Forescout XDR Brochure 2023

Forescout XDR

eXtended Detection and Response
Improve SOC efficiency by 450x with better detection
and response of true threats
Security operations center (SOC) teams face a daily barrage of incomplete and inaccurate alerts that lack vital contextual
information, many of them false positives. As a result, analysts miss critical threats and take longer to investigate andrespond to them, increasing the risk of a breach. In fact, the typical SOC receives an estimated 11,000 alerts per day,or 450 alerts per hour1 – most of them low fidelity, low confidence alerts, and false positives.
With Forescout® XDR, that number is reduced to one SOC-actionable detection an hour – or one probable threat thatwarrants human investigation.2

Solution overview
Forescout XDR converts telemetry and logs into high fidelity, SOC-actionable probable threats.
It automates the detection, investigation, hunt for and response to advanced threats across all connectedassets – IT, OT/ICS, IoT and IoMT – from campus to cloud to data center to edge. Forescout XDR combines
essential SOC technologies and functions into a unified, cloud-native platform, viewable and actionablefrom a single console.

CampusRemoteData center/cloud

IT/IoT/OT

Medical devices

Forescout XDR leverages data from across the extended enterprise,including from managed and unmanaged (agentless) devices.

2

Forescout XDR Brochure 2023

Forescout XDR is 450x more efficient than typical SOCs
at converting telemetry and logs into actionable detections.

VS* Detection: A SOC-actionable probable threat that warrants human investigation
Based on aggregate data averaged over a 1-year period (Dec 2021-2022),
across 30 enterprises, representing a range of company sizes and industries.

11,000 alerts per day = 450 alerts per hour.
Source: “The 2020 State of Security Operations,” Forrester Consulting
The actual number of alerts a SOC receives depends on many factors including
the number, type and location of security controls deployed, the tuningof those controls (which is a function of analyst capacity, risk tolerance andlevel of expertise), and the number of employees / devices, and industry.

3Forescout XDR Brochure 2023

Business value
Reduces business risk
Lessens the risk and magnitude of a successful attack
or data breach and eliminating virtually all alert “noise.”This enables SOC teams to more quickly and accurately
detect, investigate and respond to the broadest range ofadvanced threats from across the entire enterprise.
In doing so, Forescout XDR helps enable you to avoid
business disruptions and costs resulting from a successful
attack or breach.

Optimizes security
operations
Automatically enriches and normalizes key data andcorrelates signals to produce a small number of highfidelity, high-confidence detections that truly warrant
analyst investigation. It simplifies and accelerates complex
investigation and threat-hunting processes with more
complete, accurate information and contextual data, allfrom a unified console that integrates with other Forescout
solutions and third-party SIEMs, case management
systems and response solutions.
Forescout XDR provides enhanced visibility across theentire threat lifecycle via preconfigured, customizable
dashboards and reports, with key performance indicators(KPIs) tailored to analysts/IR, engineers, SOC managers,
compliance/risk managers and executives. As a result,
SOC teams can spend more time on higher-value
security activities.

Reduces costs
Lowers SOC spending related to:▶

Licensing and managing multiple SOC point solutions
including data lakes; security analytics; security
orchestration, automation and response (SOAR);
user and entity behavior analytics (UEBA); and threat
intel platforms▶

Log storage▶

Analyst burnout, turnover, recruiting and training▶

Supporting new data sources▶

Creating and tuning rules

Supports compliance
Provides several hot and cold storage options, automatedthreat detection and threat intelligence to supportcompliance with key regulations and standards. This
helps close the potential gap between when a breach or
disruption is noticed and when a response action is taken.

Leverages existing
security investments
Increases the value of your Forescout solutions as well as
your network, endpoint and cloud security sensors; andenforcement points, regardless of vendor. With Forescout
XDR, there’s no need to deploy new, vendor-specificsoftware or hardware.

4Forescout XDR Brochure 2023

Key metrics and trends support better management of SOC performance.

Preconfigured and customizable persona-based dashboards and reports provide KPIs relevant to a variety of roles,
including analysts/IR, engineers, SOC manager, compliance and risk managers, and executives.
5Forescout XDR Brochure 2023

6

Forescout XDR Brochure 2023

Why Forescout
Forescout XDR, together with other Forescout solutions, uniquely delivers vendorand EDR-agnostic data ingestion and 450x better detection, with full-spectrum
response and upfront risk reduction, all with predictable and accessible pricing.

Vendor- and EDR-agnostic
data ingestion▶ Supports the products and vendors you’ve alreadyinvested in

Upfront risk reduction▶ Can ingest data from any managed and unmanaged
device (IT, OT/ICS, IoT, IoMT)▶ Integration with other Forescout solutions reduces
the attack surface, and the risk of a compromised or
non-compliant device connecting to your network in
the first place▶ Ensures more comprehensive, powerful, flexible,
and effective threat detection▶ Continuously monitors all connected assets withdynamic access policies

450x better detection

Simple, predictable
and accessible pricing▶ Advanced data pipeline enforces a commoninformation model (CIM) to normalize ingested
data and auto enrich with user info, IP attribution,
geolocation, critical asset information▶ No penalties for sending more logs to Forescout
XDR, to support better detection▶ 2-stage threat detection engine uses a blend of 5techniques to reduce noise & improve fidelity▶ Pricing includes several hot and cold storage options
to meet your business needs▶ License fee is based on the total number of
endpoints (IP/MAC address) in your organization

Full-spectrum response▶ Powerful investigation tools▶ Native integrations with case management solutions▶ Automate responses via Forescout solutions totouch all managed & un-managed devices

7Forescout XDR Brochure 2023

Key features
Forescout XDR combines essential SOC technologies and functions into a single,
unified, cloud-native console.

Data ingestion
Natively supports Forescout eyeSight, eyeInspect andMedical Device Security data – and more than 170 vendorand EDR-agnostic sources including:▶ Security: Firewall, network IDS/IPS, EDR, endpoint
protection platform (EPP), server/workload/container security, web proxy and email security▶ Infrastructure: Windows security, ADauthentication, IAM, DHCP, DNS, cloud audit
trail and network metadata▶ Enrichment: Identity (LDAP), asset inventory
and classification, configuration management,
vulnerability scan results, and threat intelligence(indicators of compromise, or IOCs)▶ Applications: Database, ERP, CRM and APIs
▶ Cloud/SaaS: AWS, Microsoft Azure, Google Cloud,Microsoft 365, Google Workspace and any other
SaaS application

Data onboarding
Helps ensure that you extract maximum detection value
to support your most important use cases. Forescout dataengineers work alongside your team to plan and prioritize
the data sources to be onboarded, then help configure
the data pipeline and ensure your data is being properly
parsed, cleansed, normalized and enriched.

Advanced data pipeline
Applies a rigorous data science-centric approach to how it
manages data flowing from enterprise-wide sources into
its advanced threat detection engine. First, Forescout XDR
enforces a common information model (CIM) to normalize
ingested data. Next, it automatically enriches that datawith IP address, geolocation, ADObject properties,
configuration and other contextual data for security
context. This maximizes security detection value andfacilitates faster correlations and threat hunting acrossmultiple data sources. Finally, it uses an ETL (extracttransform-load) process that allows for faster, stabler,
more efficient data analysis than more common ELT(extract-load-transform) processes.

MITRE ATT&CK®
framework integration
The MITRE ATT&CK framework tracks cyber adversary
tactics and techniques across the entire attack lifecycle.
Forescout’s XDR integrates into this framework, to allow
you to instantly see how different data sources that should
be ingested for broad or specific TTP coverage, to identify
potential blind spots that adversaries can exploit and todetermine which additional data sources would furtherelevate your coverage.

8Forescout XDR Brochure 2023

MITRE ATT&CK framework integration identifies potential blind spots andopportunities to improve threat detection through the addition of other data sources.

9Forescout XDR Brochure 2023

Advanced Threat Detection
Sample list of threats that can bedetected with Forescout XDR▶

Application abuse▶

Brute-force attacks▶

Buffer overflow attacks▶

Cloud resources scanning▶

Cloud service misconfigurations▶

Cloud: Unauthorized access▶

Cloud: Unsecure storage detection▶

Command & Control connection▶

Compliance violations▶

Cross site scripting▶

Cryptojacking▶

Data exfiltration▶

File access failures▶

Illegal resource access▶

Insider threats▶

Lateral movement▶

Malware/outbreaks▶

Network scanning▶

Password cracking▶

Phishing attacks▶

Port and vulnerability scans▶

Ransomware▶

SQL injection▶

Suspicious behavior▶

Unauthorized access to systems▶

Unauthorized changes to firewall rules▶

Unauthorized service restarts▶

Unauthorized service/process creation▶

Vulnerability exploitation▶

Web application misconfiguration▶

Web-application attacks (All Layer-7
web attacks)▶

Worm / virus outbreak

Threat detection engine

Cloud-based data lake
Massively scalable, purpose-built, indexed data lakewith tiered data storage (hot, warm, cold) and rapid,
full-text search. This provides cost-effective short-termand optional longer-term (7 days to 1 year+) log retention
and management of either raw telemetry or enriched
data, in support of security and compliance requirements.

Detection rules
Includes more than 1,500 verified, out-of-the box detection
rules and models for your data sources. These rules havebeen tested on production data to ensure they operate
effectively and deliver value on Day One. Custom detection
rules give you the power and flexibility to quickly create
indicator, detection and health rules that address yourunique requirements, with a guided user experience.

Two-stage threat detection engine applies five detection
techniques to automatically generate high-fidelity, highconfidence true threats that warrant investigation, while
weeding out false positives (“noise”):▶

Signatures: Match object attributes to a known▶

UEBA: Looks for abnormal behaviors that match a▶

Statistics and outliers: Uses clustering, grouping,bad object to identify threats inside raw telemetry,uncleanable malware or ransomware, for example.
digital pattern, footprint, human activity or network
behavior with known bad behavior. Ex: a sales rep
downloading thousands of records from your CRM,
unusual activity outside of normal office hours,
beaconing, improbable distance traveled.
stack counting, baseline and variation, outlierdetection, logistic regression and other methods
to detect anomalous activity. Ex: log sources going
down, denial of service attacks.

▶

Algorithms: Uses context-aware AI and ML▶

Threat intellligence: More than 70 sources oftechniques such as supervised/unsupervised
learning or deep learning to detect maliciousor anomalous activity or to predict attacks.
Ex: identifying process paths or domain
generation algorithms (DGAs).
cyber intelligence leveraged to look for things likebackdoors and command-and-control traffic, orpeople reaching out to malicious phishing sites.

10Forescout XDR Brochure 2023

Threat intelligence
IOCs from over 70 high-quality sources worldwide,
including from Vedere Labs, Forescout’s team of global
research experts. These IOCs are classified, corroborated
and scored to provide finished intelligence that isautomatically leveraged across the threat detection,
hunting and investigation process. You have access todetailed threat reports from Forescout researchersthat profile key threat actors and threats. Anonymized
IOC data can also be shared among opt-in community
members, including industry-specific ISACs, via a built-in
community threat exchange.

1.

Forescout leverages IOC data from abroad range of reliable sources

2.

IOC intel is correlated into a searchable
graph model database of “known bad”
domains, URLs and IPv4 & IPv6 addresses

3.

Each IOC is dynamically assigned aconfidence score based on an assessmentof the quality of the source

4.

This confidence-scored IOC intel is then leveragedby the threat detection engine, and by customer
SOC teams, to accelerate and improve thethreat detection and investigation process11Forescout XDR Brochure 2023

UEBABehavior-based analytics are used to detect significant
changes to behavior or anomalous activity for an entity.
Standard profiles and behaviors are built for users andhosts across time, and any activity that is anomalous tothese standard baselines is triggered as suspicious.

Dashboards and reports
Preconfigured and customizable persona-based
dashboards provide KPIs relevant to a variety ofroles, including analysts/IR, engineers, SOC manager,compliance and risk managers, and executives. Proactive
dissemination and sharing of reports and/or metricdelivers insight into the hands of those responsible
for manageing SOC operations as well as exectutive
team members.

SOAR
Orchestrates the SOC process from detection throughinvestigation and response with built-in case management
and notifications. Forescout XDR automates security
through enrichment sources such as IP geolocation,user and asset information, and correlation to multiple
intelligence sources. It leverages Forescout eyeSight andeyeControl for automated orchestration and response
workflows that can touch every managed and unmanaged(un-agentable) device across your enterprise. You canalso continue to leverage your existing SOAR throughintegration with Palo Alto Cortex XSOAR and other SOARs.

SIEM integration
True threats identified by Forescout XDR can be fed
to an existing SIEM for centralized orchestration andincident response.

Continuous softwareand content updates
New features, functionality and fixes, along with newdetection rules and models, are seamlessly delivered
every few weeks, without requiring any operational
support or causing disruption.

Multi-tenant architecture
Logical separations (or tenants) easily created based oncountry, office location or business unit, for example. You
can also generate aggregate views and perform queries
and analyses across tenants and business units, right up
to the global level. This is particularly beneficial for large
enterprises, multinationals, MSSPs and organizations
with regional SOCs.

Unified global
architecture
Data residency and compliance requirements readilymet, with cost-effective support for regional security
operations. Specify where you want your logs to be
stored among 25 regions across the Americas, Europeand Asia-Pacific – while still being able to view and query
your data globally.

Cloud-native
Nothing to deploy, with new features, fixes and rules
delivered seamlessly, bi-weekly.
12Forescout XDR Brochure 2023

Case management provides comprehensive details and facilitates
more rapid and effective investigations and response.

Provides workflows, tight integration, transparency and seamless communication and collaboration during detection handlingand incident management. Based on the NIST Incident Response Life Cycle, Forescout XDR supports integrations with ServiceNow,
RSA Archer, Jira Software, ManageEngine ServiceDesk Plus, Palo Alto Cortex XSOAR, TheHive and ConnectWise.
13

Forescout XDR Brochure 2023

Results
Whether you have millions, tens of millions or hundreds of millions of logs, Forescout XDR can quickly and automatically cut through the noise to generate a very small numberof high-fidelity, high-confidence detections that need analyst (human) intervention.​The graph below plots the data from 31 customers covering the 1-year period beginning Dec. 15, 2021. For example, a $5B/yr hospitality company was able to distill an averageof 30 million logs/hr down to .98 SOC-actionable detections/hr.​Notes:​▶ Companies encompass a range of sizesand industries, including:​• Construction​• Consumer​• Energy / Utilities​• FinTech​• Healthcare​• Insurance​• Manufacturing​• Mining​• Publishing​• Technology​• Transportation / Logistics​​▶ Individual results will vary, andare dependent on several variables,
including use cases, log selections,
total number of logs, and the on-goingtuning of rules.

1 The State of Security Operations, Forrester, 2020
2 Endpoint refers to each of the MAC and IP addresses located on a user device, network infrastructure device, non-user device or cloudinfrastructure components.

14

SEE IT IN ACTION
forescout.com/xdr-demo-request

Forescout Technologies, Inc.

©2023 Forescout Technologies, Inc. All rights reserved. Forescout Technologies, Inc. is a Delaware

Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support +1-708-237-6591

corporation. A list of our trademarks and patents is available at www.forescout.com/company/legal/

Learn more at Forescout.com

or service marks of their respective owners. 2023_01_08

intellectual-property-patents-trademarks. Other brands, products, or service names may be trademarks

15