Forescout Technologies, Inc.

A system includes a processing device, operatively coupled to memory, to receiving a prompt comprising a potential security threat on a computer network. The processing device applies a first large language model (LLM) to the prompt to generate a first instruction that is associated with a first agent that is to handle the first instruction. The first instruction is routed to the first agent, where the first agent is to obtain at least one web page that is relevant to the first instruction and apply a second LLM to obtain first data from natural language of the at least one web page. A third LLM is applied at least to the first data to generate a data output that is associated with the potential security threat on the computer network.

Systems, methods, and related technologies including media access control (MAC) address spoofing detection are described. The MAC address spoofing detection and response may include accessing a first media access control (MAC) address associated with a first communication on a first port of a first network device coupled to a network, accessing a second media access control (MAC) address associated with a second communication on a second port of a second network device coupled to the network, and determining that the second MAC address matches the first MAC address The method further includes identifying a device associated with the first or second communication as being associated with a spoofing event based on the second port differing from the first port and based on the first and second timestamps being within a threshold amount of time from one another and performing an action associated with the first or second port.

Systems and methods for comparing and aligning clerical and configurational security policies are described. Methods include retrieving a clerical-based security policy and a configuration-based security policy associated with a network, generating a comparison prompt to a generative artificial intelligence (AI) model comprising a request to compare the clerical-based security policy and the configuration-based security policy, providing the comparison prompt to the generative AI model; and receiving a response from the generative AI model comprising indications of discrepancies between the clerical-based security policy and the configuration-based security policy.

Systems, methods, and related technologies for classification are described. Network traffic from a network may be accessed. One or more values associated with one or more properties associated with an entity may be determined. The one or more values may be determined from the network traffic. A first classification attribute is determined based on the one or more values associated with one or more properties associated with the entity. A second classification attribute is determined, by a processing device, based on the first classification attribute and the one or more values associated with one or more properties associated with the entity. The second classification attribute is stored.

Systems, methods, and related technologies for access control management are described. The access control management may be customized for an entity and be configured on an enforcement point closest to the entity. In certain aspects, an entity communicatively coupled to a network is selected and one or more characteristics of the entity determined. An access policy may be selected based on the one or more characteristics of the entity and one or more enforcement points closest to the entity determined. One or more access rules to be assigned to the one or more enforcement points based on the access policy may be determined, wherein the one or more access rules are specific to the entity based on the one or more characteristics of the entity. The one or more access rules assigned to or configured on the one or more enforcement points closest to the entity are assigned.

Systems, methods, and related technologies for generating a network system map based on network traffic and possibly additional data are described. Network traffic may be received and parsed to obtain metadata associated with the network traffic. A network system may be identified based on the metadata. A network system map may be generated for the network system based on one or more of the metadata or the additional data.

Systems, methods, and related technologies for determining a risk score or value are described. The risk score determination may include accessing network traffic from a network, where the network traffic is associated with a plurality of entities. One or more values associated with one or more properties associated with an entity are determined. The one or more values may be based on the network traffic. At least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity are determined. A risk value for the entity is determined based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity.

A system includes a processing device, operatively coupled to memory, to receive a prompt that is associated with a potential security threat on a computer network. The system applies a first large language model (LLM) to the prompt to generate a first instruction that is associated with a first agent that is to handle the first instruction, and routes the first instruction to the first agent. The first agent applies a second LLM in association with a first data source to obtain a first data that is associated with the potential security threat. The system applies a third LLM at least to the first data, to generate a data output that is associated with the potential security threat on the computer network.

Systems and methods for taxonomy framework generation are described. Methods include generating and providing a first prompt to a generative artificial intelligence (AI) model including a request to generate options for classification of network entities at a first classification granularity level and receiving, from the generative AI model, a first set of options for network entity classification. The method further includes generating and providing a second prompt to the generative AI model including a request to generate options for classification of network entities at second classification granularity level, receiving, from the generative AI model, a second set of options for network entity classification, and determining a taxonomy framework for classification of network entities based on the first set of options and the second set of options for network entity classification.

Systems, methods, and related technologies for managing network access control from anywhere are described. A method includes receiving, from a cloud-based security system, information about a device that is coupled to a public network and decoupled from a private network. Based on the information, the method detects risky activity associated with the device. The method sends instructions to a remote agent executing on the device to perform one or more security measures that protect a resource of the device.