> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery/forescout.md).

# Forescout

Connect Forescout eyeControl, through its Web API on your Enterprise Manager appliance, to pull discovered hosts into Dispel as devices — mapped to a Wicket and refreshed on a recurring sync.

## Overview

The Forescout integration lets Dispel pull the hosts that Forescout has discovered on your network and bring them in as Dispel devices. You connect to your Forescout appliance once, map it to a Dispel facility and Wicket, and Dispel imports the matching devices and keeps them current on a recurring sync.

Forescout is an on-premise **asset-discovery** integration. Specifically, Dispel integrates with **Forescout eyeControl** through its Web API (the **eyeExtend Connect** module), and only ever reads from it. You point Dispel at your **Enterprise Manager** — Forescout's central management appliance, which aggregates the individual Forescout appliances on your network. You deploy and run the Enterprise Manager yourself (as a physical or virtual appliance), so it isn't a Forescout-hosted cloud service — Dispel reaches it at an address inside your own environment, which is why the connection often uses a private URL and the self-signed-certificate option.

Because the Enterprise Manager represents a single environment, Dispel treats it as one **site** that you map to a single Wicket — there is no per-site list to work through.

{% hint style="info" %}
**A note on Forescout names.** "eyeControl" is the Forescout product Dispel connects to; "Enterprise Manager" is the management appliance you point Dispel at. The connection field is labeled **Enterprise Manager URL** to match the wording in the Forescout console.
{% endhint %}

#### What Dispel imports

* Discovered hosts (name, IP address, MAC address, make/model, operating system, device type) as Dispel devices.
* Observed network protocols and ports for each host.
* A link back to the host in Forescout, stored on the device.

{% hint style="info" %}
**Where to find it.** Sign in as an organization administrator and open **Settings → Integrations**. Forescout appears in the **Asset Discovery / Network Visibility** section. Click **Connect** on the Forescout card to begin.
{% endhint %}

## Before you begin

You'll need the following from your Forescout console:

* A **Web API user** — create one under **Tools → Options → Web API → User Settings**. Dispel authenticates with this user's **Username** and **Password**.
* The **Enterprise Manager URL** of your appliance — for example `https://192.168.1.100`.
* If your appliance uses a **self-signed TLS certificate**, be ready to enable the self-signed option during setup.

{% hint style="warning" %}
**Allowlist Dispel's IP.** When you open the connection form, Dispel shows a **Whitelist IP** value. Add this address to your network firewall allowlist so Dispel can reach the on-premise appliance.
{% endhint %}

## Connecting Forescout

1. Go to **Settings → Integrations** and click **Connect** on the Forescout card.
2. Optionally set a **Display Name** to tell this integration apart from others (you can connect more than one appliance).
3. Fill in the connection fields:

| Field                              | Type       | Notes                                                                |
| ---------------------------------- | ---------- | -------------------------------------------------------------------- |
| **Enterprise Manager URL**         | Config     | The URL of your Forescout Enterprise Manager appliance.              |
| **Allow Self-Signed Certificates** | Config     | Toggle on if your appliance uses a self-signed TLS certificate.      |
| **Username**                       | Credential | The Web API user created in the Forescout console.                   |
| **Password**                       | Credential | The Web API user's password. Stored encrypted and never shown again. |

4. Click **Test Connection** to confirm Dispel can authenticate against the appliance. Fix any reported error before saving.
5. Click **Save**. Dispel saves the integration and immediately runs the initial sync.

{% hint style="info" %}
**Your credentials are encrypted.** The password is encrypted at rest and is never displayed again after you save. When editing later, leave credential fields blank to keep the stored values.
{% endhint %}

## Mapping the appliance to a Wicket

Once the initial sync finishes, open the integration to find the **Site Mapping** section. Forescout appears as a single site representing your appliance.

> Map each vendor site to a Dispel facility and wicket. Devices from mapped sites will be synced into Dispel.

1. Pick a **Facility**.
2. Pick a **Wicket**. If the facility has only one Wicket, Dispel selects it for you.
3. Click **Save Mappings & Import**.

Dispel imports the appliance's hosts into the mapped Wicket — you'll see progress move from waiting, to fetching, to syncing, to complete — and then reports how many devices were imported (for example, **"12 devices imported"** or a breakdown of new versus already-imported devices). Imported devices appear in the mapped Wicket alongside any devices you've added manually.

## Keeping your inventory current

* Dispel **re-syncs automatically** on a recurring schedule, so newly discovered hosts and changed details are picked up without any action from you.
* To pull the latest inventory immediately, open the integration and choose **Refresh**.
* To change connection details or rotate credentials, edit the integration and use **Save & Sync**. Leave credential fields blank to keep the current password.

## Connection status

Each integration shows a status so you always know where it stands:

| Status              | Meaning                                                 |
| ------------------- | ------------------------------------------------------- |
| **Not Initialized** | Saved, but the first sync hasn't run yet.               |
| **Initializing**    | Running the first sync.                                 |
| **Ready**           | Connected and synced; the mapping is applied.           |
| **Needs Refresh**   | New vendor data is available; run a refresh to pull it. |
| **Refreshing**      | A sync is in progress.                                  |
| **Pending Changes** | Mapping changes are saved but not yet applied.          |
| **Applying**        | Importing devices for your saved mapping.               |
| **Failed**          | The last operation failed — see the error guidance.     |

A separate **health badge** (Connected, Degraded, Unreachable) reflects whether Dispel can currently reach the Forescout appliance.

## Troubleshooting

If a sync or test connection fails, Dispel classifies the error and suggests a fix:

| Error                     | What it usually means and how to fix it                                                                                                                           |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Authentication Failed** | The Web API username or password was rejected. Confirm the Web API user exists and the password is current.                                                       |
| **Endpoint Unreachable**  | Dispel couldn't reach the appliance. Verify the Enterprise Manager URL and that Dispel's IP is allowlisted in your firewall.                                      |
| **Certificate Error**     | The appliance presented an untrusted TLS certificate. If it uses a self-signed certificate, enable **Allow Self-Signed Certificates** in the connection settings. |
| **Connection Timed Out**  | The appliance took too long to respond — often network latency or a firewall rule between Dispel and your network.                                                |
| **Configuration Error**   | The URL looks wrong or the Web API isn't enabled on the appliance. Re-check the connection settings.                                                              |

## Frequently asked questions

<details>

<summary>Is this eyeControl, eyeSight, or eyeExtend?</summary>

Forescout's platform is made up of modules under the "eye" brand — eyeSight (visibility), eyeControl (policy and control), eyeExtend (third-party integrations), and others. Dispel connects to **eyeControl** through its **eyeExtend Connect** Web API. You configure it by pointing Dispel at your **Enterprise Manager** appliance, which is why the connection field is called **Enterprise Manager URL**.

</details>

<details>

<summary>Can I connect more than one Forescout appliance?</summary>

Yes. Forescout supports multiple integrations, so you can connect several appliances side by side. Give each a distinct **Display Name** to tell them apart.

</details>

<details>

<summary>Why does Forescout show only one site?</summary>

A Forescout appliance represents a single environment, so Dispel models it as one site mapped to one Wicket — rather than a list of sites to map individually.

</details>

<details>

<summary>My appliance uses a self-signed certificate. Will the connection fail?</summary>

Not if you enable **Allow Self-Signed Certificates** in the connection settings. Leave it off when your appliance presents a certificate from a trusted authority.

</details>

<details>

<summary>Does connecting Forescout change anything on my appliance?</summary>

No. Dispel only reads from Forescout's Web API. It never creates, modifies, or deletes data on the Forescout side.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery/forescout.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.