,"id":"ka0UY0000003PRhYAM"},{"k":"kb","n":"000013754","t":"“You Do Not have Permission to Access this Service” using SSO Login","b":"","u":"You-Do-Not-have-Permission-to-Access-this-Service-using-SSO-Login","d":"2025-06-22","c":"2025-05-01","v":7,"ver":1,"id":"ka0UY0000003PTJYA2"},{"k":"kb","n":"000013759","t":"Troubleshooting RADIUS Authentication Issue with WLC","b":"Troubleshooting RADIUS Authentication Issue with WLC in the following situations:\r\n\r\n(i) Ports 1812/1813 are not open\r\n(ii) Error: Ignoring request to auth address * port 1812 bound to server default from unknown client port proto udp\r\n\r\nIssue Summary:\r\nThe customer reported that users attempting to connect to one specific Wireless LAN Controller (WLC) are experiencing authentication issues. Other WLCs, which are configured identically and use the same Forescout 802.1X management appliance, are functioning well without any issues.","u":"Troubleshooting-RADIUS-Authentication-Issue-with-WLC","d":"2025-08-22","c":"2025-05-03","v":7,"ver":1,"id":"ka0UY0000003Q2nYAE"},{"k":"kb","n":"000013763","t":"Switch port exclusions are not case sensitive","b":"When creating a switch port exclusion in the switch plugin to ignore actions based on port names or port aliases the port names are not case sensitive.","u":"Switch-port-exclusions-are-not-case-sensitive","d":"2025-06-05","c":"2025-05-05","v":7,"ver":1,"id":"ka0UY0000003QXRYA2"},{"k":"kb","n":"000013774","t":"How to reset the \"Shell\" password for a physical appliance via iDRAC, if the virtual keyboard stops working after boot","b":"Certain eyeSight versions may not include the correct driver for a physical appliance's iDRAC virtual keyboard. Impacted appliances can use the keyboard during the pre-boot process, but the keyboard will stop working after the bootloader finishes running.\r\n\r\nKB 9847 requires a working keyboard to reset the Shell password. This KB documents how to reset the Shell password in situations where the keyboard is only functional during the pre-boot process.","u":"How-to-reset-the-Shell-password-for-a-physical-appliance-via-iDRAC-if-the-virtual-keyboard-stops-working-after-boot","d":"2025-09-08","c":"2025-05-14","v":7,"ver":1,"id":"ka0UY0000003T5VYAU"},{"k":"kb","n":"000013775","t":"Max size and Max duration parameters in continuous PCAP capture functionality","b":"This article explains the “Max Duration,” “Max Size,” and “Max Size per File” parameters in continuous PCAP capture, and how they impact PCAP file retention.","u":"Max-size-and-Max-duration-parameters-in-continuous-PCAP-capture-functionality","d":"2025-05-16","c":"2025-05-16","v":7,"ver":1,"id":"ka0UY0000003Tn3YAE"},{"k":"kb","n":"000013777","t":"Appliance Incorrectly Displayed as Disconnected from EM in Console (GUI) but CLI Shows No Issues with Connectivity","b":"","u":"Appliance-Incorrectly-Displayed-as-Disconnected-from-EM-in-Console-GUI-but-CLI-Shows-No-Issues-with-Connectivity","d":"2025-08-22","c":"2025-05-18","v":7,"ver":1,"id":"ka0UY0000003TwjYAE"},{"k":"kb","n":"000013779","t":"Failure to receive SNMP traps from the secondary appliance in High Availability configuration.","b":"","u":"Failure-to-receive-SNMP-traps-from-the-secondary-appliance-in-High-Availability-configuration","d":"2025-06-26","c":"2025-05-19","v":7,"ver":1,"id":"ka0UY0000003U1ZYAU"},{"k":"kb","n":"000013780","t":"Tech-Support File failing to upload to Forescout Snapshot Server","b":"","u":"Tech-Support-File-failing-to-upload-to","d":"2025-12-19","c":"2025-05-20","v":7,"ver":1,"id":"ka0UY0000003UWDYA2"},{"k":"kb","n":"000013782","t":"SecureConnector - Ubuntu 18.04LTS - libssl-dev","b":"","u":"SecureConnector-Ubuntu-18-04LTS-libssl-dev","d":"2025-05-23","c":"2025-05-23","v":7,"ver":1,"id":"ka0UY0000008mHBYAY"},{"k":"kb","n":"000013784","t":"Radius authentication tab on the GUI is absent","b":"You may at times encounter a situation where authentication details for a machine using Radius authentication are absent from the console.","u":"Radius-authentication-tab-on-the-GUI-is-absent","d":"2025-08-22","c":"2025-05-26","v":7,"ver":1,"id":"ka0UY0000003W4zYAE"},{"k":"kb","n":"000013785","t":"How to change the SSH port to a custom port for a specific switch in the Switch plugin","b":"How to change the SSH port to a custom port for a specific switch in the Switch plugin, when the switch is configured to use a non-standard (custom) SSH port?","u":"How-to-change-the-SSH-port-to-a-custom-port-for-a-specific-switch-in-the-Switch-plugin","d":"2025-08-22","c":"2025-05-27","v":7,"ver":1,"id":"ka0UY0000003WD3YAM"},{"k":"kb","n":"000013789","t":"Cannot Add Appliance due to Misconfigurations","b":"","u":"Cannot-Add-Appliance-due-to-Misconfigurations","d":"2025-07-02","c":"2025-05-27","v":7,"ver":1,"id":"ka0UY0000003WeTYAU"},{"k":"kb","n":"000013792","t":"Unable to Add or Remove Network Ranges in Segments","b":"","u":"Unable-to-Add-or-Remove-Network-Ranges-in-Segments","d":"2025-07-02","c":"2025-05-28","v":7,"ver":1,"id":"ka0UY0000004UqjYAE"},{"k":"kb","n":"000013794","t":"Runbook: Forescout Certificates Management and Troubleshooting","b":"This runbook describes procedures for managing certificates in the ForeScout platform, including:\r\n•\tGenerating CSRs\r\n•\tImporting Certificates\r\n•\tReplacing Expired Certificates\r\n•\tBacking up certificates\r\n•\tValidating certificate status\r\n•\tRenewing and revoking certificates","u":"Runbook-Forescout-Certificates-Management-and-Troubleshooting","d":"2025-08-22","c":"2025-05-29","v":7,"ver":1,"id":"ka0UY0000003Xx7YAE"},{"k":"kb","n":"000013801","t":"Access to x.x.x.x was denied HTTP ERROR 403","b":"Trying to download the secure connector, the error Access x.x.x.x was denied. You don't have the user rights to view this page. HTTP ERROR 403","u":"Access-to-x-x-x-x-was-denied-HTTP-ERROR-403","d":"2025-11-19","c":"2025-06-02","v":7,"ver":1,"id":"ka0UY0000003YwPYAU"},{"k":"kb","n":"000013809","t":"How To Clear Foreign Configuration for Dell Appliance Drive which Indicates \"Foreign\" instead of Online.","b":"The purpose of this document is to demonstrate how to clear Foreign Configuration for Dell appliances to bring it back on online after replacing the Hard drive or Re-seating it.","u":"Appliance-Drive-Indicates-Foreign","d":"2025-08-22","c":"2025-06-06","v":7,"ver":1,"id":"ka0UY0000003agTYAQ"},{"k":"kb","n":"000013812","t":"Credential Guard blocks Windows 11 authentication on Radius PEAP-MS-CHAP v2","b":"","u":"Credential-Guard-blocks-Windows-11-authentication-on-Radius-PEAP-MS-CHAP-v2","d":"2025-08-22","c":"2025-06-09","v":7,"ver":1,"id":"ka0R7000000PC2nIAG"},{"k":"kb","n":"000013813","t":"SSO Login Error with \"Group - SSO with User Directory (Web Only)\" User Type","b":"","u":"SSO-Login-Error-with-Group-SSO-with-User-Directory-Web-Only-User-Type","d":"2025-06-26","c":"2025-06-09","v":7,"ver":1,"id":"ka0UY0000003bizYAA"},{"k":"kb","n":"000013815","t":"After upgrading to version 9.1.3, 8.5.3, 8.5.4, or 8.5.5, the EyeSight service does not start in environments where users have restricted permissions or limited scope.","b":"","u":"After-upgrading-to-version-9-1-3-8-5-3-or-8-5-4-the-EyeSight-service-does-not-start-in-environments-where-users-have-restricted-permissions-or-limited-scope","d":"2025-06-11","c":"2025-06-11","v":7,"ver":1,"id":"ka0R7000000Rv0bIAC"},{"k":"kb","n":"000013816","t":"Running Post install after a failed upgrade and what does it do","b":"Sometimes if the upgrade is not completely done or if there's corruption in some of the appliance data, running a post install can do few things to remedy the issue","u":"Running-Post-install-after-a-failed-upgrade","d":"2025-06-26","c":"2025-06-12","v":7,"ver":1,"id":"ka0UY0000003ciHYAQ"},{"k":"kb","n":"000013817","t":"Newly installed MAC OS Secure Connector tied to connect to standby HA appliance","b":"","u":"Newly-installed-MAC-OS-Secure-Connector-tied-to-connect-to-standby-HA-appliance","d":"2025-06-26","c":"2025-06-12","v":7,"ver":1,"id":"ka0UY0000003cjtYAA"},{"k":"kb","n":"000013818","t":"User Directory Authentication Server Test fails when using domains for Address","b":"","u":"User-Directory-Test-fails","d":"2025-10-02","c":"2025-06-16","v":7,"ver":1,"id":"ka0UY0000003deLYAQ"},{"k":"kb","n":"000013824","t":"Forescout eyeSight Internet requirements","b":"","u":"Forescout-eyeSight-Internet-requirements","d":"2025-06-20","c":"2025-06-19","v":7,"ver":1,"id":"ka0UY0000003fbJYAQ"},{"k":"kb","n":"000013827","t":"CounterACT version 9.1.3 upgrade fail with the error- \"Upgrade Cannot Proceed: Could not find /fslog/tmp/fssetup/osupgrade/rhel8.8.iso\"","b":"","u":"CounterACT-version-9-1-3-upgrade-fail-with-the-error--Upgrade-Cannot-Proceed-Could-not-find-fslog-tmp-fssetup-osupgrade-rhel8-8-iso","d":"2025-08-22","c":"2025-06-24","v":7,"ver":1,"id":"ka0UY0000003gXNYAY"},{"k":"kb","n":"000013834","t":"pxGrid plugin test is failing","b":"","u":"pxGrid-plugin-test-is-failing","d":"2025-08-22","c":"2025-06-30","v":7,"ver":1,"id":"ka0UY0000003o6jYAA"},{"k":"kb","n":"000013835","t":"Guest Portal displays a loading failure page intermittently instead of the login page","b":"","u":"Guest-Portal-shows-a-loading-failure-page-intermittently-instead-of-the-login-page","d":"2025-08-22","c":"2025-06-30","v":7,"ver":1,"id":"ka0UY0000003o8LYAQ"},{"k":"kb","n":"000013838","t":"CounterACT service stuck on \"verifying database schema\" after upgrading to 9.1.2.1","b":"","u":"CounterACT-service-stuck-on-verifying-database-schema-after-upgrading-to-9-1-2-1","d":"2025-12-04","c":"2025-06-30","v":7,"ver":1,"id":"ka0UY0000003ojRYAQ"},{"k":"kb","n":"000013839","t":"\"Log in with SSO\" button does not appear when the Identity Provider (IdP) only provides an HTTP-POST endpoint","b":"","u":"Log-in-with-SSO-button-does-not-appear-when-the-Identity-Provider-IdP-only-provides-an-HTTP-POST-endpoint","d":"2025-07-02","c":"2025-06-30","v":7,"ver":1,"id":"ka0UY0000003orVYAQ"},{"k":"kb","n":"000013840","t":"How to set up Shell access after configuring RADIUS authentication for CLI Users","b":"Configuring RADIUS based user authentication for the Forescout CLI using steps from KB#9860 will not provide shell access to external users. An additonal step is needed to allow shell to users configured via KB#9860.","u":"How-to-set-up-Shell-access-after-configuring-RADIUS-authentication-for-CLI-Users","d":"2025-08-22","c":"2025-07-01","v":7,"ver":1,"id":"ka0UY0000003pPNYAY"},{"k":"kb","n":"000013842","t":"After upgrading to Ubuntu 22.04.04 for eyeInspect, the Base OS version still displays the previous OS version, Ubuntu 20.04.6.","b":"","u":"After-upgrading-to-Ubuntu-22-04-04-for-eyeInspect-the-Base-OS-version-still-displays-the-previous-OS-version-Ubuntu-20-04-6","d":"2025-08-22","c":"2025-07-01","v":7,"ver":1,"id":"ka0UY0000003pSbYAI"},{"k":"kb","n":"000013844","t":"Resolving Node ID Conflicts While Registering Appliance with EM","b":"How to Reset Appliance Node ID in Case of Conflict During Appliance Adding to EM","u":"Resolving-Node-ID-Conflicts-While-Registering-Appliance-with-EM","d":"2025-08-22","c":"2025-07-02","v":7,"ver":1,"id":"ka0UY0000003qJpYAI"},{"k":"kb","n":"000013846","t":"HA appliance DRBD status is showing as failed on both nodes. Only the status is failed — everything else looks good.","b":"","u":"HA-appliance-DRBD-status-is-showing-as-failed-on-both-nodes-Only-the-status-is-failed-everything-else-looks-good","d":"2025-08-22","c":"2025-07-02","v":7,"ver":1,"id":"ka0UY0000003qN3YAI"},{"k":"kb","n":"000013848","t":"System Certificates vs Trusted Certificates","b":"Note: This document primarily focuses on explaining the RADIUS certificates used in Forescout","u":"System-Certificate-vs-Trusted-Certificate","d":"2026-02-20","c":"2025-07-03","v":7,"ver":1,"id":"ka0UY0000003rSnYAI"},{"k":"kb","n":"000013860","t":"Use the separator ; to exclude multiple SSIDs in the Wireless plugin","b":"The customer needs to exclude multiple SSIDs in the wireless plugin, so the host connects to these SSIDs won't be pulled via the wireless plugin.\r\nThis feature only excludes endpoints from being discovered by the Wireless plugin; other plugins can still discover endpoints.","u":"Use-the-separator-to-exclude-multiple-SSIDs-in-the-Wireless-plugin","d":"2025-08-22","c":"2025-07-15","v":7,"ver":1,"id":"ka0UY0000003y65YAA"},{"k":"kb","n":"000013862","t":"How to create a test account within the Azure portal and test the Azure AD Connect app","b":"The customer needs to test the Azure AD Connect app.\r\nTo test the Connect app, users need to have access to the Azure portal.\r\nThis KB describes how to create a test account within the Azure portal and test the Azure AD Connect app.","u":"How-to-create-a-test-account-within-the-Azure-portal-and-test-the-Azure-AD-Connect-app","d":"2025-08-22","c":"2025-07-18","v":7,"ver":1,"id":"ka0R7000000NpJZIA0"},{"k":"kb","n":"000013867","t":"fstool netconfig gateway configuration not working on EyeSight 9.1.x","b":"","u":"fstool-netconfig-gateway-configuration-not-working-on-EyeSight-9-1-x","d":"2025-07-25","c":"2025-07-25","v":7,"ver":1,"id":"ka0R7000000MY4fIAG"},{"k":"kb","n":"000013868","t":"9.1.3 defect with console in creating a Policy with the Condition \"Function\"","b":"","u":"9-1-3-defect-with-console-in-creating-a-Policy-with-the-Condition-Function","d":"2025-07-25","c":"2025-07-25","v":7,"ver":1,"id":"ka0UY000000485RYAQ"},{"k":"kb","n":"000013869","t":"After upgrading to version 9.1.3, the EyeSight service may not start","b":"","u":"After-upgrading-to-version-9-1-3-the-EyeSight-service-may-not-start","d":"2025-07-25","c":"2025-07-25","v":7,"ver":1,"id":"ka0R7000000OBAPIA4"},{"k":"kb","n":"000013873","t":"REM connection bouncing and null pointer exception","b":"","u":"REM-connection-bouncing-and-null-pointer-exception","d":"2025-07-28","c":"2025-07-28","v":7,"ver":1,"id":"ka0UY0000004ALlYAM"},{"k":"kb","n":"000013874","t":"After upgrading EyeSight to version 9.1.2, the GUI displays REM Sync alerts","b":"","u":"After-upgrading-EyeSight-to-version-9-1-2-the-GUI-displays-REM-Sync-alerts","d":"2025-07-28","c":"2025-07-28","v":7,"ver":1,"id":"ka0UY00000094KXYAY"},{"k":"kb","n":"000013875","t":"Appliances frequently disconnect from the EM after upgrading from 8.5.2.1 to 8.5.2.2","b":"","u":"Appliances-frequently-disconnect-from-the-EM-after-upgrading-from-8-5-2-1-to-8-5-2-2","d":"2025-07-28","c":"2025-07-28","v":7,"ver":1,"id":"ka0UY0000004BZZYA2"},{"k":"kb","n":"000013876","t":"eyeSight service may fail to start after upgrading to version 9.1.2.1 from 9.1.2","b":"","u":"eyeSight-service-may-fail-to-start-after-upgrading-to-version-9-1-2-1-from-9-1-2","d":"2025-07-28","c":"2025-07-28","v":7,"ver":1,"id":"ka0UY0000008BeDYAU"},{"k":"kb","n":"000013878","t":"Microsoft Plugin remains in a re-initializing state and fails to fully load or function.","b":"","u":"After-upgrading-the-Microsoft-Plugin-the-plugin-remains-in-a-re-initializing-state-and-fails-to-fully-load-or-function","d":"2025-08-22","c":"2025-07-30","v":7,"ver":1,"id":"ka0UY0000004FuvYAE"},{"k":"kb","n":"000013879","t":"How to Change the Monitoring Period Interval on the CounterACT Appliance Communicating with a CyberArk Vault","b":"This article explains how to adjust the monitoring period interval on a Forescout CounterACT Appliance that communicates with a CyberArk Vault. Changing this interval controls how frequently the CounterACT appliance monitors the CyberArk Vault for updates or status.","u":"How-to-Change-the-Monitoring-Period-Interval-on-the-CounterACT-Appliance-Communicating-with-a-CyberArk-Vault","d":"2025-08-22","c":"2025-07-30","v":7,"ver":1,"id":"ka0UY0000004FwXYAU"},{"k":"kb","n":"000013883","t":"Forescout 9.1.2 with FIPS mode enabled fails to create PFX files for new certificates scoped to HPS Inspection Engine","b":"","u":"Forescout-9-1-2-with-FIPS-mode-enabled-fails-to-create-PFX-files-for-new-certificates-scoped-to-HPS-Inspection-Engine","d":"2025-07-31","c":"2025-07-31","v":7,"ver":1,"id":"ka0UY0000004HBxYAM"},{"k":"kb","n":"000013884","t":"The SC version 29-30 on MAC OS with proxy enabled on endpoint is unable to connect to appliance","b":"","u":"The-SC-version-29-30-on-MAC-OS-with-proxy-enabled-on-endpoint-is-unable-to-connect-to-appliance","d":"2025-09-08","c":"2025-08-01","v":7,"ver":1,"id":"ka0UY0000004HDZYA2"},{"k":"kb","n":"000013889","t":"How to replace the Active Sensor certificates with customer specific certificates","b":"This overview gives a schematic overview of the certificate structure. It shows that if the keystore on the CC is replaced, the certificates for the Active Sensor also need replacement.","u":"How-to-replace-the-Active-Sensor-certificates-with-customer-specific-certificates","d":"2026-08-06","c":"2025-08-02","v":7,"ver":1,"id":"ka0UY0000004Hn3YAE"},{"k":"kb","n":"000013890","t":"How to solve network log error page \"Not enough dictionary space to execute number","b":"Refer to this when the network logs page shows an error with the message \"Druid resource limit exceeded. Not enough dictionary space to execute number\".","u":"How-to-solve-network-log-error-page-Not-enough-dictionary-space-to-execute-number","d":"2026-08-06","c":"2025-08-02","v":7,"ver":1,"id":"ka0UY0000004HofYAE"},{"k":"kb","n":"000013891","t":"How to Install eyeInspect SSO 1.0.3 on Ubuntu 22.04 with eyeInspect Command Center 5.5","b":"eyeInspect SSO 1.0.3 is designed to run on specific OS versions, and its installer includes a version check that may prevent installation on newer distributions like Ubuntu 22.04. This guide walks you through skipping the readiness check, including the OS version check.","u":"How-to-Install-eyeInspect-SSO-1-0-3-on-Ubuntu-22-04-with-eyeInspect-Command-Center-5-5","d":"2026-08-06","c":"2025-08-02","v":7,"ver":1,"id":"ka0UY0000004HqHYAU"},{"k":"kb","n":"000013892","t":"How to fix eyeInspect grub-efi-amd64-signed issue due to Ubuntu 22 OS update deployer","b":"This article is meant to provide workaround to users facing issues like mentioned on the escalation OTPC-126: SME-300—could not be upgraded due to GRUB EFI issues encountered during the OS upgrade.\r\nClosed\r\n where there are eyeInspect Passive Sensor upgrade issues as a result of eyeinspect_u22.04_1.0.1_update_amd64.run upgrade failures.\r\n\r\nNote: This article assumes that user performs the steps in the upgrade and configuration guideline.\r\n\r\nThis article is NOT applicable if we use eyeinspect_u22.04_1.0.2_update_amd64.run for doing OS upgrades.","u":"How-to-fix-eyeInspect-grub-efi-amd64-signed-issue-due-to-Ubuntu-22-OS-update-deployer","d":"2026-08-06","c":"2025-08-02","v":7,"ver":1,"id":"ka0UY0000004HrtYAE"},{"k":"kb","n":"000013894","t":"Wiping CounterACT Appliance Disk Drives using the iDRAC and Lifecycle Controller","b":"The Lifecycle Controller (LCC) offers an option to wipe disk drives. Customers not physically located at the appliance will access the Lifecycle Controller from the iDRAC web interface. This requires connecting to the remote console, rebooting the appliance and entering the setup menu as the appliance boots.\r\n\r\nThere is an option to securely wipe encrypted drives which takes minutes but this only works for encrypted drives. There is a standard wipe option for non-encrypted drives which will take hours to complete. The standard wipe option writes a single pass of \"0\" to drive sectors. This may not be considered suficiently \"secure\" in some environments. \r\n\r\nNote that different versions of BIOS and iDRAC firmware will present different screens with different options. In some cases, option names presented may vary from items referenced in this document and the screen shot for the LCC page.","u":"Wiping-CounterACT-Appliance-Disk-Drives-using-the-iDRAC","d":"2025-08-22","c":"2025-08-06","v":7,"ver":1,"id":"ka0UY0000004IPlYAM"},{"k":"kb","n":"000013896","t":"Forescout Console: SNMP Settings stuck in \"Initializing\"","b":"","u":"Forescout-Console-SNMP-Settings-stuck-in-Initializing","d":"2025-10-17","c":"2025-08-07","v":7,"ver":1,"id":"ka0UY0000004IeHYAU"},{"k":"kb","n":"000013897","t":"How to install the FS GUI console silently","b":"The customer needs to install the FS GUI console silently on a few management PCs.\r\nSo, the logged-in user can open the FS GUI console smoothly without manually installing the GUI on their own.","u":"How-to-install-the-FS-GUI-console-silently","d":"2025-09-08","c":"2025-08-08","v":7,"ver":1,"id":"ka0UY0000004IkjYAE"},{"k":"kb","n":"000013899","t":"Forescout supported actions on the Meraki Switch via API integration","b":"Since Network Controller v1.2.11, Cisco Meraki users can now use the Block Network Access, Restrict Network Access, Whitelist Network Access, and Assign to VLAN-Network Controller actions to run on wired endpoints.\r\n\r\nThis KB outlines several key points to consider when proceeding with the above actions.","u":"Forescout-supported-actions-on-the-Meraki-Switch-via-API-integration","d":"2025-09-08","c":"2025-08-08","v":7,"ver":1,"id":"ka0UY0000004IpZYAU"},{"k":"kb","n":"000013901","t":"Recieved noAccess(6) error-status at error-index 1","b":"Switch test fail port block with error \"Recieved noAccess(6) error-status at error-index 1\" for Arista.","u":"Recieved-noAccess-6-error-status-at-error-index-1","d":"2026-07-23","c":"2025-08-11","v":7,"ver":1,"id":"ka0UY0000004Iw1YAE"},{"k":"kb","n":"000013905","t":"Endpoints are learned from HP vendor switch trunk ports","b":"","u":"Endpoints-are-learned-from-HP-switch-trunk-ports","d":"2025-09-08","c":"2025-08-11","v":7,"ver":1,"id":"ka0UY0000004J8vYAE"},{"k":"kb","n":"000013907","t":"CVE-2025-6965: SQLite [eyeSight]","b":"SQLite Memory Corruption Vulnerability: CVE-2025-6965\r\n\r\nA vulnerability exists in certain SQLite versions where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. The vulnerable version of the SQLite package is present in CounterACT 8.5.1 and 9.1.3, but this vulnerability is not exploitable in the current CounterACT architecture.","u":"sqlite-vuln-not-exploitable","d":"2025-08-14","c":"2025-08-14","v":7,"ver":1,"id":"ka0UY0000004K8DYAU"},{"k":"kb","n":"000013908","t":"forescout-root partition full of stig_benchmark.....xml files","b":"","u":"forescout-root-partition-full","d":"2025-09-08","c":"2025-08-14","v":7,"ver":1,"id":"ka0UY0000004KEfYAM"},{"k":"kb","n":"000013913","t":"RADIUS Authentications being rejected for Unknown NAS","b":"NAS is reporting radius is dead, and there are failures for Unknown NAS. The switch is unmanaged by Forescout.","u":"RADIUS-Authentications-being-rejected-for-Unknown-NAS","d":"2025-09-08","c":"2025-08-18","v":7,"ver":1,"id":"ka0UY0000004KZdYAM"},{"k":"kb","n":"000013914","t":"Advanced tools or Goodies plugin crashing","b":"You may see goodies plugin continously crashing in a loop:\r\nThe logs show the following:\r\ngoodies:22512:1752743447.619277:Thu Jul 17 11:10:47 2025: get_seg_path: SEG_LAST_READ[Thu Jan 1 02:00:00 1970] mtime[Thu Jul 17 11:06:28 2025]\r\ngoodies:22512:1752743447.619338:Thu Jul 17 11:10:47 2025: seg_read_xml: re-reading segment definitions (etc/treemap.xml)\r\ngoodies:22512:1752743449.797153:Thu Jul 17 11:10:49 2025: Error: Failed to handle message: Can't call method \"intip\" on an undefined value at lib/fstool/commands/goodies.pl line 964.\r\ngoodies:22512:1752743449.797368:Thu Jul 17 11:10:49 2025: Error: Quitting","u":"Advanced-tools-or-Goodies-plugin-crashing","d":"2025-09-08","c":"2025-08-18","v":7,"ver":1,"id":"ka0UY0000004KbFYAU"},{"k":"kb","n":"000013915","t":"ACL action is not working on LAN Lite Switches","b":"","u":"ACL-action-is-not-working-on-LAN-Lite","d":"2025-12-19","c":"2025-08-20","v":7,"ver":1,"id":"ka0UY0000004L4HYAU"},{"k":"kb","n":"000013916","t":"Although all L2 and L3 network devices are integrated with Forescout, the console still shows more than two hosts per port","b":"","u":"Although-all-L2-and-L3-network-devices-are-integrated-with-Forescout-the-console-still-shows-more-than-two-hosts-per-port","d":"2025-12-19","c":"2025-08-20","v":7,"ver":1,"id":"ka0UY0000004L5tYAE"},{"k":"kb","n":"000013919","t":"Is version 9.1.2 vulnerable to CVE-2023-51767?","b":"CVE-2023-51767 is a vulnerability affecting OpenSSH versions up to 9.6 in which certain DRAM configurations expose the authenticated integer in mm_answer_authpassword to single-bit flips via row hammer attacks, potentially enabling authentication bypass. Exploitation, however, hinges on a narrow and demanding threat model: the attacker must already hold user-level privileges and be co-located with the victim on the same physical hardware.","u":"Is-CVE-2023-51767-impacting-version-9-1-2","d":"2025-12-19","c":"2025-08-22","v":7,"ver":1,"id":"ka0UY0000009SptYAE"},{"k":"kb","n":"000013920","t":"vCenter test failed to connect to the server","b":"","u":"vCenter-test-failed-to-connect-to-the-server","d":"2026-01-07","c":"2025-08-26","v":7,"ver":1,"id":"ka0UY0000004MGTYA2"},{"k":"kb","n":"000013922","t":"After upgrade to Forescout 9.1.x, receive warning that /var/log file system is full","b":"","u":"After-upgrade-to-Forescout-9-1-x-receive-warning-that-var-log-file-system-is-full","d":"2025-08-28","c":"2025-08-27","v":7,"ver":1,"id":"ka0UY0000004OF3YAM"},{"k":"kb","n":"000013924","t":"How to Collect Console logs on Linux/Ubuntu endpoints","b":"This article provides step-by-step instructions to locate and collect GUI/console logs from Forescout console deployed on Linux/Ubuntu endpoints.","u":"How-to-Collect-Console-logs-on-Linux-Ubuntu-endpoints","d":"2025-09-08","c":"2025-08-28","v":7,"ver":1,"id":"ka0UY0000004OTZYA2"},{"k":"kb","n":"000013926","t":"CoA Action fails with error message \"COA action failed, host is not authenticated\"","b":"","u":"COA-action-failed-host-is-not-authenticated","d":"2025-09-08","c":"2025-08-30","v":7,"ver":1,"id":"ka0UY0000004OjhYAE"},{"k":"kb","n":"000013927","t":"After 802.1x/MAB authentication, the VoIP phone is placed into DATA vlan instead of the VOICE vlan","b":"We might see that in an 802.1x Multi-Domain Authentication (MDA) environment, when an endpoint is successfully authenticated via 802.1x or MAB Authentication, it is placed into the DATA vlan instead of the VOICE vlan.","u":"After-802-1x-MAB-authentication-the-VoIP-phone-is-placed-into-DATA-vlan-instead-of-the-VOICE-vlan","d":"2026-07-29","c":"2025-08-30","v":7,"ver":1,"id":"ka0UY0000004OlJYAU"},{"k":"kb","n":"000013928","t":"eyeExtend Connect App Stuck in Initializing loop","b":"After the Forescout eyeExtend Connect Module upgrade, the eyeExtend Connect App may sometimes get stuck cycling between the \"Running\" and \"Initializing\" states. This issue often occurs when the necessary Python processes fail to start, a problem that can be confirmed by checking the tech-support logs.\r\n\r\nSymptoms:\r\n- The Connect App status continuously alternates between \"Running\" and \"Initializing\" in the Forescout Console.\r\n- Running \"ps -ef | grep python\" on the appliance's command line shows no active Python processes. Typically, at least one main Python process (server.py) should be running.","u":"eyeExtend-Connect-App-Stuck-in-Initializing-loop","d":"2025-09-08","c":"2025-08-30","v":7,"ver":1,"id":"ka0UY0000004OmvYAE"},{"k":"kb","n":"000013929","t":"Best Practices For License Before Migration","b":"This Knowledge Base article provides guidance on the best practices for managing licenses before initiating a Forescout migration","u":"Best-Practices-For-License-Before-Migration","d":"2025-12-19","c":"2025-09-01","v":7,"ver":1,"id":"ka0UY0000004OoXYAU"},{"k":"kb","n":"000013932","t":"How to change password for cliadmin on multiple appliance at the same time","b":"Changing the password for cliadmin user on all appliances","u":"How-to-change-password-for-cliadmin-on-multiple-appliance-at-the-same-time","d":"2025-12-19","c":"2025-09-04","v":7,"ver":1,"id":"ka0UY0000004PUTYA2"},{"k":"kb","n":"000013934","t":"Change/Update the cliadmin password on all the child appliances from EM","b":"How to reset the cliadmin password for all the Appliance from the EM. \r\n\r\nThis method demonstrates the method to update the cliadmin password on all the Appliances with a single command run on the EM\r\n\r\nRefer the KB article \"000010669 - Reset cliadmin password\" for changing the cliadmin password individually on each appliance.","u":"Change-Update-the-cliadmin-password-on-all-the-child-appliances-from-EM","d":"2025-09-23","c":"2025-09-09","v":7,"ver":1,"id":"ka0R7000000PcrhIAC"},{"k":"kb","n":"000013935","t":"How to use the Domain\\username format in the Switch and Wireless plugins in Forescout GUI Console","b":"When configuring the SSH User accounts in the Switch and the Wireless plugins, if an account has to be defined in the domain\\username format, the login fails.","u":"How-to-use-the-Domain-username-format-in-the-Switch-and-Wireless-plugins-in-Forescout-GUI-Console","d":"2025-09-23","c":"2025-09-09","v":7,"ver":1,"id":"ka0UY0000004R6TYAU"},{"k":"kb","n":"000013939","t":"HTTP Error 403 when accessing reports from assets portal","b":"","u":"Error-403-reports-portal","d":"2025-10-02","c":"2025-09-10","v":7,"ver":1,"id":"ka0UY0000004RfxYAE"},{"k":"kb","n":"000013940","t":"Switch Plugin Main Process is stopped before subprocess has gracefully shutdown","b":"","u":"Switch-Plugin-Main-Process-is-stopped-before-subprocess-has-gracefully-shutdown","d":"2025-10-02","c":"2025-09-12","v":3,"ver":1,"id":"ka0UY0000004SXBYA2"},{"k":"kb","n":"000013941","t":"Creating Contacts in the Forescout Support Portal.","b":"How To Create Contacts in the Forescout Support Portal.\r\nThe customer contact must be an Entitlement Administrator to add contacts to the account.","u":"Creating-Contacts-in-the-Forescout-Support-Portal","d":"2025-09-12","c":"2025-09-12","v":7,"ver":1,"id":"ka0UY0000004TD7YAM"},{"k":"kb","n":"000013942","t":"How to Force Endpoints to Receive New VLAN IP via RADIUS CoA in Forescout","b":"This KB explains how to configure Forescout to change an endpoint’s VLAN using RADIUS CoA and ensure the endpoint obtains a new IP address, especially for devices without 802.1X supplicants. It addresses the issue where endpoints move to a guest VLAN but retain their old IP.","u":"How-to-Force-Endpoints-to-Receive-New-VLAN-IP-via-RADIUS-CoA-in-Forescout","d":"2025-12-04","c":"2025-09-12","v":7,"ver":1,"id":"ka0UY0000004SddYAE"},{"k":"kb","n":"000013943","t":"Radiusd services are looping","b":"","u":"Radiusd-services-are-looping","d":"2025-09-24","c":"2025-09-12","v":7,"ver":1,"id":"ka0UY0000008jsnYAA"},{"k":"kb","n":"000013944","t":"Restore accidently deleted directory while disk clean-up","b":"These are the steps to follow if you have accidently deleted a directory. This applies on cases where there is EM and REM. Before going forward, failover to REM and wait for it to get up and running.\r\n\r\nHere we will take example of /usr/local/forescout/\r\nCommand run:\r\nrm -rf /usr/local/Forescout/\r\n\r\nYou need to modify the directory based on the one removed and needs to be restored in your environment.","u":"Restore-accidently-deleted-directory-while-disk-clean-up","d":"2026-04-27","c":"2025-09-14","v":7,"ver":1,"id":"ka0UY0000004SwzYAE"},{"k":"kb","n":"000013945","t":"How to download console if it retries to download again and again.","b":"After upgrade or installing hotfix, the console version goes to download the newer version and gets stuck in loop.","u":"How-to-download-console-if-it-retries-to-download","d":"2025-10-17","c":"2025-09-15","v":7,"ver":1,"id":"ka0UY0000004T3RYAU"},{"k":"kb","n":"000013946","t":"After Upgrade cliadmin doesn't work shows permission denied","b":"","u":"After-Upgrade-cliadmin-doesn-t-work-shows-permission-denied","d":"2025-12-04","c":"2025-09-17","v":7,"ver":1,"id":"ka0UY0000004TZhYAM"},{"k":"kb","n":"000013949","t":"Upgrade from 8.5.x to 9.1.x caused fstool oneach output to display appliance IP prefix incorrectly","b":"","u":"Upgrade-from-8-5-x-to-9-1-x-caused-fstool-oneach-output-to-display-appliance-IP-prefix-incorrectly","d":"2025-10-17","c":"2025-09-18","v":7,"ver":1,"id":"ka0UY0000004U2jYAE"},{"k":"kb","n":"000013950","t":"Best Practices for Adding Incompatible Switches","b":"Vendor-Compatible = Full features, recommended.\r\nGeneric Switch = Limited features, fallback option only.","u":"Best-Practices-for-Adding-Incompatible-Switches","d":"2025-10-17","c":"2025-09-19","v":7,"ver":1,"id":"ka0UY0000004U7ZYAU"},{"k":"kb","n":"000013951","t":"Understanding Switch Virtual Interfaces (SVIs), Their Detection by CounterACT Appliance, and How to Ignore Them","b":"A Switch Virtual Interface (SVI) is the IP interface assigned to a VLAN on a switch.","u":"Understanding-Switch-Virtual-Interfaces-SVIs-Their-Detection-by-CounterACT-Appliance-and-How-to-Ignore-Them","d":"2025-10-17","c":"2025-09-19","v":7,"ver":1,"id":"ka0UY0000004U9BYAU"},{"k":"kb","n":"000013956","t":"Failed to connect to server - [hostname verification failure]","b":"","u":"Failed-to-connect-to-server","d":"2025-10-17","c":"2025-09-22","v":7,"ver":1,"id":"ka0UY0000004USXYA2"},{"k":"kb","n":"000013958","t":"BPF filter is not removed with Command Center UI","b":"This article provides a workaround to the product defect OTDP-3711 (Sensor doesn't remove BPF filter if it's removed in CC UI) where Passive Sensor doesn’t correctly remove BPF filter when user sets empty BPF filter in the Command Center UI.","u":"BPF-filter-is-not-removed-with-Command-Center-UI","d":"2025-09-23","c":"2025-09-23","v":7,"ver":1,"id":"ka0UY0000004UifYAE"},{"k":"kb","n":"000013959","t":"Differences between throughput on the interface and throughput reported in Command Center UI","b":"This article explains the difference between throughput shown in the Command Center UI and the real throughput that is on the sniffing interface.","u":"Differences-between-throughput-on-the-interface-and-throughput-reported-in-Command-Center-UI","d":"2025-09-23","c":"2025-09-23","v":7,"ver":1,"id":"ka0UY0000004UkHYAU"},{"k":"kb","n":"000013962","t":"Upgrade to 9.1.4 fail on Hyper-v Host","b":"","u":"Upgrade-to-9-1-4-fail-on-Hyper-v","d":"2026-01-07","c":"2025-09-23","v":7,"ver":1,"id":"ka0UY0000004V0PYAU"},{"k":"kb","n":"000013963","t":"Upgrade to 9.1.4 fail on Hyper-v Host, due to CPU Compatibiity","b":"","u":"Upgrade-to-9-1-4-fail-on-Hyper-v-Host-due-to-CPU-Compatibiity","d":"2025-10-17","c":"2025-09-23","v":7,"ver":1,"id":"ka0UY0000004V21YAE"},{"k":"kb","n":"000013964","t":"Changing the admin password in the GUI only updates the password saved on the EM","b":"Changing the admin password in the GUI only updates the password saved on the EM.\r\nIt will not update the admin password on other CT appliances. The admin password to log in to each CT appliance and REM doesn't change.","u":"Changing-the-admin-password-in-the-GUI-only-updates-the-password-saved-on-the-EM","d":"2025-10-17","c":"2025-09-24","v":7,"ver":1,"id":"ka0UY0000004VBhYAM"},{"k":"kb","n":"000013975","t":"Delay the Assign and Cancel Action in the Policy","b":"The customer faces an issue when they assign & cancel the action on the Switch/WLC or directly to the endpoint.\r\nThe weird issue would happen if no delay were configured for the action and the device matched and un-matched the policy/subrule quickly. For example, the applied VLAN ID is not reverted to the original VLAN ID because the cancellation action was triggered immediately after the action was applied.\r\nIt is a best practice to configure a delay to apply an action and hold it for a while before canceling the action.","u":"Delay-the-Assign-and-Cancel-Action-in-the-Policy","d":"2025-10-08","c":"2025-10-02","v":7,"ver":1,"id":"ka0UY0000004Xv3YAE"},{"k":"kb","n":"000013985","t":"How to Set Audit Trail Log Level","b":"How to Set Audit Trail at specific Log Level to see all events in specific log level between 1 to 7","u":"How-to-Set-Audit-Trail-Log-Level","d":"2025-10-17","c":"2025-10-06","v":7,"ver":1,"id":"ka0UY0000004YpVYAU"},{"k":"kb","n":"000013986","t":"How to Add PKCS#12 system certificate","b":"How to Add PKCS#12 system certificate.","u":"How-to-Add-PKCS-12-system-certificate","d":"2025-10-17","c":"2025-10-06","v":7,"ver":1,"id":"ka0UY0000004Yr7YAE"},{"k":"kb","n":"000013990","t":"eyeInspect error when creating sensor: \"Adding an active sensor is not possible. you must have 1 active sensor core available\"","b":"","u":"eyeInspect-error-when-creating-sensor","d":"2025-12-21","c":"2025-10-06","v":7,"ver":1,"id":"ka0UY0000004ZC5YAM"},{"k":"kb","n":"000013992","t":"CVE-2025-9086- curl version 7.61.1 vulnerable in eyeSight V9.1.3 and v9.1.4","b":"","u":"CVE-2025-9086--curl-version-7-61-1-vulnerable-in-eyeSight-V9-1-3-and-v9-1-4","d":"2025-10-17","c":"2025-10-07","v":7,"ver":1,"id":"ka0UY0000004ZaHYAU"},{"k":"kb","n":"000013993","t":"How to enable / disable FIPS mode on Forescout eyesight devices","b":"Enabling/Disabling FIPS Mode on Forescout eyeSight Devices","u":"How-to-enable-disable-FIPS-mode-on-Forescout-eyesight-devices","d":"2025-10-17","c":"2025-10-09","v":7,"ver":1,"id":"ka0UY0000004a9lYAA"},{"k":"kb","n":"000013994","t":"Backup Fails with “Container Name Already in Use” Error on EyeInspect 5.9.1","b":"","u":"Backup-Fails-with-Container-Name-Already-in-Use-Error-on-EyeInspect-5-9-1","d":"2025-12-21","c":"2025-10-09","v":7,"ver":1,"id":"ka0R7000000NQRdIAO"},{"k":"kb","n":"000013997","t":"Thai Language Support for FS Console GUI on Windows","b":"The FS console GUI doesn't display Thai language properly.\r\nThe config file in the FS management console installation folder on the management PC needs to be updated to support Thai.\r\nAfter the customer installs the FS GUI console on another management PC, the same change shall be updated on that PC as well to support Thai.","u":"Thai-Language-Support-for-FS-Console-GUI-on-Windows","d":"2025-10-17","c":"2025-10-13","v":7,"ver":1,"id":"ka0UY0000005fnJYAQ"},{"k":"kb","n":"000013998","t":"CVE-2024-9950-Vulnerability-Remedition","b":"CVE-2024-9950 High Severity Vulnerability in SecureConnector HPS Inspection Engine mentioned in the official announcement:\r\n\r\nhttps://docs.forescout.com/bundle/vulnerabilities/page/cve-2024-9950.html","u":"CVE-2024-9950-Vulnerability-Remedition","d":"2025-10-20","c":"2025-10-13","v":7,"ver":1,"id":"ka0UY0000005ry9YAA"},{"k":"kb","n":"000013999","t":"Support and Guidance on iDRAC updates for 5160s Revision 1 and Revision 2","b":"1.} We use 5100 Revision 01 or Revision 02 terminology.\r\n\r\n2.} The 5100 series and 6100 have different firmware files.\r\n\r\n3.} All 5100 series systems use the same firmware and BIOS.\r\n\r\n4.} iDRAC firmware does not require a system reboot. iDRAC firmware does reboot iDRAC itself.","u":"Support-and-Guidance-on-iDRAC-updates-for-5160s-Revision-1-and-Revision-2","d":"2026-01-07","c":"2025-10-15","v":7,"ver":1,"id":"ka0UY0000005sfhYAA"},{"k":"kb","n":"000014001","t":"Connection Refused Error while accessing the HTTPs pages / Can’t reach this page error","b":"Customers often encounter issues when trying to access HTTPS pages to download the SecureConnector or to log in to the Dashboard/Report portal, even when a valid certificate is in place for the required plugins. This Knowledge Base article provides guidance to help resolve this issue.","u":"Connection-Refused-Error-while-accessing-the-HTTPs-pages-Can-t-reach-this-page-error","d":"2025-12-04","c":"2025-10-15","v":7,"ver":1,"id":"ka0UY0000005sqzYAA"},{"k":"kb","n":"000014003","t":"Wireless host repeatedly disconnects from WLC and seen in host log as WLAN association 'Blacklisted'","b":"","u":"Wireless-host-repeatedly-disconnects-from-WLC-and-seen-in-host-log-as-WLAN-association-Blacklisted","d":"2025-10-23","c":"2025-10-16","v":7,"ver":1,"id":"ka0UY0000008iv7YAA"},{"k":"kb","n":"000014005","t":"Policy with the Condition \"Operating System\" Generates an Error","b":"","u":"Policy-with-the-Condition-Operating-System-Generates-an-Error","d":"2025-12-04","c":"2025-10-17","v":7,"ver":1,"id":"ka0UY0000008bvFYAQ"},{"k":"kb","n":"000014006","t":"Syslog Module Not Installed After Upgrade (9.1.3 Version or Core Extension 2.0.3)","b":"","u":"Syslog-Module-Not-Installed-After-Upgrade-9-1-3-Version-or-Core-Extension-2-0-3","d":"2026-04-10","c":"2025-10-17","v":7,"ver":1,"id":"ka0UY0000008bwrYAA"},{"k":"kb","n":"000014007","t":"CVE-2025-49844 -Vulnerability-Remediation","b":"CVE 2025 49844 is a vulnerability in Redis, involving its Lua scripting engine (a “use after free” leading to possible remote code execution)","u":"CVE-2025-49844--Vulnerability-Remediation","d":"2025-12-04","c":"2025-10-17","v":7,"ver":1,"id":"ka0UY0000008c6XYAQ"},{"k":"kb","n":"000014008","t":"61x0 Dell Servers may not function properly at 10G speed with 10/25G SFP modules if auto-negotiation is enabled.","b":"10Gb/25Gb Dual rate NIC may not function properly at Speed 10 Gb with the 10/25G SFP Modules if auto-negotiation is enabled. In such cases, the link status stays down.","u":"61x0-Dell-Servers-may-not-function-properly-at-10G-speed-with-10-25G-SFP-modules-if-auto-negotiation-is-enabled","d":"2025-10-27","c":"2025-10-20","v":7,"ver":1,"id":"ka0UY0000008wgLYAQ"},{"k":"kb","n":"000014014","t":"unable to make changs to Meraki switches","b":"","u":"unable-to-make-changs-to-Meraki-switches","d":"2025-12-04","c":"2025-10-24","v":7,"ver":1,"id":"ka0UY0000008ilRYAQ"},{"k":"kb","n":"000014015","t":"VA test failing to gather information","b":"","u":"VA-test-failing-to-gather-information","d":"2025-12-04","c":"2025-10-24","v":7,"ver":1,"id":"ka0UY0000008in3YAA"},{"k":"kb","n":"000014016","t":"Appliances are prompting for password change","b":"","u":"Appliances-are-prompting-for-password-change","d":"2025-11-06","c":"2025-10-26","v":7,"ver":1,"id":"ka0UY0000008jpZYAQ"},{"k":"kb","n":"000014017","t":"Upgrade Issue: HA Node 1 Failed to Upgrade to 9.1.3","b":"","u":"Upgrade-Issue-HA-Node-1-Failed-to-Upgrade-to-9-1-3","d":"2025-12-04","c":"2025-10-27","v":7,"ver":1,"id":"ka0UY0000008jrBYAQ"},{"k":"kb","n":"000014018","t":"Switch Plugin: SSH Fails to Login the First and Second Time","b":"","u":"Switch-Plugin-SSH-Fails-to-Login-the-First-and-Second-Time","d":"2025-12-19","c":"2025-10-27","v":7,"ver":1,"id":"ka0UY0000008k7JYAQ"},{"k":"kb","n":"000014020","t":"Packet Engine verison 9.0.0 crashes","b":"","u":"Packet-Engine-verison-9-0-0-crashes","d":"2025-10-31","c":"2025-10-27","v":7,"ver":1,"id":"ka0UY0000008kSHYAY"},{"k":"kb","n":"000014024","t":"EM Switch Plugin Crashes","b":"","u":"EM-Switch-Plugin-Crashes","d":"2025-12-19","c":"2025-10-28","v":7,"ver":1,"id":"ka0UY0000008lMjYAI"},{"k":"kb","n":"000014028","t":"Secure Connector Version Mismatch in HPS Plugin v11.3.15 Causes Reinstallation Loop","b":"","u":"Secure-Connector-Version-Mismatch-in-HPS-Plugin-v11-3-15-Causes-Reinstallation-Loop","d":"2025-10-31","c":"2025-10-30","v":7,"ver":1,"id":"ka0UY0000008mqfYAA"},{"k":"kb","n":"000014030","t":"Upgrade Verifier fails due to HA Status","b":"","u":"Upgrade-Verifier-fails-ha","d":"2025-11-05","c":"2025-11-03","v":7,"ver":1,"id":"ka0UY0000009DE9YAM"},{"k":"kb","n":"000014032","t":"HA VIP keeps disconnecting.","b":"","u":"HA-VIP-keeps-disconnecting","d":"2025-12-04","c":"2025-11-04","v":7,"ver":1,"id":"ka0UY0000008oNpYAI"},{"k":"kb","n":"000014033","t":"Segments wont change and no error message.","b":"","u":"Segments-wont-change-and-no-error-message","d":"2025-12-04","c":"2025-11-04","v":7,"ver":1,"id":"ka0UY0000008oR3YAI"},{"k":"kb","n":"000014034","t":"Console install on Windows 11","b":"","u":"Console-install-on-Windows-11","d":"2025-12-04","c":"2025-11-04","v":7,"ver":1,"id":"ka0UY0000008oajYAA"},{"k":"kb","n":"000014042","t":"Syslog config was sending all traffic to country-specific locations and now sends to only one location","b":"","u":"Syslog-config-was-sending-all-traffic-to-country-specific-locations-and-now-sends-to-only-one-location","d":"2025-11-12","c":"2025-11-10","v":7,"ver":1,"id":"ka0R7000000NsMHIA0"},{"k":"kb","n":"000014044","t":"6100 hardware supports both 10/1 [Gb/s] and 10/25 [Gb/s] SFPs","b":"6100 hardware is shipped from the factory with 2x 10/25G SFPs in the NIC.\r\n10/25G SFP does not support 1G speed.\r\nThe NIC in 6100 also supports 10/1G SFP.\r\nIf the customer requires support for a 10/1G SFP, they must purchase a 10/1G SFP kit. Each SFP kit contains 2 SFPs.","u":"6100-hardware-supports-both-10-1-Gb-s-and-10-25-Gb-s-SFPs","d":"2025-11-10","c":"2025-11-10","v":7,"ver":1,"id":"ka0UY0000008vCPYAY"},{"k":"kb","n":"000014045","t":"Excessive CPU usage in java process for DPI","b":"","u":"Excessive-CPU-usage-in-java-process-for-DPI","d":"2025-12-04","c":"2025-11-10","v":7,"ver":1,"id":"ka0UY0000008t8zYAA"},{"k":"kb","n":"000014048","t":"EM failing to install plugin to CounterACT appliance","b":"","u":"EM-failing-to-install-plugin-to-CounterACT-appliance","d":"2025-12-04","c":"2025-11-14","v":7,"ver":1,"id":"ka0UY0000008wy5YAA"},{"k":"kb","n":"000014062","t":"Radius Certificate Authentication does not work","b":"","u":"Radius-Certificate-Authentication-does-not-work","d":"2025-12-04","c":"2025-11-24","v":7,"ver":1,"id":"ka0UY00000093BZYAY"},{"k":"kb","n":"000014067","t":"SecureConnector fails to start on some Rocky Linux 9.x endpoints","b":"","u":"SecureConnector-fails-to-start-on-some-Rocky-Linux-9-x-endpoints","d":"2025-12-04","c":"2025-11-26","v":7,"ver":1,"id":"ka0UY00000094QzYAI"},{"k":"kb","n":"000014068","t":"The embedded Niic does not show in fstool netconfig.","b":"","u":"The-embedded-Niic-does-not-show-in-fstool-netconfig","d":"2025-12-19","c":"2025-11-26","v":7,"ver":1,"id":"ka0UY00000094SbYAI"},{"k":"kb","n":"000014069","t":"Excessive HTTP Login/Notification Actions After Upgrading to Tech Support Plugin v1.5.6","b":"","u":"Excessive-HTTP-Login-Notification-Actions-After-Upgrading-to-Tech-Support-Plugin-v1-5-6","d":"2025-12-19","c":"2025-11-30","v":7,"ver":1,"id":"ka0UY00000095EzYAI"},{"k":"kb","n":"000014071","t":"Syslog Messages Not Showing Username for User Operations","b":"","u":"Syslog-Messages-Not-Showing-Username-for-User-Operations","d":"2025-12-19","c":"2025-11-30","v":7,"ver":1,"id":"ka0UY00000095IDYAY"},{"k":"kb","n":"000014072","t":"Service Now tables appear to be out of sync","b":"You may encounter cases where the table names, fields, or lookup columns shown in the Forescout GUI do not match the corresponding tables or fields in the ServiceNow DB.","u":"Service-Now-tables-appear-to-be-out-of-sync","d":"2025-12-19","c":"2025-12-01","v":7,"ver":1,"id":"ka0UY00000095LRYAY"},{"k":"kb","n":"000014073","t":"How to Register an Email Address to Receive the latest Security Advisories and Vulnerability Patch Updates.","b":"Customers may contact Support requesting assistance for registering their email address to receive the latest Security Advisories and Vulnerability Patch updates to ensure they remain informed about important security information for their environment.","u":"How-to-Register-an-Email-Address-to-Receive-the-latest-Security-Advisories-and-Vulnerability-Patch-Updates","d":"2026-01-07","c":"2025-12-01","v":7,"ver":1,"id":"ka0UY00000095OfYAI"},{"k":"kb","n":"000014075","t":"Vulnerability CVE-2025-61984 OpenSSH","b":"","u":"Vulnerability-CVE-2025-61984-OpenSSH","d":"2025-12-11","c":"2025-12-01","v":7,"ver":1,"id":"ka0R7000000QqqzIAC"},{"k":"kb","n":"000014076","t":"After upgrade 9.1.4 Appliances Looping Connecting, Installing Plugins, with manual plugin install failing","b":"","u":"After-upgrade-9-1-4-Appliances-Looping-Connecting-Installing-Plugins-with-manual-plugin-install-failing","d":"2025-12-19","c":"2025-12-01","v":7,"ver":1,"id":"ka0UY00000095lFYAQ"},{"k":"kb","n":"000014080","t":"How to copy Windows secureconnector agent logs using HPS va_test commands","b":"This KB illustrates sample fstool va_test commands to copy secureconnector logs from Windows endpoints that are either HPS RI Domain Managed or HPS SecureConnector Managed.","u":"How-to-copy-Windows-secureconnector-agent-logs-using-HPS-va-test-commands","d":"2025-12-19","c":"2025-12-04","v":7,"ver":1,"id":"ka0UY000000973tYAA"},{"k":"kb","n":"000014081","t":"How to verify User Directory plugin settings in the Tech-Support or through the appliance devinfo table","b":"This KB shows how we can verify the current User Directory (ad) plugin settings in the TS or on the database devinfo table of the appliance.","u":"How-to-verify-User-Directory-plugin-settings-in-the-Tech-Support-or-through-the-appliance-devinfo-table","d":"2025-12-19","c":"2025-12-04","v":7,"ver":1,"id":"ka0UY000000975VYAQ"},{"k":"kb","n":"000014084","t":"Understanding SecureConnector Qt Library Versions on Different Linux Distributions","b":"SecureConnector uses different Qt versions based on the OpenSSL library provided by the OS.\r\nQt5 is used for OpenSSL 1.1.1 (Ubuntu 20.04, RHEL 8.10), while Qt6 is required for OpenSSL 3.x (Ubuntu 22.04+, RHEL 9.x).\r\nVerification can be done via ldd on the SecureConnector binary.\r\nDifferences in Qt versions are normal and do not indicate installation problems or version mismatches.","u":"Understanding-SecureConnector-Qt-Library-Versions-on-Different-Linux-Distributions","d":"2025-12-19","c":"2025-12-06","v":7,"ver":1,"id":"ka0UY00000098uPYAQ"},{"k":"kb","n":"000014086","t":"How to check which certification radius plugin is presenting","b":"The guide provides steps to check via CLI which certificate the radius plugin is presenting.","u":"How-to-check-which-certification-radius-plugin-is-presenting","d":"2025-12-19","c":"2025-12-08","v":7,"ver":1,"id":"ka0UY00000099wvYAA"},{"k":"kb","n":"000014087","t":"Calls used by NC plugin for Meraki","b":"Guide provides URL that can be tested via CURL, Postman , or similar tools to test Meraki API and data being received.","u":"Calls-used-by-NC-plugin-for-Meraki","d":"2025-12-19","c":"2025-12-08","v":7,"ver":1,"id":"ka0UY00000099yXYAQ"},{"k":"kb","n":"000014088","t":"LDAP connectivity using CLI failing with missing filter error","b":"","u":"LDAP-connectivity-using-CLI-failing-with-missing-filter-error","d":"2025-12-19","c":"2025-12-08","v":7,"ver":1,"id":"ka0UY0000009A4zYAE"},{"k":"kb","n":"000014089","t":"How to identify which endpoints are missing from a policy match and potential why that could take place","b":"Sometime the numbers of total endpoints and Policy match is different, and it could be tricky to identify these \"missing\" endpoints. Here is a simple solution to detect those \"missing\" endpoints","u":"How-to-identify-which-endpoints-are-missing-from-a-policy-match-and-potential-why-that-could-take-place","d":"2025-12-19","c":"2025-12-09","v":7,"ver":1,"id":"ka0UY0000009ARZYA2"},{"k":"kb","n":"000014090","t":"CVE-2025-55182 & CVE-2025-66478","b":"Is Forescout vulnerable to CVE-2025-55182 & CVE-2025-66478?","u":"CVE-2025-55182-CVE-2025-66478","d":"2025-12-09","c":"2025-12-09","v":7,"ver":1,"id":"ka0UY0000009B5tYAE"},{"k":"kb","n":"000014094","t":"CVE-2025-54988 & CVE-2025-66516","b":"Is Forescout vulnerable to CVE-2025-54988 & CVE-2025-66516?","u":"CVE-2025-54988-CVE-2025-66516","d":"2025-12-09","c":"2025-12-09","v":7,"ver":1,"id":"ka0UY0000009FCjYAM"},{"k":"kb","n":"000014095","t":"NDR tools detects \"fs_action__body.exe\" as DDI-Lateral Movement incident","b":"","u":"NDR-tools-detects-fs-action-number-body-exe-as-DDI-Lateral-Movement-incident","d":"2025-12-19","c":"2025-12-09","v":7,"ver":1,"id":"ka0UY0000009B97YAE"},{"k":"kb","n":"000014097","t":"EAP-TLS Failures When Proxied to Microsoft NPS RADIUS Servers","b":"","u":"EAP-TLS-Failures-When-Proxied-to-Microsoft-NPS-RADIUS-Servers","d":"2025-12-19","c":"2025-12-09","v":7,"ver":1,"id":"ka0UY0000009BDxYAM"},{"k":"kb","n":"000014110","t":"EyeIspect - nidstool lists container as unavailable","b":"","u":"EyeIspect---nidstool-lists-container-as-unavailable","d":"2025-12-16","c":"2025-12-15","v":7,"ver":1,"id":"ka0UY0000009EWnYAM"},{"k":"kb","n":"000014111","t":"Eyeinspect : sdconfig fails to configure the management network interface","b":"","u":"sdconfig-fails-to-configure-the-management-network-interface","d":"2025-12-19","c":"2025-12-16","v":7,"ver":1,"id":"ka0UY0000009Eq9YAE"},{"k":"kb","n":"000014113","t":"EyeInspect : Stop triggering IoC alerts only on certain sensors","b":"","u":"EyeInspect-Stop-triggering-IoC-alerts-only-on-certain-sensors","d":"2025-12-19","c":"2025-12-16","v":7,"ver":1,"id":"ka0UY0000009EtNYAU"},{"k":"kb","n":"000014114","t":"EyeInspect : How to remove or make IoC entries expire in sensors","b":"This article is about the IoC content update in eyeInspect. The reader should know the basics of how IoCs are updated in sensors by uploading a new file with the bundled content to the Command Center.","u":"EyeInspect-How-to-remove-or-make-IoC-entries-expire-in-sensors","d":"2026-08-06","c":"2025-12-16","v":7,"ver":1,"id":"ka0UY0000009EuzYAE"},{"k":"kb","n":"000014119","t":"What does \"postinstall\" do","b":"what happens when running the command \"fstool postinstall\"","u":"What-does-postinstall-do","d":"2026-01-07","c":"2025-12-17","v":7,"ver":1,"id":"ka0UY0000009FhNYAU"},{"k":"kb","n":"000014120","t":"Error \"Failed to perform Test. - Unable to get httpClient\" when configuring Microsoft defender plugin","b":"When configuring MS defender plugin the integration would not work due to missing certificate while the option to check certificate is selected.","u":"Error-Failed-to-perform-Test---Unable-to-get-httpClient-when-configuring-Microsoft-defender-plugin","d":"2026-01-07","c":"2025-12-17","v":7,"ver":1,"id":"ka0UY0000009FizYAE"},{"k":"kb","n":"000014123","t":"Error \"passed assigned to vlan. switches not confirmed (error{13})\"","b":"","u":"Error-passed-assigned-to-vlan-switches-not-confirmed-error-13","d":"2026-07-03","c":"2025-12-17","v":7,"ver":1,"id":"ka0UY0000009GlVYAU"},{"k":"kb","n":"000014128","t":"Pre-Connector ACL on Managed Cisco Switches are getting removed from global configuration","b":"Every 60m the preconnect_acl gets removed from the global configuration by the purger or garbage collector.","u":"Pre-Connector-ACL-on-Managed-Cisco-Switches-are-getting-removed-from-global-configuration","d":"2026-01-07","c":"2025-12-17","v":7,"ver":1,"id":"ka0UY0000009H6TYAU"},{"k":"kb","n":"000014129","t":"After upgrading eyeSight from 8.x to 9.1.x with FIPS mode enabled, the RADIUS plugin's \"radiusd\" service fails to start with an \"unsupported\" error logged","b":"","u":"After-upgrading-eyeSight-from-8-x-to-9-1-x-with-FIPS-mode-enabled-the-RADIUS-plugin-s-radiusd-service-fails-to-start-with-an-unsupported-error-logged","d":"2025-12-29","c":"2025-12-17","v":7,"ver":1,"id":"ka0UY0000009H85YAE"},{"k":"kb","n":"000014130","t":"Accessing the Forescout Web Portals shows error \" Application Error. Page does not exist\" HTTP Error 404","b":"","u":"Accessing-the-Forescout-Web-Portals-shows-error-Application-Error","d":"2026-01-07","c":"2025-12-18","v":7,"ver":1,"id":"ka0UY0000009HG9YAM"},{"k":"kb","n":"000014131","t":"Packet Engine Disabled","b":"","u":"Packet-Engine-Disabled","d":"2026-01-07","c":"2025-12-18","v":7,"ver":1,"id":"ka0UY0000009HMbYAM"},{"k":"kb","n":"000014136","t":"Alert \"itl_ops_md_iec104_restart\"","b":"This alert indicates that in the timespan of one hour more than one IEC104 message type 70 was seen. This message type \"M_EI_NA_1\" indicates the end of initialization sequence for a device. Usually, when an application starts the connections to all IEC104 devices are set up, and the devices initialized. No further initialization is needed again for as long as the applications and its devices keep running. Having multiple initializations for a device is not normal behavior, but not necessarily an indicator of a cyber attack.","u":"Alert-itl-ops-md-iec104-restart","d":"2026-01-07","c":"2025-12-18","v":7,"ver":1,"id":"ka0UY0000009I8zYAE"},{"k":"kb","n":"000014141","t":"CVE-2025-24813","b":"Is Forescout vulnerable to CVE-2025-24813","u":"CVE-2025-24813","d":"2026-01-07","c":"2025-12-19","v":7,"ver":1,"id":"ka0UY0000009IKHYA2"},{"k":"kb","n":"000014149","t":"How to identify which endpoints trigger high admission numbers in TS diag","b":"Appliances report Delay from EM or slow responsiveness in reporting data into the GUI. \r\nTech Support reports a high number of admission events which leads to increased queueing and large db tables","u":"How-to-identify-which-endpoints-trigger-high-admission-numbers-in-TS-diag","d":"2026-01-07","c":"2025-12-19","v":7,"ver":1,"id":"ka0UY0000009IwzYAE"},{"k":"kb","n":"000014152","t":"EM Service Fails to Start Due to Inode Exhaustion","b":"","u":"EM-Service-Fails-to-Start-Due-to-Inode-Exhaustion","d":"2026-01-07","c":"2025-12-20","v":7,"ver":1,"id":"ka0R7000000PPxhIAG"},{"k":"kb","n":"000014154","t":"CVE-2025-41244","b":"Local privilege escalation vulnerability in VMware Tools in Eyesight 9.1.4-791","u":"CVE-2025-41244","d":"2026-04-10","c":"2025-12-21","v":7,"ver":1,"id":"ka0UY0000009JJZYA2"},{"k":"kb","n":"000014155","t":"BIND Vulnerability CVE-2024-1737 & CVE-2024-1975","b":"Is Forescout vulnerable to CVE-2024-1737 and CVE-2024-1975?","u":"BIND-Vulnerability-CVE-2024-1737-CVE-2024-1975","d":"2026-01-07","c":"2025-12-21","v":7,"ver":1,"id":"ka0UY0000009JLBYA2"},{"k":"kb","n":"000014156","t":"CVE-2025-24813 Vulnerability","b":"Is Forescout vulnerable to CVE-2025-24813","u":"CVE-2025-24813-Vulnerability","d":"2026-01-07","c":"2025-12-21","v":7,"ver":1,"id":"ka0UY0000009JMnYAM"},{"k":"kb","n":"000014157","t":"DEX List Update Succeeds via API but Changes Are Not Reflected in the UI","b":"","u":"DEX-List-Update-Succeeds-via-API-but-Changes-Are-Not-Reflected-in-the-UI","d":"2026-01-07","c":"2025-12-21","v":7,"ver":1,"id":"ka0UY0000009JOPYA2"},{"k":"kb","n":"000014158","t":"Forescout REM (Recovery Enterprise Manager) Is Not Accessible After Upgrade to Version 9.1.4 in Microsoft Azure","b":"","u":"Forescout-REM-Recovery-Enterprise-Manager-Is-Not-Accessible-After-Upgrade-to-Version-9-1-4-in-Microsoft-Azure","d":"2026-01-08","c":"2025-12-21","v":7,"ver":1,"id":"ka0UY0000009JQ1YAM"},{"k":"kb","n":"000014160","t":"CVE-2006-0987","b":"Is Forescout vulnerable to,\r\nCVE-2006-0987: The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.","u":"CVE-2006-0987","d":"2026-01-08","c":"2025-12-22","v":7,"ver":1,"id":"ka0UY0000009JTFYA2"},{"k":"kb","n":"000014162","t":"VPN-connected endpoints are either not showing the Vendor and Model information, or the VPN device name is displayed under the Vendor and Model properties.","b":"","u":"VPN-connected-endpoints-are-either-not-showing-the-Vendor-and-Model-information-or-the-VPN-device-name-is-displayed-under-the-Vendor-and-Model-properties","d":"2026-01-08","c":"2025-12-22","v":7,"ver":1,"id":"ka0UY0000009JWTYA2"},{"k":"kb","n":"000014163","t":"On the Forescout console, the same MAC address is displayed for VPN-connected endpoints.","b":"","u":"On-the-Forescout-console-the-same-MAC-address-is-displayed-for-VPN-connected-endpoints","d":"2026-01-08","c":"2025-12-22","v":7,"ver":1,"id":"ka0UY0000009JY5YAM"},{"k":"kb","n":"000014164","t":"Troubleshooting passive sensor not processing all traffic","b":"In certain scenarios, the passive sensor may not completely process all network communication. This page offers further insights on how to identify when this occurs, the potential causes behind it, and some possible strategies to force the sensor to process this communication.","u":"Troubleshooting-passive-sensor-not-processing-all-traffic","d":"2026-01-08","c":"2025-12-22","v":7,"ver":1,"id":"ka0UY0000009JZhYAM"},{"k":"kb","n":"000014165","t":"Vulnerabilities Effecting Version 8.5.2","b":"Is Forescout Vulnerable To Following CVEs:\r\nCVE-2022-40897\r\nCVE-2022-40898\r\nCVE-2023-23931 \r\nCVE-2023-24329\r\nCVE-2007-4559 \r\nCVE-2023-32681\r\nCVE-2023-40217\r\nCVE-2022-27635\r\nCVE-2022-36351\r\nCVE-2022-38076 \r\nCVE-2022-40964 \r\nCVE-2022-46329\r\nCVE-2024-5564 \r\nCVE-2024-6345 \r\nCVE-2023-26604 \r\nCVE-2023-31315","u":"Vulnerabilities-Effecting-Version-8-5-2","d":"2026-01-08","c":"2025-12-22","v":7,"ver":1,"id":"ka0UY0000009JbJYAU"},{"k":"kb","n":"000014169","t":"What is a 'master' in EyeInspect","b":"","u":"What-is-a-master-in-EyeInspect","d":"2026-01-08","c":"2025-12-22","v":7,"ver":1,"id":"ka0UY0000009JkzYAE"},{"k":"kb","n":"000014174","t":"How to perform Power Cycle of an appliance?","b":"Power cycle of an appliance in","u":"How-to-perform-powercycle-of-an-appliance","d":"2026-01-08","c":"2025-12-22","v":7,"ver":1,"id":"ka0UY0000009JufYAE"},{"k":"kb","n":"000014182","t":"The action doesn't work via NC integration with Juniper MIST","b":"","u":"The-action-doesn-t-work-via-NC-integration-with-Juniper-MIST","d":"2026-01-08","c":"2025-12-23","v":7,"ver":1,"id":"ka0UY0000009KIrYAM"},{"k":"kb","n":"000014186","t":"What eyeInspect software version do I have?","b":"When you need to identify the version of EyeInspect that is currently having, the following command steps will help you obtain this information.","u":"What-eyeInspect-software-version-do-I-have","d":"2026-01-08","c":"2025-12-23","v":7,"ver":1,"id":"ka0UY0000009KPJYA2"},{"k":"kb","n":"000014187","t":"Must not use legacy BIOS. Use UEFI without Secure Boot instead.","b":"","u":"Must-not-use-legacy-BIOS-Use-UEFI-without-Secure-Boot-instead","d":"2026-01-08","c":"2025-12-23","v":7,"ver":1,"id":"ka0UY0000009KQvYAM"},{"k":"kb","n":"000014190","t":"watchdog did not stop","b":"","u":"watchdog-did-not-stop","d":"2026-01-08","c":"2025-12-23","v":7,"ver":1,"id":"ka0UY0000009KXNYA2"},{"k":"kb","n":"000014196","t":"Customer had issues with the Cloud Uploader and the eyeSegment integration - 403 Access Denied error","b":"","u":"Customer-had-issues-with-the-Cloud-Uploader-and-the-eyeSegment-integration","d":"2026-01-08","c":"2025-12-26","v":7,"ver":1,"id":"ka0UY0000009LRpYAM"},{"k":"kb","n":"000014197","t":"SSH ciphers still being presented after configuring for removal","b":"","u":"SSH-ciphers-still-being-presented-after-configuring-for-removal","d":"2026-01-08","c":"2025-12-26","v":7,"ver":1,"id":"ka0UY0000009LTRYA2"},{"k":"kb","n":"000014198","t":"MAC address and switch details are not visible for devices in console GUI","b":"","u":"MAC-address-and-switch-details-are-not-visible-for-devices-in-console-GUI","d":"2026-01-08","c":"2025-12-26","v":7,"ver":1,"id":"ka0UY0000009LV3YAM"},{"k":"kb","n":"000014203","t":"COA-vs-Re-auth-in-Policy-Action-Disconnect-Not-Working-as-Expected","b":"","u":"COA-vs-Re-auth-in-Policy-Action-Disconnect-Not-Working-as-Expected","d":"2026-02-20","c":"2025-12-29","v":7,"ver":1,"id":"ka0UY0000009Lq1YAE"},{"k":"kb","n":"000014204","t":"How to change the time in the BIOS.","b":"Errors\r\n\r\nAppliance won't boot, and is showing the following errors\r\n\r\nUEFI0034: CMOS battery loss resulting in an invalid BIOS configuration\r\nUEFI0069: CMOS checksum error\r\nUEFI0130: The System time and date are invalid\r\n\r\nTSR logs will show PSU error \"Power supply redundancy is lost\" & \"The power input for power supply 1 is lost\"","u":"How-to-change-the-time-in-the-BIOS","d":"2026-02-16","c":"2025-12-29","v":7,"ver":1,"id":"ka0UY0000009LrdYAE"},{"k":"kb","n":"000014207","t":"Dashboard and Reporting Tab error","b":"whenever we tried to open the dashboard or the Report portal, we got an error \"Application not authorized to use authentication service\"","u":"Dashboard-and-Reporting-Tab-error","d":"2026-01-08","c":"2025-12-30","v":7,"ver":1,"id":"ka0UY0000009LzhYAE"},{"k":"kb","n":"000014208","t":"CVE-2024-23848, CVE-2024-25741, CVE-2024-40902, CVE-2022-27416","b":"Is Forescout eyeInspect 5.5.x affected by the following vulnerabilities:\r\nCVE-2024-23848, CVE-2024-25741, CVE-2024-40902, and CVE-2022-27416?","u":"CVE-2024-23848-CVE-2024-25741-CVE-2024-40902-CVE-2022-27416","d":"2026-04-01","c":"2025-12-30","v":7,"ver":1,"id":"ka0UY0000009M1JYAU"},{"k":"kb","n":"000014209","t":"CVE-2022-28487","b":"Is Forescout eyeInspect 5.5.x affected by CVE-2022-28487?","u":"CVE-2022-28487","d":"2026-04-01","c":"2025-12-30","v":7,"ver":1,"id":"ka0UY0000009M2vYAE"},{"k":"kb","n":"000014210","t":"CVE-2023-38408","b":"Is Forescout eyesight 8.5.x is vulnerable to CVE-2023-38408?","u":"CVE-2023-38408","d":"2026-04-01","c":"2025-12-30","v":7,"ver":1,"id":"ka0UY0000009M4XYAU"},{"k":"kb","n":"000014211","t":"When using a single system certificate scoped for HPS subsystem and All devices, Windows SecureConnector can fail to connect","b":"","u":"When-using-a-single-system-certificate-scoped-for-HPS-subsystem-and-All-devices-Windows-SecureConnector-can-fail-to-connect","d":"2026-01-08","c":"2025-12-30","v":7,"ver":1,"id":"ka0UY0000009MSjYAM"},{"k":"kb","n":"000014212","t":"Complete License Clear Procedure","b":"Sometimes license information does not get fully cleared and removed, which can cause future issues. This article explains how to wipe the cached information.","u":"Complete-License-Clear-Procedure","d":"2026-01-08","c":"2025-12-30","v":7,"ver":1,"id":"ka0UY0000009MVxYAM"},{"k":"kb","n":"000014213","t":"Licensing Information Storage","b":"Licensing information, which is used in the GUI to display license status and to send license warning emails, is stored in 2 separate locations.","u":"Licensing-Information-Storage","d":"2026-01-08","c":"2025-12-30","v":7,"ver":1,"id":"ka0UY0000009MXZYA2"},{"k":"kb","n":"000014214","t":"Issues Connecting Network Controller to Cisco ACI error communication timeout","b":"","u":"Issues-Connecting-Network-Controller-to-Cisco-ACI-error-communication-timeout","d":"2026-02-20","c":"2025-12-31","v":7,"ver":1,"id":"ka0UY0000009MZBYA2"},{"k":"kb","n":"000014217","t":"Seeing \"threshold limit for server dex reached\" across all DEX actions post-migration","b":"","u":"Seeing-threshold-limit-for-server-dex-reached-across-all-DEX-actions-post-migration","d":"2026-02-20","c":"2025-12-31","v":7,"ver":1,"id":"ka0UY0000009MpJYAU"},{"k":"kb","n":"000014219","t":"This article describe how to use Linux system commands to perform basic connectivity troubleshooting on eyeInspect hosts","b":"Prerequisites\r\nLinux shell access on the Command Center or Sensor host\r\n\r\nInstructions\r\nOverview\r\nThis guide explains how to use Linux tools (netstat and tcpdump) to troubleshoot traffic flow for:\r\n\r\nWeb Application: TCP/443 (TLS)\r\n\r\nPassive Sensors: TCP/29999\r\n\r\nActive Sensors: TCP/9092 (Kafka)","u":"This-article-describe-how-to-use-Linux-system-commands-to-perform-basic-connectivity-troubleshooting-on-eyeInspect-hosts","d":"2026-07-23","c":"2025-12-31","v":7,"ver":1,"id":"ka0UY0000009MsXYAU"},{"k":"kb","n":"000014222","t":"NC block network access by mac address is not persistent with Ruckus configuration","b":"","u":"NC-block-network-access-not-persistent-with-Ruckus-configuration","d":"2026-04-01","c":"2026-01-01","v":7,"ver":1,"id":"ka0UY0000009MxNYAU"},{"k":"kb","n":"000014223","t":"PAN-NGFW Plugin Crashes Due to Invalid plugin.java.maxmem Configuration","b":"Observed that when incorrectly setting/increasing plugin java memory for Palo Alto NG Firewall, it falls it constant crashing loop.","u":"PAN-NGFW-Plugin-Crashes-Due-to-Invalid-plugin-java-maxmem-Configuration","d":"2026-02-20","c":"2026-01-01","v":7,"ver":1,"id":"ka0UY0000009N2DYAU"},{"k":"kb","n":"000014224","t":"CVE-2025-26482 vulnerability-Remediation","b":"Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contain an Information Disclosure vulnerability. \r\nA highly privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.","u":"CVE-2025-26482-vulnerability-Remediation","d":"2026-02-20","c":"2026-01-02","v":7,"ver":1,"id":"ka0UY0000009NAHYA2"},{"k":"kb","n":"000014225","t":"How to fix the no boot issue for model R640","b":"If the system is set up to boot to Optical Drive > embedded SATA. It will cause no boot issue, or it will not be able to boot.","u":"How-to-fix-the-no-boot-issue-for-model-R640","d":"2026-02-20","c":"2026-01-02","v":7,"ver":1,"id":"ka0UY0000009NBtYAM"},{"k":"kb","n":"000014226","t":"How to decommission an appliance","b":"How to decommission an appliance","u":"How-to-decommission-an-appliance","d":"2026-04-01","c":"2026-01-05","v":7,"ver":1,"id":"ka0UY0000009NwfYAE"},{"k":"kb","n":"000014227","t":"CounterACT service at was stopped because the file-system where the /tmp folder resides is full.","b":"","u":"CounterACT-service-at-appliance-IP-was-stopped-because-the-file-system-where-the-tmp-folder-resides-is-full","d":"2026-01-05","c":"2026-01-05","v":7,"ver":1,"id":"ka0UY0000009NyHYAU"},{"k":"kb","n":"000014231","t":"Impact of Non-Dedicated CPU and Memory Resources on Appliance Performance and Stability","b":"It is recommended to allocate dedicated CPU and memory resources to the virtual appliance.\r\nIf the appliance is not assigned dedicated CPU or memory, this may result in resource contention, leading to degraded performance, increased latency, unpredictable behavior, or potential service instability under load.","u":"Impact-of-Non-Dedicated-CPU-and-Memory-Resources-on-Appliance-Performance-and-Stability","d":"2026-02-20","c":"2026-01-11","v":7,"ver":1,"id":"ka0UY0000009RXFYA2"},{"k":"kb","n":"000014232","t":"Is Forescout 9.1.3 Affected by CVE-2025-8885?","b":"","u":"Is-Forescout-9-1-3-Affected-by-CVE-2025-8885","d":"2026-02-20","c":"2026-01-12","v":7,"ver":1,"id":"ka0UY0000009RiXYAU"},{"k":"kb","n":"000014233","t":"Is Forescout 8.5.2 Affected by CVE-2025-26482?","b":"","u":"Is-Forescout-8-5-2-Affected-by-CVE-2025-26482","d":"2026-02-20","c":"2026-01-12","v":7,"ver":1,"id":"ka0UY0000009RllYAE"},{"k":"kb","n":"000014234","t":"LicenseLoginErrorsMap : Failed to run license login","b":"","u":"LicenseLoginErrorsMap-Failed-to-run-license-login","d":"2026-02-20","c":"2026-01-13","v":7,"ver":1,"id":"ka0UY0000009St7YAE"},{"k":"kb","n":"000014238","t":"CVE-2025-70974- JSON parsing library Fastjson vulnerability in eyeSight","b":"","u":"CVE-2025-70974--JSON-parsing-library-Fastjson-vulnerability-in-eyeSight","d":"2026-02-20","c":"2026-01-15","v":7,"ver":1,"id":"ka0UY0000009U25YAE"},{"k":"kb","n":"000014240","t":"How to Enable / Disable Disk Encryption on Forescout eyeSight Devices","b":"This article explains how to enable or disable disk encryption on Forescout eyeSight devices using the \"fstool\" command-line utility.","u":"How-to-Enable-Disable-Disk-Encryption-on-Forescout-eyeSight-Devices","d":"2026-02-16","c":"2026-01-20","v":7,"ver":1,"id":"ka0R7000000MPZFIA4"},{"k":"kb","n":"000014241","t":"How to add NTP servers IP manually in the applaince","b":"The customer had run the command \"fstool ntp test\" on the server, and the error is \"No association ID's returned.\"","u":"How-to-add-NTP-servers-IP-manually-in-the-appliance","d":"2026-07-03","c":"2026-01-21","v":7,"ver":1,"id":"ka0R7000000MTMjIAO"},{"k":"kb","n":"000014245","t":"CVE-2025-60021 Remote command injection vulnerability in Apache bRPC","b":"","u":"CVE-2025-60021-Remote-command-injection-vulnerability-in-Apache-bRPC","d":"2026-02-16","c":"2026-01-26","v":7,"ver":1,"id":"ka0R7000000Md2jIAC"},{"k":"kb","n":"000014248","t":"Certificate Failure Caused by Incorrect Folder Ownership on Appliances","b":"","u":"Certificate-Failure-Caused-by-Incorrect-Folder-Ownership-on-Appliances","d":"2026-02-19","c":"2026-01-28","v":7,"ver":1,"id":"ka0R7000000PgP3IAK"},{"k":"kb","n":"000014251","t":"Syslog Integration with Check Point SSL VPN","b":"Checkpoint SSL VPN integrates with the Forescout Syslog plugin.\r\nWhen the VPN client connects to and disconnects from the Check Point SSL VPN gateway, the gateway sends syslog messages to the FS appliance.\r\nThe FS appliance's syslog plugin parses incoming syslog messages and displays the VPN client properties in the FS GUI.","u":"Syslog-Integration-with-Check-Point-SSL-VPN","d":"2026-02-20","c":"2026-01-30","v":7,"ver":1,"id":"ka0R7000000NcPZIA0"},{"k":"kb","n":"000014252","t":"Unwanted devices in the Forescout consume licenses.","b":"Unwanted devices in Forescout consume licenses and can cause the license capacity to be exceeded.","u":"Unwanted-devices-in-the-Forescout-consume-licenses-How-can-we-limit-licenses-getting-exceeded","d":"2026-02-11","c":"2026-01-30","v":7,"ver":1,"id":"ka0R7000000MnZxIAK"},{"k":"kb","n":"000014257","t":"How to Check the Last Time Forescout did a Recheck on the Endpoint?","b":"Users may occasionally need to verify when an endpoint was last rechecked, regardless of policy. This information is available in the Forescout GUI by adding the “Matched Times” column.","u":"How-to-Check-the-Last-Time-Forescout-did-a-Recheck-on-the-Endpoint","d":"2026-02-20","c":"2026-02-03","v":7,"ver":1,"id":"ka0R7000000MuoLIAS"},{"k":"kb","n":"000014258","t":"Is Forescout Vulnerable to CVE-2024-47575, CVE-2024-47569, CVE-2024-52964?","b":"Is Forescout Vulnerable to CVE-2024-47575, CVE-2024-47569, CVE-2024-52964?","u":"Is-Forescout-Vulnerable-to-CVE-2024-47575-CVE-2024-47569-CVE-2024-52964","d":"2026-02-16","c":"2026-02-05","v":7,"ver":1,"id":"ka0R7000000MzZVIA0"},{"k":"kb","n":"000014263","t":"Is Forescout Vulnerable To CVE-2025-48976 ?","b":"Apache Commons FileUpload CVE-2025-48976","u":"Is-Forescout-Vulnerable-To-CVE-2025-48976","d":"2026-02-16","c":"2026-02-05","v":7,"ver":1,"id":"ka0R7000000N1BVIA0"},{"k":"kb","n":"000014273","t":"Cisco WLC 9800 test [Failed to read 1.3.6.1.2.1.1.3.0] SNMP error No transport Domain","b":"Cisco WLC 9800 integration Wireless plugin fails with test read credentials [Failed to read 1.3.6.1.2.1.1.3.0] SNMP error No transport Domain","u":"Failed-to-read-1-3-6-1-2-1-1-3-0-SNMP-error-No-transport-Domain","d":"2026-07-13","c":"2026-02-11","v":7,"ver":1,"id":"ka0R7000000NBkLIAW"},{"k":"kb","n":"000014277","t":"Recommended Approach for Integrating Forescout with Cisco Meraki (API‑Based)","b":"Customers using Cisco Meraki can integrate with Forescout through Meraki’s cloud APIs, allowing Forescout to retrieve device and network context such as MAC address, IP address, switch port, VLAN, and SSID association. This provides contextual visibility into connected devices and enables policy-based response actions (such as VLAN changes or policy assignment) through API-driven enforcement workflows\r\n\r\nBelow is a recommended approach with examples.","u":"Recommended-Approach-for-Integrating-Forescout-with-Cisco-Meraki-API-Based","d":"2026-02-20","c":"2026-02-13","v":7,"ver":1,"id":"ka0R7000000NHZdIAO"},{"k":"kb","n":"000014278","t":"Endpoint in the Meraki Network is not updated in the Forescout GUI","b":"","u":"Endpoint-in-the-Meraki-Network-is-not-updated-in-the-Forescout-GUI","d":"2026-02-20","c":"2026-02-13","v":7,"ver":1,"id":"ka0R7000000NHbFIAW"},{"k":"kb","n":"000014279","t":"Performance-tune the Network Controller plugin","b":"The customer will meet the Meraki API rate limit issue while they integrate the Foresout Network Controller plugin with the Meraki API.\r\nHere are the detailed statistics from performance tuning the Network Controller plugin.","u":"Performance-tune-the-Network-Controller-plugin","d":"2026-02-20","c":"2026-02-13","v":7,"ver":1,"id":"ka0R7000000NHmXIAW"},{"k":"kb","n":"000014280","t":"Integrate Forescout with Zscaler SASE","b":"Many Forescout customers use the Zscaler SASE solution.\r\nThey need to monitor the VPN clients of the Zscaler SASE solution in the Forescout GUI.\r\nThe integration requires the client to install the Forescout SecureConnector agent.","u":"Integrate-Forescout-with-Zscaler-SASE","d":"2026-02-20","c":"2026-02-16","v":7,"ver":1,"id":"ka0R7000000NoovIAC"},{"k":"kb","n":"000014281","t":"How to change the default/forgotten login password for IDRAC using iDRAC settings utility","b":"This KB article helps in changing the default / forgotten login password of the iDRAC web console using the iDRAC setting utility","u":"How-to-change-the-default-forgotten-login-password-for-IDRAC-using-iDRAC-settings-utility","d":"2026-02-22","c":"2026-02-16","v":7,"ver":1,"id":"ka0R7000000NKndIAG"},{"k":"kb","n":"000014282","t":"Endpoint Not Receiving IP Address After Successful 802.1X Authentication","b":"","u":"Endpoint-Not-Receiving-IP-Address-After-Successful-802-1X-Authentication","d":"2026-02-22","c":"2026-02-17","v":7,"ver":1,"id":"ka0R7000000NMnpIAG"},{"k":"kb","n":"000014286","t":"Configure the Huawei Switch to send the Linkup and Linkdown SNMP Trap to Forescout","b":"The Linkup and Linkdown SNMP trap can help Forescout to reflect the device's online and offline status quickly in the GUI.\r\nThe customer needs to configure the switch to send out the Linkup and Linkdown SNMP Trap to the Forescout appliances.\r\nThe following is an example of the Huawei switch configuration to send out the SNMP trap via SNMP v2.\r\nThe Huawei switch sends the SNMP traps to the Forescout appliance on UDP 162.","u":"Configure-the-Huawei-Switch-to-send-the-Linkup-and-Linkdown-SNMP-Trap-to-Forescout","d":"2026-02-22","c":"2026-02-20","v":7,"ver":1,"id":"ka0R7000000NXxlIAG"},{"k":"kb","n":"000014288","t":"Configure the Forescout Radius Accounting Integration with Meraki AP and Switch","b":"Radius Accounting Start and Stop can tell the Radius server when the Radius account session starts and stops.\r\nThis Radius accounting information can help Forescout mark the client as online or offline in real time.\r\nThe following is an example of the test in the Forescout and Meraki network (Meraki AP and Meraki Switch).","u":"Configure-the-Forescout-Radius-Accounting-Integration-with-Meraki-AP-and-Switch","d":"2026-04-01","c":"2026-02-25","v":7,"ver":1,"id":"ka0R7000000NiMvIAK"},{"k":"kb","n":"000014290","t":"How to create the cliadmin_console User for Forescout Console Access Only?","b":"This article explains how to create the cliadmin_console user to allow \"Console-only access\" on a Forescout Appliance.\r\n\r\nThis procedure must be performed using the Appliance CLI","u":"How-to-create-the-cliadmin-console-User-for-Forescout-Console-Access-Only","d":"2026-04-01","c":"2026-02-27","v":7,"ver":1,"id":"ka0R7000000NonJIAS"},{"k":"kb","n":"000014291","t":"How to enable or disable the Forescout Console Site Map?","b":"This article explains how to enable or disable the Site Map view in the Forescout Console.\r\nThe configuration applies globally to all managed Appliances.","u":"How-to-enable-or-disable-the-Forescout-Console-Site-Map","d":"2026-03-26","c":"2026-02-27","v":7,"ver":1,"id":"ka0R7000000NoqXIAS"},{"k":"kb","n":"000014293","t":"Secure Connector agent failed to install by \"Remote Installation\" method","b":"","u":"Secure-Connector-agent-failed-to-install-by-Remote-Installation-method","d":"2026-03-03","c":"2026-02-28","v":7,"ver":1,"id":"ka0R7000000NtGjIAK"},{"k":"kb","n":"000014294","t":"Hard-Disk-and-RAID-Controller-Not-Detected-Appliance-Unable-to-Boot","b":"","u":"Hard-Disk-and-RAID-Controller-Not-Detected-Appliance-Unable-to-Boot","d":"2026-03-26","c":"2026-02-28","v":7,"ver":1,"id":"ka0R7000000NtLZIA0"},{"k":"kb","n":"000014295","t":"Command-Center-GUI-admin-account-locked-again-after-password-reset","b":"","u":"Command-Center-GUI-admin-account-locked-again-after-password-reset","d":"2026-07-03","c":"2026-03-01","v":7,"ver":1,"id":"ka0R7000000NuSvIAK"},{"k":"kb","n":"000014297","t":"After a Certificate is Created, its Details are no Longer Displayed","b":"","u":"After-a-Certificate-is-Created-its-Details-are-no-Longer-Displayed","d":"2026-04-10","c":"2026-03-02","v":7,"ver":1,"id":"ka0R7000000NufpIAC"},{"k":"kb","n":"000014300","t":"How to Check if a Switch Action is Stuck in the NPAction Database?","b":"Occasionally, switch actions may become stuck in the NPAction database. The best way to search for stuck actions through a tech-support file is by generating a database dump.","u":"How-to-Check-if-a-Switch-Action-is-Stuck-in-the-NPAction-Database","d":"2026-04-27","c":"2026-03-03","v":7,"ver":1,"id":"ka0R7000000NzQzIAK"},{"k":"kb","n":"000014302","t":"CVE-2026-29000 Authentication‑bypass vulnerability in the pac4j‑jwt library","b":"","u":"CVE-2026-29000-Authentication-bypass-vulnerability-in-the-pac4j-jwt-library","d":"2026-03-13","c":"2026-03-05","v":7,"ver":1,"id":"ka0R7000000OEt3IAG"},{"k":"kb","n":"000014307","t":"A Patrol Read operation started for Integrated RAID Controller 1","b":"Received iDRAC alert showing 'A Patrol Read operation started for Integrated RAID Controller 1'","u":"A-Patrol-Read-operation-started-for-Integrated-RAID-Controller-1","d":"2026-07-03","c":"2026-03-10","v":7,"ver":1,"id":"ka0R7000000OM2bIAG"},{"k":"kb","n":"000014308","t":"Packet engine crashing after forescout upgrade to 9.1.5","b":"","u":"Packet-engine-crashing-after-forescout-upgrade-to-9-1-5","d":"2026-04-01","c":"2026-03-10","v":7,"ver":1,"id":"ka0R7000000OMU1IAO"},{"k":"kb","n":"000014309","t":"CVE-2002-1663 Post_Method function crafted content-length header DoS","b":"The Post_Method function in method.c for Monkey HTTP Daemon before 0.5.1 allows remote attackers to cause a denial of service (crash) via a POST request with an invalid or missing Content-Length header value.","u":"CVE-2002-1663-Post-Method-function-crafted-content-length-header-DoS","d":"2026-03-11","c":"2026-03-10","v":7,"ver":1,"id":"ka0R7000000OMtpIAG"},{"k":"kb","n":"000014312","t":"Switches labeled as \"Not a Switch\" become managed after moving them to a different forescout appliance","b":"In the switch plugin we have the option to mark switches as \"Not a switch\", when a switch is tagged with that label and then moved to a different appliance it becomes a managed switch.","u":"Switches-labeled-as-Not-a-Switch-become-managed-after-moving-them-to-a-different-forescout-appliance","d":"2026-04-01","c":"2026-03-12","v":7,"ver":1,"id":"ka0R7000000OVvVIAW"},{"k":"kb","n":"000014314","t":"Check For Updates Failed : Server returned HTTP response code:500 for URL: https://api.forescout.com/rest/swupdates..","b":"","u":"Check-For-Updates-Failed-Server-returned-HTTP-response-code-500-for-URL-https-api-forescout-com-rest-swupdates","d":"2026-03-26","c":"2026-03-16","v":7,"ver":1,"id":"ka0R7000000OZhNIAW"},{"k":"kb","n":"000014317","t":"mutual TLS (mutual TLS) setup","b":"","u":"mutual-TLS-mutual-TLS-setup","d":"2026-04-10","c":"2026-03-17","v":7,"ver":1,"id":"ka0R7000000OcnJIAS"},{"k":"kb","n":"000014318","t":"DNS configuration on Forescout appliances hosted in the GCP environment is reset after a reboot.","b":"","u":"DNS-configuration-on-Forescout-appliances-hosted-in-the-GCP-environment-is-reset-after-a-reboot","d":"2026-04-10","c":"2026-03-18","v":7,"ver":1,"id":"ka0R7000000OeIrIAK"},{"k":"kb","n":"000014320","t":"SCD / CIS / STIG Controls on Forescout NAC Appliances Running Red Hat Linux","b":"Forescout NAC servers that run on Red Hat Linux are delivered as vendor‑managed appliances. Security configuration and hardening must be performed only through Forescout‑documented platform controls. Applying generic OS‑level SCD, CIS, or STIG baselines directly to the underlying Red Hat operating system is not supported and may impact system functionality and supportability.","u":"SCD-CIS-STIG-Controls-on-Forescout-NAC-Appliances-Running-Red-Hat-Linux","d":"2026-03-18","c":"2026-03-18","v":7,"ver":1,"id":"ka0R7000000OgVxIAK"},{"k":"kb","n":"000014324","t":"HPS plugin Secureconnector version 11.3.17 fails to connect to it's managing appliance - ProbeConnection called, probe timeout: 400","b":"","u":"HPS-plugin-Secureconnector-version-11-3-17-fails-to-connect-to-it-s-managing-appliance---ProbeConnection-called-probe-timeout-400","d":"2026-04-10","c":"2026-03-19","v":7,"ver":1,"id":"ka0R7000000OjX3IAK"},{"k":"kb","n":"000014326","t":"How to install CounterACT GUI Console in Linux (CentOS/Ubuntu) 2026","b":"This KB shows how to install the Forescout Console onto Ubunut/CentOS in 2026 using the .run file from the Forescout console","u":"How-to-install-CounterACT-GUI-Console-in-Linux-CentOS-Ubuntu-2026","d":"2026-04-10","c":"2026-03-20","v":7,"ver":1,"id":"ka0R7000000OkEbIAK"},{"k":"kb","n":"000014327","t":"After upgrading the switch plugin switch ACL actions fail where they were working prior to the upgrade","b":"","u":"After-upgrading-the-switch-plugin-switch-ACL-actions-fail-where-they-were-working-prior-to-the-upgrade","d":"2026-03-23","c":"2026-03-20","v":7,"ver":1,"id":"ka0R7000000Ol93IAC"},{"k":"kb","n":"000014328","t":"FortiManager error \"Workspace-Mode Unsupported\"","b":"","u":"FortiManager-error-Workspace-Mode-Unsupported","d":"2026-03-25","c":"2026-03-23","v":7,"ver":1,"id":"ka0R7000000OmTJIA0"},{"k":"kb","n":"000014329","t":"Switch plugin can be configure using it's IP or FQDN, using IP should be consider Best Practice.","b":"Based on the issues outlined in KBs 9986 & 14327 configuring switches in the switch plugin to use it's IP address instead of FQDN should be considered best practice.","u":"Switch-plugin-can-be-configure-using-it-s-IP-or-FQDN-using-IP-should-be-consider-Best-Practice","d":"2026-04-01","c":"2026-03-23","v":7,"ver":1,"id":"ka0R7000000OnNlIAK"},{"k":"kb","n":"000014330","t":"\"Last Trap Received\" Is Empty or Delayed","b":"This article helps in scenarios where the \"Last Trap Received\" field is empty or delayed in the Forescout Console.","u":"Last-Trap-Received-Is-Empty-or-Delayed","d":"2026-04-13","c":"2026-03-24","v":7,"ver":1,"id":"ka0R7000000OnqnIAC"},{"k":"kb","n":"000014331","t":"License activation error \"licenseLoginErrorMap\" Failed to run license login","b":"At the time of the license activation, the error occurs: \"licenseLoginErrorMap\" Failed to run license login","u":"License-activation-error-licenseLoginErrorMap-Failed-to-run-license-login","d":"2026-04-10","c":"2026-03-24","v":7,"ver":1,"id":"ka0R7000000OoYLIA0"},{"k":"kb","n":"000014336","t":"HPS Agent Manager constantly initializing","b":"HPS Agent Manager is restarting/stopping and initializing over and over again","u":"HPS-Agent-Manager-constantly-initializing","d":"2026-08-06","c":"2026-03-27","v":7,"ver":1,"id":"ka0R7000000Ow7hIAC"},{"k":"kb","n":"000014341","t":"Multiple CVEs for OpenSSL in CounterACT Version 9.1.4‑791","b":"OpenSSL released a Security Advisory the 27th of January :\r\nhttps://openssl-library.org/news/secadv/20260127.txt\r\n\r\nContaining the following CVEs:\r\nCVE-2026-22795\r\nCVE-2026-22796\r\nCVE-2025-11187\r\nCVE-2025-15467\r\nCVE-2025-15468\r\nCVE-2025-15469\r\nCVE-2025-66199\r\nCVE-2025-68160 \r\nCVE-2025-69418\r\nCVE-2025-69419 \r\nCVE-2025-69420\r\nCVE-2025-69421\r\n\r\nIs ForeScout is vulnerable these CVEs ?","u":"Multiple-CVEs-for-OpenSSL-in-CounterACT-Version-9-1-4-791","d":"2026-04-10","c":"2026-03-31","v":7,"ver":1,"id":"ka0R7000000P3IrIAK"},{"k":"kb","n":"000014342","t":"Your client IP address is not within an approved subnet for organization","b":"","u":"Your-client-IP-address-is-not-within-an-approved-subnet-for-organization","d":"2026-04-01","c":"2026-03-31","v":7,"ver":1,"id":"ka0R7000000P3XNIA0"},{"k":"kb","n":"000014343","t":"HSTS Missing From HTTPS Server (RFC 6797) (142960)","b":"The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.","u":"HSTS-Missing-From-HTTPS-Server-RFC-6797-142960","d":"2026-04-10","c":"2026-04-01","v":7,"ver":1,"id":"ka0R7000000P6LZIA0"},{"k":"kb","n":"000014347","t":"Meraki API query to the Meraki stacked switch will respond with 400 error","b":"","u":"Meraki-API-query-to-the-Meraki-stacked-switch-will-respond-with-400-error","d":"2026-04-10","c":"2026-04-02","v":7,"ver":1,"id":"ka0R7000000P7zBIAS"},{"k":"kb","n":"000014353","t":"Is Forescout vulnerable to CVE-2025-26466 ?","b":"A security vulnerability related to OpenSSH (CVE-2025-26466) was found during scanning with version 8.5.1","u":"Is-Forescout-vulnerable-to-CVE-2025-26466","d":"2026-08-06","c":"2026-04-09","v":7,"ver":1,"id":"ka0R7000000PHSHIA4"},{"k":"kb","n":"000014354","t":"ESXi on AMD Processors and VMware Warning: The guest operating system ‘rhel9_64Guest’ is not supported","b":"Forescout virtual appliances are supported based on the VMware ESXi/vSphere version, not on the underlying CPU vendor (Intel vs. AMD).\r\nUsing AMD-based ESXi hosts might introduce a Forescout compatibility limitation. In reality, Forescout’s guidance and the official compatibility matrix define support only by ESXi/vSphere versions.\r\nVMware Error: “The guest operating system ‘rhel9_64Guest’ is not supported.” This warning is generated by VMware ESXi / vSphere, not by Forescout.\r\nThe ESXi build in use does not fully recognize the specific guest OS identifier rhel9_64Guest defined in the VM/OVA configuration.\r\n\r\nThis typically occurs when the vSphere version or build does not yet list Red Hat Enterprise Linux 9 (RHEL 9) as a selectable/recognized guest OS, even though the underlying hypervisor is technically capable of running it.","u":"ESXi-on-AMD-Processors-and-VMware-Warning-The-guest-operating-system-rhel9-64Guest-is-not-supported","d":"2026-07-23","c":"2026-04-09","v":7,"ver":1,"id":"ka0R7000000PHorIAG"},{"k":"kb","n":"000014356","t":"REM appliance restarting intermittently due to “Too many open files” error (file descriptor exhaustion)","b":"","u":"REM-appliance-restarting-intermittently-due-to-Too-many-open-files-error-file-descriptor-exhaustion","d":"2026-07-23","c":"2026-04-10","v":7,"ver":1,"id":"ka0R7000000PI9pIAG"},{"k":"kb","n":"000014357","t":"GUI gap In eyeSight 8.5.4 & 9.1.x","b":"","u":"GUI-gap-In-eyeSight-8-5-4-9-1-x","d":"2026-07-23","c":"2026-04-10","v":7,"ver":1,"id":"ka0R7000000PIJVIA4"},{"k":"kb","n":"000014359","t":"Applicability of CVE‑2026‑21925, CVE‑2026‑21932, CVE‑2026‑21933, and CVE‑2026‑21945 to CounterACT 9.1.4","b":"","u":"Regarding-CVE-2026-21925-CVE-2026-21932-CVE-2026-21933-CVE-2026-21945","d":"2026-04-14","c":"2026-04-13","v":7,"ver":1,"id":"ka0R7000000PJp3IAG"},{"k":"kb","n":"000014360","t":"How to replace the CMOS Battery in the CounterACT appliance","b":"","u":"how-to-replace-the-CMOS-Battery-in-the-appliance","d":"2026-04-27","c":"2026-04-14","v":7,"ver":1,"id":"ka0R7000000PM3lIAG"},{"k":"kb","n":"000014365","t":"Certification Compliance Mode – Feature Restrictions, Available Options, and Recommendations","b":"This KB explains what Certification Compliance Mode is, how it restricts certain features (like Bash access and legacy protocols), and what remains available. It outlines best practices for operating securely within these constraints and clarifies configuration requirements for features like web portals. It also helps organizations decide between staying compliant or redeploying in commercial mode.","u":"Certification-Compliance-Mode-Feature-Restrictions-Available-Options-and-Recommendations","d":"2026-08-08","c":"2026-04-16","v":7,"ver":1,"id":"ka0R7000000PPuTIAW"},{"k":"kb","n":"000014366","t":"vFW Intermittent Web Access Block","b":"Endpoints were intermittently able to access an internal website despite a Virtual Firewall (vFW) block policy. Investigation indicated that TCP Reset (RST) packets were reaching the server, but users could still load the page after refreshing.","u":"vFW-Intermittent-Web-Access-Block","d":"2026-04-27","c":"2026-04-16","v":7,"ver":1,"id":"ka0R7000000PQ0vIAG"},{"k":"kb","n":"000014367","t":"Windows 10 and Windows 11 Native SSH Command","b":"Windows 10 Build 1809 and Windows 11 have OpenSSH installed and this can be used on Windows endpoints where 3rd-party tools are not available.","u":"Windows-10-and-Windows-11-Native-SSH-Command","d":"2026-07-23","c":"2026-04-16","v":7,"ver":1,"id":"ka0R7000000PQKHIA4"},{"k":"kb","n":"000014368","t":"Enterprise Manager / Appliance show “NTP Servers” alert although NTP configuration and Test are OK","b":"Enterprise Manager (EM) and Appliances may display a persistent “NTP Servers” alert even though NTP servers are configured and the GUI Test reports “OK.” This occurs when the configured NTP server is not a valid time source (commonly advertising Stratum 16) or the NTP service has not fully synchronized. Updating the NTP server to a synchronized source (Stratum < 16) and NTP server is unsynchronized or advertising Stratum 16 (invalid time source).","u":"Enterprise-Manager-Appliance-show-NTP-Servers-alert-although-NTP-configuration-and-Test-are-OK","d":"2026-07-23","c":"2026-04-16","v":7,"ver":1,"id":"ka0R7000000PR9tIAG"},{"k":"kb","n":"000014369","t":"wolfSSL vulnerability CVE-2026-5194","b":"A flaw was found in wolfSSL. Missing hash/digest size and Object Identifier (OID) checks allow the acceptance of smaller, less secure digests during the verification of Elliptic Curve Digital Signature Algorithm (ECDSA) certificates. This could enable a remote attacker, with knowledge of the public Certificate Authority (CA) key, to weaken the security of ECDSA certificate-based authentication. The vulnerability affects ECDSA/ECC verification when EdDSA or ML-DSA are also enabled.\r\n\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-5194\r\nhttps://access.redhat.com/security/cve/cve-2026-5194","u":"wolfSSL-vulnerability-CVE-2026-5194","d":"2026-07-23","c":"2026-04-17","v":7,"ver":1,"id":"ka0R7000000PSM5IAO"},{"k":"kb","n":"000014370","t":"Applicability of OpenSSL April 2026 CVEs to Forescout eyeSight 9.1.5","b":"","u":"Applicability-of-OpenSSL-April-2026-CVEs-to-Forescout-eyeSight-9-1-5","d":"2026-07-23","c":"2026-04-17","v":7,"ver":1,"id":"ka0R7000000PSU9IAO"},{"k":"kb","n":"000014372","t":"How to check if Palo Alto communication is up and working.","b":"The KB provides the list of commands run by the Switch module to retrieve Layer 3 (ARP) information from a Palo Alto NGFW:","u":"How-to-check-Palo-Alto-communication-is-up-and-working","d":"2026-04-20","c":"2026-04-20","v":7,"ver":1,"id":"ka0R7000000PVgXIAW"},{"k":"kb","n":"000014373","t":"Forescout Appliance Boots into Emergency Mode After Upgrade – Duplicate Swap and Missing Docker Volume","b":"After a failed or interrupted upgrade, the Forescout appliance fails to boot normally and enters Linux emergency mode. As a result:\r\n\r\nEnterprise Manager (EM) service does not start\r\nfstool service start fails\r\nSystem repeatedly prompts for root maintenance password\r\n\r\nOne or more of the following messages appear during boot:\r\n\r\nDuplicate entry in /etc/fstab\r\nFailed to create unit file fslog-SWAP.swap\r\nTimed out waiting for device /dev/mapper/forescout-docker\r\nDependency failed for /var/lib/docker\r\nYou are in emergency mode\r\nAdditional messages such as:\r\npiix4_smbus: SMBus Host Controller not enabled","u":"Forescout-Appliance-Boots-into-Emergency-Mode-After-Upgrade-Duplicate-Swap-and-Missing-Docker-Volume","d":"2026-04-22","c":"2026-04-20","v":7,"ver":1,"id":"ka0R7000000PXSDIA4"},{"k":"kb","n":"000014376","t":"Protocol Differences between Eyeinspect 4.3.1 and 5.5.1","b":"","u":"Protocol-Differences-between-Eyeinspect-4-3-1-and-5-5-1","d":"2026-08-18","c":"2026-04-22","v":7,"ver":1,"id":"ka0R7000000PbcHIAS"},{"k":"kb","n":"000014377","t":"ctDeviceEngineStatus returns value 4 when querying the EM","b":"","u":"ctDeviceEngineStatus-returns-value-4-when-querying-the-EM","d":"2026-07-23","c":"2026-04-22","v":7,"ver":1,"id":"ka0R7000000Pbh7IAC"},{"k":"kb","n":"000014378","t":"Failed to import certificate.","b":"","u":"Failed-to-import-certificate","d":"2026-04-27","c":"2026-04-23","v":7,"ver":1,"id":"ka0R7000000PdkXIAS"},{"k":"kb","n":"000014383","t":"Unable to view all the list of scheduled report in excel sheet","b":"","u":"Unable-to-view-all-the-list-of-scheduled-report-in-excel-sheet","d":"2026-04-28","c":"2026-04-24","v":7,"ver":1,"id":"ka0R7000000PgldIAC"},{"k":"kb","n":"000014385","t":"Invalid Request Authenticator for Accounting-Request","b":"","u":"Invalid-Request-Authenticator-for-Accounting-Request","d":"2026-07-23","c":"2026-04-27","v":7,"ver":1,"id":"ka0R7000000PhszIAC"},{"k":"kb","n":"000014387","t":"Illegal additional site entry xx.xx.xx.xx","b":"","u":"Illegal-additional-site-entry-xx-xx-xx-xx","d":"2026-07-23","c":"2026-04-27","v":7,"ver":1,"id":"ka0R7000000Pi13IAC"},{"k":"kb","n":"000014388","t":"Microsoft Intune Integration Test Fails – “Failed to obtain authentication token”","b":"When testing the Microsoft Intune integration in the Forescout console (Tools → Options → Microsoft → Test), the test fails with the error:\r\n“Failed to obtain authentication token.”\r\nThe Azure AD (Entra ID) application was configured with the Client Secret ID instead of the Client Secret VALUE in the Forescout Microsoft Intune configuration.\r\nIn Azure AD App Registrations:\r\n\r\nSecret ID is only an internal identifier\r\nSecret VALUE is the actual credential required for OAuth authentication\r\n\r\nWhen the Secret ID is used instead of the Secret VALUE, Azure AD rejects the authentication request, causing token acquisition to fail.","u":"Microsoft-Intune-Integration-Test-Fails-Failed-to-obtain-authentication-token","d":"2026-07-23","c":"2026-04-27","v":7,"ver":1,"id":"ka0R7000000PkAvIAK"},{"k":"kb","n":"000014391","t":"Appliance unable to join the domain with error \"Failed to join domain: Failed to set machine spn: Constraint violation\"","b":"The appliance fails to join the domain with error \"Failed to join domain: Failed to set machine spn: Constraint violation\". \r\nAD LDAP ERROR: 19 (Constraint violation): 000021C7: AtrErr: DSID-03200E90, #1:0 000021C7: DSID-03200E90, problem 1005 (CONTRAINT_ATT_TYPE) data 0, Att 90303 (servicePrincipalName)\r\n\r\nThere are 2 reasons for this error,\r\n\r\n1) The hostname/Service Principal Name (SPN) that the appliance is trying to register already exists on another computer object in AD. AD enforces SPN uniqueness — no two objects can have the same SPN.\r\n2) The appliance hostname is exceeding the allowed limit of 15 charachters in it.","u":"Appliance-unable-to-join-the-domain-with-error-Failed-to-join-domain-Failed-to-set-machine-spn-Constraint-violation","d":"2026-07-03","c":"2026-04-30","v":7,"ver":1,"id":"ka0R7000000PpH3IAK"},{"k":"kb","n":"000014392","t":"Incorrect classification troubleshooting requirements","b":"This KB goes over the process of collecting the correct logs for classification troubleshooting when opening a case with Forescout support. \r\nThis information will help the assigned TSE to your case review and troubleshoot why classification isn't as you intend.","u":"Incorrect-classification-troubleshooting-requirements","d":"2026-07-23","c":"2026-04-30","v":7,"ver":1,"id":"ka0R7000000PpddIAC"},{"k":"kb","n":"000014394","t":"Upgrade Verifier plugin 1.0.7 does not show the option to run the compatibility test for version 8.5.5.","b":"When a customer is trying to upgrade to CounterAct version 8.5.5, the upgrade verifier plugin 1.0.7 does not show the option to run the compatibility test for version 8.5.5.","u":"Upgrade-Verifier-plugin-1-0-7-does-not-show-the-option-to-run-the-compatibility-test-for-version-8-5-5","d":"2026-07-03","c":"2026-05-03","v":7,"ver":1,"id":"ka0R7000000PuobIAC"},{"k":"kb","n":"000014396","t":"How to disable Secure Boot from BIOS settings","b":"After a fresh install, the Packet Engine (PE) plugin may not start on virtual or physical machines if Secure Boot is enabled during the eyeSight setup. To avoid this, choose UEFI and disable Secure Boot when installing the new ISO image.","u":"How-to-disable-Secure-Boot-from-BIOS-settings","d":"2026-07-03","c":"2026-05-04","v":7,"ver":1,"id":"ka0R7000000Pv1VIAS"},{"k":"kb","n":"000014398","t":"Product Security Statement Regarding Locally Exploitable Vulnerabilities [eyesight","b":"Locally Exploitable Vulnerabilities\r\nLocally exploitable vulnerabilities are considered not applicable because the CounterAct appliance has only one local user (cliadmin) with root privileges. A locally exploitable vulnerability requires the attacker to have either physical access to the vulnerable system or a local (shell) account.","u":"local-vulns-prodsec-statement-2026","d":"2026-05-04","c":"2026-05-04","v":7,"ver":1,"id":"ka0R7000000PwQbIAK"},{"k":"kb","n":"000014399","t":"DES and MD5 no longer supported on RHEL9","b":"Forescout version 9.x.x is based on Red Hat Enterprise Linux 9 (RHEL 9). As a result, cryptographic algorithm support and behaviour within Forescout is directly influenced by the RHEL 9 system-wide cryptographic policies and libraries that underpin the platform.","u":"DES-and-MD5-no-longer-supported-on-RHEL9","d":"2026-07-23","c":"2026-05-05","v":7,"ver":1,"id":"ka0R7000000PxBNIA0"},{"k":"kb","n":"000014409","t":"Is CVE-2026-21962 affecting Forescout platform","b":"","u":"Is-CVE-2026-21962-affecting-Forescout-platform","d":"2026-05-07","c":"2026-05-07","v":7,"ver":1,"id":"ka0R7000000Q21NIAS"},{"k":"kb","n":"000014414","t":"CVE-2026-1519","b":"Is Forescout vulnerable to CVE-2026-1519","u":"CVE-2026-1519","d":"2026-08-07","c":"2026-05-12","v":7,"ver":1,"id":"ka0R7000000QGAnIAO"},{"k":"kb","n":"000014415","t":"Axios Usage Confirmation for eyeInspect (v5.2.2 / v5.5 / v5.9)","b":"[eyeInspect] Axios Usage Confirmation for eyeInspect (v5.2.2 / v5.5 / v5.9)","u":"Axios-Usage-Confirmation-for-eyeInspect-v5-2-2-v5-5-v5-9","d":"2026-08-18","c":"2026-05-12","v":7,"ver":1,"id":"ka0R7000000QGE1IAO"},{"k":"kb","n":"000014417","t":"HA (High Availability ) Command Reference Guide","b":"This article provides a consolidated reference for Forescout CounterACT High Availability (HA) environments, including HA status and diagnostic commands, failover procedures, SSH aliases, and miniroot maintenance utilities. It also includes operational cautions and best practices for maintaining HA cluster integrity.","u":"HA-High-Command-Reference-Guide","d":"2026-07-23","c":"2026-05-13","v":7,"ver":1,"id":"ka0R7000000QHObIAO"},{"k":"kb","n":"000014420","t":"Appliance fails to boot with \"file not found\" and \"you need to load the kernel first\" errors.","b":"","u":"Appliance-fails-to-boot-with-file-not-found-and-you-need-to-load-the-kernel-first-errors","d":"2026-05-14","c":"2026-05-14","v":7,"ver":1,"id":"ka0R7000000RFRBIA4"},{"k":"kb","n":"000014423","t":"Enterprise Manager/Appliance “Failed to start TCPServer”","b":"The Enterprise Manager/Appliance failed to start its TCP listener on port 13000 due to a corrupted node keystore.\r\n\r\nSymptoms\r\nConsole cannot connect to EM; SSH to EM works.\r\nfstool service status shows repeated aborts/restarts or countdown to restart and displays “Failed to start TCPServer”.","u":"Enterprise-Manager-Appliance-Failed-to-start-TCPServer","d":"2026-08-06","c":"2026-05-18","v":7,"ver":1,"id":"ka0R7000000QQQHIA4"},{"k":"kb","n":"000014424","t":"How to reset/recover the shell password if we forget the shell password.","b":"How to reset/recover the shell password if we forget the shell password.","u":"How-to-reset-recover-the-shell-password-if-we-forget-the-shell-password","d":"2026-07-29","c":"2026-05-19","v":7,"ver":1,"id":"ka0R7000000QS2HIAW"},{"k":"kb","n":"000014432","t":"Uploads to upload.forescout.com","b":"Recent changes have changed how upload.forescout.com works. The below process is how to proceed with uploading logs larger than 1gb to cases when direct upload is not possible from appliances/EM/REM","u":"Uploads-to-upload-forescout-com","d":"2026-07-23","c":"2026-05-20","v":7,"ver":1,"id":"ka0R7000000QXzdIAG"},{"k":"kb","n":"000014433","t":"Unable to See Compliance/Non-Compliance Status on Endpoint","b":"A compliance policy is configured on the FS. We are able to see the endpoint compliance status on the FS console. However, when clicking on the Compliance Center on the endpoint where the SecureConnector is installed, we are not able to see the policy compliance/non-compliance status.","u":"Unable-to-See-Compliance-Non-Compliance-Status-on-Endpoint","d":"2026-06-25","c":"2026-05-21","v":7,"ver":1,"id":"ka0R7000000QaXhIAK"},{"k":"kb","n":"000014438","t":"How to manually transfer files via sftp and cli","b":"If the customer does not have a graphical File Transfer tool i.e. WinSCP installed, the files can be retrieved using PowerShell on the workstation.","u":"How-to-manually-transfer-files-via-sftp-and-cli","d":"2026-07-23","c":"2026-05-26","v":7,"ver":1,"id":"ka0R7000000Qf7ZIAS"},{"k":"kb","n":"000014439","t":"Eyeinspect not available under Base Product dropdown in Download portal","b":"Eyeinspect not available under Base Product dropdown in Download portal to download the files related to eyeinspect.","u":"Eyeinspect-Product-not-available-in-Download-portal","d":"2026-08-18","c":"2026-05-26","v":7,"ver":1,"id":"ka0R7000000QfXNIA0"},{"k":"kb","n":"000014440","t":"Product Announcement: Forescout Secure Remote Access version 5.5.3","b":"Forescout is proud to introduce Secure Remote Access (FSRA), an agentless secure remote access solution purpose-built for OT and other cyber physical system (CPS) environments. Its primary goal is to enable remote operations and third party access to critical systems in a controlled, monitored, and auditable way—without exposing entire networks or relying on broad VPN connectivity.","u":"Product-Announcement-Forescout-Secure-Remote-Access-version-5-5-3","d":"2026-05-28","c":"2026-05-26","v":7,"ver":1,"id":"ka0R7000000Qg5FIAS"},{"k":"kb","n":"000014442","t":"How to Collect Logs for Classification Issues","b":"This article will list the necessary commands for retrieving logs in order to troubleshoot classification type issues.","u":"How-to-Collect-Logs-for-Classification-Issues","d":"2026-06-03","c":"2026-05-28","v":7,"ver":1,"id":"ka0R7000000Qk8rIAC"},{"k":"kb","n":"000014443","t":"Where Does the Upgrade Verifier Plugin Store Upgrade Reports","b":"This KB explains where the upgrade verifier plugin stores reports when run against CounterACT devices. The report is not stored on the CounterACT device but rather on the endpoint where the Console was launched to run the Upgrade Verifier.","u":"Where-Does-the-Upgrade-Verifier-Plugin-Store-Upgrade-Reports","d":"2026-07-23","c":"2026-05-28","v":7,"ver":1,"id":"ka0R7000000QlHpIAK"},{"k":"kb","n":"000014447","t":"Crowdstrike API Test Result Failed Failed to obtain OAuth2 token","b":"","u":"Crowdstrike-API-Test-Result-Failed-Failed-to-obtain-OAuth2-token","d":"2026-06-09","c":"2026-06-01","v":7,"ver":1,"id":"ka0R7000000Qo4PIAS"},{"k":"kb","n":"000014449","t":"eyeSegment web UI doesn't load after update to 6.05.0","b":"","u":"eyeSegment-web-UI-doesn-t-load-after-update-to-6-05-0","d":"2026-06-09","c":"2026-06-01","v":7,"ver":1,"id":"ka0R7000000QoyrIAC"},{"k":"kb","n":"000014453","t":"Upgrade to 9.1.x failed - could not find LVM partition","b":"","u":"Upgrade-to-9-1-x-failed---could-not-find-LVM-partition","d":"2026-07-03","c":"2026-06-03","v":7,"ver":1,"id":"ka0R7000000QujJIAS"},{"k":"kb","n":"000014455","t":"How to Deploy the Forescout SC Agent on Ubuntu Server, Red Hat Enterprise Linux (RHEL), and CentOS Using AWS Systems Manager (SSM)","b":"The KB provides detailed information about FS SC installation on Ubuntu Server, Red Hat Enterprise Linux (RHEL) and CentOS using AWS Systems Manager (SSM).","u":"How-to-Deploy-the-Forescout-SC-Agent-on-Ubuntu-Server-Red-Hat-Enterprise-Linux-RHEL-and-CentOS-Using-AWS-Systems-Manager-SSM","d":"2026-06-25","c":"2026-06-05","v":7,"ver":1,"id":"ka0R7000000R2nJIAS"},{"k":"kb","n":"000014456","t":"How to deploying the Forescout SC Agent on Windows using AWS Systems Manager (SSM).","b":"The KB provides detailed information about FS SC installation on Windows using AWS Systems Manager (SSM).","u":"How-to-deploying-the-Forescout-SC-Agent-on-Windows-using-AWS-Systems-Manager-SSM","d":"2026-06-25","c":"2026-06-05","v":7,"ver":1,"id":"ka0R7000000R2s9IAC"},{"k":"kb","n":"000014465","t":"Populate AD email property with the Intune email","b":"With the growing popularity of Intune integration, fewer companies are populating the AD user Email . This issue with this is, with no AD user email Forescout cannot use the Send user Email action.\r\n\r\nThis procedure will copy the Intune email to the User AD email property.","u":"Populate-AD-email","d":"2026-07-23","c":"2026-06-11","v":7,"ver":1,"id":"ka0R7000000RGYXIA4"},{"k":"kb","n":"000014468","t":"Disabling Disk Encryption Getting Error: The operation was aborted","b":"","u":"Disabling-Disk-Encryption-Getting-Error-The-operation-was-aborted","d":"2026-07-01","c":"2026-06-12","v":7,"ver":1,"id":"ka0R7000000RIFNIA4"},{"k":"kb","n":"000014470","t":"How to find OID (Object Identifiers) used in Wireless plugin","b":"In some situations, it is required to know what possible MIBs/OIDs are being utilized by the Wireless Plugin to communication with current Wireless controllers.\r\n\r\nThis is useful when:\r\n\r\nTroubleshooting device classification issues\r\nValidating SNMP responses\r\nComparing expected vs actual device behavior\r\nDebugging plugin-related inconsistencies","u":"How-to-find-OIDs-used-in-Wireless-plugin","d":"2026-07-23","c":"2026-06-15","v":7,"ver":1,"id":"ka0R7000000RKnRIAW"},{"k":"kb","n":"000014471","t":"How to Localize Web Pages and Messages in eyeSight","b":"This article explains how to edit and localize text strings used in Forescout CounterACT (eyeSight), including:\r\n\r\n- Endpoint notification messages\r\n- HTTP redirect portal text\r\n- Error messages\r\n- Email messages and labels\r\n\r\nThis allows administrators to customize messaging to align with:\r\n\r\n- Organizational policies\r\n- Branding requirements\r\n- User-friendly communication\r\n\r\nForescout allows customization of text displayed during:\r\n\r\n- Web redirect pages (e.g., Guest Portal, Compliance Portal)\r\n- Endpoint interactions (remediation, blocking, login prompts)\r\n- Email notifications\r\n\r\nThese text strings are managed centrally through the Language Localization settings.\r\nYou can also apply basic HTML formatting (e.g., bold, line breaks) when customizing messages","u":"How-to-Localize-Web-Pages-and-Messages-in-eyeSight","d":"2026-07-23","c":"2026-06-16","v":7,"ver":1,"id":"ka0R7000000RMHNIA4"},{"k":"kb","n":"000014474","t":"Manually downgrade a forescout plugin","b":"How to manually downgrade a plugin from the CLI when the option is not available via the GUI","u":"Manually-downgrade-a-forescout-plugin","d":"2026-07-23","c":"2026-06-16","v":7,"ver":1,"id":"ka0R7000000RMyvIAG"},{"k":"kb","n":"000014480","t":"Dashboard and Asset Portal Internal Server Error After Upgrading to Dashboards 1.4.8","b":"","u":"Dashboard-and-Asset-Portal-Internal-Server-Error-After-Upgrading-to-Dashboards-1-4-8","d":"2026-06-17","c":"2026-06-17","v":7,"ver":1,"id":"ka0R7000000RTIrIAO"},{"k":"kb","n":"000014482","t":"Juniper MIST integration only shows the endpoint's Mac address but not the IP address","b":"The customer has successfully integrated the Juniper MIST within the NC plugin.\r\nThe correct API key has been input, and the connection test is successful.\r\nBut the FS GUI only shows the endpoint's MAC address and its connected switch's IP and Port. Their IP addresses are not displayed in the FS GUI.","u":"Juniper-MIST-integration-only-shows-the-endpoint-s-Mac-address-but-not-the-IP-address","d":"2026-07-23","c":"2026-06-22","v":7,"ver":1,"id":"ka0R7000000RXKrIAO"},{"k":"kb","n":"000014485","t":"How to Filter traffic from Flow Collector (NetFlow)","b":"Sometimes NetFlow can generate ghost devices due to other scanners, WAN Accelerators or even FWs on the network, this can generate false positives and licenses consumption.\r\n\r\nTo avoid this, we can use the Traffic Heuristics module. With this module, you can set filters and exclude any traffic that doesn’t add any value to the environment.","u":"How-to-Filter-traffic-from-Flow-Collector-NetFlow","d":"2026-07-23","c":"2026-06-22","v":7,"ver":1,"id":"ka0R7000000RYK9IAO"},{"k":"kb","n":"000014488","t":"SecureConnector download and SC compliance web pages are not accessible from the endpoints, while other web pages and reports are accessible from the same endpoint.","b":"","u":"SecureConnector-download-and-SC-compliance-web-pages-are-not-accessible-from-the-endpoints-while-other-web-pages-and-reports-are-accessible-from-the-same-endpoint","d":"2026-07-03","c":"2026-06-23","v":7,"ver":1,"id":"ka0R7000000RZXxIAO"},{"k":"kb","n":"000014490","t":"License Activate button is not functioning on the GUI Console","b":"At the time of license activation, when clicking on the License Activate button, the window doesn't pop up to enter the deployment ID","u":"License-Activate-button-is-not-functioning-on-the-GUI-Console","d":"2026-07-03","c":"2026-06-23","v":7,"ver":1,"id":"ka0R7000000RaozIAC"},{"k":"kb","n":"000014493","t":"ForeScout REM out of Sync Status","b":"","u":"ForeScout-REM-out-of-Sync-Status","d":"2026-07-03","c":"2026-06-24","v":7,"ver":1,"id":"ka0R7000000RbgDIAS"},{"k":"kb","n":"000014494","t":"OSX plugin is crashing constantly","b":"","u":"OSX-plugin-is-crashing-constantly","d":"2026-07-23","c":"2026-06-24","v":7,"ver":1,"id":"ka0R7000000Re1NIAS"},{"k":"kb","n":"000014501","t":"SSH Login Banners: Practical Implementation Guide","b":"Purpose:\r\n\r\nSSH login banners serve an important legal and compliance function by notifying users that access is restricted and activity may be monitored. \r\nWhen implemented correctly, they satisfy regulatory requirements without interfering with system administration or automation solution, such as Forescout.\r\n\r\nThis guide outlines recommended practices for deploying SSH banners in a way that supports both compliance, operational reliability and more seamless integration with Forescout.","u":"SSH-Login-Banners-Practical-Implementation-Guide","d":"2026-07-23","c":"2026-06-26","v":7,"ver":1,"id":"ka0R7000000RgSzIAK"},{"k":"kb","n":"000014502","t":"The host count in sub-rules does not align with the host count observed by the policy.","b":"","u":"The-host-count-in-sub-rules-does-not-align-with-the-host-count-observed-by-the-policy","d":"2026-07-23","c":"2026-06-29","v":7,"ver":1,"id":"ka0R7000000RhvJIAS"},{"k":"kb","n":"000014503","t":"How to change the default “Interval to Download Asset Properties” settings for Qualys VM plugin","b":"In the 9.1.x versions, the “Interval to Download Asset Properties” setting is no longer available in the GUI. This change was made by our Engineering team, and the parameter is now configurable only via the install.properties file.","u":"How-to-change-the-default-Interval-to-Download-Asset-Properties-settings-for-Qualys-VM-plugin","d":"2026-08-22","c":"2026-06-29","v":7,"ver":1,"id":"ka0R7000000RhwvIAC"},{"k":"kb","n":"000014504","t":"The preconfigured ACL is removed from the switch port once the option \"Add ACL access group to physical ports\" is enabled","b":"The customer manually configured the ACL and applied it to the switch port.\r\nThe applied ACL on the switch port is working well.\r\nThe customer added the switch to the switch plugin. After the option \"Add ACL access group to physical ports\" under the tab \"ACL\" is enabled, the preconfigured ACL on the switch port is removed.","u":"The-preconfigured-ACL-is-removed-from-the-switch-port-once-the-option-Add-ACL-access-group-to-physical-ports-is-enabled","d":"2026-07-23","c":"2026-06-29","v":7,"ver":1,"id":"ka0R7000000Ri1lIAC"},{"k":"kb","n":"000014506","t":"How to install and run the Upgrade Verifier Plugin in Forescout eyeSight","b":"The Upgrade Verifier (UV) Plugin helps assess the upgrade readiness of your Forescout eyeSight deployment before performing a version upgrade.\r\n\r\nUnlike the built-in Pre-Upgrade Verifier (PUV), the Upgrade Verifier Plugin:\r\n\r\n- Does not require the upgrade FSP file to be transferred to all Appliances.\r\n- Supports verification against multiple target upgrade versions.\r\n- Identifies upgrade readiness issues before initiating the upgrade process.","u":"How-to-install-and-run-the-Upgrade-Verifier-Plugin-in-Forescout-eyeSight","d":"2026-07-23","c":"2026-06-30","v":7,"ver":1,"id":"ka0R7000000RkA1IAK"},{"k":"kb","n":"000014509","t":"Accessing the Forescout Web Portals shows error \"Application Error. An error has occurred.\"","b":"","u":"Accessing-the-Forescout-Web-Portals-shows-error-Application-Error-An-error-has-occurred","d":"2026-07-23","c":"2026-06-30","v":7,"ver":1,"id":"ka0R7000000RmoXIAS"},{"k":"kb","n":"000014511","t":"OSX SecureConnector agent requesting permissions for \"Screen and Audio Recording\"","b":"","u":"OSX-SecureConnector-agent","d":"2026-07-23","c":"2026-06-30","v":7,"ver":1,"id":"ka0R7000000RmtNIAS"},{"k":"kb","n":"000014512","t":"CounterACT Appliance service is restarting in a loop","b":"","u":"CounterACT-Appliance-service-is-restarting-in-a-loop","d":"2026-07-23","c":"2026-07-01","v":7,"ver":1,"id":"ka0R7000000RnW5IAK"},{"k":"kb","n":"000014516","t":"Captive Portal Tips - guidance for MAC users","b":"Purpose\r\n\r\nThis article helps Mac users connect more reliably to the Guest Wi‑Fi when the Forescout captive portal:\r\n\r\nDoes not appear automatically\r\nShows errors (especially on HTTPS sites)\r\nOnly works after multiple browser refreshes\r\n\r\nThese steps are safe for end users and do not require admin access on the Mac.","u":"Captive-Portal-Tips---guidance-for-MAC-users","d":"2026-08-06","c":"2026-07-02","v":7,"ver":1,"id":"ka0R7000000RpPpIAK"},{"k":"kb","n":"000014518","t":"Trend Micro AV Update Date Displayed Incorrectly in the Forescout Console","b":"","u":"Trend-Micro-AV-Update-Date-Displayed-Incorrectly-in-the-Forescout-Console","d":"2026-07-08","c":"2026-07-02","v":7,"ver":1,"id":"ka0R7000000RpeLIAS"},{"k":"kb","n":"000014519","t":"Multiple URLs in HTTP notification actions are not clickable or act like a Hyperlink","b":"","u":"Multiple-URLs-in-HTTP-notification-actions-are-not-clickable-or-act-like-a-Hyperlink","d":"2026-07-29","c":"2026-07-02","v":7,"ver":1,"id":"ka0R7000000RpjBIAS"},{"k":"kb","n":"000014520","t":"Apache Tomcat -Improper Input Validation vulnerability -Multiple CVEs","b":"Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from -M1 through , from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.","u":"Apache-Tomcat--Multiple-CVE","d":"2026-07-23","c":"2026-07-02","v":7,"ver":1,"id":"ka0R7000000Rq8zIAC"},{"k":"kb","n":"000014522","t":"Customer is unable to change appliance description","b":"","u":"Customer-is-unable-to-change-appliance-description","d":"2026-07-23","c":"2026-07-02","v":7,"ver":1,"id":"ka0R7000000RqybIAC"},{"k":"kb","n":"000014524","t":"Switch vendor list is not sorted by name","b":"","u":"Switch-vendor-list-is-not-sorted-by-name","d":"2026-07-13","c":"2026-07-03","v":7,"ver":1,"id":"ka0R7000000RrWTIA0"},{"k":"kb","n":"000014526","t":"After upgrading to 9.1.6 the Enterprise Manager (or appliance) service is constantly restarting","b":"","u":"After-upgrading-to-9-1-6-the-Enterprise-Manager-or-appliance-service-is-constantly-restarting","d":"2026-07-23","c":"2026-07-07","v":7,"ver":1,"id":"ka0R7000000SYl7IAG"},{"k":"kb","n":"000014528","t":"Arista-C-460 AP and CWA support","b":"","u":"Arista-AP-and-CWA-support","d":"2026-07-07","c":"2026-07-07","v":7,"ver":1,"id":"ka0R7000000RwRJIA0"},{"k":"kb","n":"000014529","t":"Multiple CVEs - Apache HTTP Server -CVE-2026-23918","b":"","u":"Multiple-CVEs---Apache-HTTP-Server","d":"2026-07-08","c":"2026-07-07","v":7,"ver":1,"id":"ka0R7000000SC9VIAW"},{"k":"kb","n":"000014530","t":"Trusted Certificate is Owned by Root","b":"","u":"Trusted-Certificate-is-Owned-by-Root","d":"2026-07-23","c":"2026-07-08","v":7,"ver":1,"id":"ka0R7000000RwpVIAS"},{"k":"kb","n":"000014535","t":"How to reserve CPU and Memory resources for Nutanix VM","b":"Many Nutanix customers need to reserve CPU and Memory resources for their Nutanix VMs.\r\nBy default, the Nutanix VM doesn't have reserved CPU resources.\r\nBecause the Forescout appliance has a database running, which requires dedicated CPU resources.","u":"How-to-reserve-CPU-and-Memory-resources-for-Nutanix-VM","d":"2026-07-24","c":"2026-07-09","v":7,"ver":1,"id":"ka0R7000000SuP3IAK"},{"k":"kb","n":"000014536","t":"Failed to find MAC addresses [CLI connection is invalid [Unsupported KEX algorithm","b":"","u":"Failed-to-find-MAC-addresses-CLI-connection-is-invalid-Unsupported-KEX-algorithm","d":"2026-08-06","c":"2026-07-09","v":7,"ver":1,"id":"ka0R7000000S0RhIAK"},{"k":"kb","n":"000014537","t":"OpenSSH CVE's flagged by Qualys (CVE-2026-35385 + others)","b":"","u":"OpenSSH-CVE-s-flagged-by-Qualys-CVE-2026-35385-others","d":"2026-07-17","c":"2026-07-09","v":7,"ver":1,"id":"ka0R7000000S0Y9IAK"},{"k":"kb","n":"000014538","t":"Minimum Module Versions required when upgrading Forescout eyeSight from 9.1.5 to 9.1.6","b":"Provides a list of Modules versions to upgrade to so that Pre-Upgrade Verification passes.","u":"Minimum-Module-Versions-required-when-upgrading-Forescout-eyeSight-from-9-1-5-to-9-1-6","d":"2026-08-06","c":"2026-07-09","v":7,"ver":1,"id":"ka0R7000000S0hpIAC"},{"k":"kb","n":"000014540","t":"Backup is getting failed with error command failed Exit value is 1.","b":"","u":"Backup-is-getting-failed-with-error-command-failed-Exit-value-is-1","d":"2026-08-06","c":"2026-07-10","v":7,"ver":1,"id":"ka0R7000000S2oTIAS"},{"k":"kb","n":"000014545","t":"How to manually tune the number of switch plugin processes","b":"The switch plugin will create multiple processes to manage the large number of switches.\r\nThe switch plugin in-built calculation may not be accurate when there are stacked switches in the network.\r\nIn a large environment, the customer needs to manually tune the number of switch plugin processes.","u":"How-to-manually-tune-the-number-of-switch-plugin-processes","d":"2026-07-13","c":"2026-07-13","v":7,"ver":1,"id":"ka0R7000000S4WvIAK"},{"k":"kb","n":"000014548","t":"Network stack issues with Windows 11 23H2 and 24H2 versions","b":"","u":"Network-stack-issues-with-Windows-11-23H2-and-24H2-versions","d":"2026-07-13","c":"2026-07-13","v":7,"ver":1,"id":"ka0R7000000S5xdIAC"},{"k":"kb","n":"000014553","t":"Upgrade to Forescout 9.1.x is not available from version 8.5.5-6","b":"When running Upgrade Verifier on 8.5.5-6, the following error pops-up:\r\n\r\n(Example 8.5.5-6 to 9.1.5)\r\nUpgrade to 9.1.5 is not available from version 8.5.5-6","u":"Upgrade-to-Forescout-9-1-x-is-not-available-from-version-8-5-5-6","d":"2026-07-24","c":"2026-07-14","v":7,"ver":1,"id":"ka0R7000000S8STIA0"},{"k":"kb","n":"000014555","t":"Apache Log4j CVE-2026-34480 & CVE-2026-34477","b":"","u":"Apache-Log4j","d":"2026-07-29","c":"2026-07-15","v":7,"ver":1,"id":"ka0R7000000S9unIAC"},{"k":"kb","n":"000014557","t":"Technical Support 1.5.11: fstool tech-support command fails with message \"fileparse(): need a valid pathname at lib/fstool/commands/tech-support.pl line 3027.\"","b":"","u":"Technical-Support-1-5-11-fstool-tech-support-command-fails-with-message-fileparse-need-a-valid-pathname-at-lib-fstool-commands-tech-support-pl-line-3027","d":"2026-07-16","c":"2026-07-15","v":7,"ver":1,"id":"ka0R7000000SBLVIA4"},{"k":"kb","n":"000014558","t":"NCC plugin stalled or crashed in the Tech Support logs","b":"","u":"NCC-plugin-stalled-or-crashed-in-the-Tech-Support-logs","d":"2026-07-24","c":"2026-07-16","v":7,"ver":1,"id":"ka0R7000000SBzpIAG"},{"k":"kb","n":"000014559","t":"Regarding CVE-2025-41245","b":"","u":"Regarding-CVE-2025-41245","d":"2026-07-24","c":"2026-07-16","v":7,"ver":1,"id":"ka0R7000000SCCjIAO"},{"k":"kb","n":"000014560","t":"Regarding CVE-2025-41244","b":"","u":"Regarding-CVE-2025-41244","d":"2026-07-24","c":"2026-07-16","v":7,"ver":1,"id":"ka0R7000000SCELIA4"},{"k":"kb","n":"000014562","t":"How to Add RADIUS dictionaries to Forescout","b":"Forescout's RADIUS implementation includes over 187 pre-packaged RADIUS dictionaries covering most major networking and security vendors. Occasionally, vendors introduce new Vendor Specific Attributes (VSAs), update existing dictionaries, or add support for new functionality that is not yet included in the default Forescout dictionary set.\r\n\r\nThis article describes the process for adding a custom RADIUS dictionary to Forescout so that:\r\n\r\nThe FreeRADIUS service can recognize and interpret the new attributes.\r\nThe Forescout Management Console can display the attributes in the user interface.\r\nThe attributes become available for use in RADIUS-based authentication and authorization policies, including pre-admission enforcement.\r\n\r\nExample Used: dictionary.arista\r\n\r\nPrerequisites:\r\nAdministrative access to the Forescout appliance.\r\nSCP access to transfer files.\r\nAccess to the Management Console host (if updating a locally installed console).\r\nA vendor-provided RADIUS dictionary file.","u":"How-to-Add-RADIUS-dictionaries-to-Forescout","d":"2026-07-24","c":"2026-07-17","v":7,"ver":1,"id":"ka0R7000000SFDpIAO"},{"k":"kb","n":"000014563","t":"MAC Address Bypass (MAB) Whitelisting Process in Forescout","b":"Forescout supports MAC Authentication Bypass (MAB) for devices that do not support 802.1X authentication, such as printers, IP phones, CCTV cameras, badge readers, medical devices, smart TVs, and other IoT devices.\r\n\r\nForescout maintains a MAC Address Repository (MAR) that serves as a centralized database of approved MAC addresses. Devices whose MAC addresses exist in the repository can be permitted access through the MAB workflow.\r\n\r\nForescout provides multiple methods to populate and maintain the MAC Address Repository, ranging from manual entry to automated policy-driven enrollment. Additionally, Forescout can leverage device profiling information to validate endpoint authenticity and help mitigate MAC spoofing attempts.","u":"MAC-Address-Bypass-MAB-Whitelisting-Process-in-Forescout","d":"2026-07-24","c":"2026-07-17","v":7,"ver":1,"id":"ka0R7000000SFH3IAO"},{"k":"kb","n":"000014564","t":"Cisco SNMP v3 configuration failed authorization when trying to read any VLAN other than the default","b":"","u":"Cisco-SNMP-v3-configuration-failed-authorization-when-trying-to-read-any-VLAN-other-than-the-default","d":"2026-08-06","c":"2026-07-20","v":7,"ver":1,"id":"ka0R7000000SJCbIAO"},{"k":"kb","n":"000014566","t":"Upgrade Verifier flagging HA Appliance with HA Status SSH connection - Failed","b":"","u":"Upgrade-Verifier-flagging-HA-Appliance-with-HA-Status-SSH-connection---Failed","d":"2026-08-06","c":"2026-07-21","v":7,"ver":1,"id":"ka0R7000000SKYTIA4"},{"k":"kb","n":"000014574","t":"Web Portals are Not Working after upgrading to eyesight version 9.1.5","b":"","u":"Web-Portals-are-Not-Working-after-upgrading-to-eyesight-version-9-1-5","d":"2026-07-29","c":"2026-07-28","v":7,"ver":1,"id":"ka0R7000000SSz3IAG"},{"k":"kb","n":"000014578","t":"Connect Plugin 2.0.5 — HTTP 403 Forbidden on POST /connect/v1/hosts","b":"","u":"Connect-Plugin-2-0-5-HTTP-403-Forbidden-on-POST-connect-v1-hosts","d":"2026-08-22","c":"2026-07-29","v":7,"ver":1,"id":"ka0R7000000SURNIA4"},{"k":"kb","n":"000014589","t":"How to perform Tenable.SC Integration with Cert Compliance Mode version 8.2","b":"We have verified a workaround to make Tenable module work in Compliance Mode. The issue that prevents it from working is a mismatch in cipher suites used by Tenable.sc and Forescout.","u":"How-to-perform-Tenable-SC-Integration-with-Cert-Compliance-Mode-version-8-2","d":"2026-08-22","c":"2026-07-30","v":7,"ver":1,"id":"ka0R7000000SVqTIAW"},{"k":"kb","n":"000014594","t":"How to change the iDRAC password from CLI.","b":"How to change a forgotten iDRAC password from the CLI.","u":"How-to-change-the-iDRAC-password-from-CLI","d":"2026-07-31","c":"2026-07-30","v":7,"ver":1,"id":"ka0R7000000SWkvIAG"},{"k":"kb","n":"000014599","t":"NCC plugin queue delays and message build-up","b":"","u":"NCC-plugin-queue-delays-and-message-build-up","d":"2026-08-04","c":"2026-08-04","v":7,"ver":1,"id":"ka0R7000000ScqLIAS"},{"k":"kb","n":"000014601","t":"PxGrid Plugin Test Failed - Failed to retrieve any of the nodes reported by ISE for the service: com.cisco.ise.config.anc","b":"","u":"PxGrid-Plugin-Test-Failed---Failed-to-retrieve-any-of-the-nodes-reported-by-ISE-for-the-service-com-cisco-ise-config-anc","d":"2026-08-06","c":"2026-08-05","v":7,"ver":1,"id":"ka0R7000000SbKnIAK"},{"k":"kb","n":"000014603","t":"Failed to use CLI for vlan setting error Login refused","b":"","u":"Failed-to-use-CLI-for-vlan-setting-error-Login-refused","d":"2026-08-06","c":"2026-08-06","v":7,"ver":1,"id":"ka0R7000000SbflIAC"},{"k":"kb","n":"000014604","t":"VLAN is not configured on switch","b":"","u":"VLAN-is-not-configured-on-switch","d":"2026-08-06","c":"2026-08-06","v":7,"ver":1,"id":"ka0R7000000SbkbIAC"},{"k":"kb","n":"000014605","t":"MAC Spoofing Detection Policy Overview","b":"This MAC Spoofing Detection Policy serves as a foundational framework for enhancing network security by detecting and mitigating MAC spoofing scenarios. It leverages Forescout’s native ability to detect device property changes using custom policy.","u":"MAC-Spoofing-Detection-Policy-Overview","d":"2026-08-22","c":"2026-08-08","v":7,"ver":1,"id":"ka0R7000000Sd4rIAC"},{"k":"kb","n":"000014623","t":"After upgrading eyeSight to 9.1.5 or later, RADIUS EAP-TLS authentication fails while FIPS mode is enabled","b":"","u":"After-upgrading-eyeSight-to-9-1-5-or-later-RADIUS-EAP-TLS-authentication-fails-while-FIPS-mode-is-enabled","d":"2026-08-18","c":"2026-08-12","v":7,"ver":1,"id":"ka0R7000000SfmbIAC"},{"k":"kb","n":"000014659","t":"Cloud Classification Gateway (CCG) Service and Device Cloud Migration to Azure","b":"Forescout is modernizing its cloud infrastructure by migrating Cloud Classification Gateway (CCG) services and Device Cloud services to Microsoft Azure. These changes are designed to improve platform consistency, support future innovation, and maintain classification continuity for customers.\r\nTo ensure a seamless transition, customers using Cloud Classification Gateway or Device Cloud services must review firewall and proxy configurations and allow communication to the new Forescout cloud domains before the migration is completed.\r\nForescout expects no service interruption and is actively monitoring the migration to rapidly identify and address any issues.","u":"Cloud-Classification-Gateway-CCG-Service-and-Device-Cloud-Migration-to-Azure","d":"2026-08-18","c":"2026-08-18","v":7,"ver":1,"id":"ka0R7000000Sm4vIAC"},{"k":"kb","n":"000014671","t":"macOS Support ending for Intel-based Apps","b":"macOS prompt/alert \" Support ending for Intel-based Apps\" when accessing the SecureConnector app","u":"macOS-Support-ending-for-Intel-based-Apps","d":"2026-08-22","c":"2026-08-20","v":7,"ver":1,"id":"ka0R7000000SmuXIAS"}]