What Changed
Version 3.1.0 ships both the legacy Log Ingestion API connector and a new CCF push connector in parallel, rather than replacing the former outright.
The CCF connector adds:
- ForescoutHostPropertyMonitor_connectorDefinition.json – kind: Customizable, wiring the UI and poller together
- ForescoutHostPropertyMonitor_DCR.json – a Microsoft.Insights/dataCollectionRules resource declaring three custom streams
- ForescoutHostPropertyMonitor_PollerConfig.json – push poller configuration
- Three table schema files defining the destination custom log tables
New Custom Tables
| Table | Purpose |
|---|---|
| ForescoutHostProperties_CL | Rich host property telemetry: 100+ fields covering AV state, EDR agents (CrowdStrike, CbEDR, Defender), 802.1X auth state, DHCP classification, network connectivity |
| ForescoutPolicyStatus_CL | Per-device Forescout policy evaluation results |
| ForescoutComplianceStatus_CL | Compliance posture per device |
Detection Logic Impact
The Analytic Rule ForeScout-DNSSniffEventMonitor.yaml (version bumped from 2.0.0 to 2.0.2) now queries ForescoutHostProperties_CL directly. The legacy parser alias is no longer the indirection point.
KQL logic unavailable – the rule body was not included in the diff context, only the version bump line was changed.
Security Impact
Environments ingesting from the legacy connector gain no additional visibility automatically – the CCF connector must be separately deployed. Once deployed, the ForescoutHostProperties_CL table exposes endpoint state fields (AV running/version, EDR agent health, 802.1X authentication results, DHCP OS classification) that were previously absent or required parser normalisation. Detection rules that previously referenced parser aliases now query native _CL tables directly, eliminating one layer of query indirection.
The playbook support contact was updated to Microsoft (tier: Microsoft) while Forescout remains listed as provider/author – no functional playbook logic changed.
Affected Files
Solutions/ForescoutHostPropertyMonitor/Analytic Rules/ForeScout-DNSSniffEventMonitor.yaml
Solutions/ForescoutHostPropertyMonitor/Data Connectors/ForescoutHostPropertyMonitor.json
Solutions/ForescoutHostPropertyMonitor/Data Connectors/ForescoutHostPropertyMonitor_ccf/ForescoutHostPropertyMonitor_DCR.json
Solutions/ForescoutHostPropertyMonitor/Data Connectors/ForescoutHostPropertyMonitor_ccf/ForescoutHostPropertyMonitor_PollerConfig.json
Solutions/ForescoutHostPropertyMonitor/Data Connectors/ForescoutHostPropertyMonitor_ccf/ForescoutHostPropertyMonitor_connectorDefinition.json
Solutions/ForescoutHostPropertyMonitor/Data Connectors/ForescoutHostPropertyMonitor_ccf/ForescoutHostPropertyMonitor_table_ForescoutComplianceStatus.json
Solutions/ForescoutHostPropertyMonitor/Data Connectors/ForescoutHostPropertyMonitor_ccf/ForescoutHostPropertyMonitor_table_ForescoutHostProperties.json
Solutions/ForescoutHostPropertyMonitor/Data Connectors/ForescoutHostPropertyMonitor_ccf/ForescoutHostPropertyMonitor_table_ForescoutPolicyStatus.json
Solutions/ForescoutHostPropertyMonitor/Playbooks/Forescout-DNSSniffEventPlaybook.json
(packaging artefacts: 3.1.0.zip, ReleaseNotes.md, Solution_ForescoutHostProp.json, createUiDefinition.json, mainTemplate.json)