# Classification: empty means do not enforce

Source: https://ai.techclick.in/blog_forescout_classification_empty_profile
Markdown: https://ai.techclick.in/blog_forescout_classification_empty_profile.md
Publisher: Techclick Infosec Pvt Ltd

Function/OS/vendor classification. Empty profile means you do not enforce. Dummy camera vs laptop.

## The ticket

 New badge cameras are “Unknown.” Night policy blocked Unknown. Lobby cameras died. Classification was one DHCP miss away from being fine.

  Quick interview answer

 eyeSight auto-classifies type and ownership after it sees a device (docs). Console fields: Function, OS, Vendor, Network Function. Empty/low-confidence =  do not enforce . Use notify + better discovery. Custom groups need two signals (OUI + DHCP class, or banner + port) so a laptop cannot fake a camera with one spoofed MAC OUI.

  Hero · empty label

 Empty is a discovery ticket, not a block ticket.
  Lab data · dummy only
 Enterprise Manager  fs-em   10.10.10.30  · Appliance  fs-app1   10.10.10.31  · span/mirror on  sw-access-01  · same LAN  10.20.30.0/24  · Priya  10.20.30.80  · printer  10.20.30.60  · OT PLC  10.50.1.10 . Not a live customer.

## The fields

   Field  Example

  Function  Laptop / Printer / PLC / Camera
  OS  Windows 11 / unknown
  Vendor  Dell / HP / Siemens
  NIC vendor (OUI)  Hint only — spoofable

     https://fs-em.techclick-lab.in

     Training mock · not live

       Forescout Console

       Asset Inventory  Policy  Channels  Tools

       Asset Inventory → 10.20.30.80

### Host priya-hr

        Function  Laptop

  OS  Windows 11

  Vendor  Dell

  Policy status  Inspect — no control

        Cancel  Save

   Inventory host properties. Training mock.

## When to custom-group

 Built-in profile is wrong or missing. Require DHCP class-id  and  OUI, or HTTP banner  and  MAC. One signal is a spoof.

## How you classify

- #### Side A — see properties Open the host. Note which properties are empty.

- #### Side B — add visibility DHCP span, HTTP user-agent, SNMP on IT printers only.

- #### Side C — group Only then a user-defined group “Lab-Cameras.” Policy: notify if Unknown > 24h, do not block.

## Four classify failures

### 1 · Block Unknown

### 2 · OUI-only camera group

### 3 · Stale manual group

### 4 · No DHCP in the span

## How to prove it

  Close the ticket only when

 1) Function is populated or Unknown is notify-only. 2) Custom group has two conditions. 3) No control action on empty profiles. 4) A spoofed OUI laptop does not enter Cameras.

## Traps

   Wrong  Right

  Unknown = enemy  Unknown = homework
  One OUI  Two independent properties

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       Empty Function means…

           Do not enforce yet
           Block immediately
           It is Priya
           Disable SPAN

       Correct:  a . Title.

       Q2
       OUI-only camera group is weak because…

           OUI is spoofable
           OUI is encrypted
           Switches ignore MAC
           DHCP forbids OUI

       Correct:  a . Choose.

       Q3
       Two signals example?

           DHCP class-id AND vendor OUI
           Hostname only
           Random IP
           Only the port number 80

       Correct:  a . Runbook.

       Q4
       Where do you read Function?

           Asset Inventory host properties
           Show ip route
           Live Logs on MnT
           Hide NAT

       Correct:  a . Portal.

       Q5
       Unknown > 24h first action?

           Notify / improve discovery
           Virtual FW drop
           Delete the host
           Force PEAP

       Correct:  a . Runbook Side C.

       Q6
       Laptop in Cameras group. Suspect?

           Weak group conditions
           Perfect classify
           NTP
           EM HA

       Correct:  a . Proof 4.

       Check answers
       Reset

  Forescout class series:   Three products  ·  First day  ·  Discovery  ·  Classification  ·  Policy  ·  Enforcement  ·  Switch plugin  ·  eyeExtend  ·  OT / IoT  ·  vs ISE + interview

## Sources

- eyeSight admin — auto-classify type and ownership.
- This series lesson 3 (discovery).

 Related:  Forescout evidence desk  ·  session factory  ·  Cisco ISE series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt