Do we need to install Splunk ES (Enterprise Security) in able ForeScout Adaptive Response Add-on for Splunk to work?

[gsales]

I installed all the technology add-on of Forescout and Forescout App for Splunk. I'm encountering an error found below.
Also, when I've read about Forescout Adaptive Response Add-on for Splunk, it says that this is the module for Splunk Enterprise Security. Sorry to ask but do we really need to install ES?

[fs_splunk_app]

Hi Azeemering and gsales,
It is NOT mandatory to install Splunk Enterprise Security to use ForeScout Adaptive Response add-on. We can still do the response actions without Splunk Enterprise Security.

The error message you see is possibly because communication from CounterACT to Splunk as well as communication from Splunk to CounterACT may not be fully setup or correctly setup. When you have configured all the pieces correctly, you will see that CounterACT will publish the list of actions that can be taken in response to the alerts triggered. This is what you would use to configure the response the alerts. Please refer to the doc here - https://www.forescout.com/products/forescout-app-guide-splunk-2-7-0. This should explain all the necessary steps.

For further assistance, please reach out to support@forescout.com

Hope this helps.

[Azeemering]

Hi,

There are 3 downloads for Forescout on splunkbase:

1 The Forescout Technology Add-on for Splunk is data collector app which maintains credentials for CounterACT appliance
communications and provides field extraction configurations for all CounterACT events.

This is needed to collect and ingest the data properly.

2 The ForeScout Adaptive Response Add-on for Splunk is module for Splunk Enterprise Security Suite (ES) app for executing Modular Alert Actions on CounterACT. It leverages Adaptive Response Framework solution provided by Splunk through Splunk Enterprise Security Suite (ES).
This is the 'hook in' to get the Forescout data to integrate into the Splunk Enterprise Security.

3 The ForeScout App for Splunk is the Visualization app containing dashboards to monitor CounterACT endpoints using event data provided by CounterACT to Splunk. It also contains dashboards to monitor Modular Alert Actions in case of non-ESS environments.

This is the app to visualise and display the data that you ingest with the TA (1).

So if you do not have Enterprise Security running you need to ingest the data with 1 (the TA) and display the data with 3 (the app).

Please read the how to guide: https://www.forescout.com/wp-content/uploads/2018/04/App_for_Splunk_2.7_and_2.81.pdf

[gsales]

Hi Azeemering,

Thank you for the response.
Yes, I've installed all the 3 apps. Will restate my question. Is it required to install Splunk Enterprise Security for the ForeScout Adaptive response Add-on to function correctly or can we just use Splunk Enterprise alone?

[Azeemering]

Yes it is required. There is no point installing the ForeScout Adaptive response Add-on if you do not have Splunk Enterprise Security