# Discovery: passive first, active with a written list Source: https://ai.techclick.in/blog_forescout_discovery_passive_active Markdown: https://ai.techclick.in/blog_forescout_discovery_passive_active.md Publisher: Techclick Infosec Pvt Ltd Passive traffic vs active NMAP/SNMP/WMI. When active is safe. Dummy OT prefix 10.50.1.0/24. ## The ticket Biomed: “Your scanner crashed the infusion VLAN.” The policy had “NMAP all unknowns.” That is not visibility. That is an incident. Quick interview answer Passive: SPAN/TAP, DHCP, banners that already exist. Active: SNMP, WMI, NMAP, authenticated queries. Docs: eyeSight uses a mix after a device is seen. Production rule: passive everywhere; active only on IT user/server subnets that signed the change. OT/medical: passive + vendor-approved methods only. Hero · watch vs poke If you did not write the prefix on a change ticket, do not NMAP it. Lab data · dummy only Enterprise Manager fs-em 10.10.10.30 · Appliance fs-app1 10.10.10.31 · span/mirror on sw-access-01 · same LAN 10.20.30.0/24 · Priya 10.20.30.80 · printer 10.20.30.60 · OT PLC 10.50.1.10 . Not a live customer. ## Two ways to see Passive Active How SPAN, DHCP, traffic NMAP, SNMP, WMI, login Risk Low Can fault OT / printers Use Default IT subnets, after classify attempt https://fs-em.techclick-lab.in Training mock · not live Forescout Console Asset Inventory Policy Channels Tools Tools → Options → Discovery ### Active scanning Passive On — all channels NMAP Allow 10.20.30.0/24 only Exclude 10.50.1.0/24 OT Schedule Off-hours for IT servers Cancel Save eyeSight classification uses passive + active. Training mock. ## Allow-list Allow: 10.20.30.0/24 users. Deny/exclude: 10.50.1.0/24 PLC, 10.60.0.0/24 medical. Review quarterly. ## How you set it - #### Side A — prefixes Write the list before clicking. - #### Side B — console Discovery / Internal Network. Active methods scoped. OT excluded. - #### Side C — prove A new laptop appears from DHCP/span before any NMAP. PLC appears from traffic only. ## Four discovery failures ### 1 · NMAP all RFC1918 ### 2 · WMI as domain admin everywhere ### 3 · No DHCP visibility (no span of DHCP server) ### 4 · Calling empty inventory a product bug ## How to prove it Close the ticket only when 1) Exclude list contains OT. 2) A test host is seen passively. 3) No active hit on 10.50.1.10. 4) Change ticket attached. ## Traps Wrong Right Scan to classify faster Better SPAN + DHCP One global NMAP Per-segment allow ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Default discovery style? Passive first NMAP the hospital first Disable span Only WMI Correct: a . Quick answer. Q2 OT prefix in this lab to exclude? 10.50.1.0/24 10.10.10.0/24 only 0.0.0.0/0 ::/0 Correct: a . Lab. Q3 Active methods include… NMAP, SNMP, WMI Only syslog Only BGP Only PEAP Correct: a . Table. Q4 Empty inventory after NMAP off. First? SPAN/DHCP visibility Scan OT Delete EM Disable NTP Correct: a . Failure 3/4. Q5 WMI as Domain Admin everywhere is bad because… Blast radius if the appliance is abused Forescout requires it Switches reject NTP ISE cannot join AD Correct: a . Failure 2. Q6 Prove a PLC was not scanned? Discovery exclude + no active events on 10.50.1.10 Ping it harder Add it to HR Turn on Virtual FW Correct: a . Proof. Check answers Reset Forescout class series: Three products · First day · Discovery · Classification · Policy · Enforcement · Switch plugin · eyeExtend · OT / IoT · vs ISE + interview ## Sources - Forescout eyeSight — passive and active classification methods. - Internal change-control: no OT scan without vendor approval. Related: Forescout evidence desk · session factory · Cisco ISE series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt