Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Announcement: Try the Ask AI chatbot for answers to your technical questions about Juniper products and solutions.

close
header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

ForeScout CounterACT Sample Event Messages

date_range 27-Mar-21

Use these sample event messages to verify a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

ForeScout CounterACT Sample Messages When You Use the Syslog Protocol

Sample 1: The following sample event message shows that an authentication certificate issuer is detected.

content_copy zoom_out_map
LEEF:1.0|ForeScout|CounterACT|8.0.1-99|agent_auth_issuer|cat=Property sev=1
src=10.84.144.14 usrName=testUser srcMAC=00:00:5E:00:53:00 domain=testDomain
identHostName=testHostName Folder_Name=Authentication Property_Name=Authentication
Certificate Issuer devTime=Mar 7 2019 07:50:32.000 EST devTimeFormat=MMM dd yyyy
HH:mm:ss.SSS z Property_Value=\DC=BLAH\DC=testDomain\CN=testDomain2-CA
Table 1: Highlighted Values in the Forescout CounterACT Sample Event

JSA field name

Highlighted values in the event payload

Event ID

agent_auth_issuer

Category

Property

Source IP

10.84.144.14

Username

testUser

Device Time

Mar 7 2019 07:50:32.000 EST

Sample 2: The following sample event message shows when the last credentials succeeded on this host.

content_copy zoom_out_map
LEEF:1.0|ForeScout|CounterACT|8.0.1-99|cached_credentials|cat=Property sev=1
src=192.168.74.25 usrName=qradar1 srcMAC=00:00:5E:00:53:C8 domain=testDomain
identHostName=D-q1labs1 Folder_Name= Property_Name=Last credentials to succeed on this
host devTime=Mar 26 2019 15:56:14.000 PDT devTimeFormat=MMM dd yyyy HH:mm:ss.SSS z
Property_Value=admin1@example.test2001:db8:4D1C:A2FA:3EC9:C66D:8522:B7A4
Table 2: Highlighted Values in the Forescout CounterACT Sample Event

JSA field name

Highlighted values in the event payload

Event ID

cached_credentials

Category

Property

Source IP

192.168.74.25

Username

qradar1

Device Time

Mar 26 2019 15:56:14.000 PDT

footer-navigation