All Apps and Add-ons

Do we need to install Splunk ES (Enterprise Security) in able ForeScout Adaptive Response Add-on for Splunk to work?

New Member

I installed all the technology add-on of Forescout and Forescout App for Splunk. I'm encountering an error found below.
Also, when I've read about Forescout Adaptive Response Add-on for Splunk, it says that this is the module for Splunk Enterprise Security. Sorry to ask but do we really need to install ES?

alt text

0 Karma

New Member

Hi Azeemering and gsales,
It is NOT mandatory to install Splunk Enterprise Security to use ForeScout Adaptive Response add-on. We can still do the response actions without Splunk Enterprise Security.

The error message you see is possibly because communication from CounterACT to Splunk as well as communication from Splunk to CounterACT may not be fully setup or correctly setup. When you have configured all the pieces correctly, you will see that CounterACT will publish the list of actions that can be taken in response to the alerts triggered. This is what you would use to configure the response the alerts. Please refer to the doc here - This should explain all the necessary steps.

For further assistance, please reach out to

Hope this helps.

0 Karma



There are 3 downloads for Forescout on splunkbase:

1 The Forescout Technology Add-on for Splunk is data collector app which maintains credentials for CounterACT appliance
communications and provides field extraction configurations for all CounterACT events.

This is needed to collect and ingest the data properly.

2 The ForeScout Adaptive Response Add-on for Splunk is module for Splunk Enterprise Security Suite (ES) app for executing Modular Alert Actions on CounterACT. It leverages Adaptive Response Framework solution provided by Splunk through Splunk Enterprise Security Suite (ES).
This is the 'hook in' to get the Forescout data to integrate into the Splunk Enterprise Security.

3 The ForeScout App for Splunk is the Visualization app containing dashboards to monitor CounterACT endpoints using event data provided by CounterACT to Splunk. It also contains dashboards to monitor Modular Alert Actions in case of non-ESS environments.

This is the app to visualise and display the data that you ingest with the TA (1).

So if you do not have Enterprise Security running you need to ingest the data with 1 (the TA) and display the data with 3 (the app).

Please read the how to guide:

0 Karma

New Member

Hi Azeemering,

Thank you for the response.
Yes, I've installed all the 3 apps. Will restate my question. Is it required to install Splunk Enterprise Security for the ForeScout Adaptive response Add-on to function correctly or can we just use Splunk Enterprise alone?

0 Karma


Yes it is required. There is no point installing the ForeScout Adaptive response Add-on if you do not have Splunk Enterprise Security

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...