ForeScout Endpoint Cycling Rapidly Between Compliance States
Detects an endpoint flipping between compliant and non-compliant repeatedly in a short period. Stable devices stay in one state. Rapid oscillation suggests something is being disabled and restored — a security agent stopped and restarted, or posture data being manipulated to satisfy the check only when it is being observed. Onboarding: FORESCOUT is ingested via Syslog (CEF) (Bloo extractor 247). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=compliance where sourcename='FORESCOUT' and action='COMPLIANCE_CHECK' | duration 1h | groupby user, policy | select user, policy, count(*) as cnt | having cnt > 6
Sigma
