Forescout · eyeSight / eyeControl · Lesson 4 of 10

Classification: empty means do not enforce

Host is in inventory. Function = —. Someone still built a “block unknown” Virtual FW. That is how the CEO’s new phone dies. This lesson is Forescout classification fields and a safe Unknown policy.

Updated 2026-08-18·16 min read·L2 primary·Quiz at end

After this page you can

Read Function / OS / Vendor / NIC vendor.
Add a custom group only with two independent signals.
Authorize Unknown as watch/notify, not block.
Re-check after DHCP/HTTP is visible.

The ticket

New badge cameras are “Unknown.” Night policy blocked Unknown. Lobby cameras died. Classification was one DHCP miss away from being fine.

Quick interview answer

eyeSight auto-classifies type and ownership after it sees a device (docs). Console fields: Function, OS, Vendor, Network Function. Empty/low-confidence = do not enforce. Use notify + better discovery. Custom groups need two signals (OUI + DHCP class, or banner + port) so a laptop cannot fake a camera with one spoofed MAC OUI.

Empty classification label on a host — Empty is a discovery ticket, not a block ticket.

Lab data · dummy only

Enterprise Manager fs-em 10.10.10.30 · Appliance fs-app1 10.10.10.31 · span/mirror on sw-access-01 · same LAN 10.20.30.0/24 · Priya 10.20.30.80 · printer 10.20.30.60 · OT PLC 10.50.1.10. Not a live customer.

The fields

Field	Example
Function	Laptop / Printer / PLC / Camera
OS	Windows 11 / unknown
Vendor	Dell / HP / Siemens
NIC vendor (OUI)	Hint only — spoofable

https://fs-em.techclick-lab.in

Training mock · not live

Forescout Console

Asset InventoryPolicyChannelsTools

Asset Inventory → 10.20.30.80

Host priya-hr

Function

Laptop

Windows 11

Vendor

Dell

Policy status

Inspect — no control

Inventory host properties. Training mock.

When to custom-group

Built-in profile is wrong or missing. Require DHCP class-id and OUI, or HTTP banner and MAC. One signal is a spoof.

How you classify

Side A — see properties
Open the host. Note which properties are empty.
Side B — add visibility
DHCP span, HTTP user-agent, SNMP on IT printers only.
Side C — group
Only then a user-defined group “Lab-Cameras.” Policy: notify if Unknown > 24h, do not block.

Four classify failures

1 · Block Unknown

2 · OUI-only camera group

3 · Stale manual group

4 · No DHCP in the span

How to prove it

Close the ticket only when

1) Function is populated or Unknown is notify-only. 2) Custom group has two conditions. 3) No control action on empty profiles. 4) A spoofed OUI laptop does not enter Cameras.

Traps

Wrong	Right
Unknown = enemy	Unknown = homework
One OUI	Two independent properties

Forescout class series: Three products · First day · Discovery · Classification · Policy · Enforcement · Switch plugin · eyeExtend · OT / IoT · vs ISE + interview

Sources

eyeSight admin — auto-classify type and ownership.
This series lesson 3 (discovery).