What is NOT an admission event?
Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to theForescout Administration Guide,'Host becomes offline' is NOT an admission event. Admission events are triggers that cause policy rechecks, and according to the documentation:
What IS an Admission Event:
According to the official documentation:
'An admission event is a trigger that causes policies to be rechecked. Examples of admission events include:
DHCP Request
IP Address Change
Switch Port Change
Authentication via RADIUS or other authentication servers
Login to an authentication server
New VPN user'
Specific Admission Events Listed:
According to the Policy Main Rule Advanced Options documentation:
Admission events include:
DHCP Request- When an endpoint sends a DHCP request
IP Address Change- When an endpoint's IP address changes
Switch Port Change- When an endpoint moves to a different switch port
Authentication Events- When endpoints authenticate to RADIUS or other servers
VPN Events- When VPN users connect
Why 'Host becomes offline' is NOT an Admission Event:
According to the documentation:
A hostbecoming offlineis NOT listed as an admission event. Instead, policies handle offline hosts differently:
By default, policies are rechecked every 8 hours regardless of online/offline status
Offline detection is aproperty state change, not anadmission event
The system tracks whether a host was 'seen' or is currently 'online,' but this doesn't trigger admission event rechecks
Why Other Options ARE Admission Events:
A . DHCP Request - Explicitly listed admission event
B . IP Address Change - Explicitly listed admission event
D . Login to an authentication server - Explicitly listed admission event
E . New VPN user - Explicitly listed admission event
Referenced Documentation:
Forescout eyeSight policy main rule advanced options
Working with Policy Templates - When Are Policies Run
Event Properties documentation
Currently there are no comments in this discussion, be the first to comment!