New ForeScout App for Splunk delivers bi-directional interoperability.
September 30, 2013
ForeScout Technologies Inc., a provider of network security solutions for Fortune 1000 enterprises and government organizations, has announced a technology partnership with Splunk Inc. In conjunction with the partnership, ForeScout has made available bi-directional integration between ForeScout CounterACT and Splunk Enterprise and a new ForeScout App for Splunk Enterprise. By combining ForeScout’s endpoint visibility, access, and security capabilities with Splunk Enterprise’s machine data analytics capabilities, enterprises gain enhanced threat insight and automated control.
ForeScout CounterACT helps organizations gain complete visibility for all devices, users, systems, and applications attempting to connect to or on an enterprise network—wired or wireless, managed or unmanaged, PC, or mobile. Devices are discovered, classified, profiled, and assessed without requiring agents. CounterACT applies policy-based controls to: allow, limit or block access; manage guests and BYOD users; monitor and enforce endpoint compliance and mitigate violations and exposures. All captured information, as well as event logs, can be sent to Splunk Enterprise for data analysis, reporting and optimized retention. In addition, operators can enable Splunk Enterprise to communicate with CounterACT to directly mitigate security issues.
“IT organizations are challenged with enormous visibility and control gaps given increased network complexity, BYOD proliferation and the velocity of sophisticated threats. Users not only want greater operational intelligence, but they also want the means to efficiently analyze data and effectuate policy,” says Scott Gordon, chief marketing officer at ForeScout. “A combined approach with ForeScout and Splunk gives the best of both worlds to solve a broad range of security issues.”
The ForeScout App for Splunk Enterprise allows customers to use and create a variety of operational dashboards and reports, which take advantage of Splunk Enterprise to analyze, visualize, and store huge volumes of identity, device, application, access and violation data generated by ForeScout CounterACT. Security analysts can combine this information with other big data sources for real-time monitoring and to conduct historical searches to identify advanced threats, fraud, and other security exposures. Furthermore, Splunk can be configured to send triggered event data to ForeScout CounterACT in order to remediate endpoint security issues, isolate breached systems, or trigger other policy-based controls.
“In today’s threat landscape, all data is security relevant and requires a solution that delivers real-time insights. ForeScout CounterACT provides visibility to network and endpoint activity that our customers can use to augment their Splunk analytics in order to monitor for critical security issues and expedite investigations,” says Bill Gaylord, senior vice president of business development at Splunk. “Leveraging the interoperability of Splunk Enterprise and ForeScout not only helps expand the surface area for customers to more rapidly and confidently identify problems, but also automates controls to directly mitigate threats.”
The ForeScout App for Splunk Enterprise is available now on Splunk Apps. ForeScout integration with Splunk is performed via syslog, CEF, and Web API standards. To check out the app, visit ForeScout at .conf2013, Splunk’s fourth annual worldwide users’ conference.